MyCity » Ambulanta -> Arhiva Ambulante » Mozda ima jos necega

Mozda ima jos necega

Napisano na dan: 18.12.2007

Mozda ima jos necega
Sledeća strana Pagination

Idi na vrh

Poslao: 18 Dec 2007 12:14
Idi na vrh
offline
  • Pridružio: 13 Jul 2007
  • Poruke: 363

Bio sam zarazen nekim trojancima, ne znam tacno kako se zovu, i bukvalno nisam mogao da pokrenem ni jedan program, nisam mogao da odem na internet i cak nisam mogao da iskljucim ili restartujem racunar (u task baru pokrene samo windowblinds a antivirus ne). Kada god sam hteo da pokrenem program izlazilo je upozorenje "(taj i taj program) is not valid Win32 application".
Otisao sam u safe mode i skenirao avastom koji je nasao trojance i obrisao ali opet nista nije radilo kada normalno pokrenem racunar. Potom sam u safe modu uradio oporavak sistema. Tada je radilo sve normalno, avastom sam opet skenirao i nasao je trojance koje sam stavio u karantin (mozda su isti kao iz predhodnog scana). 3xWin32:Delf-GVX i Win32:Trojan-gen{UPX}. E sad je problem u tome sto ja mislim da ima jos tu necega jer svaki put kada hocu da iskljucim racunar on pokazuje "End program-No Title".
Evp loga:

Logfile of HijackThis v1.99.1
Scan saved at 12:10:44, on 18.12.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\program files\a-squared free\a2service.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\taskswitch.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\PROGRA~1\TIADSL~1\bin\win2k\tidslmon.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\MagicRotation\MagicPvt.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\PowerMenu\PowerMenu.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Nemanja\Desktop\Nova fascikla\tr3.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [Link mogu videti samo ulogovani korisnici]
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: (no name) - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - (no file)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [TIxDSL] C:\PROGRA~1\TIADSL~1\bin\win2k\tidslmon.exe
O4 - HKLM\..\Run: [CorelDRAW Graphics Suite 11b] C:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe /title="CorelDRAW Graphics Suite 12" /date=122407 serial=..... lang=EN
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [MagicRotation] C:\Program Files\MagicRotation\MagicPvt.exe
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: PowerMenu.lnk = C:\Program Files\PowerMenu\PowerMenu.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: Append to existing PDF - [Link mogu videti samo ulogovani korisnici]\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - [Link mogu videti samo ulogovani korisnici]\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - [Link mogu videti samo ulogovani korisnici]\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - [Link mogu videti samo ulogovani korisnici]\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - [Link mogu videti samo ulogovani korisnici]\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - [Link mogu videti samo ulogovani korisnici]\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - [Link mogu videti samo ulogovani korisnici]\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - [Link mogu videti samo ulogovani korisnici]\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - [Link mogu videti samo ulogovani korisnici]\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - [Link mogu videti samo ulogovani korisnici]
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - [Link mogu videti samo ulogovani korisnici]
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - [Link mogu videti samo ulogovani korisnici]
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - [Link mogu videti samo ulogovani korisnici]
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - [Link mogu videti samo ulogovani korisnici]
O17 - HKLM\System\CCS\Services\Tcpip\..\{31163409-ADF7-46FC-A2F3-8A7BA4FDCCEC}: NameServer = 77.105.0.19 77.105.0.18
O17 - HKLM\System\CS1\Services\Tcpip\..\{31163409-ADF7-46FC-A2F3-8A7BA4FDCCEC}: NameServer = 77.105.0.19 77.105.0.18
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll,wbsys.dll C:\WINDOWS\system32\guard32.dll
O20 - Winlogon Notify: WBSrv - C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbsrv.dll
O20 - Winlogon Notify: WgaLogon - WgaLogon.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - c:\program files\a-squared free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing)



Poslao: 18 Dec 2007 23:08
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Pozdrav...



Skini ComboFix sa jedne od sledecih adresa:
[Link mogu videti samo ulogovani korisnici]
[Link mogu videti samo ulogovani korisnici]

Startuj ga i ne diraj prozor programa dok skenira.
Sledi uputstva na ekranu. Kada zavrsi pojavice se log koji ces nam ovde iskopirati.



Poslao: 19 Dec 2007 00:53
Idi na vrh
offline
  • Pridružio: 13 Jul 2007
  • Poruke: 363

Pozdrav i tebi.
Evo ComboFix loga:

ComboFix 07-12-19.2 - Nemanja 2007-12-18 23:29:05.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1251.381.1033.18.544 [GMT 1:00]
Running from: C:\Documents and Settings\Nemanja\Desktop\ComboFix(2).exe
* Created a new restore point
.
The following files were disabled during the run:
C:\WINDOWS\system32\guard32.dll


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\2.exe
C:\WINDOWS\search_res.txt
C:\WINDOWS\system32\drivers\sfsync02.sys

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_SFSYNC02
-------\sfsync02


((((((((((((((((((((((((( Files Created from 2007-11-19 to 2007-12-19 )))))))))))))))))))))))))))))))
.

2007-12-17 18:25 . 2007-12-04 19:38 129,784 --------- C:\WINDOWS\system32\pxafs.dll
2007-12-17 18:25 . 2007-12-04 19:38 9,464 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-12-17 18:25 . 2007-12-04 19:38 9,336 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-12-17 00:01 . 2007-12-17 00:01 268 --ah----- C:\sqmdata17.sqm
2007-12-17 00:01 . 2007-12-17 00:01 244 --ah----- C:\sqmnoopt17.sqm
2007-12-14 23:22 . 2007-12-14 23:24 <DIR> d-------- C:\Program Files\AoA Audio Extractor
2007-12-14 21:59 . 2007-12-14 21:59 <DIR> d-------- C:\Games
2007-12-14 19:18 . 2007-12-14 19:18 139,008 --a------ C:\WINDOWS\system32\guard32.dll.vir
2007-12-14 19:18 . 2007-12-14 19:18 79,096 --a------ C:\WINDOWS\system32\drivers\cmdGuard.sys
2007-12-14 19:18 . 2007-12-14 19:18 23,672 --a------ C:\WINDOWS\system32\drivers\cmdhlp.sys
2007-12-14 18:46 . 2007-12-04 15:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-14 18:46 . 2007-12-04 15:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-14 18:46 . 2007-12-04 15:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-14 18:45 . 2007-12-04 14:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe
2007-12-14 18:45 . 2004-01-09 11:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2007-12-14 18:45 . 2007-12-04 13:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2007-12-14 18:45 . 2007-12-04 15:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-14 18:45 . 2007-12-04 15:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-11 23:34 . 2007-12-11 23:34 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll
2007-12-11 23:34 . 2007-12-11 23:34 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll
2007-12-11 22:09 . 2007-12-11 22:09 <DIR> d-------- C:\Program Files\COMODO
2007-12-11 22:09 . 2007-12-11 22:09 <DIR> d-------- C:\Documents and Settings\Nemanja\Application Data\Comodo
2007-12-11 22:09 . 2007-12-14 19:27 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\comodo
2007-12-09 11:12 . 2007-12-09 11:12 360,576 --a------ C:\WINDOWS\system32\drivers\TCPIP.SYS.ORIGINAL
2007-12-09 11:07 . 2007-12-09 11:07 <DIR> d-------- C:\WINDOWS\vbSkinner
2007-12-09 11:00 . 2007-12-09 13:06 <DIR> d-------- C:\Program Files\PFConfig
2007-12-04 23:45 . 2007-12-04 23:45 203,776 --a------ C:\WINDOWS\system32\clrviddc.dll
2007-12-04 19:38 . 2007-12-04 19:38 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2007-12-04 19:38 . 2007-12-04 19:38 524,288 --a------ C:\WINDOWS\system32\DivXsm.exe
2007-12-04 19:38 . 2007-12-04 19:38 4,816 --a------ C:\WINDOWS\system32\divxsm.tlb
2007-12-04 19:35 . 2007-12-04 19:35 156,992 --a------ C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-12-04 19:35 . 2007-12-04 19:35 12,288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll
2007-12-04 15:20 . 2007-12-04 15:20 <DIR> d-------- C:\tmp99
2007-12-04 13:48 . 2007-12-04 13:48 <DIR> d-------- C:\Program Files\Common Files\xing shared
2007-12-04 13:36 . 2007-12-04 13:36 <DIR> d-------- C:\Documents and Settings\Nemanja\Application Data\JLC's Software
2007-12-04 13:25 . 2007-12-04 21:39 <DIR> d-------- C:\Program Files\Webteh
2007-12-04 13:25 . 2007-12-04 13:25 <DIR> d-------- C:\Documents and Settings\Nemanja\Application Data\BSplayer Pro
2007-12-04 13:25 . 2007-12-04 22:09 <DIR> d-------- C:\Documents and Settings\Nemanja\Application Data\BSplayer
2007-12-02 15:44 . 2007-12-02 15:44 268 --ah----- C:\sqmdata16.sqm
2007-12-02 15:44 . 2007-12-02 15:44 244 --ah----- C:\sqmnoopt16.sqm
2007-12-02 11:45 . 2007-12-02 11:45 268 --ah----- C:\sqmdata15.sqm
2007-12-02 11:45 . 2007-12-02 11:45 244 --ah----- C:\sqmnoopt15.sqm
2007-11-30 23:51 . 2007-11-30 23:51 <DIR> d-------- C:\Program Files\MSECache
2007-11-28 00:03 . 2007-12-03 13:46 <DIR> d-------- C:\Program Files\Common Files\Nero
2007-11-26 00:08 . 2007-11-26 21:24 <DIR> d-------- C:\Program Files\KeyOPS
2007-11-24 18:33 . 2007-11-24 18:36 <DIR> d-------- C:\Program Files\BitLord
2007-11-21 19:37 . 2007-11-21 19:37 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
2007-11-21 19:37 . 2007-11-21 19:37 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\FLEXnet
2007-11-21 12:20 . 2007-11-21 12:20 <DIR> d-------- C:\Program Files\Stardock
2007-11-19 17:54 . 2007-11-19 17:54 <DIR> d--h----- C:\WINDOWS\PIF
2007-11-19 17:26 . 2007-11-19 17:53 <DIR> d-------- C:\Program Files\BMW M3 Challenge

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-18 10:23 --------- d-----w C:\Program Files\Mozilla Thunderbird
2007-12-17 20:55 --------- d-----w C:\Documents and Settings\Nemanja\Application Data\BearShare
2007-12-17 17:35 --------- d-----w C:\Program Files\DivX
2007-12-14 22:22 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2007-12-14 18:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-12-14 12:00 --------- d-----w C:\Documents and Settings\Nemanja\Application Data\uTorrent
2007-12-11 22:34 43,528 ------w C:\WINDOWS\system32\drivers\pxhelp20.sys
2007-12-10 22:39 --------- d-----w C:\Documents and Settings\Nemanja\Application Data\LimeWire
2007-12-09 17:36 360,576 ----a-w C:\WINDOWS\system32\drivers\TCPIP.SYS
2007-12-06 12:41 --------- d-----w C:\Program Files\Defcon
2007-12-04 13:38 --------- d-----w C:\Program Files\MSN Messenger
2007-12-04 12:48 --------- d-----w C:\Program Files\Common Files\Real
2007-12-03 12:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
2007-12-02 11:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\DVD Shrink
2007-11-29 17:22 --------- d-----w C:\Program Files\Common Files\Adobe
2007-11-22 21:59 --------- d-----w C:\Program Files\TuneUp Utilities 2007
2007-11-19 20:57 --------- d-----w C:\Program Files\Starcraft
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-13 09:59 --------- d-----w C:\Program Files\a-squared Free
2007-11-12 21:03 --------- d-----w C:\Program Files\Google
2007-11-10 19:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2007-11-10 19:10 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-11-09 12:14 --------- d-----w C:\Documents and Settings\Nemanja\Application Data\Apple Computer
2007-11-09 11:35 --------- d-----w C:\Documents and Settings\Nemanja\Application Data\Teleca
2007-11-09 11:16 --------- d-----w C:\Program Files\Sony
2007-11-09 11:03 --------- d-----w C:\Program Files\QuickTime
2007-11-09 11:01 --------- d-----w C:\Program Files\Apple Software Update
2007-11-09 11:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-11-09 10:53 --------- d-----w C:\Program Files\Common Files\Teleca Shared
2007-11-09 10:52 --------- d-----w C:\Program Files\Common Files\Sony Ericsson Shared
2007-11-09 10:52 --------- d-----w C:\Documents and Settings\Nemanja\Application Data\Sony Ericsson
2007-11-09 10:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\Teleca
2007-11-09 10:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sony Ericsson
2007-11-09 10:51 --------- d-----w C:\Program Files\Sony Ericsson
2007-11-08 12:45 --------- d-----w C:\Documents and Settings\Nemanja\Application Data\Talkback
2007-11-08 12:44 --------- d-----w C:\Documents and Settings\Nemanja\Application Data\Thunderbird
2007-11-07 13:01 --------- d-----w C:\Documents and Settings\Nemanja\Application Data\ESET
2007-11-07 12:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\ESET
2007-11-06 14:05 --------- d-----w C:\Program Files\Image-Line
2007-11-06 12:50 --------- d-----w C:\Program Files\VstPlugins
2007-11-06 09:49 --------- d-----w C:\Program Files\PROS
2007-11-05 14:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-04 12:22 --------- d-----w C:\Program Files\Tall Emu
2007-11-01 14:16 --------- d-----w C:\Program Files\EA GAMES
2007-11-01 12:50 --------- d-----w C:\Program Files\BearShare Applications
2007-10-31 10:25 --------- d-----w C:\Program Files\Pocket Tanks Deluxe
2007-10-31 07:13 --------- d-----w C:\Program Files\YouTube Downloader
2007-10-27 18:23 --------- d-----w C:\Documents and Settings\User1\Application Data\Microsoft Games
2007-10-27 18:23 --------- d-----w C:\Documents and Settings\Nemanja\Application Data\Microsoft Games
2007-10-26 17:42 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Nero
2007-10-26 10:59 --------- d-----w C:\Program Files\Quick Screen Capture
2007-10-23 13:53 --------- d-----w C:\Program Files\Alwil Software
2007-10-23 13:20 972,072 ----a-w C:\WINDOWS\UNNeroMediaHome.exe
2007-10-23 13:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft(2)
2007-10-23 13:02 --------- d-----w C:\Documents and Settings\Nemanja\Application Data\BearShare(2)
2007-10-22 07:51 972,072 ----a-w C:\WINDOWS\UNRecode.exe
2007-10-21 19:35 --------- d-----w C:\Documents and Settings\Jelena\Application Data\AVG7
2007-10-20 11:01 --------- d-----w C:\Program Files\LimeWire
2007-01-19 15:43 56 --sh--r C:\WINDOWS\system32\7A4EB6551E.sys
2007-07-25 15:15 4,184 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 11:54]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CoolSwitch"="C:\WINDOWS\system32\taskswitch.exe" [2002-03-19 17:30]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-08-25 10:11]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2006-08-25 10:11]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 23:47]
"TIxDSL"="C:\PROGRA~1\TIADSL~1\bin\win2k\tidslmon.exe" [2002-08-27 11:37]
"CorelDRAW Graphics Suite 11b"="C:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe" [2003-11-25 12:39]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 03:00]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-09-20 08:51]
"MagicRotation"="C:\Program Files\MagicRotation\MagicPvt.exe" [2005-09-12 14:20]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-05-28 10:14]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54]
"Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2007-05-10 22:46]
"NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 14:57]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-12-04 13:47]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00]
"COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [2007-12-14 19:18]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:56]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
PowerMenu.lnk - C:\Program Files\PowerMenu\PowerMenu.exe [2007-01-08 12:11:08]
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2007-06-06 10:10:02]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="C:\\WINDOWS\\system32\\logonui.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbsrv.dll 2007-11-21 12:22 229376 C:\Program Files\Stardock\Object Desktop\WindowBlinds\WbSrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll,wbsys.dll C:\WINDOWS\system32\guard32.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"TuneUp MemOptimizer"="C:\Program Files\TuneUp Utilities 2007\MemOptimizer.exe" autostart
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

R1 cdawdm;CDAWDM;C:\WINDOWS\system32\DRIVERS\CDAWDM.sys [2002-01-24 14:25]
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\WINDOWS\system32\DRIVERS\cmdguard.sys [2007-12-14 19:18]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\WINDOWS\system32\DRIVERS\cmdhlp.sys [2007-12-14 19:18]
R1 magicpvt;magicpvt;C:\WINDOWS\system32\drivers\magicpvt.sys [2005-06-10 09:42]
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3;C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe [2007-09-20 08:51]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe -k netsvcs []
R3 TIAU5CO;Actiontec Home DSL Modem(WAN) Service;C:\WINDOWS\system32\DRIVERS\TIAU5CO.sys [2002-04-02 12:06]
S3 akshasp;Aladdin HASP Key;C:\WINDOWS\system32\DRIVERS\akshasp.sys [2005-07-20 18:08]
S3 AtmElan;ATM Emulated LAN;C:\WINDOWS\system32\DRIVERS\atmlane.sys [2004-08-03 22:58]
S3 AtmLane;ATM LAN Emulation;C:\WINDOWS\system32\DRIVERS\atmlane.sys [2004-08-03 22:58]
S3 pohci13F;pohci13F;C:\DOCUME~1\Nemanja\LOCALS~1\Temp\pohci13F.sys []
S3 s716bus;Sony Ericsson Device 716 driver (WDM);C:\WINDOWS\system32\DRIVERS\s716bus.sys [2007-04-04 12:43]
S3 s716mdfl;Sony Ericsson Device 716 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\s716mdfl.sys [2007-04-04 12:43]
S3 s716mdm;Sony Ericsson Device 716 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\s716mdm.sys [2007-04-04 12:43]
S3 s716mgmt;Sony Ericsson Device 716 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\s716mgmt.sys [2007-04-04 12:43]
S3 s716nd5;Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (NDIS);C:\WINDOWS\system32\DRIVERS\s716nd5.sys [2007-04-04 12:43]
S3 s716obex;Sony Ericsson Device 716 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\s716obex.sys [2007-04-04 12:43]
S3 s716unic;Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (WDM);C:\WINDOWS\system32\DRIVERS\s716unic.sys [2007-04-04 12:43]
S3 SmartCd;SmartCd;C:\WINDOWS\system32\Drivers\SmartCd.sys [2002-01-19 17:00]
S3 TIAu5Bt;Actiontec Home DSL Modem Boot Device Service;C:\WINDOWS\system32\Drivers\tiau5bt.sys [2002-04-02 12:05]
S3 usnjsvc;Messenger Sharing Folders USN Journal Reader service;"C:\Program Files\MSN Messenger\usnsvc.exe" [2007-01-19 11:54]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f4eeb5e3-2163-11dc-8e47-000795db2512}]
\Shell\Auto\command - Cn911.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Cn911.exe

.
Contents of the 'Scheduled Tasks' folder
"2007-12-07 16:21:59 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
"2007-11-09 11:01:50 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2007-12-20 00:38:47
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.3156]
-> C:\WINDOWS\system32\guard32.dll
.
Completion time: 2007-12-20 0:45:54 - machine was rebooted
.
2007-12-16 19:23:33 --- E O F ---

Poslao: 19 Dec 2007 11:26
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Otvoriti Notepad i iskopirati sledeci tekst:

Driver::
pohci13F

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f4eeb5e3-2163-11dc-8e47-000795db2512}]


Snimiti na Desktop fajl iz Notepada kao "CFScript"




Prevuci snimljeni skript/tekst na ComboFix ikonicu kao na slici.
Postaviti u sledecoj poruci log koji bude bio napravljen na kraju ciscenja/skeniranja.

Poslao: 19 Dec 2007 12:56
Idi na vrh
offline
  • Pridružio: 13 Jul 2007
  • Poruke: 363

Evo uradio sam kako si mi rekao:

ComboFix 07-12-19.2 - Nemanja 2007-12-20 12:21:40.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1251.381.1033.18.549 [GMT 1:00]
Running from: C:\Documents and Settings\Nemanja\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Nemanja\Desktop\CFScript.txt
* Created a new restore point
.
The following files were disabled during the run:
C:\WINDOWS\system32\guard32.dll


((((((((((((((((((((((((( Files Created from 2007-11-20 to 2007-12-20 )))))))))))))))))))))))))))))))
.

2007-12-17 18:25 . 2007-12-04 19:38 129,784 --------- C:\WINDOWS\system32\pxafs.dll
2007-12-17 18:25 . 2007-12-04 19:38 9,464 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-12-17 18:25 . 2007-12-04 19:38 9,336 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-12-17 00:01 . 2007-12-17 00:01 268 --ah----- C:\sqmdata17.sqm
2007-12-17 00:01 . 2007-12-17 00:01 244 --ah----- C:\sqmnoopt17.sqm
2007-12-14 23:22 . 2007-12-14 23:24 <DIR> d-------- C:\Program Files\AoA Audio Extractor
2007-12-14 21:59 . 2007-12-14 21:59 <DIR> d-------- C:\Games
2007-12-14 19:18 . 2007-12-14 19:18 139,008 --a------ C:\WINDOWS\system32\guard32.dll.vir
2007-12-14 19:18 . 2007-12-14 19:18 79,096 --a------ C:\WINDOWS\system32\drivers\cmdGuard.sys
2007-12-14 19:18 . 2007-12-14 19:18 23,672 --a------ C:\WINDOWS\system32\drivers\cmdhlp.sys
2007-12-14 18:46 . 2007-12-04 15:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-14 18:46 . 2007-12-04 15:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-14 18:46 . 2007-12-04 15:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-14 18:45 . 2007-12-04 14:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe
2007-12-14 18:45 . 2004-01-09 11:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2007-12-14 18:45 . 2007-12-04 13:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2007-12-14 18:45 . 2007-12-04 15:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-14 18:45 . 2007-12-04 15:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-11 23:34 . 2007-12-11 23:34 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll
2007-12-11 23:34 . 2007-12-11 23:34 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll
2007-12-11 22:09 . 2007-12-11 22:09 <DIR> d-------- C:\Program Files\COMODO
2007-12-11 22:09 . 2007-12-11 22:09 <DIR> d-------- C:\Documents and Settings\Nemanja\Application Data\Comodo
2007-12-11 22:09 . 2007-12-14 19:27 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\comodo
2007-12-09 11:12 . 2007-12-09 11:12 360,576 --a------ C:\WINDOWS\system32\drivers\TCPIP.SYS.ORIGINAL
2007-12-09 11:07 . 2007-12-09 11:07 <DIR> d-------- C:\WINDOWS\vbSkinner
2007-12-09 11:00 . 2007-12-09 13:06 <DIR> d-------- C:\Program Files\PFConfig
2007-12-04 23:45 . 2007-12-04 23:45 203,776 --a------ C:\WINDOWS\system32\clrviddc.dll
2007-12-04 19:38 . 2007-12-04 19:38 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2007-12-04 19:38 . 2007-12-04 19:38 524,288 --a------ C:\WINDOWS\system32\DivXsm.exe
2007-12-04 19:38 . 2007-12-04 19:38 4,816 --a------ C:\WINDOWS\system32\divxsm.tlb
2007-12-04 19:35 . 2007-12-04 19:35 156,992 --a------ C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-12-04 19:35 . 2007-12-04 19:35 12,288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll
2007-12-04 15:20 . 2007-12-04 15:20 <DIR> d-------- C:\tmp99
2007-12-04 13:48 . 2007-12-04 13:48 <DIR> d-------- C:\Program Files\Common Files\xing shared
2007-12-04 13:36 . 2007-12-04 13:36 <DIR> d-------- C:\Documents and Settings\Nemanja\Application Data\JLC's Software
2007-12-04 13:25 . 2007-12-04 21:39 <DIR> d-------- C:\Program Files\Webteh
2007-12-04 13:25 . 2007-12-04 13:25 <DIR> d-------- C:\Documents and Settings\Nemanja\Application Data\BSplayer Pro
2007-12-04 13:25 . 2007-12-04 22:09 <DIR> d-------- C:\Documents and Settings\Nemanja\Application Data\BSplayer
2007-12-02 15:44 . 2007-12-02 15:44 268 --ah----- C:\sqmdata16.sqm
2007-12-02 15:44 . 2007-12-02 15:44 244 --ah----- C:\sqmnoopt16.sqm
2007-12-02 11:45 . 2007-12-02 11:45 268 --ah----- C:\sqmdata15.sqm
2007-12-02 11:45 . 2007-12-02 11:45 244 --ah----- C:\sqmnoopt15.sqm
2007-11-30 23:51 . 2007-11-30 23:51 <DIR> d-------- C:\Program Files\MSECache
2007-11-28 00:03 . 2007-12-03 13:46 <DIR> d-------- C:\Program Files\Common Files\Nero
2007-11-26 00:08 . 2007-11-26 21:24 <DIR> d-------- C:\Program Files\KeyOPS
2007-11-24 18:33 . 2007-11-24 18:36 <DIR> d-------- C:\Program Files\BitLord
2007-11-21 19:37 . 2007-11-21 19:37 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
2007-11-21 19:37 . 2007-11-21 19:37 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\FLEXnet
2007-11-21 12:20 . 2007-11-21 12:20 <DIR> d-------- C:\Program Files\Stardock

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-18 10:23 --------- d-----w C:\Program Files\Mozilla Thunderbird
2007-12-17 20:55 --------- d-----w C:\Documents and Settings\Nemanja\Application Data\BearShare
2007-12-17 17:35 --------- d-----w C:\Program Files\DivX
2007-12-14 22:22 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2007-12-14 18:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-12-14 12:00 --------- d-----w C:\Documents and Settings\Nemanja\Application Data\uTorrent
2007-12-11 22:34 43,528 ------w C:\WINDOWS\system32\drivers\pxhelp20.sys
2007-12-10 22:39 --------- d-----w C:\Documents and Settings\Nemanja\Application Data\LimeWire
2007-12-09 17:36 360,576 ----a-w C:\WINDOWS\system32\drivers\TCPIP.SYS
2007-12-06 12:41 --------- d-----w C:\Program Files\Defcon
2007-12-04 13:38 --------- d-----w C:\Program Files\MSN Messenger
2007-12-04 12:48 --------- d-----w C:\Program Files\Common Files\Real
2007-12-03 12:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
2007-12-02 11:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\DVD Shrink
2007-11-29 17:22 --------- d-----w C:\Program Files\Common Files\Adobe
2007-11-22 21:59 --------- d-----w C:\Program Files\TuneUp Utilities 2007
2007-11-19 20:57 --------- d-----w C:\Program Files\Starcraft
2007-11-19 16:53 --------- d-----w C:\Program Files\BMW M3 Challenge
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-13 09:59 --------- d-----w C:\Program Files\a-squared Free
2007-11-12 21:03 --------- d-----w C:\Program Files\Google
2007-11-10 19:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2007-11-10 19:10 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-11-09 12:14 --------- d-----w C:\Documents and Settings\Nemanja\Application Data\Apple Computer
2007-11-09 11:35 --------- d-----w C:\Documents and Settings\Nemanja\Application Data\Teleca
2007-11-09 11:16 --------- d-----w C:\Program Files\Sony
2007-11-09 11:03 --------- d-----w C:\Program Files\QuickTime
2007-11-09 11:01 --------- d-----w C:\Program Files\Apple Software Update
2007-11-09 11:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-11-09 10:53 --------- d-----w C:\Program Files\Common Files\Teleca Shared
2007-11-09 10:52 --------- d-----w C:\Program Files\Common Files\Sony Ericsson Shared
2007-11-09 10:52 --------- d-----w C:\Documents and Settings\Nemanja\Application Data\Sony Ericsson
2007-11-09 10:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\Teleca
2007-11-09 10:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sony Ericsson
2007-11-09 10:51 --------- d-----w C:\Program Files\Sony Ericsson
2007-11-08 12:45 --------- d-----w C:\Documents and Settings\Nemanja\Application Data\Talkback
2007-11-08 12:44 --------- d-----w C:\Documents and Settings\Nemanja\Application Data\Thunderbird
2007-11-07 13:01 --------- d-----w C:\Documents and Settings\Nemanja\Application Data\ESET
2007-11-07 12:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\ESET
2007-11-06 14:05 --------- d-----w C:\Program Files\Image-Line
2007-11-06 12:50 --------- d-----w C:\Program Files\VstPlugins
2007-11-06 09:49 --------- d-----w C:\Program Files\PROS
2007-11-05 14:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-04 12:22 --------- d-----w C:\Program Files\Tall Emu
2007-11-01 14:16 --------- d-----w C:\Program Files\EA GAMES
2007-11-01 12:50 --------- d-----w C:\Program Files\BearShare Applications
2007-10-31 10:25 --------- d-----w C:\Program Files\Pocket Tanks Deluxe
2007-10-31 07:13 --------- d-----w C:\Program Files\YouTube Downloader
2007-10-27 18:23 --------- d-----w C:\Documents and Settings\User1\Application Data\Microsoft Games
2007-10-27 18:23 --------- d-----w C:\Documents and Settings\Nemanja\Application Data\Microsoft Games
2007-10-26 17:42 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Nero
2007-10-26 10:59 --------- d-----w C:\Program Files\Quick Screen Capture
2007-10-23 13:53 --------- d-----w C:\Program Files\Alwil Software
2007-10-23 13:20 972,072 ----a-w C:\WINDOWS\UNNeroMediaHome.exe
2007-10-23 13:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft(2)
2007-10-23 13:02 --------- d-----w C:\Documents and Settings\Nemanja\Application Data\BearShare(2)
2007-10-22 07:51 972,072 ----a-w C:\WINDOWS\UNRecode.exe
2007-10-21 19:35 --------- d-----w C:\Documents and Settings\Jelena\Application Data\AVG7
2007-10-20 11:01 --------- d-----w C:\Program Files\LimeWire
2007-01-19 15:43 56 --sh--r C:\WINDOWS\system32\7A4EB6551E.sys
2007-07-25 15:15 4,184 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( snapshot@2007-12-20_ 0.42.40.68 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-12-19 23:41:54 72,386 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2007-12-20 11:47:22 72,386 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2007-12-19 23:41:54 442,760 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2007-12-20 11:47:22 442,760 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2007-12-20 11:42:28 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_56c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 11:54]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CoolSwitch"="C:\WINDOWS\system32\taskswitch.exe" [2002-03-19 17:30]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-08-25 10:11]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2006-08-25 10:11]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 23:47]
"TIxDSL"="C:\PROGRA~1\TIADSL~1\bin\win2k\tidslmon.exe" [2002-08-27 11:37]
"CorelDRAW Graphics Suite 11b"="C:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe" [2003-11-25 12:39]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 03:00]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-09-20 08:51]
"MagicRotation"="C:\Program Files\MagicRotation\MagicPvt.exe" [2005-09-12 14:20]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-05-28 10:14]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54]
"Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2007-05-10 22:46]
"NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 14:57]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-12-04 13:47]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00]
"COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [2007-12-14 19:18]
"combofix"="C:\WINDOWS\system32\cmd.exe" [2004-08-04 00:56]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:56]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
PowerMenu.lnk - C:\Program Files\PowerMenu\PowerMenu.exe [2007-01-08 12:11:08]
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2007-06-06 10:10:02]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="C:\\WINDOWS\\system32\\logonui.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbsrv.dll 2007-11-21 12:22 229376 C:\Program Files\Stardock\Object Desktop\WindowBlinds\WbSrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll,wbsys.dll C:\WINDOWS\system32\guard32.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"TuneUp MemOptimizer"="C:\Program Files\TuneUp Utilities 2007\MemOptimizer.exe" autostart
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

R1 cdawdm;CDAWDM;C:\WINDOWS\system32\DRIVERS\CDAWDM.sys [2002-01-24 14:25]
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\WINDOWS\system32\DRIVERS\cmdguard.sys [2007-12-14 19:18]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\WINDOWS\system32\DRIVERS\cmdhlp.sys [2007-12-14 19:18]
R1 magicpvt;magicpvt;C:\WINDOWS\system32\drivers\magicpvt.sys [2005-06-10 09:42]
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3;C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe [2007-09-20 08:51]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe -k netsvcs []
R3 TIAU5CO;Actiontec Home DSL Modem(WAN) Service;C:\WINDOWS\system32\DRIVERS\TIAU5CO.sys [2002-04-02 12:06]
S3 akshasp;Aladdin HASP Key;C:\WINDOWS\system32\DRIVERS\akshasp.sys [2005-07-20 18:08]
S3 AtmElan;ATM Emulated LAN;C:\WINDOWS\system32\DRIVERS\atmlane.sys [2004-08-03 22:58]
S3 AtmLane;ATM LAN Emulation;C:\WINDOWS\system32\DRIVERS\atmlane.sys [2004-08-03 22:58]
S3 s716bus;Sony Ericsson Device 716 driver (WDM);C:\WINDOWS\system32\DRIVERS\s716bus.sys [2007-04-04 12:43]
S3 s716mdfl;Sony Ericsson Device 716 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\s716mdfl.sys [2007-04-04 12:43]
S3 s716mdm;Sony Ericsson Device 716 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\s716mdm.sys [2007-04-04 12:43]
S3 s716mgmt;Sony Ericsson Device 716 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\s716mgmt.sys [2007-04-04 12:43]
S3 s716nd5;Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (NDIS);C:\WINDOWS\system32\DRIVERS\s716nd5.sys [2007-04-04 12:43]
S3 s716obex;Sony Ericsson Device 716 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\s716obex.sys [2007-04-04 12:43]
S3 s716unic;Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (WDM);C:\WINDOWS\system32\DRIVERS\s716unic.sys [2007-04-04 12:43]
S3 SmartCd;SmartCd;C:\WINDOWS\system32\Drivers\SmartCd.sys [2002-01-19 17:00]
S3 TIAu5Bt;Actiontec Home DSL Modem Boot Device Service;C:\WINDOWS\system32\Drivers\tiau5bt.sys [2002-04-02 12:05]
S3 usnjsvc;Messenger Sharing Folders USN Journal Reader service;"C:\Program Files\MSN Messenger\usnsvc.exe" [2007-01-19 11:54]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

.
Contents of the 'Scheduled Tasks' folder
"2007-12-07 16:21:59 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
"2007-11-09 11:01:50 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2007-12-20 12:44:04
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\guard32.dll

PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180]
-> C:\WINDOWS\system32\guard32.dll

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.3156]
-> C:\WINDOWS\system32\guard32.dll
.
Completion time: 2007-12-20 12:49:53 - machine was rebooted
C:\ComboFix2.txt ... 2007-12-20 00:45
.
2007-12-16 19:23:33 --- E O F ---

Poslao: 19 Dec 2007 13:41
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

OK... Ovde više nema vidljivih tragova malware-a.

Da li sada primećuješ neke probleme?


Iskljucivanje System Restore-a

Na Desktopu, desni klik na My Computer.
Odaberite Properties.
Odaberite System Restore tab.
Stiklirajte Turn off System Restore.
Kliknite na dugme Apply.
Kliknite na dugme OK.


Restartuj kompjuter.


Ukljucivanje System Restore-a

Na Desktopu, desni klik na My Computer.
Odaberite Properties.
Odaberite System Restore tab.
Destiklirajte Turn off System Restore.
Kliknite na dugme Apply.
Kliknite na dugme OK.

Poslao: 19 Dec 2007 13:46
Idi na vrh
offline
  • Pridružio: 13 Jul 2007
  • Poruke: 363

Nema vise nista neobicno. Samo da iskljucim i ukljucim System Restore.
U svakom slucaju jedno veliko HVALA!!! Nema sta, kvalitet i pouzdanost. Svaka cast.

MyCity » Ambulanta -> Arhiva Ambulante » Mozda ima jos necega

Ko je trenutno na forumu
 

Ukupno su 1193 korisnika na forumu :: 136 registrovanih, 19 sakrivenih i 1038 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: 100ka, 9191vs, A.R.Chafee.Jr., aleksmajstor, Alexa77, Apok, aramis s, Asteker, awathorn, babaroga, Bane5, BB, bobomicek, bojan581, bokisha253, Boris BM, bpop, Cicumile, comi_pfc, dankisha, darkojovxp, dekiz, deLacy, DH, Dioniss, Djota1, DonRumataEstorski, Dorcolac, dulleo, Electron, esko_hz, Fabius, filip1326, Flanker-G, FOX, GeoM, Gerilac, Gogi_avio, gregorxix, Hardenberg, Hitri, iceburn, Ir, istina, Jonbonjovi, Još malo pa deda, koom0001, Kubovac, kunktator, lafa008, lcc, Lester Freamon, LjubisaR, LostInSpaceandTime, M74AB3, macak44, Macalone, markomacii9, mat, MB120mm, Mercury, Metanoja, Mi lao shu, mikrimaus, milos.cbr, MiroslavD, mist-mist, mix1, MK10, Motocar, mrav pesadinac, Mskok, Murko, N.e.m.a.nj.a., narandzasti, Ne doznajem se u oružje, neko iz mase, nevjerna beba, nisamBot, novator, Orc, paja69, Paklenica, panzerwaffe, pirke96, PlayerOne, Polifon, Povratak1912, precan, PrincipL, rebcooil, Regrut Boskica, Sagotolio, sale76, samocitam, Sančo, sekretar, sevenino, silikon, Sir Budimir, Sićko, Smajser, spalev, Sr.Stat., Srky Boy, strn, suton, synergia, Tas011, Trpe Grozni, tvlada, US_Rank_0, vaci, varda, vasa.93, Vatreni Zmaj, Velizar Laro, vensla, vidra1, voja64, Volkhov-M, VOŽD, vrlenija, vuksa72, wizzardone, wolf431, XBMC, Yugol33, YugoSlav, Zdilar, zlatkoa987, ZlatniRez, zokizemun, Zorge, šumar bk2, 79693