MyCity » Ambulanta -> Arhiva Ambulante » urdvxc.exe

urdvxc.exe

Napisano na dan: 31.1.2007
2

urdvxc.exe
Pagination Prethodna strana
Sledeća strana Pagination

Idi na vrh

Poslao: 06 Feb 2007 17:35
Idi na vrh
offline
  • Cigarette Smoking Man
  • Pridružio: 14 Feb 2005
  • Poruke: 9113
  • Gde živiš: Beograd

Prvo skeniraj sa Ewidom kao što sam već napisao, pa nam ovde postavi log od Ewida i svež HijackThis log da vidimo šta je i da li je nešto ostalo...

Poslao: 08 Feb 2007 01:44
Idi na vrh
offline
  • Pridružio: 03 Okt 2006
  • Poruke: 27

Evo me konacno...pa redom...

__________________________________________________
ewido anti-spyware online scanner
http://www.ewido.net
__________________________________________________


Name: Not-A-Virus.Downloader.Win32.ImLoader.b
Path: C:\Documents and Settings\Sestre S\Local Settings\Temp\ImInstaller\IncrediMail\imloader.exe
Risk: Low

Name: Backdoor.AlLight.20.k
Path: C:\Program Files\SCREENSAVERS\Kiss.exe
Risk: High

Name: Not-A-Virus.RemoteAdmin.Win32.TFAK
Path: C:\System Volume Information\_restore{CDEEBAC2-3156-4CB2-969B-5DADDF0FBDDB}\RP1\A0000028.exe
Risk: Low

Name: Backdoor.AlLight.20.k
Path: C:\WINDOWS\Kusje.scr
Risk: High

Name: Adware.VCatch
Path: C:\WINDOWS\system32\mcAct.dll
Risk: Medium

Name: Adware.Sahat
Path: C:\WINDOWS\system32\umqltg4cl.ini
Risk: Medium


A evo ga i HijackThis log....

Logfile of HijackThis v1.99.1
Scan saved at 1:40:37, on 8.2.2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\MMTray.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Sestre S\Desktop\ht3\ht3.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: rxh - {DCCF4B2F-5EC0-46FB-94B5-49B752359A65} - C:\Program Files\RAX Fireworks Screensaver\rxh.dll (file missing)
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [Microsoft Update] msconfg.exe
O4 - HKLM\..\Run: [MMTray] MMTray.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\RunServices: [Microsoft Update] msconfg.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Save Flash - res://C:\Program Files\UnH Solutions\Flash Saving Plugin\FlashSButton.dll/210
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Flash - {43CF38F3-5AEC-45a3-AD31-04EB06E9C6CA} - C:\Program Files\UnH Solutions\Flash Saving Plugin\FlashSButton.dll (HKCU)
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin4.dll
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - static.windupdates.com/cab/MediaAccessVerisign/ie/bridge-c18.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpdj - HP - C:\DOCUME~1\SESTRE~1\LOCALS~1\Temp\hpdj.exe
O23 - Service: Network Windows Service (MSWindows) - Unknown owner - C:\WINDOWS\System32\urdvxc.exe" /service (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Poslao: 08 Feb 2007 17:12
Idi na vrh
offline
  • Cigarette Smoking Man
  • Pridružio: 14 Feb 2005
  • Poruke: 9113
  • Gde živiš: Beograd

Odlično, sad ću da pregledam logove pa ti se javljam ubrzo... Wink

Dopuna: 08 Feb 2007 17:12

Ewido je skinuo nešto, ali ostalo je još nekoliko problematičnih fajlova.

Ako nije problem da sačekaš do večeras kada će biti gotov jedan program koji će nam mnogo pomoći u rešavanju ovog slučaja... Samo malo strapljenja i problem će brzo biti rešen... Wink

Poslao: 08 Feb 2007 21:38
Idi na vrh
offline
  • Pridružio: 03 Okt 2006
  • Poruke: 27

Ma nema problema...cekacu koliko treba...Pretpostavila sam da i dalje nesto ne valja. Iz puke radoznalosti sam danas ponovo skenirala Ewidom i ponovo je nasao dva backdoora....i jos ponesto...
Pozdrav

Poslao: 08 Feb 2007 23:21
Idi na vrh
offline
  • Cigarette Smoking Man
  • Pridružio: 14 Feb 2005
  • Poruke: 9113
  • Gde živiš: Beograd

Da, kao što rekoh već, uspeo je da ukloni nešto a nešto ne... Jedan od problema je što nemaš ni SP2 pa je operativni sistem totalno bušan. Čak i kada rešimo ovaj problem moraćeš što pre da instaliraš SP2, jer će se bez njega problemi konstantno pojavljivati.
U svakom slučaju, čim program bude gotov (očekujem u toku večeri) javljam ti se sa novim instrukcijama...

Poslao: 09 Feb 2007 00:29
Idi na vrh
offline
  • Pridružio: 03 Okt 2006
  • Poruke: 27

Da, i ja sam kriva velikim delom...znam da nemam SP2...planiram da instaliram Operu umesto Explorera, hoce li to pomoci bar donekle...?

Poslao: 09 Feb 2007 01:24
Idi na vrh
offline
  • Cigarette Smoking Man
  • Pridružio: 14 Feb 2005
  • Poruke: 9113
  • Gde živiš: Beograd

Pomoći će ali jako malo, jer od izlaska XP-a do danas napisano je mnogo zakrpa. Bez njih tvoj operativni sistem je na velikoj vetrometini i skoro da je totalno nezaštićen. Moja preporuka je da ga apdejtuješ što pre, jer ako ostane ovakva situacija mislim da neće proći ni nekoliko dana a da ćeš nam se opet javiti sa nekim problemom...

Dopuna: 09 Feb 2007 1:24

Program je završen, pa možemo nastaviti sa radom. Wink

Otvori HijackThis i nakon skeniranja štikliraj sledeće linije:

O2 - BHO: rxh - {DCCF4B2F-5EC0-46FB-94B5-49B752359A65} - C:\Program Files\RAX Fireworks Screensaver\rxh.dll (file missing)

O4 - HKLM\..\Run: [Microsoft Update] msconfg.exe

O4 - HKLM\..\RunServices: [Microsoft Update] msconfg.exe

O23 - Service: Network Windows Service (MSWindows) - Unknown owner - C:\WINDOWS\System32\urdvxc.exe" /service (file missing)

Nakon što si ih štiklirala klikni na Fix Checked.
Kada to završiš restartuj računar.

Sa ove adrese skini program Santa`s Little Helper:
https://www.mycity.rs/must-login.png

Na tabu Search ćeš iskopirati ovu listu:

rxh.dll
msconfg.exe
urdvxc.exe

u gornje polje i nakon toga pritisni dugme Search. Skeniranje će potrajati koji minut nakon čega će se u donjem polju pojaviti rezultat. Kada se pojavi rezultat klikni na donje polje, selektuj ceo log i iskopiraj ga ovde da vidimo šta je našao...

Poslao: 09 Feb 2007 02:23
Idi na vrh
offline
  • Pridružio: 03 Okt 2006
  • Poruke: 27

Pa bas i nemam sta da kopiram...

Nothing found

Poslao: 09 Feb 2007 02:26
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Jel restartovan racunar posle sredjivanja u HijackThis-u?
Ukoliko jeste, postavi novi HijackThis log.

Poslao: 09 Feb 2007 11:07
Idi na vrh
offline
  • Pridružio: 03 Okt 2006
  • Poruke: 27

Jeste, restartovan je...

Logfile of HijackThis v1.99.1
Scan saved at 11:05:52, on 9.2.2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\MMTray.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Sestre S\Desktop\ht3\ht3.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [MMTray] MMTray.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Save Flash - res://C:\Program Files\UnH Solutions\Flash Saving Plugin\FlashSButton.dll/210
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Flash - {43CF38F3-5AEC-45a3-AD31-04EB06E9C6CA} - C:\Program Files\UnH Solutions\Flash Saving Plugin\FlashSButton.dll (HKCU)
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin4.dll
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - static.windupdates.com/cab/MediaAccessVerisign/ie/bridge-c18.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpdj - HP - C:\DOCUME~1\SESTRE~1\LOCALS~1\Temp\hpdj.exe
O23 - Service: Network Windows Service (MSWindows) - Unknown owner - C:\WINDOWS\System32\urdvxc.exe" /service (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

12 Feb 2007 21:44 bobby Zaključavanje topica Razlog: Javiti se na PP ukoliko je potrebno otkljucavanje teme  

MyCity » Ambulanta -> Arhiva Ambulante » urdvxc.exe

Ko je trenutno na forumu
 

Ukupno su 1255 korisnika na forumu :: 38 registrovanih, 8 sakrivenih i 1209 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: aleksmajstor, Atomski čoban, Ben Roj, Bluper, bojank, Boris Bosiljčić, Boris90, Buzdovan, ccoogg123, cenejac111, comi_pfc, Demostant, Denaya, doktor1964, Dr.Strangelove, Excalibur13, flash12, FOX, ILGromovnik, ivica976, Joja, Karla, Kriglord, kunktator, laki_bb, MB120mm, mercedesamg, Mixelotti, Mlav, Ne doznajem se u oružje, nenad81, procesor, slonic_tonic, Srki94, Stoilkovic, YU-UKI, |_MeD_|, 1107