Problem RECYCLER\S-4-9-97-10000......

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

U pokusaju da Otvorim C particiju Prikaze Mi Ovo.

i41.tinypic.com/fu5i02.jpg

Koristim Bitedefender IS 2009, i Malwarebytes' Anti-Malware
Bitdegender Ne vidi Taj Virus Dok Malwarebytes' Anti-Malware vidi i navodno obrise Ali problem je jos uvek tu.
Video sam Srodnu Temu na ovo Pa reko da posebno otvorim Novu Ja se nadam da ce mi neko pomoci da se resim Ovoga,SKontao sam da je u pitanju Trojan Agent.
Hijack kaze oVo
*************************************************************

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:17:20 PM, on 1/30/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Atomic Alarm Clock\AtomicAlarmClock.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Ovislink\Common\TurboG-UI.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Documents and Settings\Rebel025\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = search.live.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = search.live.com/sphome.aspx
O2 - BHO: Flashget Catch Url Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll
O3 - Toolbar: FlashGet - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\Program Files\FlashGet\fgiebar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe"
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [SkinClock] C:\Program Files\Atomic Alarm Clock\AtomicAlarmClock.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: AirLive Turbo-G Wireless Utility.lnk = C:\Program Files\Ovislink\Common\TurboG-UI.exe
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{2B60F28D-75C7-449A-9ECF-F386E7CC5055}: NameServer = 10.238.116.254 89.216.43.2
O17 - HKLM\System\CS1\Services\Tcpip\..\{2B60F28D-75C7-449A-9ECF-F386E7CC5055}: NameServer = 10.238.116.254 89.216.43.2
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
O23 - Service: BitDefender Arrakis Server (Arrakis3) - BitDefender S.R.L. bitdefender.com - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S. R. L. - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe

--
End of file - 7591 bytes

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

- Preuzmi USBNoRisk na Desktop i pokreni ga duplim klikom na ikonicu programa.
- Sacekaj koji sekund dok program izvrsi inicijalno skeniranje.
- Ubacuj sve USB memorijske uredjaje redom u USB slot i svaki zadrzi u slotu po 10 sekundi.
- Ukoliko imas vise uredjaja za proveru, onda na parcetu papira zapisi kojim redom su ubacivani jer ce nam kasnije trebati taj podatak
- Kada zavrsis sa svim uredjajima, klikni desno dugme misa na sred prozora programa i odaberi opciju Save log. To ce automatski otvoriti log u Notepadu. Iskopiraj nam taj log iz Notepada na forum.

Objasnjenje: U USB memorijske uredjaje spadaju svi oni uredjaji koji po prikljucivanju na kompjuter dobijaju svoju oznaku particije. Tu spadaju USB flash drajvovi, eksterni hard-diskovi, memorijske kartice, MP3 i MP4 plejeri, neki mobilni telefoni, neki GPS (navigacioni) uredjaji itd.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Zadnje sto sam ubacivao je Bilo Blutut USB stick al to je bilo pre par dana A problem se javio juche.
Od tih uredjaja samo sam to i stavio.

A log Fajl je ovaj

USBNoRisk by bobby

Started at 1/31/2009 5:33:16 PM

Scanning for connected USB Mass storage...
----------------------------------------
========================================

Scanning for other storage...
----------------------------------------
C: {455d5fe5-7b17-11da-9471-806d6172696f}
D: {455d5fe6-7b17-11da-9471-806d6172696f}
========================================


Scanning fixed storage for autorun.inf files...
----------------------------------------
autorun.inf found on C:
----------------------------------------
File C:\autorun.inf renamed successfully

Content of C:\autorun(1).inf.blocked
----------------------------------------
[autorun]
;sdhdwlcfrhkorpnzoigjdswnkdjljlj
shellexecute="RECYCLER\S-6-0-20-100022773-100000169-100021416-5140.com c:\"
;xmwakojywrisjnlzhfhmzftzpzeaemkcbdhw
shell\Open\command="RECYCLER\S-6-0-20-100022773-100000169-100021416-5140.com c:\"
;mgjvaooivbxvbvwylgyjuhopsff
shell=Open
----------------------------------------

Sanitizing Shell Menu...
----------------------------------------
No key found for C:
No key found for 455d5fe5-7b17-11da-9471-806d6172696f
========================================

autorun.inf found on D:
----------------------------------------
File D:\autorun.inf renamed successfully

Content of D:\autorun(1).inf.blocked
----------------------------------------
[autorun]
;ctuyejbxlrzozyvxnnbosjf
shellexecute="RECYCLER\S-6-0-20-100022773-100000169-100021416-5140.com d:\"
;wfsjdpit
shell\Open\command="RECYCLER\S-6-0-20-100022773-100000169-100021416-5140.com d:\"
;hkfhaantufuuxclohnieudladyqagwodluvikbfnlkxuuarhduhchipbfmgosvioauhjwfnimcwyeeit
shell=Open
----------------------------------------

Sanitizing Shell Menu...
----------------------------------------
No key found for D:
No key found for 455d5fe6-7b17-11da-9471-806d6172696f
========================================

========================================

Dopuna: 31 Jan 2009 17:44

Hm Dali sad to znaci da je resen Problem Sad moze da mi otvara kao i ranije Particije C i D.hmm.....

Dopuna: 31 Jan 2009 17:57

Bitdefender Je odreagovao ovog Puta Ocigledno je hteo da se vrati virus nazad,Prijavio mi je upad i da je Blokiran i smesten u Karantin.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Ovaj log od USBNoRiska mi pokazuje da je pokretan i ranije, i da se infekcija vraca.

Skini ComboFix sa jedne od sledecih adresa na Desktop:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://www.forospyware.com/sUBs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe

Startuj ga i ne diraj prozor programa dok skenira.
Sledi uputstva na ekranu. Kada zavrsi pojavice se log (C:\ComboFix.txt) koji ces nam ovde iskopirati.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Odradio sam Al nije Hteo da Nastavi jer Je Aktivan Bitdegender....Znaci moram da ga iskljucim tako?!

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Yup, iskljuci Bitdefender na sledeci nacin:

Klikni desnim tasterom miša na BitDefender ikonicu ( ) u donjem, desnom uglu ekrana i izaberi Show.
Nakon toga, takođe, u donjem, desnom uglu prozora izaberi Settings.
Zatim odštikliraj Real-Time potection is enabled, i u padajućem meniju izaberi Permanently i klikni OK.

Napomena: Ne zaboravi da uključiš ovu opciju po završetku čišćenja.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Evo Ga!
*******

ComboFix 09-01-31.01 - Rebel025 2009-01-31 22:21:46.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1022.536 [GMT -8:00]
Running from: c:\documents and settings\Rebel025\Desktop\ComboFix.exe
AV: BitDefender Antivirus *On-access scanning disabled* (Updated)
FW: BitDefender Firewall *enabled*
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\autorun.inf
c:\documents and settings\Rebel025\Application Data\kis8.0.0.506en.exe
D:\Autorun.inf
d:\recycler\S-6-0-20-100022773-100000169-100021416-5140.com
d:\recycler\S-7-4-35-100027974-100021266-100028139-9397.com
d:\recycler\S-8-3-27-100026480-100018990-100020921-1045.com

.
((((((((((((((((((((((((( Files Created from 2009-01-01 to 2009-02-01 )))))))))))))))))))))))))))))))
.

2009-01-31 17:32 . 2009-01-31 17:38 <DIR> d-------- C:\USBNoRisk
2009-01-31 17:32 . 2009-01-31 17:32 286 --a------ C:\autorun(1).inf.blocked
2009-01-30 21:03 . 2009-01-31 17:31 401 --a------ C:\autorun.inf.blocked
2009-01-30 18:51 . 2009-01-30 18:54 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-01-30 18:51 . 2009-01-30 18:51 <DIR> d-------- c:\documents and settings\Rebel025\Application Data\Malwarebytes
2009-01-30 18:51 . 2009-01-30 18:51 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-30 18:51 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-30 18:51 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-01-30 16:56 . 2009-01-30 16:56 <DIR> d-------- c:\windows\Sun
2009-01-30 01:36 . 2009-01-30 01:36 <DIR> d-------- c:\program files\Konami
2009-01-28 14:39 . 2009-01-29 21:16 69 --a------ c:\windows\NeroDigital.ini
2009-01-28 02:53 . 2009-01-28 02:52 410,984 --a------ c:\windows\system32\deploytk.dll
2009-01-28 02:37 . 2009-01-28 02:52 <DIR> d-------- c:\program files\Java
2009-01-28 02:37 . 2009-01-28 02:37 <DIR> d-------- c:\program files\Common Files\Java
2009-01-28 02:37 . 2009-01-28 02:52 73,728 --a------ c:\windows\system32\javacpl.cpl
2009-01-27 19:52 . 2006-12-24 14:12 <DIR> d-------- c:\windows\system32\pro
2009-01-27 19:52 . 2009-01-27 19:52 <DIR> d-------- c:\program files\Google
2009-01-27 04:03 . 2009-01-27 04:03 <DIR> d-------- c:\program files\Smart Projects
2009-01-27 03:36 . 2006-10-26 19:56 32,592 --a------ c:\windows\system32\msonpmon.dll
2009-01-27 03:34 . 2009-01-27 03:34 <DIR> d-------- c:\program files\Microsoft Works
2009-01-27 03:34 . 2009-01-27 03:34 <DIR> d---s---- c:\documents and settings\Rebel025\UserData
2009-01-27 03:33 . 2009-01-27 03:33 <DIR> d-------- c:\program files\MSBuild
2009-01-27 03:32 . 2009-01-27 03:32 <DIR> d-------- c:\program files\Microsoft.NET
2009-01-27 03:29 . 2009-01-27 03:33 <DIR> d-------- c:\windows\SHELLNEW
2009-01-27 03:29 . 2009-01-27 03:29 <DIR> d-------- c:\program files\Microsoft Visual Studio 8
2009-01-27 03:28 . 2009-01-27 03:36 <DIR> d-------- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-01-27 03:27 . 2009-01-27 03:27 <DIR> dr-h----- C:\MSOCache
2009-01-27 03:23 . 2009-01-27 03:23 <DIR> d-------- c:\program files\Foxit Software
2009-01-27 03:22 . 2009-01-27 03:22 <DIR> d-------- c:\program files\PowerISO
2009-01-27 03:12 . 2009-01-27 03:12 <DIR> d-------- c:\documents and settings\Rebel025\Application Data\BitDefender
2009-01-27 03:11 . 2009-01-27 03:13 <DIR> d-------- c:\documents and settings\All Users\Application Data\BitDefender
2009-01-27 03:07 . 2009-01-27 03:07 <DIR> d-------- c:\program files\K-Lite Codec Pack
2009-01-27 03:07 . 2007-09-04 08:56 164,352 --a------ c:\windows\system32\unrar.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-01 06:23 81,984 ----a-w c:\windows\system32\bdod.bin
2009-02-01 06:21 --------- d-----w c:\program files\FlashGet
2009-01-31 22:30 --------- d-----w c:\program files\Winamp
2009-01-30 19:51 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-30 19:51 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-01-30 05:16 --------- d-----w c:\documents and settings\Rebel025\Application Data\Ahead
2009-01-27 11:43 242,184 ----a-w c:\windows\system32\drivers\bdfsfltr.sys
2009-01-27 11:43 192,512 ----a-w c:\windows\system32\txmlutil.dll
2009-01-27 11:43 111,112 ----a-w c:\windows\system32\drivers\bdfm.sys
2009-01-27 11:43 104,328 ----a-w c:\windows\system32\drivers\bdfndisf.sys
2009-01-27 11:25 --------- d-----w c:\program files\Common Files\Adobe
2009-01-27 11:11 --------- d-----w c:\program files\Common Files\BitDefender
2008-12-03 06:37 49,480 ----a-w c:\windows\system32\sirenacm.dll
2006-01-02 09:38 81,920 ----a-w c:\documents and settings\Rebel025\Application Data\ezpinst.exe
2006-01-02 09:38 47,360 ----a-w c:\documents and settings\Rebel025\Application Data\pcouffin.sys
2009-01-27 11:41 61,440 ----a-w c:\program files\mozilla firefox\components\FFComm.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SkinClock"="c:\program files\Atomic Alarm Clock\AtomicAlarmClock.exe" [2008-05-21 1134592]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2008-01-22 152872]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2008-12-02 3882312]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"Jet Detection"="c:\program files\Creative\SBLive\PROGRAM\ADGJDet.exe" [2001-11-29 28672]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-01-02 155648]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-01-02 185896]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2008-05-28 570664]
"BDAgent"="c:\program files\BitDefender\BitDefender 2009\bdagent.exe" [2009-01-27 741376]
"BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2009\IEShow.exe" [2009-01-27 69632]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-28 136600]
"nwiz"="nwiz.exe" [2008-10-07 c:\windows\system32\nwiz.exe]
"WINDVDPatch"="CTHELPER.EXE" [2002-07-02 c:\windows\system32\CTHELPER.EXE]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
AirLive Turbo-G Wireless Utility.lnk - c:\program files\Ovislink\Common\TurboG-UI.exe [2006-01-01 614400]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= msaud32_divx.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.321\\English\\setup.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\FlashGet\\flashget.exe"=

R3 bdfm;BDFM;c:\windows\system32\drivers\bdfm.sys [2008-08-12 111112]
R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\system32\drivers\bdfndisf.sys [2008-08-14 104328]
R4 BDVEDISK;BDVEDISK;c:\program files\BitDefender\BitDefender 2009\BDVEDISK.sys [2008-07-02 82696]
S3 Arrakis3;BitDefender Arrakis Server;c:\program files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe [2008-07-17 118784]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - 5F07C00F
*Deregistered* - 5f07c00f

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\autorun.exe
.
Contents of the 'Scheduled Tasks' folder

2009-01-31 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [2006-12-19 16:53]
.
.
------- Supplementary Scan -------
.
IE: &Download All with FlashGet - c:\program files\FlashGet\jc_all.htm
IE: &Download with FlashGet - c:\program files\FlashGet\jc_link.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: {2B60F28D-75C7-449A-9ECF-F386E7CC5055} = 10.238.116.254 89.216.43.2
FF - ProfilePath - c:\documents and settings\Rebel025\Application Data\Mozilla\Firefox\Profiles\ms237hzh.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - component: c:\program files\Mozilla Firefox\components\FFComm.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, gmer.net
Rootkit scan 2009-01-31 22:23:50
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-01-31 22:25:26
ComboFix-quarantined-files.txt 2009-02-01 06:25:23

Pre-Run: 38,556,778,496 bytes free
Post-Run: 40,311,693,312 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

166

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Sudeci po logu, rekao bih da nema vise malwarea.

Hajde sada da deinstaliramo ComboFix:

Klikni START a zatim RUN
U liniju za unos teksta ukucaj Combofix /u i klikni OK





Sačekaj da se proces deinstalacije završi
Gornja procedura će:
Obrisati sledeće:
ComboFix i njegove file-ove i foldere
VundoFix Backups folder, ako postoji
C:\Deckard folder, ako postoji
C:\OtMoveIt folder, ako postoji
Resetovati podešavanja sata na kompjuteru
Sakriti ekstenzije file-ova, ako je potrebno
Sakriti sistemske/skrivene file-ove/foldere, ako je potrebno
Resetovati System Restore

===============================

USBNoRisk nema posebnu proceduru za deinstalaciju. Dovoljno je obrisati program, kao i folder C:\USBNoRisk

===============================

Obrisi rucno sledeca dva fajla:
C:\autorun(1).inf.blocked
C:\autorun.inf.blocked

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

OK A Jel mogu da brisem

Boot.bak
cmldr
ComboFix

Ro znaci standardno da obrisem?!
Nasao sam I oVo u C folder

924be7bf20a009d58d5e6c

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Deinstalacija Combofixa ce da obrise sve ono sto je ComboFix instalirao, ne treba nista rucno da brises od njegovih fajlova i foldera.

Boot.bak ti je kopija boot.ini fajla, za slucaj da kasnije pozelis da uklonis Recovery Console iz boot menija.