offline
- Pridružio: 23 Mar 2008
- Poruke: 68
|
Pozdrav,
Danas je poceo da se pojavljuje odjednom desktop sec 2010 i kao nesto skenira i prijavljuje viruse a ustvari je to sam malware koliko sam video na googlu... Tamo pise da se instalira malware bytes i da ce on da ga obrise... Pise da mora iz safe mode-a da se pokrene scan... Sve sam pokusao ali nikako da ga obrisem... Trenutno mogu laptop da pokrenem samo u safemodu jer na startup-u pre nego sto se pojave ikonice na desktopu izadje neki pop-up Desktop Security 2010 i ne da nista da radim...
DDS:
DDS (Ver_10-03-17.01) - NTFSx86 NETWORK
Run by Freezing Cool at 20:52:41.54 on Fri 08/06/2010
Internet Explorer: 8.0.7600.16385
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.3071.2285 [GMT 2:00]
============== Running Processes ===============
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\Explorer.EXE
C:\Windows\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Users\Freezing Cool\Desktop\dds.scr
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
============== Pseudo HJT Report ===============
uStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [AlcoholAutomount] "c:\program files\alcohol soft\alcohol 120\AxAutoMntSrv.exe" -automount
uRun: [BSK91O3T6D] c:\users\freezi~1\appdata\local\temp\Dks.exe
uRun: [7o3osowveob2] c:\users\freezing cool\appdata\local\temp\m.2CAB0.tmp.exe
uRun: [Desktop Security] "c:\users\freezing cool\appdata\roaming\desktop security\Desktop Security 2010.exe" /STARTUP
uRun: [SecurityCenter] c:\users\freezing cool\appdata\roaming\desktop security\securitycenter.exe
mRun: [googletalk] c:\program files\google\google talk\googletalk.exe /autostart
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [PowerArchiverPA7ZSFX1.1.0.1] c:\users\freezi~1\appdata\local\temp\jtpualeh.exe
mRun: [StudioStudio] c:\program files\microsoft visual studio 9.0\vc\redist\x86\microsoft.vc90.mfc\mfcm90studio.exe
mRun: [msmdcb80System6.1.7600.163857.0907131255] c:\program files\common files\system\ole db\sharepointsystem.exe
mRun: [DPDPLStudio] c:\program files\microsoft visual studio 9.0\smartdevices\projects\1033\smartdeviceprojectvisual.exe
mRun: [StudioMFC90U9.00.21022.08] c:\program files\microsoft visual studio 9.0\vc\redist\x86\microsoft.vc90.mfc\MFCM90Studio.exe
mRun: [ae0965a7157cdPowerArchiver] c:\users\freezing cool\appdata\local\temp\jtpualeh.exe
mRun: [PowerArchiverae0965a7157cd] c:\users\freezing cool\appdata\local\temp\jtpualeh.exe
mRunServices: [PA7ZSFXPowerArchiver] c:\users\freezi~1\appdata\local\temp\jtpualeh.exe
mRunServices: [AclUIFramework] c:\program files\microsoft sdks\windows\v6.0a\lib\frameworkcordebug.exe
mRunServices: [MFC90FRAMicrosoft9.00.21022.08] c:\program files\microsoft visual studio 9.0\vc\redist\amd64\microsoft.vc90.mfcloc\visualmfc90ita.exe
mRunServices: [MicrosoftHelp] c:\program files\common files\microsoft shared\help\3082\hxdsuihxvzui.exe
mRunServices: [StudioVisual] c:\program files\microsoft visual studio 9.0\vc\redist\x86\microsoft.vc90.mfc\MFCM90Studio.exe
mRunServices: [PA7ZSFXae0965a7157cd5705] c:\users\freezing cool\appdata\local\temp\jtpualeh.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\mif5ba~1\office11\EXCEL.EXE/3000
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mif5ba~1\office11\REFIEBAR.DLL
DPF: Microsoft XML Parser for Java - file:///C:/Windows/Java/classes/xmldso.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
AppInit_DLLs: nmklo
================= FIREFOX ===================
FF - ProfilePath - c:\users\freezi~1\appdata\roaming\mozilla\firefox\profiles\xuep3yht.default\
FF - component: c:\program files\mozilla firefox\extensions\{ab2ce124-6272-4b12-94a9-7303c7397bd1}\components\SkypeFfComponent.dll
FF - plugin: c:\program files\pando networks\media booster\npPandoWebPlugin.dll
FF - plugin: c:\windows\system32\c2mp\npdivx32.dll
FF - plugin: c:\windows\system32\wat\npWatWeb.dll
---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
============= SERVICES / DRIVERS ===============
R0 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [2008-9-23 39680]
R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-14 48128]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2009-6-10 139776]
S2 AcuWVSSchedulerv6;Acunetix WVS Scheduler v6;c:\program files\acunetix\web vulnerability scanner 6\WVSScheduler.exe [2008-11-24 994952]
S2 Apache2.2;Apache2.2;c:\xampp\apache\bin\httpd.exe [2010-5-2 24640]
S2 StarWindServiceAE;StarWind AE Service;c:\program files\alcohol soft\alcohol 120\starwind\StarWindServiceAE.exe [2009-12-23 370688]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888]
S3 GarenaPEngine;GarenaPEngine;c:\users\freezi~1\appdata\local\temp\JBE66ED.tmp [2010-8-6 25616]
S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2010-5-16 1343400]
=============== Created Last 30 ================
2010-08-06 11:28:23 4 ----a-w- c:\users\freezing cool\proxy_port
2010-08-06 11:27:57 0 d-----w- c:\users\freezi~1\appdata\roaming\Malwarebytes
2010-08-06 11:27:47 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-08-06 11:27:45 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-08-06 11:27:45 0 d-----w- c:\programdata\Malwarebytes
2010-08-06 11:27:45 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-08-06 11:26:14 36864 ----a-w- c:\windows\system32\hgtd.ruy
2010-08-06 11:26:14 21504 ----a-w- c:\windows\system32\ff4h.gy
2010-08-06 11:26:13 68096 ----a-w- c:\windows\system32\h7t.wt
2010-08-06 11:14:18 0 d-----w- c:\users\freezi~1\appdata\roaming\InfraRecorder
2010-08-06 11:14:14 0 d-----w- c:\program files\InfraRecorder
2010-08-06 11:10:24 0 d-----w- c:\users\freezi~1\appdata\roaming\Desktop Security
2010-08-06 11:10:00 173056 --sha-r- c:\windows\system32\bg-BG1.dll
2010-08-06 11:08:55 208896 ----a-w- c:\windows\Dcimaa.exe
2010-08-03 23:14:37 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2010-08-03 23:14:37 49472 ----a-w- c:\windows\system32\netfxperf.dll
2010-08-03 23:14:37 297808 ----a-w- c:\windows\system32\mscoree.dll
2010-08-03 23:14:37 295264 ----a-w- c:\windows\system32\PresentationHost.exe
2010-08-03 23:14:37 1130824 ----a-w- c:\windows\system32\dfshim.dll
2010-08-02 16:05:19 977920 ----a-w- c:\windows\system32\wininet.dll
2010-08-02 15:59:15 285696 ----a-w- c:\windows\system32\winlogon.exe
2010-08-02 15:59:15 2614272 ----a-w- c:\windows\explorer.exe
2010-08-02 15:59:09 133720 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2010-08-02 15:59:09 1037312 ----a-w- c:\windows\system32\lsasrv.dll
2010-08-02 15:58:06 740864 ----a-w- c:\windows\system32\inetcomm.dll
2010-08-02 15:58:03 2326528 ----a-w- c:\windows\system32\win32k.sys
2010-08-02 15:58:01 67584 ----a-w- c:\windows\system32\asycfilt.dll
2010-08-02 15:56:37 427520 ----a-w- c:\windows\system32\vbscript.dll
2010-08-02 15:54:11 2048 ----a-w- c:\windows\system32\tzres.dll
2010-08-02 15:53:15 95744 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-08-02 15:53:15 221696 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-08-02 15:53:15 123392 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-08-02 15:50:37 70656 ----a-w- c:\windows\system32\fontsub.dll
2010-08-02 15:50:37 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-08-02 15:50:37 293888 ----a-w- c:\windows\system32\atmfd.dll
2010-08-02 15:32:29 172032 ----a-w- c:\windows\system32\wintrust.dll
2010-08-02 15:32:13 132608 ----a-w- c:\windows\system32\cabview.dll
2010-08-01 23:23:16 0 d-----w- C:\Playlist
2010-07-30 23:31:53 171136 --sha-r- C:\grldr
2010-07-30 23:31:26 3 ----a-w- C:\7Loader.TAG
2010-07-30 23:26:49 783424 ----a-w- c:\windows\pkeyconfig.xrm-ms
2010-07-30 23:24:32 20 --sh--r- C:\winx.ld
2010-07-30 23:24:31 331622 --sh--r- C:\NYPJI
2010-07-26 20:30:04 0 d-----w- c:\program files\NIERSOFT
2010-07-24 22:48:06 0 d-----w- c:\program files\NRadioBox
2010-07-24 17:33:53 0 d-----w- c:\windows\system32\Filmovi
2010-07-18 23:29:47 0 d-----w- c:\program files\Pixel Mine
2010-07-14 20:29:02 0 d-----w- c:\programdata\WhereIsIt
2010-07-14 20:29:02 0 d-----w- c:\program files\WhereIsIt
2010-07-12 23:23:50 0 d-----w- c:\program files\common files\Microsoft Games
2010-07-12 11:35:35 0 d-----w- c:\users\freezi~1\appdata\roaming\Microsoft Games
2010-07-12 11:14:22 0 d-----w- c:\programdata\Microsoft Games
2010-07-11 23:11:28 0 d-----w- C:\Zoo Tycoon 2 Complete Collection
2010-07-11 22:43:09 0 d-----w- c:\users\freezing cool\.android
2010-07-11 15:36:07 0 d-----w- c:\program files\Microsoft Chart Controls
2010-07-11 15:31:29 0 d-----w- C:\UDK
2010-07-07 22:58:41 0 d-----w- c:\users\freezi~1\appdata\roaming\LolClient
==================== Find3M ====================
2010-05-25 22:07:51 3532 ----a-w- C:\drmHeader.bin
2010-05-21 12:14:28 221568 ------w- c:\windows\system32\MpSigStub.exe
2010-05-13 22:12:59 63979 ----a-w- c:\users\freezing cool\gen_lyrics03.exe
2009-07-14 04:56:42 31548 ----a-w- c:\windows\inf\perflib\0409\perfd.dat
2009-07-14 04:56:42 31548 ----a-w- c:\windows\inf\perflib\0409\perfc.dat
2009-07-14 04:56:42 291294 ----a-w- c:\windows\inf\perflib\0409\perfi.dat
2009-07-14 04:56:42 291294 ----a-w- c:\windows\inf\perflib\0409\perfh.dat
2009-07-14 04:41:57 174 --sha-w- c:\program files\desktop.ini
2009-07-14 00:34:40 291294 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
2009-07-14 00:34:40 291294 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
2009-07-14 00:34:38 31548 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
2009-07-14 00:34:38 31548 ----a-w- c:\windows\inf\perflib\0000\perfc.dat
2009-06-10 21:26:35 9633792 --sha-r- c:\windows\fonts\StaticCache.dat
2009-07-14 01:14:45 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
============= FINISH: 20:53:20.14 ===============
mycity.rs/must-login.png
mycity.rs/must-login.png
mycity.rs/must-login.png
mycity.rs/must-login.png
|
