virusi problem

1

virusi problem

offline
  • Pridružio: 30 Jul 2010
  • Poruke: 54

Nod je pronasao gomilu virusa na kompu. Da li je moguce ocistiti ih? Evo DDS logova:

DDS (Ver_10-03-17.01) - FAT32x86
Run by LELA at 12:27:33,85 on ned 22.08.2010
Internet Explorer: 6.0.2900.2180
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.384.81 [GMT 2:00]

AV: ESET NOD32 Antivirus 3.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
SVCHOST.EXE
C:\WINDOWS\System32\svchost.exe -k netsvcs
SVCHOST.EXE
SVCHOST.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\Mixer.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\FixCamera.exe
C:\WINDOWS\vsnp2uvc.exe
C:\WINDOWS\tsnp2uvc.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\McAfee Security Scan\1.0.150\SSScheduler.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\TeamViewer\Version5\TeamViewer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\LELA\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.ba/
uInternet Connection Wizard,ShellNext = iexplore
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
mRun: [C-Media Mixer] Mixer.exe /startup
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [FixCamera] c:\windows\FixCamera.exe
mRun: [snp2uvc] c:\windows\vsnp2uvc.exe
mRun: [tsnp2uvc] c:\windows\tsnp2uvc.exe
mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice
mRunOnce: [NSSInstallation] c:\windows\system32\adobe\shockwave 11\nssstub.exe /runonce /rm
mRunOnce: [Uninstall Adobe Download Manager] "c:\windows\system32\rundll32.exe" "c:\program files\nos\bin\getPlus_Helper_3004.dll",Uninstall /IE2883E8F-472F-4fb0-9522-AC9BF37916A7 /Get1noarp
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\1.0.150\SSScheduler.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\lela\applic~1\mozilla\firefox\profiles\2lwfdvwc.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.ba/
FF - component: c:\program files\real\realplayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll
FF - plugin: c:\documents and settings\lela\application data\mozilla\firefox\profiles\2lwfdvwc.default\extensions\{e2883e8f-472f-4fb0-9522-ac9bf37916a7}\plugins\np_gp.dll
FF - plugin: c:\program files\google\update\1.2.183.29\npGoogleOneClick8.dll

============= SERVICES / DRIVERS ===============

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2008-7-1 35168]
R2 ekrn;Eset Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2009-10-7 472280]
R3 NtApm;NT Apm/Legacy Interface Driver;c:\windows\system32\drivers\NtApm.sys [2009-10-14 9344]
R3 slnt;Silan SC92031 PCI Fast Ethernet Adapter;c:\windows\system32\drivers\slnt.sys [2009-12-11 18004]
S3 nosGetPlusHelper;getPlus(R) Helper 3004;c:\windows\system32\svchost.exe -k nosGetPlusHelper [2004-8-3 14336]
S4 MSWindows;Network Windows Service;"c:\windows\system32\urdvxc.exe" /service --> c:\windows\system32\urdvxc.exe [?]

=============== Created Last 30 ================

2010-08-22 09:58:27 0 d-----w- c:\program files\TeamViewer
2010-08-22 08:08:03 0 d-----w- c:\windows\system32\drivers\NSS
2010-08-22 08:08:03 0 d-----w- c:\program files\Norton Security Scan
2010-08-22 08:08:03 0 d-----w- c:\docume~1\alluse~1\applic~1\Symantec
2010-08-22 08:08:03 0 d-----w- c:\docume~1\alluse~1\applic~1\Norton
2010-08-22 08:07:59 0 d-----w- c:\program files\NortonInstaller
2010-08-22 08:07:59 0 d-----w- c:\docume~1\alluse~1\applic~1\NortonInstaller
2010-08-22 05:07:22 0 d-----w- c:\windows\system32\Adobe
2010-08-18 18:46:42 0 d-sh--w- C:\FOUND.002
2010-08-16 21:18:00 0 d-sh--w- C:\FOUND.001
2010-08-13 15:43:08 0 d-sh--w- C:\FOUND.000
2010-08-05 11:14:38 0 d-sh--w- C:\FOUND.037
2010-07-31 19:01:02 0 d-----w- C:\agw_demo
2010-07-31 16:41:12 0 d-----w- c:\docume~1\lela\applic~1\TeamViewer

==================== Find3M ====================

2010-08-21 11:33:38 1632 ----a-w- c:\windows\system32\d3d8caps.dat
2010-08-18 18:55:22 1744 ----a-w- c:\windows\system32\d3d9caps.dat

============= FINISH: 12:28:50,72 ===============

ATACH:
mycity.rs/must-login.png

offline
  • Pridružio: 02 Feb 2008
  • Poruke: 14018
  • Gde živiš: Nish

Pozdrav i dobro dosao u Ambulantu MyCity foruma.




Ispratio si samo delimicno Uputstvo za otvaranje teme sa ovog link-a:
-> http://www.mycity.rs/Ambulanta/Kako-otvoriti-temu-u-Ambulanti.html

Potrebno je da ispratis jos jedan korak (Korak #3: iz uputstva) i da postavis potrebne log-ove.




Takodje, ostavi nam SS (screenshot) NOD-ovih detekcija.
Kako napraviti SS? http://www.mycity.rs/Pitanja-i-predlozi/Pravljenje-screenshota.html



goran9888 (AMF Tim)

offline
  • Pridružio: 30 Jul 2010
  • Poruke: 54

Izvinjavam se zbog nekomplene teme.Evo i ostalih logova i screenshota od NOD-a:

mycity.rs/must-login.png

mycity.rs/must-login.png

mycity.rs/must-login.png

NOD screenshot:



mycity.rs/must-login.png

offline
  • Pridružio: 02 Feb 2008
  • Poruke: 14018
  • Gde živiš: Nish

Preuzmi The Avenger na Desktop.
Raspakuj arhivu u neki folder

Dvoklikom pokreni avenger.exe

Iskopiraj tekst koji se nalazi unutar Kod polja u (beli) prozor programa:

Drivers to delete:
MSWindows

Files to delete:
c:\windows\system32\urdvxc.exe


Klikni Execute, a zatim Yes u sledeća dva prozora koji će se otvoriti

Kompjuter će se restartovati (u određenim slučajevima: dva puta) i započeti će proces čišćenja/skeniranja

Kada proces bude završen, logfile C:\avenger.txt će se otvoriti u Notepad-u

Iskopiraj sadržaj dobijenog loga u temu na forumu.






goran9888 (AMF Tim)

offline
  • Pridružio: 30 Jul 2010
  • Poruke: 54

Napisano: 22 Avg 2010 20:04

Pojavila mi se greska kod avengera.Evo screenshota:


mycity.rs/must-login.png

Dopuna: 22 Avg 2010 20:15

Greska se pojavljuje odmah nakon prve potvrde na Yes.

offline
  • Pridružio: 02 Feb 2008
  • Poruke: 14018
  • Gde živiš: Nish

Izvinjavam se sto kasnim sa odgovorom, no nadam se da ces imati strpljenja da isteramo slucaj do kraja.







-Deaktiviraj antivirus (uputstvo: http://www.mycity.rs/Uputstva/Iskljucivanje-zastitnog-softvera.html);
-Isprati uputstvo za Avenger koje sam ti ostavio u prethodnoj poruci;
-Postavi mi u sledecoj poruci sadrzaj Avenger-ov log.







goran9888 (AMF Tim)

offline
  • Pridružio: 30 Jul 2010
  • Poruke: 54

Nije problem zbog kasnjenja i ja malo kasnim. Iskljucio sam antivirus ali mi se i dalje pojavljuje ista greska.

offline
  • Pridružio: 02 Feb 2008
  • Poruke: 14018
  • Gde živiš: Nish

Ok, precicemo na drugi alat.


Detaljno isprati sledece Uputstvo

----------------------------------------------------------------------------------

Preuzmi sUBs-ov ComboFix sa sledeće adrese na Desktop:


Bleeping Computer
Klikni desnim tasterom na link i odaberi opciju Save Target As... (Save Link As..., Save Linked Content As... ili sličnu);
Kada se otvori dijalog za izbor lokacije na kojoj treba sačuvati file, odaberi Desktop i klikni Save.




Kada preuzimanje programa bude završeno:
deaktiviraj zaštitni softver (uputstvo);
zatvori pokrenute programe;
dvoklikom pokreni program ComboFix.

U toku rada, ComboFix će:proveriti postoji li novija verzija programa:
klikni Yes ako bude ponuđeno preuzimanje iste.
prikazati DISCLAIMER OF WARRANTY ON SOFTWARE:
klikni Yes kako bi proces bio nastavljen.
ako Recovery Console nije instalirana, ponuditi instalaciju:
obavezno prihvati klikom na Yes i isprati postupak.
postaviti/dati određeni broj upita/obaveštenja:
prihvati klikom na Yes ili OK.
po potrebi, restartovati Windows (više puta);
na kraju rada, otvoriti Notepad sa izveštajem o skeniranju.


Iskopiraj izveštaj koji je ComboFix napravio u temu na forumu:
klikni desnim tasterom miša u prozor Notepad-a i izaberi Select All;
klikni desnim tasterom miša na obeleženi tekst i izaberi Copy;
klikni desnim tasterom miša u polje za pisanje poruke i izaberi Paste.


Napomena:Izveštaj će biti sačuvan pod nazivom ComboFix.txt na sistemskoj particiji (tipična lokacija: C:\ComboFix.txt);
Ukoliko nakon slanja poruke primetiš da izveštaj nije kompletan, iskoristi opciju Prikači fajl za prilaganje file-a C:\ComboFix.txt uz poruku.







goran9888 (AMF Tim)

offline
  • Pridružio: 30 Jul 2010
  • Poruke: 54

Evo konacno je i ovo gotovo.
Combo fix log izgleda ovako:

ComboFix 10-08-23.06 - LELA 24.08.2010 18:08:22.1.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.384.158 [GMT 2:00]
Running from: c:\documents and settings\LELA\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\delextra.exe
c:\windows\system\delnew.exe
c:\windows\system\nadlocop.exe
c:\windows\system\run.exe
c:\windows\system\temp2.exe
c:\windows\WPlayer.exe
D:\winlogon.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_MSWINDOWS
-------\Service_MSWindows


((((((((((((((((((((((((( Files Created from 2010-07-24 to 2010-08-24 )))))))))))))))))))))))))))))))
.

2010-08-22 11:25 . 2010-08-22 11:25 -------- d-----w- c:\program files\Common Files\PC Tools
2010-08-22 11:25 . 2010-08-22 11:25 -------- d-----w- c:\documents and settings\All Users\Application Data\TEMP
2010-08-22 10:02 . 2010-08-22 10:02 -------- d-----w- c:\program files\NOS
2010-08-22 10:02 . 2010-08-22 10:02 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-08-22 10:02 . 2010-07-26 14:01 37184 ----a-w- c:\documents and settings\LELA\Application Data\Mozilla\Firefox\Profiles\2lwfdvwc.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
2010-08-22 10:02 . 2010-07-26 14:01 32032 ----a-w- c:\documents and settings\LELA\Application Data\Mozilla\Firefox\Profiles\2lwfdvwc.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\chrome\content\getPlusPlus_Adobe_reg.exe
2010-08-22 09:58 . 2010-08-22 09:58 -------- d-----w- c:\program files\TeamViewer
2010-08-22 08:08 . 2010-08-22 08:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec
2010-08-22 08:08 . 2010-08-22 08:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton
2010-08-22 08:07 . 2010-08-22 08:08 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller
2010-08-22 05:07 . 2010-08-22 05:07 -------- d-----w- c:\windows\system32\Adobe
2010-08-21 18:22 . 2010-08-22 09:59 2788816 ----a-w- c:\documents and settings\LELA\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe
2010-08-21 11:19 . 2010-08-21 11:19 45056 ----a-r- c:\documents and settings\LELA\Application Data\Microsoft\Installer\{0A28C610-EE06-4A33-BB56-A2155B524916}\ARPPRODUCTICON.exe
2010-08-18 18:46 . 2010-08-18 18:46 -------- d-----w- C:\FOUND.002
2010-08-16 21:18 . 2010-08-16 21:18 -------- d-----w- C:\FOUND.001
2010-08-14 17:24 . 2007-10-23 07:27 110592 ----a-w- c:\documents and settings\LELA\Application Data\U3\temp\cleanup.exe
2010-08-14 17:11 . 2008-05-02 08:41 3493888 ---ha-w- c:\documents and settings\LELA\Application Data\U3\temp\Launchpad Removal.exe
2010-08-14 17:11 . 2010-08-14 17:11 -------- d-----w- c:\documents and settings\LELA\Application Data\U3
2010-08-13 15:43 . 2010-08-13 15:43 -------- d-----w- C:\FOUND.000
2010-08-05 11:14 . 2010-08-05 11:14 -------- d-----w- C:\FOUND.037
2010-07-31 19:01 . 2010-07-31 19:01 -------- d-----w- C:\agw_demo
2010-07-31 16:41 . 2010-07-31 16:41 -------- d-----w- c:\documents and settings\LELA\Application Data\TeamViewer

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-24 15:05 . 2010-02-22 18:34 1744 ----a-w- c:\windows\system32\d3d9caps.dat
2010-08-21 11:33 . 2009-11-07 16:18 1632 ----a-w- c:\windows\system32\d3d8caps.dat
2010-07-21 17:29 . 2010-07-21 17:29 -------- d-----w- c:\program files\ESET
2010-07-21 17:29 . 2010-07-21 17:29 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET
2010-07-01 09:47 . 2010-03-22 16:38 439816 ----a-w- c:\documents and settings\LELA\Application Data\Real\Update\setup3.10\setup.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-04-06 26102056]
"RegistryMechanic"="c:\program files\Registry Mechanic\RegMech.exe" [2010-04-08 3233752]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"C-Media Mixer"="Mixer.exe" [2002-07-12 1581056]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-12-28 198160]
"FixCamera"="c:\windows\FixCamera.exe" [2008-08-21 188928]
"snp2uvc"="c:\windows\vsnp2uvc.exe" [2008-08-01 675840]
"tsnp2uvc"="c:\windows\tsnp2uvc.exe" [2009-06-01 320512]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-10-07 1461080]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Hotkey]
2004-04-03 16:38 36864 ----a-w- c:\program files\Hotkey\Hotkey.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 08:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
2004-12-20 18:41 33792 ----a-w- c:\program files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ose"=3 (0x3)
"MSWindows"=2 (0x2)
"gupdate1ca87e9c760bf40"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Google\\Chrome\\Application\\chrome.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\TeamViewer\\Version5\\TeamViewer.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [1.7.2008 9:04 35168]
R2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [7.10.2009 9:16 472280]
R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\Common Files\PC Tools\sMonitor\StartManSvc.exe [22.8.2010 13:25 632792]
R2 TeamViewer5;TeamViewer 5;c:\program files\TeamViewer\Version5\TeamViewer_Service.exe [6.7.2010 17:03 173352]
R3 NtApm;NT Apm/Legacy Interface Driver;c:\windows\system32\drivers\NtApm.sys [14.10.2009 20:52 9344]
R3 slnt;Silan SC92031 PCI Fast Ethernet Adapter;c:\windows\system32\drivers\slnt.sys [11.12.2009 11:59 18004]
S3 nosGetPlusHelper;getPlus(R) Helper 3004;c:\windows\System32\svchost.exe -k nosGetPlusHelper [3.8.2004 22:56 14336]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper
.
Contents of the 'Scheduled Tasks' folder

2010-08-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-28 17:15]

2010-08-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-28 17:15]

2010-08-23 c:\windows\Tasks\RMSchedule_219.job
- c:\program files\Registry Mechanic\Launcher.exe [2010-08-22 07:14]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.ba/
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\LELA\Application Data\Mozilla\Firefox\Profiles\2lwfdvwc.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.ba/
FF - component: c:\program files\Real\RealPlayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll
FF - plugin: c:\documents and settings\LELA\Application Data\Mozilla\Firefox\Profiles\2lwfdvwc.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-MsnMsgr - c:\program files\MSN Messenger\MsnMsgr.Exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, gmer.net
Rootkit scan 2010-08-24 18:18
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3268-)
c:\program files\TeamViewer\Version5\tv.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\TeamViewer\Version5\TeamViewer.exe
c:\windows\system32\wscntfy.exe
c:\windows\Mixer.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Completion time: 2010-08-24 18:24:23 - machine was rebooted
ComboFix-quarantined-files.txt 2010-08-24 16:24

Pre-Run: 4.092.051.456 bytes free
Post-Run: 4.357.898.240 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 32761B943570DC0301A1380CD8531C9E

offline
  • Pridružio: 02 Feb 2008
  • Poruke: 14018
  • Gde živiš: Nish

Napomena:
Nismo jos zavrsili. Obavesticu te kada je slucaj gotov;
Isprati detaljno sledece Uputstvo.


-------------------------------------------------------------------------------



Otvoriti Notepad i iskopirati sledeci tekst:

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"MSWindows"=-


Snimiti na Desktop fajl iz Notepada kao "CFScript"




Prevuci snimljeni skript/tekst na ComboFix ikonicu kao na slici.
Postaviti u sledecoj poruci log koji bude bio napravljen na kraju ciscenja/skeniranja.

Ko je trenutno na forumu
 

Ukupno su 1003 korisnika na forumu :: 54 registrovanih, 6 sakrivenih i 943 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: _Sale, A.R.Chafee.Jr., aleksmajstor, alkatraz080, aramis s, ArmyBoss, babaroga, Bane san, Cranium, Ctrl x, dane007, darcaud, DARKMEN22, djordje92sm, dozorni, Dukelander, ekser222, Filip Marinković, Georgius, goxin, havoc995, Insan, kaisarevic1, Kibice, Kiki2004, krlebgd77, Leonardo, LUDI, mane123, mačković, MB120mm, Mercury, Mihajlo, milos.cbr, mrvica78, nenad81, repac, RJ, Roman, S-lash, sakota79, Simon simonović, Sirius, SlaKoj, Snorks, Srki94, stegonosa, Toni, Vl veliki, Vlada1389, voja64, zexoni, Zi0mek, zuxbg