MyCity » Ambulanta -> Arhiva Ambulante » urdvxc.exe

urdvxc.exe

Napisano na dan: 31.1.2007
2

urdvxc.exe
Pagination Prethodna strana
Sledeća strana Pagination

Idi na vrh

Poslao: 06 Feb 2007 17:35
Idi na vrh
offline
  • Cigarette Smoking Man
  • Pridružio: 14 Feb 2005
  • Poruke: 9113
  • Gde živiš: Beograd

Prvo skeniraj sa Ewidom kao što sam već napisao, pa nam ovde postavi log od Ewida i svež HijackThis log da vidimo šta je i da li je nešto ostalo...



Poslao: 08 Feb 2007 01:44
Idi na vrh
offline
  • Pridružio: 03 Okt 2006
  • Poruke: 27

Evo me konacno...pa redom...

__________________________________________________
ewido anti-spyware online scanner
http://www.ewido.net
__________________________________________________


Name: Not-A-Virus.Downloader.Win32.ImLoader.b
Path: C:\Documents and Settings\Sestre S\Local Settings\Temp\ImInstaller\IncrediMail\imloader.exe
Risk: Low

Name: Backdoor.AlLight.20.k
Path: C:\Program Files\SCREENSAVERS\Kiss.exe
Risk: High

Name: Not-A-Virus.RemoteAdmin.Win32.TFAK
Path: C:\System Volume Information\_restore{CDEEBAC2-3156-4CB2-969B-5DADDF0FBDDB}\RP1\A0000028.exe
Risk: Low

Name: Backdoor.AlLight.20.k
Path: C:\WINDOWS\Kusje.scr
Risk: High

Name: Adware.VCatch
Path: C:\WINDOWS\system32\mcAct.dll
Risk: Medium

Name: Adware.Sahat
Path: C:\WINDOWS\system32\umqltg4cl.ini
Risk: Medium


A evo ga i HijackThis log....

Logfile of HijackThis v1.99.1
Scan saved at 1:40:37, on 8.2.2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\MMTray.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Sestre S\Desktop\ht3\ht3.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: rxh - {DCCF4B2F-5EC0-46FB-94B5-49B752359A65} - C:\Program Files\RAX Fireworks Screensaver\rxh.dll (file missing)
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [Microsoft Update] msconfg.exe
O4 - HKLM\..\Run: [MMTray] MMTray.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\RunServices: [Microsoft Update] msconfg.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - [Link mogu videti samo ulogovani korisnici]\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Save Flash - [Link mogu videti samo ulogovani korisnici]\Program Files\UnH Solutions\Flash Saving Plugin\FlashSButton.dll/210
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Flash - {43CF38F3-5AEC-45a3-AD31-04EB06E9C6CA} - C:\Program Files\UnH Solutions\Flash Saving Plugin\FlashSButton.dll (HKCU)
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin4.dll
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - [Link mogu videti samo ulogovani korisnici]
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - [Link mogu videti samo ulogovani korisnici]
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - [Link mogu videti samo ulogovani korisnici]
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpdj - HP - C:\DOCUME~1\SESTRE~1\LOCALS~1\Temp\hpdj.exe
O23 - Service: Network Windows Service (MSWindows) - Unknown owner - C:\WINDOWS\System32\urdvxc.exe" /service (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe



Poslao: 08 Feb 2007 17:12
Idi na vrh
offline
  • Cigarette Smoking Man
  • Pridružio: 14 Feb 2005
  • Poruke: 9113
  • Gde živiš: Beograd

Odlično, sad ću da pregledam logove pa ti se javljam ubrzo... Wink

Dopuna: 08 Feb 2007 17:12

Ewido je skinuo nešto, ali ostalo je još nekoliko problematičnih fajlova.

Ako nije problem da sačekaš do večeras kada će biti gotov jedan program koji će nam mnogo pomoći u rešavanju ovog slučaja... Samo malo strapljenja i problem će brzo biti rešen... Wink

Poslao: 08 Feb 2007 21:38
Idi na vrh
offline
  • Pridružio: 03 Okt 2006
  • Poruke: 27

Ma nema problema...cekacu koliko treba...Pretpostavila sam da i dalje nesto ne valja. Iz puke radoznalosti sam danas ponovo skenirala Ewidom i ponovo je nasao dva backdoora....i jos ponesto...
Pozdrav

Poslao: 08 Feb 2007 23:21
Idi na vrh
offline
  • Cigarette Smoking Man
  • Pridružio: 14 Feb 2005
  • Poruke: 9113
  • Gde živiš: Beograd

Da, kao što rekoh već, uspeo je da ukloni nešto a nešto ne... Jedan od problema je što nemaš ni SP2 pa je operativni sistem totalno bušan. Čak i kada rešimo ovaj problem moraćeš što pre da instaliraš SP2, jer će se bez njega problemi konstantno pojavljivati.
U svakom slučaju, čim program bude gotov (očekujem u toku večeri) javljam ti se sa novim instrukcijama...

Poslao: 09 Feb 2007 00:29
Idi na vrh
offline
  • Pridružio: 03 Okt 2006
  • Poruke: 27

Da, i ja sam kriva velikim delom...znam da nemam SP2...planiram da instaliram Operu umesto Explorera, hoce li to pomoci bar donekle...?

Poslao: 09 Feb 2007 01:24
Idi na vrh
offline
  • Cigarette Smoking Man
  • Pridružio: 14 Feb 2005
  • Poruke: 9113
  • Gde živiš: Beograd

Pomoći će ali jako malo, jer od izlaska XP-a do danas napisano je mnogo zakrpa. Bez njih tvoj operativni sistem je na velikoj vetrometini i skoro da je totalno nezaštićen. Moja preporuka je da ga apdejtuješ što pre, jer ako ostane ovakva situacija mislim da neće proći ni nekoliko dana a da ćeš nam se opet javiti sa nekim problemom...

Dopuna: 09 Feb 2007 1:24

Program je završen, pa možemo nastaviti sa radom. Wink

Otvori HijackThis i nakon skeniranja štikliraj sledeće linije:

O2 - BHO: rxh - {DCCF4B2F-5EC0-46FB-94B5-49B752359A65} - C:\Program Files\RAX Fireworks Screensaver\rxh.dll (file missing)

O4 - HKLM\..\Run: [Microsoft Update] msconfg.exe

O4 - HKLM\..\RunServices: [Microsoft Update] msconfg.exe

O23 - Service: Network Windows Service (MSWindows) - Unknown owner - C:\WINDOWS\System32\urdvxc.exe" /service (file missing)

Nakon što si ih štiklirala klikni na Fix Checked.
Kada to završiš restartuj računar.

Sa ove adrese skini program Santa`s Little Helper:
[Link mogu videti samo ulogovani korisnici]

Na tabu Search ćeš iskopirati ovu listu:

rxh.dll
msconfg.exe
urdvxc.exe

u gornje polje i nakon toga pritisni dugme Search. Skeniranje će potrajati koji minut nakon čega će se u donjem polju pojaviti rezultat. Kada se pojavi rezultat klikni na donje polje, selektuj ceo log i iskopiraj ga ovde da vidimo šta je našao...

Poslao: 09 Feb 2007 02:23
Idi na vrh
offline
  • Pridružio: 03 Okt 2006
  • Poruke: 27

Pa bas i nemam sta da kopiram...

Nothing found

Poslao: 09 Feb 2007 02:26
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Jel restartovan racunar posle sredjivanja u HijackThis-u?
Ukoliko jeste, postavi novi HijackThis log.

Poslao: 09 Feb 2007 11:07
Idi na vrh
offline
  • Pridružio: 03 Okt 2006
  • Poruke: 27

Jeste, restartovan je...

Logfile of HijackThis v1.99.1
Scan saved at 11:05:52, on 9.2.2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\MMTray.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Sestre S\Desktop\ht3\ht3.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [MMTray] MMTray.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - [Link mogu videti samo ulogovani korisnici]\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Save Flash - [Link mogu videti samo ulogovani korisnici]\Program Files\UnH Solutions\Flash Saving Plugin\FlashSButton.dll/210
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Flash - {43CF38F3-5AEC-45a3-AD31-04EB06E9C6CA} - C:\Program Files\UnH Solutions\Flash Saving Plugin\FlashSButton.dll (HKCU)
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin4.dll
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - [Link mogu videti samo ulogovani korisnici]
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - [Link mogu videti samo ulogovani korisnici]
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - [Link mogu videti samo ulogovani korisnici]
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpdj - HP - C:\DOCUME~1\SESTRE~1\LOCALS~1\Temp\hpdj.exe
O23 - Service: Network Windows Service (MSWindows) - Unknown owner - C:\WINDOWS\System32\urdvxc.exe" /service (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

12 Feb 2007 21:44 bobby Zaključavanje topica Razlog: Javiti se na PP ukoliko je potrebno otkljucavanje teme  

MyCity » Ambulanta -> Arhiva Ambulante » urdvxc.exe

Ko je trenutno na forumu
 

Ukupno su 921 korisnika na forumu :: 60 registrovanih, 3 sakrivenih i 858 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 20624 - dana 04 Apr 2026 04:18

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: _Rade, A.R.Chafee.Jr., ajugovic74, Alexandar-1973, APS, Aska, Asteker, Atomski čoban, bankulen, blankspace, bobor, boranin45, Boris BM, BZ, cifra, DavidA, dd201176, Dioniss, dukajov, Dvojac005, FOX, Goxy1, GveX, ikan, Jakonjveliki, JOntra, Još malo pa deda, kybonacci, Leonov, LjubisaR, MaRtInsrbija1993, mercedesamg, Mi lao shu, milutin134, mocnijogurt, Mrav Obrad, mrvica78, nebojsag, Nemanja Opalić, neutrino, niki, nobutado, pceklic, pedja.st, PlayerOne, proka89, samocitam, Sava89, stegonosa, Stevan Visoki, TAdNtEBPZZDoEPKQh, Tanjagre, teodorica, uruk, US_Rank_0, Vanderx, vathra, Vlada78, Vladovbl, voja64