MyCity » Ambulanta -> Arhiva Ambulante » virus, nešto?!

virus, nešto?!

Napisano na dan: 5.3.2009
1

virus, nešto?!
Sledeća strana Pagination

Idi na vrh

Poslao: 05 Mar 2009 20:54
Idi na vrh
offline
  • Pridružio: 05 Mar 2009
  • Poruke: 6

Tek vrlo malo, kratko upućeni, a opet, znamo da smo zaraženi. Upomoć!

Dopuna: 05 Mar 2009 20:40

eto nisam napravila ispravno

Dopuna: 05 Mar 2009 20:54

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:39:16 PM, on 3/5/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20627)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\agrsmsvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Documents and Settings\Admin\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Admin\Application Data\Microsoft\Windows\lsass.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\WINDOWS\system32\frmwrk32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [Link mogu videti samo ulogovani korisnici]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [Link mogu videti samo ulogovani korisnici]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [Link mogu videti samo ulogovani korisnici]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [Link mogu videti samo ulogovani korisnici]
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: MyPlayCity Toolbar - {4724c5d8-dfa7-417a-a2f5-1eabfee9b4ac} - C:\Program Files\MyPlayCity\tbMyP1.dll
O2 - BHO: MyPlayCity Toolbar - {4724c5d8-dfa7-417a-a2f5-1eabfee9b4ac} - C:\Program Files\MyPlayCity\tbMyP1.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: PDF-XChange Viewer IE-Plugin - {C5D07EB6-BBCE-4DAE-ACBB-D13A8D28CB1F} - C:\Program Files\Tracker Software\PDF-XChange Viewer\pdf-viewer\PDFXCviewIEPlugin.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O4 - HKLM\..\Run: [StartCCC] "c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [QlbCtrl.exe] C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Framework Windows] frmwrk32.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKLM\..\Policies\Explorer\Run: [Lsass Service] C:\Documents and Settings\Admin\Application Data\Microsoft\Windows\lsass.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Shortcut to autorun.exe.lnk = D:\autorun.exe
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xport to Microsoft Excel - [Link mogu videti samo ulogovani korisnici]\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send To Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O20 - Winlogon Notify: 1235904601_m7d_opf_260209 - 1235904601_m7d_opf_260209.dll (file missing)
O20 - Winlogon Notify: c00A6903 - C:\WINDOWS\SYSTEM32\c00A6903.mat
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\WINDOWS\system32\agrsmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe

--
End of file - 9029 bytes



Poslao: 05 Mar 2009 21:09
Idi na vrh
offline
  • diarno  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 15 Jun 2007
  • Poruke: 5572

Pozdrav...

Uradi sledece :


Klikni desnim tasterom miša na avast! ikonicu ( ) u donjem, desnom uglu ekrana i izaberi Stop OnAccess Protection.

Napomena: Ne zaboravi da uključiš ovu opciju po završetku čišćenja.

Skini ComboFix sa jedne od sledecih adresa na Desktop:
[Link mogu videti samo ulogovani korisnici]
[Link mogu videti samo ulogovani korisnici]
[Link mogu videti samo ulogovani korisnici]

Startuj ga i ne diraj prozor programa dok skenira.
Sledi uputstva na ekranu. Kada zavrsi pojavice se log (C:\ComboFix.txt) koji ces nam ovde iskopirati.[/quote]



Poslao: 06 Mar 2009 00:10
Idi na vrh
offline
  • Pridružio: 05 Mar 2009
  • Poruke: 6

nešto.....

ComboFix 09-03-04.01 - Admin 2009-03-05 21:15:24.1 - NTFSx86
Running from: c:\documents and settings\Admin\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Admin\Application Data\Microsoft\Windows\lsass.exe
c:\windows\system32\ahtn.htm
c:\windows\system32\drivers\265.exe
c:\windows\system32\drivers\953.exe
c:\windows\system32\frmwrk32.exe
c:\windows\system32\init32.exe
c:\windows\system32\test.ttt
c:\windows\system32\uniq.tll
c:\windows\system32\warning.gif
c:\windows\system32\win32hlp.cnf

c:\windows\system32\userinit.exe . . . is infected!!

.
((((((((((((((((((((((((( Files Created from 2009-02-05 to 2009-03-05 )))))))))))))))))))))))))))))))
.

2009-03-05 19:33 . 2009-03-05 19:33 <DIR> d-------- c:\program files\Trend Micro
2009-03-05 13:34 . 2009-03-05 13:43 <DIR> d-------- c:\program files\Spybot - Search & Destroy
2009-03-05 01:07 . 2009-03-05 01:07 20,992 --ahs---- c:\windows\system32\c0031261.mat
2009-03-04 19:04 . 2009-03-04 21:51 <DIR> d-------- c:\documents and settings\Admin\Application Data\Lavasoft
2009-03-04 18:52 . 2009-03-04 21:50 <DIR> d-------- c:\program files\a-squared HiJackFree
2009-03-04 18:46 . 2005-08-25 18:18 118,784 --a------ c:\windows\system32\MSSTDFMT.DLL
2009-03-04 18:46 . 2005-08-25 18:19 115,920 --a------ c:\windows\system32\MSINET.OCX
2009-03-04 18:04 . 2009-03-04 18:03 104,960 --a------ c:\windows\system32\dllcache\userinit.exe
2009-03-04 15:31 . 2009-03-04 15:31 <DIR> d-------- c:\program files\Crawler
2009-03-04 15:24 . 2009-03-04 15:24 <DIR> d-------- c:\documents and settings\NetworkService\Application Data\Spyware Terminator
2009-03-04 15:04 . 2009-03-05 13:37 <DIR> d-------- c:\program files\SDHelper (Spybot - Search & Destroy)
2009-03-04 15:04 . 2009-03-04 15:04 <DIR> d-------- c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2009-03-04 15:04 . 2009-03-04 15:04 <DIR> d-------- c:\program files\File Scanner Library (Spybot - Search & Destroy)
2009-03-04 14:59 . 2009-03-04 14:59 20,992 --ahs---- c:\windows\system32\c00A6903.mat
2009-03-04 14:50 . 2009-03-05 13:46 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-03-04 08:58 . 2009-03-05 19:08 <DIR> d-------- c:\program files\MyPlayCity
2009-03-04 08:58 . 2009-03-04 08:58 <DIR> d-------- c:\program files\Conduit
2009-03-03 23:32 . 2009-03-04 22:22 <DIR> d-------- c:\program files\TrackMania Nations ESWC
2009-03-02 11:20 . 2009-03-02 11:20 <DIR> d-------- c:\documents and settings\Admin\Application Data\Thunderbird
2009-03-01 23:56 . 2009-03-01 23:56 <DIR> d-------- c:\documents and settings\All Users\Application Data\TrackMania
2009-03-01 23:54 . 2009-03-01 23:55 <DIR> d-------- c:\program files\TmNationsForever
2009-02-25 19:52 . 1994-09-21 01:00 12,800 --a------ c:\windows\system32\wing32.dll
2009-02-25 14:31 . 2001-08-17 13:56 7,552 --a------ c:\windows\system32\drivers\SONYPVU1.SYS
2009-02-23 18:51 . 2009-02-23 18:51 <DIR> d-------- c:\documents and settings\All Users\Application Data\GRETECH
2009-02-23 18:51 . 2009-02-23 18:51 <DIR> d-------- c:\documents and settings\Admin\Application Data\GRETECH
2009-02-23 17:33 . 2009-02-23 17:33 <DIR> d-------- c:\program files\CMVideoPlugin
2009-02-23 17:09 . 2004-02-23 20:42 1,386,496 --a------ c:\windows\system32\msvbvm60.dll
2009-02-23 17:09 . 2002-05-08 06:47 164,112 --a------ c:\windows\system32\olepro32.dll
2009-02-23 17:09 . 2002-05-08 06:47 147,728 --a------ c:\windows\system32\asycfilt.dll
2009-02-23 17:09 . 2002-05-08 06:47 22,288 --a------ c:\windows\system32\comcat.dll
2009-02-23 16:32 . 2009-02-23 16:32 <DIR> d-------- c:\program files\CommitCRM
2009-02-23 16:32 . 2009-02-23 16:33 <DIR> d-------- C:\Commit
2009-02-23 15:48 . 2009-02-23 15:53 <DIR> d-------- c:\documents and settings\All Users\Application Data\DriverScanner
2009-02-23 15:48 . 2009-02-23 16:09 <DIR> d-------- c:\documents and settings\Admin\Application Data\Uniblue
2009-02-19 21:59 . 2009-02-19 21:59 32 --a------ c:\documents and settings\All Users\Application Data\ezsid.dat
2009-02-19 19:22 . 2009-03-02 19:09 <DIR> d-------- c:\documents and settings\Admin\Application Data\skypePM
2009-02-19 19:22 . 2009-02-19 19:22 48 --ah----- c:\windows\system32\ezsidmv.dat
2009-02-19 19:18 . 2009-03-03 11:54 <DIR> d-------- c:\documents and settings\Admin\Application Data\Skype
2009-02-19 19:16 . 2009-02-19 19:16 <DIR> dr------- c:\program files\Skype
2009-02-19 19:16 . 2009-02-19 19:16 <DIR> d-------- c:\program files\Common Files\Skype
2009-02-19 19:16 . 2009-02-19 19:16 <DIR> d-------- c:\documents and settings\All Users\Application Data\Skype
2009-02-18 17:01 . 2009-02-18 17:01 <DIR> d-------- c:\program files\YouTube Downloader
2009-02-18 14:58 . 2009-02-18 14:58 <DIR> d-------- c:\program files\Into Sudoku
2009-02-18 11:04 . 2009-02-18 13:00 2,723 --a------ c:\windows\langorig.ini
2009-02-18 09:46 . 2009-02-18 09:46 <DIR> d-------- c:\program files\Tracker Software
2009-02-18 09:02 . 2009-03-04 00:03 <DIR> d-------- c:\program files\TuneUp Utilities 2007
2009-02-18 09:02 . 2009-02-18 09:02 <DIR> d-------- c:\documents and settings\Admin\Application Data\TuneUp Software
2009-02-18 09:02 . 2007-03-29 04:42 29,704 --a------ c:\windows\system32\uxtuneup.dll
2009-02-18 09:01 . 2009-02-18 09:01 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
2009-02-18 09:01 . 2009-02-18 09:01 <DIR> d-------- c:\documents and settings\All Users\Application Data\TuneUp Software
2009-02-18 08:55 . 2009-03-04 17:11 <DIR> d-------- c:\program files\ESET
2009-02-12 14:41 . 2009-02-12 14:46 <DIR> d-------- c:\program files\Mystery in London
2009-02-11 23:52 . 2009-02-11 23:52 <DIR> d-------- c:\windows\system32\NtmsData
2009-02-08 17:20 . 2009-02-08 17:20 <DIR> d-------- c:\program files\The Adventure Company
2009-02-08 13:01 . 2009-02-08 13:01 <DIR> d-------- c:\documents and settings\Admin\Application Data\Media Player Classic
2009-02-07 12:19 . 2009-02-07 12:19 <DIR> d-------- c:\documents and settings\All Users\Application Data\BigFish

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-04 17:03 104,960 ----a-w c:\windows\system32\userinit.exe
2009-03-04 13:40 14,336 ----a-w c:\windows\system32\svchost.exe
2009-03-03 23:06 --------- d-----w c:\program files\Oberon Media
2009-03-03 23:06 --------- d-----w c:\program files\Cpt. Binary
2009-03-02 10:19 --------- d-----w c:\program files\Alawar
2009-02-23 16:36 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-02-23 15:47 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-23 15:06 --------- d-----w c:\program files\GRETECH
2009-02-19 22:50 --------- d-----w c:\documents and settings\Admin\Application Data\ForgottenRiddles2
2009-02-19 19:46 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-02-18 10:12 --------- d-----w c:\program files\Deep Voyage
2009-02-18 10:12 --------- d-----w c:\program files\Aztec Bricks
2009-02-18 10:12 --------- d-----w c:\program files\Azada
2009-02-18 09:45 --------- d-----w c:\program files\Windows Sidebar
2009-02-18 08:31 --------- d-----w c:\program files\Styler
2009-02-18 07:31 --------- d-----w c:\program files\Hidden Expedition Titanic
2009-02-17 17:15 --------- d-----w c:\program files\Google
2009-02-14 14:58 --------- d-----w c:\documents and settings\All Users\Application Data\AlawarWrapper
2009-02-13 19:06 --------- d-----w c:\program files\LeeGTs Games
2009-02-13 18:24 --------- d-----w c:\documents and settings\Admin\Application Data\Big Fish Games
2009-02-13 18:22 --------- d-----w c:\documents and settings\All Users\Application Data\MysteryChronicles
2009-02-09 12:37 --------- d-----w c:\documents and settings\Admin\Application Data\GlarySoft
2009-02-04 08:47 --------- d-----w c:\documents and settings\All Users\Application Data\MumboJumbo
2009-02-02 14:41 --------- d-----w c:\documents and settings\All Users\Application Data\Friends Games
2009-02-01 20:28 --------- d-----w c:\documents and settings\All Users\Application Data\Forge of Games
2009-02-01 20:27 --------- d-----w c:\program files\Common Files\Sandlot Shared
2009-02-01 20:26 --------- d-----w c:\documents and settings\All Users\Application Data\Sandlot Games
2009-02-01 16:11 --------- d-----w c:\program files\Just Sudoku PE
2009-02-01 13:27 --------- d-----w c:\documents and settings\Admin\Application Data\Beep Industries
2009-01-31 13:54 --------- d-----w c:\program files\Forgotten Riddles - The Moonlight Sonatas
2009-01-31 13:30 --------- d-----w c:\documents and settings\All Users\Application Data\Oberon Media
2009-01-31 13:22 --------- d-----w c:\documents and settings\Admin\Application Data\Beep
2009-01-31 13:13 --------- d-----w c:\program files\DAEMON Tools
2009-01-31 13:11 685,816 ----a-w c:\windows\system32\drivers\sptd.sys
2009-01-30 10:26 --------- d-----w c:\program files\Mystery Chronicles - Murder Among Friends
2009-01-29 18:37 --------- d-----w c:\program files\The Three Stooges - Treasure Hunt Hijinks
2009-01-29 18:37 --------- d-----w c:\documents and settings\Admin\Application Data\BigFish
2009-01-29 17:35 --------- d-----w c:\program files\ReflexiveArcade
2009-01-28 20:38 --------- d-----w c:\program files\MyPlayCity.com
2009-01-28 00:50 --------- d-----w c:\program files\SecureW2
2009-01-27 16:19 --------- d-----w c:\documents and settings\Admin\Application Data\FastStone
2009-01-27 16:05 --------- d-----w c:\program files\FastStone Image Viewer
2009-01-27 02:56 --------- d-----w c:\documents and settings\Admin\Application Data\Talkback
2009-01-26 22:20 --------- d-----w c:\documents and settings\Admin\Application Data\Winamp
2009-01-26 22:17 --------- d-----w c:\program files\Winamp
2009-01-24 03:32 --------- d-----w c:\program files\Common Files\Adobe
2009-01-23 05:06 87,280 ----a-w c:\windows\system32\bcmwlcoi.dll
2009-01-23 05:06 1,391,104 ----a-w c:\windows\system32\drivers\BCMWL5.SYS
2009-01-23 05:06 --------- d-----w c:\program files\Broadcom
2009-01-23 05:03 --------- d-----w c:\documents and settings\All Users\Application Data\ATI
2009-01-23 05:03 --------- d-----w c:\documents and settings\Admin\Application Data\ATI
2009-01-23 04:59 --------- d-----w c:\program files\ATI Technologies
2009-01-23 04:56 --------- d-----w c:\program files\Common Files\InstallShield
2009-01-23 04:55 --------- d-----w c:\program files\WIDCOMM
2009-01-23 04:51 --------- d-----w c:\program files\Analog Devices
2009-01-23 04:50 --------- d-----w c:\program files\Marvell
2009-01-23 04:49 0 ---ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2009-01-23 04:49 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_HpqKbFiltr_01005.Wdf
2009-01-23 04:48 --------- d-----w c:\program files\Hewlett-Packard
2009-01-23 04:47 --------- d-----w c:\program files\Common Files\SNP2UVC
2009-01-23 04:47 --------- d-----w c:\documents and settings\Admin\Application Data\InstallShield
2009-01-22 04:08 --------- d-----w c:\documents and settings\Admin\Application Data\Nero
2009-01-22 04:01 --------- d-----w c:\program files\Microsoft Works
2009-01-22 04:00 --------- d-----w c:\program files\Microsoft.NET
.

------- Sigcheck -------

2007-10-13 13:04 2182144 a09c144d8d5a460b8ebfa56f913715d2 c:\windows\system32\ntkrnlpa.exe

2007-10-13 13:04 2302464 465e3e1178812be755634457f4a778bf c:\windows\system32\ntoskrnl.exe

2007-10-13 13:03 1224192 3fe7b5db9e412bcffaef9359cae82fc8 c:\windows\explorer.exe
2007-10-13 13:03 1224192 3fe7b5db9e412bcffaef9359cae82fc8 c:\windows\icon_TMP\explorer.exe
2007-10-13 13:03 1033216 42d32722b805d7df42d30487a0bcbd78 c:\windows\system_backup\explorer.exe

2007-10-13 13:05 80216 c7bcea1533be5c9e15884d6c39b667f1 c:\windows\icon_TMP\wuauclt.exe
2007-10-13 13:05 80216 c7bcea1533be5c9e15884d6c39b667f1 c:\windows\system32\wuauclt.exe
2007-10-13 13:05 53080 3a83a45e7dd5276315aa20245e7c32bf c:\windows\system_backup\wuauclt.exe

2009-03-04 18:03 104960 36503a3904f87a085bb3877e3d16564f c:\windows\system32\userinit.exe
2009-03-04 18:03 104960 36503a3904f87a085bb3877e3d16564f c:\windows\system32\dllcache\userinit.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{4724c5d8-dfa7-417a-a2f5-1eabfee9b4ac}"= "c:\program files\MyPlayCity\tbMyP1.dll" [2009-03-05 1883672]

[HKEY_CLASSES_ROOT\clsid\{4724c5d8-dfa7-417a-a2f5-1eabfee9b4ac}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4724c5d8-dfa7-417a-a2f5-1eabfee9b4ac}]
2009-03-05 19:09 1883672 --a------ c:\program files\MyPlayCity\tbMyP1.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2007-10-13 15360]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-02-17 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-06-04 177456]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv"="grpconv -o" [X]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2007-10-13 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2007-10-13 c:\windows\system32\advpack.dll]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\explorer.exe,"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
2005-12-21 07:57 176128 c:\progra~1\Stardock\OBJECT~1\WINDOW~1\WbSrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\c00A6903]
2009-03-04 14:59 20992 c:\windows\system32\c00A6903.mat

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= msaud32_divx.acm

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Shortcut to autorun.exe.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Shortcut to autorun.exe.lnk
backup=c:\windows\pss\Shortcut to autorun.exe.lnkCommon Startup

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"swg"=c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
"Google Update"="c:\documents and settings\Admin\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe"
"hpWirelessAssistant"=c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
"SoundMAXPnP"=c:\program files\Analog Devices\Core\smax4pnp.exe
"SoundMAX"=c:\program files\Analog Devices\SoundMAX\Smax4.exe /tray

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"WinampAgent"="c:\program files\Winamp\winampa.exe"
"AdVantage Setup"=c:\program files\DAEMON Tools\AdVantageSetup.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Documents and Settings\\Admin\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\Admin\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\TmNationsForever\\TmForever.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\TrackMania Nations ESWC\\TmNationsESWC.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"2383:TCP"= 2383:TCP:Akamai NetSession Interface
"5000:UDP"= 5000:UDP:Akamai NetSession Interface
"1097:TCP"= 1097:TCP:Akamai NetSession Interface
"1050:TCP"= 1050:TCP:Akamai NetSession Interface
"1057:TCP"= 1057:TCP:Akamai NetSession Interface
"1047:TCP"= 1047:TCP:Akamai NetSession Interface
"1052:TCP"= 1052:TCP:Akamai NetSession Interface
"1042:TCP"= 1042:TCP:Akamai NetSession Interface

S0 SFAUDIO;Sonic Focus DSP Driver;c:\windows\system32\drivers\sfaudio.sys [2008-03-28 24064]
S1 aswSP;avast! Self Protection; [x]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2009-02-05 20560]
S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2008-04-03 193840]


--- Other Services/Drivers In Memory ---

*Deregistered* - Aavmker4
*Deregistered* - AFD
*Deregistered* - AgereModemAudio
*Deregistered* - ALG
*Deregistered* - aswFsBlk
*Deregistered* - aswMon2
*Deregistered* - aswRdr
*Deregistered* - aswSP
*Deregistered* - aswTdi
*Deregistered* - aswUpdSv
*Deregistered* - Ati HotKey Poller
*Deregistered* - AudioSrv
*Deregistered* - audstub
*Deregistered* - avast! Antivirus
*Deregistered* - avast! Mail Scanner
*Deregistered* - avast! Web Scanner
*Deregistered* - Beep
*Deregistered* - BITS
*Deregistered* - Browser
*Deregistered* - BTKRNL
*Deregistered* - btwdins
*Deregistered* - Cdfs
*Deregistered* - Com4QLBEx
*Deregistered* - Compbatt
*Deregistered* - CryptSvc
*Deregistered* - DcomLaunch
*Deregistered* - Dhcp
*Deregistered* - dmio
*Deregistered* - dmload
*Deregistered* - dmserver
*Deregistered* - Dnscache
*Deregistered* - ERSvc
*Deregistered* - EventSystem
*Deregistered* - FastUserSwitchingCompatibility
*Deregistered* - Fips
*Deregistered* - FltMgr
*Deregistered* - Ftdisk
*Deregistered* - Gpc
*Deregistered* - gusvc
*Deregistered* - helpsvc
*Deregistered* - hpqwmiex
*Deregistered* - HTTP
*Deregistered* - ImapiService
*Deregistered* - IpNat
*Deregistered* - IPSec
*Deregistered* - KSecDD
*Deregistered* - lanmanserver
*Deregistered* - lanmanworkstation
*Deregistered* - LmHosts
*Deregistered* - MDM
*Deregistered* - mnmdd
*Deregistered* - MountMgr
*Deregistered* - MRxDAV
*Deregistered* - MRxSmb
*Deregistered* - Msfs
*Deregistered* - mssmbios
*Deregistered* - Mup
*Deregistered* - NDIS
*Deregistered* - NdisTapi
*Deregistered* - Ndisuio
*Deregistered* - NdisWan
*Deregistered* - NDProxy
*Deregistered* - NetBIOS
*Deregistered* - NetBT
*Deregistered* - Netman
*Deregistered* - Nla
*Deregistered* - Npfs
*Deregistered* - Ntfs
*Deregistered* - Null
*Deregistered* - PartMgr
*Deregistered* - PolicyAgent
*Deregistered* - PptpMiniport
*Deregistered* - ProtectedStorage
*Deregistered* - PSched
*Deregistered* - RasAcd
*Deregistered* - Rasl2tp
*Deregistered* - RasMan
*Deregistered* - RasPppoe
*Deregistered* - Raspti
*Deregistered* - Rdbss
*Deregistered* - RDPCDD
*Deregistered* - rdpdr
*Deregistered* - RemoteRegistry
*Deregistered* - RpcSs
*Deregistered* - rspndr
*Deregistered* - SamSs
*Deregistered* - Schedule
*Deregistered* - Secdrv
*Deregistered* - seclogon
*Deregistered* - SENS
*Deregistered* - SFAUDIO
*Deregistered* - sfdrv01
*Deregistered* - sfhlp02
*Deregistered* - sfvfs02
*Deregistered* - SharedAccess
*Deregistered* - ShellHWDetection
*Deregistered* - Spooler
*Deregistered* - sptd
*Deregistered* - sr
*Deregistered* - srservice
*Deregistered* - Srv
*Deregistered* - SSDPSRV
*Deregistered* - stisvc
*Deregistered* - swenum
*Deregistered* - TapiSrv
*Deregistered* - Tcpip
*Deregistered* - TermDD
*Deregistered* - TermService
*Deregistered* - Themes
*Deregistered* - TrkWks
*Deregistered* - Update
*Deregistered* - UxTuneUp
*Deregistered* - VgaSave
*Deregistered* - VolSnap
*Deregistered* - W32Time
*Deregistered* - Wanarp
*Deregistered* - Wdf01000
*Deregistered* - WebClient
*Deregistered* - winmgmt
*Deregistered* - wscsvc
*Deregistered* - wuauserv
*Deregistered* - WZCSVC

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - D:\BugDVD.exe
\Shell\Install\command - D:\BugDVD.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{68a85a0a-fdb8-11dd-9b43-00210065420b}]
\Shell\AutoRun\command - F:\
\Shell\open\Command - rundll32.exe .\\wmpcwre.dll,InstallM
.
Contents of the 'Scheduled Tasks' folder

2009-02-27 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [2007-04-27 06:51]

2009-03-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-854245398-1580436667-682003330-1003.job
- c:\documents and settings\Admin\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-02-17 22:16]
.
- - - - ORPHANS REMOVED - - - -

HKLM-RunOnce-<NO NAME> - (no file)
HKLM-Explorer_Run-Lsass Service - c:\documents and settings\Admin\Application Data\Microsoft\Windows\lsass.exe
Notify-1235904601_m7d_opf_260209 - 1235904601_m7d_opf_260209.dll


.
------- Supplementary Scan -------
.
IE: Crawler Search - tbr:iemenu
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\Toolbar\ctbr.dll
FF - ProfilePath - c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\efcuy4p1.default\
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - component: c:\program files\Mozilla Firefox\extensions\browserhighlighter@ebay.com\components\Shim.dll
FF - plugin: c:\documents and settings\Admin\Application Data\Mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\Admin\Local Settings\Application Data\Google\Update\1.2.141.5\npGoogleOneClick7.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2009-03-05 21:16:42
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
Lsass Service = c:\documents and settings\Admin\Application Data\Microsoft\Windows\lsass.exe???????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A4FD1254-DE42-4A46-9B3D-B9167686B8BF}\LocalServer32]
@DACL=(02 0000)
@="c:\\PROGRA~1\\SPYWAR~1\\SPYWAR~1.EXE"
"ThreadingModel"="Free"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A4FD1254-DE42-4A46-9B3D-B9167686B8BF}\ProgID]
@DACL=(02 0000)
@="CSTerminator.CoCSTerminator"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A4FD1254-DE42-4A46-9B3D-B9167686B8BF}\TypeLib]
@DACL=(02 0000)
@="{27FBDC7C-30AF-4EDB-9108-0AF6EE3FC89D}"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A4FD1254-DE42-4A46-9B3D-B9167686B8BF}\Version]
@DACL=(02 0000)
@="1.0"

[HKEY_LOCAL_MACHINE\software\Classes\CSTerminator.CoCSTerminator\Clsid]
@DACL=(02 0000)
@="{A4FD1254-DE42-4A46-9B3D-B9167686B8BF}"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(932)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\c00A6903.mat
c:\progra~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll
.
Completion time: 2009-03-05 21:18:03
ComboFix-quarantined-files.txt 2009-03-05 20:18:01

Pre-Run: 196,535,152,640 bytes free
Post-Run: 196,553,838,592 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

434

Dopuna: 05 Mar 2009 22:41

Izgleda mi, ovako kako ja vidim, sve u redu.
Hvala

Dopuna: 06 Mar 2009 0:10

Šta sam napravila da mi se pojavilo, to što se pojavilo? Pitam informativno da mi se problem ne pojavi ponovo.
Hvala

Poslao: 06 Mar 2009 00:18
Idi na vrh
offline
  • diarno  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 15 Jun 2007
  • Poruke: 5572

Nazalost, nismo jos zavrsili.. jos uvek ima infekcije i moracemo sutra da nastavimo Sad

Poslao: 06 Mar 2009 00:27
Idi na vrh
offline
  • Pridružio: 05 Mar 2009
  • Poruke: 6

:-( do sutra

Poslao: 06 Mar 2009 14:13
Idi na vrh
offline
  • diarno  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 15 Jun 2007
  • Poruke: 5572

Skini ovaj zip i raspakuj ga na desktop.


[Link mogu videti samo ulogovani korisnici]

Zatim uradi sledece :





Otvoriti Notepad i iskopirati sledeci tekst:

FCOPY::
c:\documents and settings\Admin\Desktop\userinit.exe|c:\windows\system32\userinit.exe
c:\documents and settings\Admin\Desktop\userinit.exe|c:\windows\system32\dllcache\userinit.exe

File::
c:\windows\system32\c0031261.mat
c:\windows\system32\c00A6903.mat

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\c00A6903]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{68a85a0a-fdb8-11dd-9b43-00210065420b}]

Snimiti na Desktop fajl iz Notepada kao "CFScript"




Prevuci snimljeni skript/tekst na ComboFix ikonicu kao na slici.
Postaviti u sledecoj poruci log koji bude bio napravljen na kraju ciscenja/skeniranja.

Poslao: 06 Mar 2009 18:07
Idi na vrh
offline
  • Pridružio: 05 Mar 2009
  • Poruke: 6

ComboFix 09-03-04.01 - Admin 2009-03-06 17:48:28.2 - NTFSx86
Running from: c:\documents and settings\Admin\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Admin\Desktop\CFScript.txt
* Created a new restore point

FILE ::
c:\windows\system32\c0031261.mat
c:\windows\system32\c00A6903.mat
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\c0031261.mat
c:\windows\system32\c00A6903.mat

.
--------------- FCopy ---------------

c:\documents and settings\Admin\Desktop\userinit.exe --> c:\windows\system32\userinit.exe
c:\documents and settings\Admin\Desktop\userinit.exe --> c:\windows\system32\dllcache\userinit.exe
.
((((((((((((((((((((((((( Files Created from 2009-02-06 to 2009-03-06 )))))))))))))))))))))))))))))))
.

2009-03-06 17:48 . 2009-03-06 14:02 24,576 --a------ c:\windows\system32\userinit.exe
2009-03-06 17:48 . 2009-03-06 14:02 24,576 --a------ c:\windows\system32\dllcache\userinit.exe
2009-03-05 22:51 . 2009-03-05 23:01 <DIR> d-------- c:\program files\DesktopEarth
2009-03-05 21:30 . 2009-03-05 21:30 <DIR> d-------- c:\windows\system32\xircom
2009-03-05 21:30 . 2009-03-05 21:30 <DIR> d-------- c:\program files\microsoft frontpage
2009-03-05 19:33 . 2009-03-05 19:33 <DIR> d-------- c:\program files\Trend Micro
2009-03-04 19:04 . 2009-03-04 21:51 <DIR> d-------- c:\documents and settings\Admin\Application Data\Lavasoft
2009-03-04 18:52 . 2009-03-04 21:50 <DIR> d-------- c:\program files\a-squared HiJackFree
2009-03-04 18:46 . 2005-08-25 18:18 118,784 --a------ c:\windows\system32\MSSTDFMT.DLL
2009-03-04 18:46 . 2005-08-25 18:19 115,920 --a------ c:\windows\system32\MSINET.OCX
2009-03-04 15:31 . 2009-03-04 15:31 <DIR> d-------- c:\program files\Crawler
2009-03-04 15:24 . 2009-03-04 15:24 <DIR> d-------- c:\documents and settings\NetworkService\Application Data\Spyware Terminator
2009-03-04 15:04 . 2009-03-05 13:37 <DIR> d-------- c:\program files\SDHelper (Spybot - Search & Destroy)
2009-03-04 15:04 . 2009-03-04 15:04 <DIR> d-------- c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2009-03-04 15:04 . 2009-03-04 15:04 <DIR> d-------- c:\program files\File Scanner Library (Spybot - Search & Destroy)
2009-03-04 14:50 . 2009-03-05 21:26 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-03-04 08:58 . 2009-03-05 19:08 <DIR> d-------- c:\program files\MyPlayCity
2009-03-04 08:58 . 2009-03-04 08:58 <DIR> d-------- c:\program files\Conduit
2009-03-03 23:32 . 2009-03-04 22:22 <DIR> d-------- c:\program files\TrackMania Nations ESWC
2009-03-02 11:20 . 2009-03-02 11:20 <DIR> d-------- c:\documents and settings\Admin\Application Data\Thunderbird
2009-03-01 23:56 . 2009-03-01 23:56 <DIR> d-------- c:\documents and settings\All Users\Application Data\TrackMania
2009-03-01 23:54 . 2009-03-01 23:55 <DIR> d-------- c:\program files\TmNationsForever
2009-02-25 19:52 . 1994-09-21 01:00 12,800 --a------ c:\windows\system32\wing32.dll
2009-02-25 14:31 . 2001-08-17 13:56 7,552 --a------ c:\windows\system32\drivers\SONYPVU1.SYS
2009-02-23 18:51 . 2009-02-23 18:51 <DIR> d-------- c:\documents and settings\All Users\Application Data\GRETECH
2009-02-23 18:51 . 2009-02-23 18:51 <DIR> d-------- c:\documents and settings\Admin\Application Data\GRETECH
2009-02-23 17:33 . 2009-02-23 17:33 <DIR> d-------- c:\program files\CMVideoPlugin
2009-02-23 17:09 . 2004-02-23 20:42 1,386,496 --a------ c:\windows\system32\msvbvm60.dll
2009-02-23 17:09 . 2002-05-08 06:47 164,112 --a------ c:\windows\system32\olepro32.dll
2009-02-23 17:09 . 2002-05-08 06:47 147,728 --a------ c:\windows\system32\asycfilt.dll
2009-02-23 17:09 . 2002-05-08 06:47 22,288 --a------ c:\windows\system32\comcat.dll
2009-02-23 16:32 . 2009-02-23 16:32 <DIR> d-------- c:\program files\CommitCRM
2009-02-23 16:32 . 2009-02-23 16:33 <DIR> d-------- C:\Commit
2009-02-23 15:48 . 2009-02-23 15:53 <DIR> d-------- c:\documents and settings\All Users\Application Data\DriverScanner
2009-02-23 15:48 . 2009-02-23 16:09 <DIR> d-------- c:\documents and settings\Admin\Application Data\Uniblue
2009-02-19 21:59 . 2009-02-19 21:59 32 --a------ c:\documents and settings\All Users\Application Data\ezsid.dat
2009-02-19 19:22 . 2009-03-02 19:09 <DIR> d-------- c:\documents and settings\Admin\Application Data\skypePM
2009-02-19 19:22 . 2009-02-19 19:22 48 --ah----- c:\windows\system32\ezsidmv.dat
2009-02-19 19:18 . 2009-03-03 11:54 <DIR> d-------- c:\documents and settings\Admin\Application Data\Skype
2009-02-19 19:16 . 2009-02-19 19:16 <DIR> dr------- c:\program files\Skype
2009-02-19 19:16 . 2009-02-19 19:16 <DIR> d-------- c:\program files\Common Files\Skype
2009-02-19 19:16 . 2009-02-19 19:16 <DIR> d-------- c:\documents and settings\All Users\Application Data\Skype
2009-02-18 17:01 . 2009-02-18 17:01 <DIR> d-------- c:\program files\YouTube Downloader
2009-02-18 14:58 . 2009-02-18 14:58 <DIR> d-------- c:\program files\Into Sudoku
2009-02-18 11:04 . 2009-02-18 13:00 2,723 --a------ c:\windows\langorig.ini
2009-02-18 09:46 . 2009-02-18 09:46 <DIR> d-------- c:\program files\Tracker Software
2009-02-18 09:02 . 2009-03-04 00:03 <DIR> d-------- c:\program files\TuneUp Utilities 2007
2009-02-18 09:02 . 2009-02-18 09:02 <DIR> d-------- c:\documents and settings\Admin\Application Data\TuneUp Software
2009-02-18 09:02 . 2007-03-29 04:42 29,704 --a------ c:\windows\system32\uxtuneup.dll
2009-02-18 09:01 . 2009-02-18 09:01 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
2009-02-18 09:01 . 2009-02-18 09:01 <DIR> d-------- c:\documents and settings\All Users\Application Data\TuneUp Software
2009-02-18 08:55 . 2009-03-04 17:11 <DIR> d-------- c:\program files\ESET
2009-02-12 14:41 . 2009-02-12 14:46 <DIR> d-------- c:\program files\Mystery in London
2009-02-11 23:52 . 2009-02-11 23:52 <DIR> d-------- c:\windows\system32\NtmsData
2009-02-08 17:20 . 2009-02-08 17:20 <DIR> d-------- c:\program files\The Adventure Company
2009-02-08 13:01 . 2009-02-08 13:01 <DIR> d-------- c:\documents and settings\Admin\Application Data\Media Player Classic
2009-02-07 12:19 . 2009-02-07 12:19 <DIR> d-------- c:\documents and settings\All Users\Application Data\BigFish

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-06 09:07 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-03-03 23:06 --------- d-----w c:\program files\Oberon Media
2009-03-03 23:06 --------- d-----w c:\program files\Cpt. Binary
2009-03-02 10:19 --------- d-----w c:\program files\Alawar
2009-02-23 15:47 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-23 15:06 --------- d-----w c:\program files\GRETECH
2009-02-19 22:50 --------- d-----w c:\documents and settings\Admin\Application Data\ForgottenRiddles2
2009-02-19 19:46 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-02-18 10:12 --------- d-----w c:\program files\Deep Voyage
2009-02-18 10:12 --------- d-----w c:\program files\Aztec Bricks
2009-02-18 10:12 --------- d-----w c:\program files\Azada
2009-02-18 09:45 --------- d-----w c:\program files\Windows Sidebar
2009-02-18 08:31 --------- d-----w c:\program files\Styler
2009-02-18 07:31 --------- d-----w c:\program files\Hidden Expedition Titanic
2009-02-17 17:15 --------- d-----w c:\program files\Google
2009-02-14 14:58 --------- d-----w c:\documents and settings\All Users\Application Data\AlawarWrapper
2009-02-13 19:06 --------- d-----w c:\program files\LeeGTs Games
2009-02-13 18:24 --------- d-----w c:\documents and settings\Admin\Application Data\Big Fish Games
2009-02-13 18:22 --------- d-----w c:\documents and settings\All Users\Application Data\MysteryChronicles
2009-02-09 12:37 --------- d-----w c:\documents and settings\Admin\Application Data\GlarySoft
2009-02-04 08:47 --------- d-----w c:\documents and settings\All Users\Application Data\MumboJumbo
2009-02-02 14:41 --------- d-----w c:\documents and settings\All Users\Application Data\Friends Games
2009-02-01 20:28 --------- d-----w c:\documents and settings\All Users\Application Data\Forge of Games
2009-02-01 20:27 --------- d-----w c:\program files\Common Files\Sandlot Shared
2009-02-01 20:26 --------- d-----w c:\documents and settings\All Users\Application Data\Sandlot Games
2009-02-01 16:11 --------- d-----w c:\program files\Just Sudoku PE
2009-02-01 13:27 --------- d-----w c:\documents and settings\Admin\Application Data\Beep Industries
2009-01-31 13:54 --------- d-----w c:\program files\Forgotten Riddles - The Moonlight Sonatas
2009-01-31 13:30 --------- d-----w c:\documents and settings\All Users\Application Data\Oberon Media
2009-01-31 13:22 --------- d-----w c:\documents and settings\Admin\Application Data\Beep
2009-01-31 13:13 --------- d-----w c:\program files\DAEMON Tools
2009-01-31 13:11 685,816 ----a-w c:\windows\system32\drivers\sptd.sys
2009-01-30 10:26 --------- d-----w c:\program files\Mystery Chronicles - Murder Among Friends
2009-01-29 18:37 --------- d-----w c:\program files\The Three Stooges - Treasure Hunt Hijinks
2009-01-29 18:37 --------- d-----w c:\documents and settings\Admin\Application Data\BigFish
2009-01-29 17:35 --------- d-----w c:\program files\ReflexiveArcade
2009-01-28 20:38 --------- d-----w c:\program files\MyPlayCity.com
2009-01-28 00:50 --------- d-----w c:\program files\SecureW2
2009-01-27 16:19 --------- d-----w c:\documents and settings\Admin\Application Data\FastStone
2009-01-27 16:05 --------- d-----w c:\program files\FastStone Image Viewer
2009-01-27 02:56 --------- d-----w c:\documents and settings\Admin\Application Data\Talkback
2009-01-26 22:20 --------- d-----w c:\documents and settings\Admin\Application Data\Winamp
2009-01-26 22:17 --------- d-----w c:\program files\Winamp
2009-01-24 03:32 --------- d-----w c:\program files\Common Files\Adobe
2009-01-23 05:06 1,391,104 ----a-w c:\windows\system32\drivers\BCMWL5.SYS
2009-01-23 05:06 --------- d-----w c:\program files\Broadcom
2009-01-23 05:03 --------- d-----w c:\documents and settings\All Users\Application Data\ATI
2009-01-23 05:03 --------- d-----w c:\documents and settings\Admin\Application Data\ATI
2009-01-23 04:59 --------- d-----w c:\program files\ATI Technologies
2009-01-23 04:56 --------- d-----w c:\program files\Common Files\InstallShield
2009-01-23 04:55 --------- d-----w c:\program files\WIDCOMM
2009-01-23 04:51 --------- d-----w c:\program files\Analog Devices
2009-01-23 04:50 --------- d-----w c:\program files\Marvell
2009-01-23 04:49 0 ---ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2009-01-23 04:49 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_HpqKbFiltr_01005.Wdf
2009-01-23 04:48 --------- d-----w c:\program files\Hewlett-Packard
2009-01-23 04:47 --------- d-----w c:\program files\Common Files\SNP2UVC
2009-01-23 04:47 --------- d-----w c:\documents and settings\Admin\Application Data\InstallShield
2009-01-22 04:08 --------- d-----w c:\documents and settings\Admin\Application Data\Nero
2009-01-22 04:01 --------- d-----w c:\program files\Microsoft Works
2009-01-22 04:00 --------- d-----w c:\program files\Microsoft.NET
.

------- Sigcheck -------

2007-10-13 13:04 2182144 a09c144d8d5a460b8ebfa56f913715d2 c:\windows\system32\ntkrnlpa.exe

2007-10-13 13:04 2302464 465e3e1178812be755634457f4a778bf c:\windows\system32\ntoskrnl.exe

2007-10-13 13:03 1224192 3fe7b5db9e412bcffaef9359cae82fc8 c:\windows\explorer.exe
2007-10-13 13:03 1224192 3fe7b5db9e412bcffaef9359cae82fc8 c:\windows\icon_TMP\explorer.exe
2007-10-13 13:03 1033216 42d32722b805d7df42d30487a0bcbd78 c:\windows\system_backup\explorer.exe

2007-10-13 13:05 80216 c7bcea1533be5c9e15884d6c39b667f1 c:\windows\icon_TMP\wuauclt.exe
2007-10-13 13:05 80216 c7bcea1533be5c9e15884d6c39b667f1 c:\windows\system32\wuauclt.exe
2007-10-13 13:05 53080 3a83a45e7dd5276315aa20245e7c32bf c:\windows\system_backup\wuauclt.exe
.
((((((((((((((((((((((((((((( [Link mogu videti samo ulogovani korisnici] )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-03-05 22:01:37 29,926 ----a-r c:\windows\Installer\{DBA5E973-660D-4CBE-A469-F5C37FBF0CE4}\_6FEFF9B68218417F98F549.exe
+ 2009-03-05 22:01:37 29,926 ----a-r c:\windows\Installer\{DBA5E973-660D-4CBE-A469-F5C37FBF0CE4}\_C1A9BF9D98647632ED5172.exe
+ 2009-03-05 22:01:37 29,926 ----a-r c:\windows\Installer\{DBA5E973-660D-4CBE-A469-F5C37FBF0CE4}\_CE4FFA1DD37E7C505AED29.exe
- 2009-03-05 17:59:16 71,108 ----a-w c:\windows\system32\perfc009.dat
+ 2009-03-06 07:36:45 71,108 ----a-w c:\windows\system32\perfc009.dat
- 2009-03-05 17:59:16 439,062 ----a-w c:\windows\system32\perfh009.dat
+ 2009-03-06 07:36:45 439,062 ----a-w c:\windows\system32\perfh009.dat
+ 2009-03-06 16:52:10 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_79c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{4724c5d8-dfa7-417a-a2f5-1eabfee9b4ac}"= "c:\program files\MyPlayCity\tbMyP1.dll" [2009-03-05 1883672]

[HKEY_CLASSES_ROOT\clsid\{4724c5d8-dfa7-417a-a2f5-1eabfee9b4ac}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4724c5d8-dfa7-417a-a2f5-1eabfee9b4ac}]
2009-03-05 19:09 1883672 --a------ c:\program files\MyPlayCity\tbMyP1.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2007-10-13 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-02-17 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-06-04 177456]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2007-10-13 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2007-10-13 c:\windows\system32\advpack.dll]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
2005-12-21 07:57 176128 c:\progra~1\Stardock\OBJECT~1\WINDOW~1\WbSrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= msaud32_divx.acm

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Shortcut to autorun.exe.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Shortcut to autorun.exe.lnk
backup=c:\windows\pss\Shortcut to autorun.exe.lnkCommon Startup

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"swg"=c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
"Google Update"="c:\documents and settings\Admin\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe"
"hpWirelessAssistant"=c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
"SoundMAXPnP"=c:\program files\Analog Devices\Core\smax4pnp.exe
"SoundMAX"=c:\program files\Analog Devices\SoundMAX\Smax4.exe /tray

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"WinampAgent"="c:\program files\Winamp\winampa.exe"
"AdVantage Setup"=c:\program files\DAEMON Tools\AdVantageSetup.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Documents and Settings\\Admin\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\Admin\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\TmNationsForever\\TmForever.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\TrackMania Nations ESWC\\TmNationsESWC.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"2383:TCP"= 2383:TCP:Akamai NetSession Interface
"5000:UDP"= 5000:UDP:Akamai NetSession Interface
"1097:TCP"= 1097:TCP:Akamai NetSession Interface
"1050:TCP"= 1050:TCP:Akamai NetSession Interface
"1057:TCP"= 1057:TCP:Akamai NetSession Interface
"1047:TCP"= 1047:TCP:Akamai NetSession Interface
"1052:TCP"= 1052:TCP:Akamai NetSession Interface
"1042:TCP"= 1042:TCP:Akamai NetSession Interface

S0 SFAUDIO;Sonic Focus DSP Driver;c:\windows\system32\drivers\sfaudio.sys [2008-03-28 24064]
S1 aswSP;avast! Self Protection; [x]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2009-02-05 20560]
S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2008-04-03 193840]


--- Other Services/Drivers In Memory ---

*Deregistered* - Aavmker4
*Deregistered* - AFD
*Deregistered* - AgereModemAudio
*Deregistered* - ALG
*Deregistered* - aswFsBlk
*Deregistered* - aswMon2
*Deregistered* - aswRdr
*Deregistered* - aswSP
*Deregistered* - aswTdi
*Deregistered* - aswUpdSv
*Deregistered* - Ati HotKey Poller
*Deregistered* - AudioSrv
*Deregistered* - audstub
*Deregistered* - avast! Antivirus
*Deregistered* - avast! Mail Scanner
*Deregistered* - avast! Web Scanner
*Deregistered* - Beep
*Deregistered* - Browser
*Deregistered* - BTKRNL
*Deregistered* - btwdins
*Deregistered* - Cdfs
*Deregistered* - Com4QLBEx
*Deregistered* - Compbatt
*Deregistered* - CryptSvc
*Deregistered* - DcomLaunch
*Deregistered* - Dhcp
*Deregistered* - dmio
*Deregistered* - dmload
*Deregistered* - dmserver
*Deregistered* - Dnscache
*Deregistered* - ERSvc
*Deregistered* - EventSystem
*Deregistered* - FastUserSwitchingCompatibility
*Deregistered* - Fips
*Deregistered* - FltMgr
*Deregistered* - Ftdisk
*Deregistered* - Gpc
*Deregistered* - helpsvc
*Deregistered* - hpqwmiex
*Deregistered* - HTTP
*Deregistered* - ImapiService
*Deregistered* - IpNat
*Deregistered* - IPSec
*Deregistered* - KSecDD
*Deregistered* - lanmanserver
*Deregistered* - lanmanworkstation
*Deregistered* - LmHosts
*Deregistered* - MDM
*Deregistered* - mnmdd
*Deregistered* - MountMgr
*Deregistered* - MRxDAV
*Deregistered* - MRxSmb
*Deregistered* - Msfs
*Deregistered* - mssmbios
*Deregistered* - Mup
*Deregistered* - NDIS
*Deregistered* - NdisTapi
*Deregistered* - Ndisuio
*Deregistered* - NdisWan
*Deregistered* - NDProxy
*Deregistered* - NetBIOS
*Deregistered* - NetBT
*Deregistered* - Netman
*Deregistered* - Nla
*Deregistered* - Npfs
*Deregistered* - Ntfs
*Deregistered* - Null
*Deregistered* - PartMgr
*Deregistered* - PolicyAgent
*Deregistered* - PptpMiniport
*Deregistered* - ProtectedStorage
*Deregistered* - PSched
*Deregistered* - RasAcd
*Deregistered* - Rasl2tp
*Deregistered* - RasMan
*Deregistered* - RasPppoe
*Deregistered* - Raspti
*Deregistered* - Rdbss
*Deregistered* - RDPCDD
*Deregistered* - rdpdr
*Deregistered* - RemoteRegistry
*Deregistered* - RpcSs
*Deregistered* - rspndr
*Deregistered* - SamSs
*Deregistered* - Schedule
*Deregistered* - Secdrv
*Deregistered* - seclogon
*Deregistered* - SENS
*Deregistered* - SFAUDIO
*Deregistered* - sfdrv01
*Deregistered* - sfhlp02
*Deregistered* - sfvfs02
*Deregistered* - SharedAccess
*Deregistered* - ShellHWDetection
*Deregistered* - Spooler
*Deregistered* - sptd
*Deregistered* - sr
*Deregistered* - srservice
*Deregistered* - Srv
*Deregistered* - SSDPSRV
*Deregistered* - stisvc
*Deregistered* - swenum
*Deregistered* - TapiSrv
*Deregistered* - Tcpip
*Deregistered* - TermDD
*Deregistered* - TermService
*Deregistered* - Themes
*Deregistered* - TrkWks
*Deregistered* - Update
*Deregistered* - UxTuneUp
*Deregistered* - VgaSave
*Deregistered* - VolSnap
*Deregistered* - W32Time
*Deregistered* - Wanarp
*Deregistered* - Wdf01000
*Deregistered* - WebClient
*Deregistered* - winmgmt
*Deregistered* - wscsvc
*Deregistered* - wuauserv
*Deregistered* - WZCSVC

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - D:\BugDVD.exe
\Shell\Install\command - D:\BugDVD.exe
.
Contents of the 'Scheduled Tasks' folder

2009-02-27 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [2007-04-27 06:51]

2009-03-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-854245398-1580436667-682003330-1003.job
- c:\documents and settings\Admin\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-02-17 22:16]
.
.
------- Supplementary Scan -------
.
IE: Crawler Search - tbr:iemenu
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\Toolbar\ctbr.dll
FF - ProfilePath - c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\efcuy4p1.default\
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - component: c:\program files\Mozilla Firefox\extensions\browserhighlighter@ebay.com\components\Shim.dll
FF - plugin: c:\documents and settings\Admin\Application Data\Mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\Admin\Local Settings\Application Data\Google\Update\1.2.141.5\npGoogleOneClick7.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2009-03-06 17:52:40
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A4FD1254-DE42-4A46-9B3D-B9167686B8BF}\LocalServer32]
@DACL=(02 0000)
@="c:\\PROGRA~1\\SPYWAR~1\\SPYWAR~1.EXE"
"ThreadingModel"="Free"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A4FD1254-DE42-4A46-9B3D-B9167686B8BF}\ProgID]
@DACL=(02 0000)
@="CSTerminator.CoCSTerminator"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A4FD1254-DE42-4A46-9B3D-B9167686B8BF}\TypeLib]
@DACL=(02 0000)
@="{27FBDC7C-30AF-4EDB-9108-0AF6EE3FC89D}"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A4FD1254-DE42-4A46-9B3D-B9167686B8BF}\Version]
@DACL=(02 0000)
@="1.0"

[HKEY_LOCAL_MACHINE\software\Classes\CSTerminator.CoCSTerminator\Clsid]
@DACL=(02 0000)
@="{A4FD1254-DE42-4A46-9B3D-B9167686B8BF}"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(940)
c:\windows\system32\Ati2evxx.dll
c:\progra~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe
c:\program files\DesktopEarth\DesktopEarth.exe
c:\program files\WIDCOMM\Bluetooth Software\BTStackServer.exe
c:\windows\system32\agrsmsvc.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\progra~1\COMMON~1\MICROS~1\DW\DW20.EXE
.
**************************************************************************
.
Completion time: 2009-03-06 17:55:11 - machine was rebooted [Admin]
ComboFix-quarantined-files.txt 2009-03-06 16:55:08
ComboFix2.txt 2009-03-05 20:18:04

Pre-Run: 193,712,398,336 bytes free
Post-Run: 193,707,253,760 bytes free

436

Poslao: 06 Mar 2009 18:13
Idi na vrh
offline
  • diarno  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 15 Jun 2007
  • Poruke: 5572

Kako ti se sad cini stanje sistema?

Poslao: 06 Mar 2009 18:23
Idi na vrh
offline
  • Pridružio: 05 Mar 2009
  • Poruke: 6

Danas je sistem puno brži nego jučer, hvala.
Ali kao totalni laik i dalje neznam šta mi se događalo. Možda nešto kao kako spriječiti da se ne ponovi?
Zahvalna sam šta sam naletila na ovu stranicu i na Vas Zagrljaj
Ivana

Poslao: 06 Mar 2009 19:10
Idi na vrh
offline
  • diarno  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 15 Jun 2007
  • Poruke: 5572

Pa imala si malware koji je inficirao sistemske fajlove pa smo to sredili... E sad.. kako spreciti da se to ne ponovi.. to je tesko pitanje... samo redovno update-uj zastitni softver, kloni se krekovanih programa i to je ono sto je do tebe... Ono sto se nikad ne zna je to koji sajt sadrzi malware( to je vise stvar srece Wink )...

Uradi jos ovo :


Klikni START a zatim RUN
U liniju za unos teksta ukucaj Combofix /u i klikni OK





Sačekaj da se proces deinstalacije završi
Gornja procedura će:
Obrisati sledeće:
ComboFix i njegove file-ove i foldere
VundoFix Backups folder, ako postoji
C:\Deckard folder, ako postoji
C:\OtMoveIt folder, ako postoji
Resetovati podešavanja sata na kompjuteru
Sakriti ekstenzije file-ova, ako je potrebno
Sakriti sistemske/skrivene file-ove/foldere, ako je potrebno
Resetovati System Restore

MyCity » Ambulanta -> Arhiva Ambulante » virus, nešto?!

Ko je trenutno na forumu
 

Ukupno su 1192 korisnika na forumu :: 191 registrovanih, 18 sakrivenih i 983 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: 04bokibole, 9k38, advokat84, AleksandarV, ALEXV, Alooo, annon, arezina, Aska, Asteker, atmel, babaroga, baltazar01, Baltimor, bavar357, Baždaranac, blackjack, Blacksky, blue, bobomicek, Bobrock1, bojankrstc, bojanM84, Bombarder, Boroš, Borski1977, BOXRR, bpvl, BrcakRS, Bubimir, BWG, chitach, Cicumile, Cirkon, Dambi, darcaud, darkangel, dejandr, dekan.m, delrey, DENIRO, dexteroza, Doc, dok80, Dorcolac, dragan_mig31, Drugsparrow, Duh sa sekirom, dule10savic, Dusko Nikolin, Electron, entriun, EXIT78, Feller, flash12, geo.dule, Georgius, Gibli, gobrad, gomago, goranjovic, Hans Gajger, havoc995, Heisenberg99, Hitri, ihis, ikan, ILGromovnik, Inner-Cell, Insan, Ir, istina, Jaz, Jenoyi, Jeremiah, Jerry Drake, Još malo pa deda, K-1A, Kajzer Soze, kalens021, Kamov, kirucar, Kosmos Banja Luka, Krin, Kubovac, Kuroje, laki_bb, Lazur_01, leonard, Leonov, Litostroton, lord sir giga, M74AB3, MaCS, marko.markovic, markoni.slo, marsi, Martin543, mat, mercedesamg, Mercury, Metanoja, Might is Right, mihajlot2013, mikrimaus, Milan A. Nikolic, milanpb, Milanče222, Milometer, Milost111, milutin134, mir juzni, Miska13, mist-mist, mitja123, Miškić, Natuzzi, neko_drugi, Nemanja.M, nenorodjo, nevjerna beba, Nik_sasa, nuki1234, Paklenica, Panter, Patent, pein, Polemarchoi, posmatrac300, Povratak1912, precan, Primus17, PrincipL, promajauglavi, pzoca, Radogost, radoznao, RajkoB, rovac, ruma, Rusmir, S2M, samocitam, sap, sedan, shota91, sickmouse, Sir Budimir, siwoti, skvara, spektorsky, spot4chulle, srbomir, Srky Boy, ss10, stalja, stibium51, Stojan Mrsavi, strelac07, Su 57, synergia, taomaster, teddy, tmanda323, tomislav33, Tribal, trpche, trutcina, Tumansky, uruk, vaci, Vaske8990, veljko82, virked, Vlad000, VNVK, Vuk koji sjedi, vuk77, vukajlo71, VX1, x011, yiyi, YugoSlav, zajcev1, Zastava, Zdenko, ZetaMan, zil10, zillbg, Zrcalo, 800077