MyCity » Ambulanta -> Arhiva Ambulante » Problem sa virusom

Problem sa virusom

Napisano na dan: 6.1.2012
1

Problem sa virusom
Sledeća strana Pagination

Idi na vrh

Poslao: 06 Jan 2012 03:12
Idi na vrh
offline
  • Stefanovic
  • Pridružio: 02 Nov 2011
  • Poruke: 144
  • Gde živiš: Nis

Napisano: 06 Jan 2012 2:00

Preso sam sa Telekomovog ADSL-a na kablovski internet IKOM,i kako sam prikljucio komp poludeo je od virusa,pokusao da obrisem Avirom i Malwarebytes Anti-Malware-om ali bezuspesno.....uradio sistem re na raniji datum i nista,ko postoji resenje bio bih vam zahvalan,ako ne da reinstalirAM xp3 inace imam 32-bit-ni....hvala unapred





mycity.rs/must-login.png

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_29
Run by owner at 11:16:30 on 2012-01-05
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.512.103 [GMT 1:00]
.
AV: Avira Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\VisualTaskTips\VisualTaskTips.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\YoWindow\yowindow.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\Documents and Settings\owner\Application Data\2.tmp
C:\Documents and Settings\owner\Application Data\3.tmp
C:\WINDOWS\aadrive32.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
mWinlogon: Taskman=c:\recycler\s-1-5-21-0243556031-888888379-781863308-1830\zaberg.exe
uWinlogon: Shell=explorer.exe,c:\recycler\s-1-5-21-0243556031-888888379-781863308-1830\zaberg.exe,Explorer.exe
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
uRun: [VisualTaskTips] c:\program files\visualtasktips\VisualTaskTips.exe
uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\DTLite.exe" -autorun
uRun: [AdobeBridge]
uRun: [zaber0] c:\recycler\s-1-5-21-0243556031-888888379-781863308-1830\zaberg.exe
uRun: [zaber0] c:\recycler\s-1-5-21-0243556031-888888379-781863308-1830\zaberg.exe
mRun: [Smapp] c:\program files\analog devices\soundmax\SMTray.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [AdobeCS4ServiceManager] "c:\program files\common files\adobe\cs4servicemanager\CS4ServiceManager.exe" -launchedbylogin
mRun: [UnlockerAssistant] "c:\program files\unlocker\UnlockerAssistant.exe"
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [Microsoft Driver Setup] c:\windows\aadrive32.exe
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
mExplorerRun: [Microsoft Driver Setup] c:\windows\aadrive32.exe
StartupFolder: c:\docume~1\owner\startm~1\programs\startup\yowindow.lnk - c:\program files\yowindow\yowindow.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: Free YouTube Download - c:\documents and settings\owner\application data\dvdvideosoftiehelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - c:\documents and settings\owner\application data\dvdvideosoftiehelpers\freeyoutubetomp3converter.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1177316463750
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = 95.180.0.18 95.180.1.2
TCP: Interfaces\{15E13B7F-0590-4AEE-9375-86D10DA96DE7} : DhcpNameServer = 192.168.0.1 192.168.1.1
TCP: Interfaces\{328A07BF-0A62-4771-A364-4F693F54BF25} : DhcpNameServer = 95.180.0.18 95.180.1.2
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\owner\application data\mozilla\firefox\profiles\kwcbr7em.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.rs/
FF - prefs.js: network.proxy.type - 0
FF - component: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\firefox\ext\components\nprpffbrowserrecordext.dll
FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll
FF - plugin: c:\program files\adobe\reader 9.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npwachk.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}
FF - Ext: RapidShare DownloadHelper: rsDownloadHelper@yevgenyandrov.net - %profile%\extensions\rsDownloadHelper@yevgenyandrov.net
FF - Ext: 1-Click YouTube Video Downloader: YoutubeDownloader@PeterOlayev.com - %profile%\extensions\YoutubeDownloader@PeterOlayev.com
FF - Ext: Facebook Phishing Protector: {023e9ca0-63f3-47b1-bcb2-9badf9d9ef28} - %profile%\extensions\{023e9ca0-63f3-47b1-bcb2-9badf9d9ef28}
FF - Ext: Linkification: {35106bca-6c78-48c7-ac28-56df30b51d2a} - %profile%\extensions\{35106bca-6c78-48c7-ac28-56df30b51d2a}
FF - Ext: Free YouTube Download (Free Studio) Menu: {ACAA314B-EEBA-48e4-AD47-84E31C44796C} - %profile%\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
FF - Ext: Greasemonkey: {e4a8a97b-f2ed-450b-b12d-ee082ba24781} - %profile%\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\firefox\Ext
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff
.
============= SERVICES / DRIVERS ===============
.
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [2011-11-4 36000]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [2011-11-3 232512]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2011-11-4 74640]
S2 AntiVirSchedulerService;Avira Scheduler;c:\program files\avira\antivir desktop\sched.exe [2011-11-4 86224]
S2 AntiVirService;Avira Realtime Protection;c:\program files\avira\antivir desktop\avguard.exe [2011-11-4 110032]
S2 jyblwxk;Microsoft Windows;c:\windows\system32\svchost.exe -k netsvcs [2004-8-3 14336]
S3 N100;Compaq Ethernet or Fast Ethernet NIC Driver;c:\windows\system32\drivers\n100325.sys [2007-4-23 128000]
.
=============== Created Last 30 ================
.
2012-01-05 10:12:29 52736 --sh--r- c:\windows\aadrive32.exe
2012-01-05 10:12:28 52736 ----a-w- c:\documents and settings\owner\application data\4.tmp
2012-01-05 10:12:26 27648 ----a-w- c:\documents and settings\owner\application data\3.tmp
2012-01-05 10:12:24 135024 ----a-w- c:\documents and settings\owner\application data\2.tmp
2012-01-05 00:04:18 135024 ----a-w- c:\documents and settings\owner\application data\10.tmp
2012-01-04 22:53:17 52736 ----a-w- c:\documents and settings\owner\application data\B.tmp
2012-01-04 21:23:35 29696 ----a-w- c:\windows\system32\02.exe
2012-01-04 21:21:51 29696 ----a-w- c:\windows\system32\65.exe
2012-01-04 21:19:50 29696 ----a-w- c:\windows\system32\38.exe
2012-01-04 21:14:17 52736 ----a-w- c:\documents and settings\owner\application data\A.tmp
2012-01-04 08:12:37 29696 ----a-w- c:\windows\system32\12.exe
2012-01-04 06:59:28 29696 ----a-w- c:\windows\system32\51.exe
2012-01-04 03:28:56 29696 ----a-w- c:\windows\system32\64.exe
2012-01-04 03:26:13 29696 ----a-w- c:\windows\system32\22.exe
2012-01-04 03:18:12 83456 ----a-w- c:\documents and settings\owner\vfdewd.exe
2012-01-04 03:17:06 29696 ----a-w- c:\windows\system32\74.exe
2012-01-04 02:52:41 135024 ------w- c:\documents and settings\owner\application data\5.tmp
2012-01-04 02:24:51 274288 ----a-w- c:\windows\system32\mucltui.dll
2012-01-04 02:24:51 215920 ----a-w- c:\windows\system32\muweb.dll
2012-01-04 02:24:51 16736 ----a-w- c:\windows\system32\mucltui.dll.mui
2012-01-04 02:24:13 21728 ----a-w- c:\windows\system32\wucltui.dll.mui
2012-01-04 02:24:12 17632 ----a-w- c:\windows\system32\wuaueng.dll.mui
2012-01-04 02:24:12 15072 ----a-w- c:\windows\system32\wuaucpl.cpl.mui
2012-01-04 02:24:12 15064 ----a-w- c:\windows\system32\wuapi.dll.mui
2012-01-04 02:05:12 135024 ----a-w- c:\documents and settings\owner\application data\21.tmp
2012-01-04 02:04:21 29696 ----a-w- c:\windows\system32\03.exe
2012-01-04 01:50:09 -------- d-----w- c:\windows\system32\wbem\repository\FS
2012-01-04 01:50:09 -------- d-----w- c:\windows\system32\wbem\Repository
2012-01-03 11:05:50 -------- d-----w- c:\windows\LastGood(2)
2012-01-02 10:28:53 -------- d-----w- c:\documents and settings\owner\local settings\application data\Google
.
==================== Find3M ====================
.
2011-12-10 14:24:06 20464 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-12-02 14:30:07 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-27 21:18:04 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-11-27 21:18:03 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-11-26 18:23:55 499712 ----a-w- c:\windows\system32\msvcp71.dll
2011-11-26 18:23:55 348160 ----a-w- c:\windows\system32\msvcr71.dll
2011-11-03 16:24:05 232512 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2011-10-19 06:28:06 689664 ----a-w- c:\windows\system32\yowindow.scr
.
============= FINISH: 11:17:43,96 ===============





mycity.rs/must-login.png



mycity.rs/must-login.png






mycity.rs/must-login.png

mycity.rs/must-login.png

mycity.rs/must-login.png

Dopuna: 06 Jan 2012 2:12

mycity.rs/must-login.png



Poslao: 06 Jan 2012 03:34
Idi na vrh
offline
  • Pridružio: 02 Feb 2008
  • Poruke: 14018
  • Gde živiš: Nish

Pozdrav cilitis!







U toku resavanja slucaja, zamolio bih te da se pridrzavas sledeceg:
Detaljno citati moja uputstva ( ili uputstva kolega koji ce me zamenjivati) i raditi iskljucivo po njima;
Ne traziti istovremeno pomoc na drugom mestu;
Nemoj koristiti druge programe za uklanjanje malware-a, osim onih za koje budes dobio uputstvo;
U toku intervencije ne koristiti USB memorijske uredjaje, dok to ne budem zatrazio;
Ukoliko ne odgovorim u roku od 48h, osvezi temu novim post-om;
Ukoliko se ne javis u roku od 5 dana, zatvoricemo slucaj.
Za vise informacija o pravilima Ambulante MyCity foruma: LINK

-------------------------------------------------------------------------------------




Arrow


Preuzmi sUBs-ov ComboFix sa sledeće adrese na Desktop:


Bleeping Computer
Klikni desnim tasterom na link i odaberi opciju Save Target As... (Save Link As..., Save Linked Content As... ili sličnu);
Kada se otvori dijalog za izbor lokacije na kojoj treba sačuvati file, odaberi Desktop i klikni Save.



Kada preuzimanje programa bude završeno:
deaktiviraj zaštitni softver (uputstvo);
zatvori pokrenute programe;
dvoklikom pokreni program ComboFix;
u prozoru koji se otvori klikni "I Agree".
U toku rada, ComboFix će:proveriti postoji li novija verzija programa:
klikni Yes ako bude ponuđeno preuzimanje iste.ako Recovery Console nije instalirana, ponuditi instalaciju:
obavezno prihvati klikom na Yes i isprati postupak.postaviti/dati određeni broj upita/obaveštenja:
prihvati klikom na Yes ili OK.po potrebi, restartovati Windows (više puta);
na kraju rada, otvoriti Notepad sa izveštajem o skeniranju.

Iskopiraj izveštaj koji je ComboFix napravio u temu na forumu:
klikni desnim tasterom miša u prozor Notepad-a i izaberi Select All;
klikni desnim tasterom miša na obeleženi tekst i izaberi Copy;
klikni desnim tasterom miša u polje za pisanje poruke i izaberi Paste.

Napomena:Izveštaj će biti sačuvan pod nazivom ComboFix.txt na sistemskoj particiji (tipična lokacija: C:\ComboFix.txt);
Ukoliko nakon slanja poruke primetiš da izveštaj nije kompletan, iskoristi opciju Prikači fajl za prilaganje file-a C:\ComboFix.txt uz poruku.









goran9888 (AMF Tim)

Poslao: 06 Jan 2012 04:40
Idi na vrh
offline
  • Stefanovic
  • Pridružio: 02 Nov 2011
  • Poruke: 144
  • Gde živiš: Nis

ComboFix 12-01-05.04 - owner 06.01.2012 4:10.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.512.144 [GMT 1:00]
Running from: c:\documents and settings\owner\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\owner\Application Data\10.tmp
c:\documents and settings\owner\Application Data\2.tmp
c:\documents and settings\owner\Application Data\21.tmp
c:\documents and settings\owner\Application Data\3.tmp
c:\documents and settings\owner\Application Data\34.tmp
c:\documents and settings\owner\Application Data\35.tmp
c:\documents and settings\owner\Application Data\36.tmp
c:\documents and settings\owner\Application Data\37.tmp
c:\documents and settings\owner\Application Data\38.tmp
c:\documents and settings\owner\Application Data\39.tmp
c:\documents and settings\owner\Application Data\3A.tmp
c:\documents and settings\owner\Application Data\3B.tmp
c:\documents and settings\owner\Application Data\3C.tmp
c:\documents and settings\owner\Application Data\3D.tmp
c:\documents and settings\owner\Application Data\3E.tmp
c:\documents and settings\owner\Application Data\3F.tmp
c:\documents and settings\owner\Application Data\4.tmp
c:\documents and settings\owner\Application Data\40.tmp
c:\documents and settings\owner\Application Data\5.tmp
c:\documents and settings\owner\Application Data\6.tmp
c:\documents and settings\owner\Application Data\7.tmp
c:\documents and settings\owner\Application Data\8.tmp
c:\documents and settings\owner\Application Data\96.tmp
c:\documents and settings\owner\Application Data\97.tmp
c:\documents and settings\owner\Application Data\98.tmp
c:\documents and settings\owner\Application Data\A.tmp
c:\documents and settings\owner\Application Data\B.tmp
c:\documents and settings\owner\vfdewd.exe
c:\windows\aadrive32.exe
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
c:\windows\system32\02.exe
c:\windows\system32\03.exe
c:\windows\system32\12.exe
c:\windows\system32\22.exe
c:\windows\system32\38.exe
c:\windows\system32\51.exe
c:\windows\system32\64.exe
c:\windows\system32\65.exe
c:\windows\system32\74.exe
c:\windows\system32\drivers\etc\hosts.txt
c:\windows\system32\msssc.dll
c:\windows\XSxS
.
.
((((((((((((((((((((((((( Files Created from 2011-12-06 to 2012-01-06 )))))))))))))))))))))))))))))))
.
.
2012-01-04 03:21 . 2012-01-04 03:21 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\PCHealth
2012-01-04 02:24 . 2009-08-06 18:23 274288 ----a-w- c:\windows\system32\mucltui.dll
2012-01-04 02:24 . 2009-08-06 18:23 215920 ----a-w- c:\windows\system32\muweb.dll
2012-01-04 02:24 . 2009-08-06 18:24 21728 ----a-w- c:\windows\system32\wucltui.dll.mui
2012-01-04 02:24 . 2009-08-06 18:24 15072 ----a-w- c:\windows\system32\wuaucpl.cpl.mui
2012-01-04 02:24 . 2009-08-06 18:24 15064 ----a-w- c:\windows\system32\wuapi.dll.mui
2012-01-04 02:24 . 2009-08-06 18:24 17632 ----a-w- c:\windows\system32\wuaueng.dll.mui
2012-01-04 01:50 . 2012-01-04 01:50 -------- d-----w- c:\windows\system32\wbem\Repository
2012-01-03 11:05 . 2012-01-04 01:41 -------- d-----w- c:\windows\LastGood(2)
2012-01-02 10:28 . 2012-01-04 01:48 -------- d-----w- c:\documents and settings\owner\Local Settings\Application Data\Google
2011-12-29 02:49 . 2011-12-29 02:49 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Mozilla
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-10 14:24 . 2011-11-03 16:37 20464 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-12-02 14:30 . 2011-11-03 16:18 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-27 21:18 . 2011-11-27 21:18 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-11-27 21:18 . 2011-11-27 21:18 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-11-26 18:23 . 2003-03-18 20:14 499712 ----a-w- c:\windows\system32\msvcp71.dll
2011-11-26 18:23 . 2003-02-21 02:42 348160 ----a-w- c:\windows\system32\msvcr71.dll
2011-11-03 16:24 . 2011-11-03 16:24 232512 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2011-10-19 06:28 . 2011-10-19 06:28 689664 ----a-w- c:\windows\system32\yowindow.scr
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VisualTaskTips"="c:\program files\VisualTaskTips\VisualTaskTips.exe" [2006-03-14 34816]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2011-08-02 4910912]
"AdobeBridge"="" [BU]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Smapp"="c:\program files\Analog Devices\SoundMAX\SMTray.exe" [2002-11-08 98304]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-09-16 8491008]
"nwiz"="nwiz.exe" [2007-09-16 1626112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-09-16 81920]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-09-23 258512]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2010-07-04 17408]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2011-11-26 202256]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-12-24 460872]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-25 437160]
.
c:\documents and settings\owner\Start Menu\Programs\Startup\
YoWindow.lnk - c:\program files\YoWindow\yowindow.exe [2011-9-17 759808]
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-03-30 04:59 937920 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-09-07 22:58 37296 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2004-11-02 18:24 32768 ----a-w- c:\program files\CyberLink\PowerDVD\PDVDServ.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4
"8559:TCP"= 8559:TCP:qjbudnlz
.
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [11/4/2011 7:50 PM 36000]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [11/3/2011 5:24 PM 232512]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [11/3/2011 5:37 PM 652872]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [11/3/2011 5:37 PM 20464]
S2 AntiVirSchedulerService;Avira Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [11/4/2011 7:50 PM 86224]
S2 jyblwxk;Microsoft Windows;c:\windows\system32\svchost.exe -k netsvcs [8/3/2004 11:56 PM 14336]
S3 N100;Compaq Ethernet or Fast Ethernet NIC Driver;c:\windows\system32\drivers\n100325.sys [4/23/2007 9:13 AM 128000]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - IPFILTERDRIVER
*NewlyCreated* - MBAMPROTECTOR
*NewlyCreated* - MBAMSERVICE
*NewlyCreated* - RSVP
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
jyblwxk
.
Contents of the 'Scheduled Tasks' folder
.
2012-01-06 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-670792205-2225589205-3563514748-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 02:02]
.
2011-12-24 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-670792205-2225589205-3563514748-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 02:02]
.
2012-01-06 c:\windows\Tasks\User_Feed_Synchronization-{EF5539D9-73C2-488E-899E-A6A99A167973}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Free YouTube Download - c:\documents and settings\owner\Application Data\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - c:\documents and settings\owner\Application Data\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
TCP: DhcpNameServer = 95.180.0.18 95.180.1.2
FF - ProfilePath - c:\documents and settings\owner\Application Data\Mozilla\Firefox\Profiles\kwcbr7em.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.rs/
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}
FF - Ext: RapidShare DownloadHelper: rsDownloadHelper@yevgenyandrov.net - %profile%\extensions\rsDownloadHelper@yevgenyandrov.net
FF - Ext: 1-Click YouTube Video Downloader: YoutubeDownloader@PeterOlayev.com - %profile%\extensions\YoutubeDownloader@PeterOlayev.com
FF - Ext: Facebook Phishing Protector: {023e9ca0-63f3-47b1-bcb2-9badf9d9ef28} - %profile%\extensions\{023e9ca0-63f3-47b1-bcb2-9badf9d9ef28}
FF - Ext: Linkification: {35106bca-6c78-48c7-ac28-56df30b51d2a} - %profile%\extensions\{35106bca-6c78-48c7-ac28-56df30b51d2a}
FF - Ext: Free YouTube Download (Free Studio) Menu: {ACAA314B-EEBA-48e4-AD47-84E31C44796C} - %profile%\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
FF - Ext: Greasemonkey: {e4a8a97b-f2ed-450b-b12d-ee082ba24781} - %profile%\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
.
- - - - ORPHANS REMOVED - - - -
.
HKCU-Run-AdobeBridge - (no file)
MSConfigStartUp-BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Common Files\Ahead\lib\NMBgMonitor.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, gmer.net
Rootkit scan 2012-01-06 04:22
Windows 5.1.2600 Service Pack 3 NTFS
.
detected NTDLL code modification:
ZwEnumerateValueKey, ZwQueryDirectoryFile
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Rcaeav = c:\documents and settings\owner\Application Data\Rcaeav.exe
.
scanning hidden files ...
.
.
c:\documents and settings\owner\Application Data\Rcaeav.exe 83456 bytes executable
.
scan completed successfully
hidden files: 1
.
**************************************************************************
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Rcaeav"="c:\\Documents and Settings\\owner\\Application Data\\Rcaeav.exe"
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\jyblwxk]
"ServiceDll"="c:\windows\system32\iimsikty.dll"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(640)
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
c:\windows\system32\WININET.dll
.
Completion time: 2012-01-06 04:26:17
ComboFix-quarantined-files.txt 2012-01-06 03:26
.
Pre-Run: 34.518.896.640 bytes free
Post-Run: 34.732.343.296 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - FF3FE5BAD0953C0D965F45CD8FF71DDF


mycity.rs/must-login.png





Posle ComboFix-a restartovao sam komp i izasla su ova 3 prozorcica










Poslao: 06 Jan 2012 13:36
Idi na vrh
offline
  • Pridružio: 02 Feb 2008
  • Poruke: 14018
  • Gde živiš: Nish

Nadam se da nisi, i nemoj dok ti to ne zatrazim, prikljucivao usb memorijske uredjaje.





Arrow

Otvoriti Notepad i iskopirati sledeci tekst:

KillAll::

File::
c:\documents and settings\owner\Application Data\Rcaeav.exe
c:\windows\system32\iimsikty.dll

Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8559:TCP"=-
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Rcaeav"=-
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"=dword:00000001

Driver::
jyblwxk

NetSvc::
jyblwxk


Snimiti na Desktop fajl iz Notepada kao "CFScript"




Prevuci snimljeni skript/tekst na ComboFix ikonicu kao na slici.
Postaviti u sledecoj poruci log koji bude bio napravljen na kraju ciscenja/skeniranja.







goran9888 (AMF Tim)

Poslao: 07 Jan 2012 08:44
Idi na vrh
offline
  • Stefanovic
  • Pridružio: 02 Nov 2011
  • Poruke: 144
  • Gde živiš: Nis

Nisam prikljucivao nikakve usb memorijske uredjaje.......niti sam do sada na kompu

Kada prevucem snimljeni skript/tekst na ComboFix ,pocfne da radi i ukoci komp ,tako da je sve "mrtvo" i moram ga resetovati da bih mogao ponovo i isto se desava ,ComboFix izbaci propzorcic i ne odradi vec zablokiraju sve funkcije.......pa popnovo restart .....

Sta uraditi dalje?

Poslao: 07 Jan 2012 12:59
Idi na vrh
offline
  • Pridružio: 02 Feb 2008
  • Poruke: 14018
  • Gde živiš: Nish

cilitis ::Kada prevucem snimljeni skript/tekst na ComboFix ,pocfne da radi i ukoci komp ,tako da je sve "mrtvo" i moram ga resetovati da bih mogao ponovo i isto se desava ,ComboFix izbaci propzorcic i ne odradi vec zablokiraju sve funkcije.......pa popnovo restart .....

Sta uraditi dalje?


AV (Avira) je iskljucen u tom trenutku? Obrisi taj ComboFix sa Desktop-a, skini novu verziju sa ove adrese i snimi je opet na Desktop: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Zatim pokusaj ponovo da napravis skriptu i prevuces je na ComboFix ikonu.







goran9888 (AMF Tim)

Poslao: 08 Jan 2012 02:05
Idi na vrh
offline
  • Stefanovic
  • Pridružio: 02 Nov 2011
  • Poruke: 144
  • Gde živiš: Nis

mycity.rs/must-login.png

ComboFix 12-01-07.02 - owner 08.01.2012 1:44.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.512.190 [GMT 1:00]
Running from: d:\my documents\Downloads\ComboFix.exe
Command switches used :: c:\documents and settings\owner\Desktop\CFScript.txt
.
FILE ::
"c:\documents and settings\owner\Application Data\Rcaeav.exe"
"c:\windows\system32\iimsikty.dll"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\owner\Application Data\2.tmp
c:\documents and settings\owner\Application Data\21.tmp
c:\documents and settings\owner\Application Data\3.tmp
c:\documents and settings\owner\Application Data\4.tmp
c:\documents and settings\owner\Application Data\5.tmp
c:\documents and settings\owner\Application Data\6.tmp
c:\documents and settings\owner\Application Data\7.tmp
c:\documents and settings\owner\Application Data\8.tmp
c:\documents and settings\owner\Application Data\9.tmp
c:\documents and settings\owner\Application Data\A.tmp
c:\documents and settings\owner\Application Data\A6.tmp
c:\documents and settings\owner\Application Data\A7.tmp
c:\documents and settings\owner\Application Data\A8.tmp
c:\documents and settings\owner\Application Data\Rcaeav.exe
c:\windows\aadrive32.exe
c:\windows\system32\iimsikty.dll
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_JYBLWXK
-------\Service_jyblwxk
.
.
((((((((((((((((((((((((( Files Created from 2011-12-08 to 2012-01-08 )))))))))))))))))))))))))))))))
.
.
2012-01-07 07:19 . 2012-01-07 07:19 -------- d-----w- c:\documents and settings\owner\Application Data\Qualys
2012-01-04 03:21 . 2012-01-04 03:21 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\PCHealth
2012-01-04 02:24 . 2009-08-06 18:23 274288 ----a-w- c:\windows\system32\mucltui.dll
2012-01-04 02:24 . 2009-08-06 18:23 215920 ----a-w- c:\windows\system32\muweb.dll
2012-01-04 02:24 . 2009-08-06 18:24 21728 ----a-w- c:\windows\system32\wucltui.dll.mui
2012-01-04 02:24 . 2009-08-06 18:24 15072 ----a-w- c:\windows\system32\wuaucpl.cpl.mui
2012-01-04 02:24 . 2009-08-06 18:24 15064 ----a-w- c:\windows\system32\wuapi.dll.mui
2012-01-04 02:24 . 2009-08-06 18:24 17632 ----a-w- c:\windows\system32\wuaueng.dll.mui
2012-01-04 01:50 . 2012-01-04 01:50 -------- d-----w- c:\windows\system32\wbem\Repository
2012-01-03 11:05 . 2012-01-04 01:41 -------- d-----w- c:\windows\LastGood(2)
2012-01-02 10:28 . 2012-01-04 01:48 -------- d-----w- c:\documents and settings\owner\Local Settings\Application Data\Google
2011-12-29 02:49 . 2011-12-29 02:49 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Mozilla
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-10 14:24 . 2011-11-03 16:37 20464 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-12-02 14:30 . 2011-11-03 16:18 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-27 21:18 . 2011-11-27 21:18 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-11-27 21:18 . 2011-11-27 21:18 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-11-26 18:23 . 2003-03-18 20:14 499712 ----a-w- c:\windows\system32\msvcp71.dll
2011-11-26 18:23 . 2003-02-21 02:42 348160 ----a-w- c:\windows\system32\msvcr71.dll
2011-11-03 16:24 . 2011-11-03 16:24 232512 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2011-10-19 06:28 . 2011-10-19 06:28 689664 ----a-w- c:\windows\system32\yowindow.scr
.
.
((((((((((((((((((((((((((((( SnapShot@2012-01-06_03.22.48 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-01-08 00:56 . 2012-01-08 00:56 16384 c:\windows\temp\Perflib_Perfdata_4b4.dat
+ 2001-08-23 12:00 . 2012-01-08 00:32 67312 c:\windows\system32\perfc009.dat
- 2001-08-23 12:00 . 2012-01-06 01:46 67312 c:\windows\system32\perfc009.dat
+ 2001-08-23 12:00 . 2012-01-08 00:32 432356 c:\windows\system32\perfh009.dat
- 2001-08-23 12:00 . 2012-01-06 01:46 432356 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VisualTaskTips"="c:\program files\VisualTaskTips\VisualTaskTips.exe" [2006-03-14 34816]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2011-08-02 4910912]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Smapp"="c:\program files\Analog Devices\SoundMAX\SMTray.exe" [2002-11-08 98304]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-09-16 8491008]
"nwiz"="nwiz.exe" [2007-09-16 1626112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-09-16 81920]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-09-23 258512]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2010-07-04 17408]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2011-11-26 202256]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-12-24 460872]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-25 437160]
.
c:\documents and settings\owner\Start Menu\Programs\Startup\
YoWindow.lnk - c:\program files\YoWindow\yowindow.exe [2011-9-17 759808]
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-03-30 04:59 937920 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-09-07 22:58 37296 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2004-11-02 18:24 32768 ----a-w- c:\program files\CyberLink\PowerDVD\PDVDServ.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4
.
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [11/4/2011 7:50 PM 36000]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [11/3/2011 5:24 PM 232512]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [11/3/2011 5:37 PM 20464]
S3 N100;Compaq Ethernet or Fast Ethernet NIC Driver;c:\windows\system32\drivers\n100325.sys [4/23/2007 9:13 AM 128000]
.
Contents of the 'Scheduled Tasks' folder
.
2012-01-08 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-670792205-2225589205-3563514748-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 02:02]
.
2011-12-24 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-670792205-2225589205-3563514748-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 02:02]
.
2012-01-08 c:\windows\Tasks\User_Feed_Synchronization-{EF5539D9-73C2-488E-899E-A6A99A167973}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Free YouTube Download - c:\documents and settings\owner\Application Data\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - c:\documents and settings\owner\Application Data\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
TCP: DhcpNameServer = 95.180.0.18 95.180.1.2
FF - ProfilePath - c:\documents and settings\owner\Application Data\Mozilla\Firefox\Profiles\kwcbr7em.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.rs/
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}
FF - Ext: RapidShare DownloadHelper: rsDownloadHelper@yevgenyandrov.net - %profile%\extensions\rsDownloadHelper@yevgenyandrov.net
FF - Ext: 1-Click YouTube Video Downloader: YoutubeDownloader@PeterOlayev.com - %profile%\extensions\YoutubeDownloader@PeterOlayev.com
FF - Ext: Facebook Phishing Protector: {023e9ca0-63f3-47b1-bcb2-9badf9d9ef28} - %profile%\extensions\{023e9ca0-63f3-47b1-bcb2-9badf9d9ef28}
FF - Ext: Linkification: {35106bca-6c78-48c7-ac28-56df30b51d2a} - %profile%\extensions\{35106bca-6c78-48c7-ac28-56df30b51d2a}
FF - Ext: Free YouTube Download (Free Studio) Menu: {ACAA314B-EEBA-48e4-AD47-84E31C44796C} - %profile%\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
FF - Ext: Greasemonkey: {e4a8a97b-f2ed-450b-b12d-ee082ba24781} - %profile%\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
FF - Ext: QualysBrowserCheck: {7D2FB79E-E58C-4DB5-A36F-AC1C73967F4D} - %profile%\extensions\{7D2FB79E-E58C-4DB5-A36F-AC1C73967F4D}
FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, gmer.net
Rootkit scan 2012-01-08 01:56
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(648-)
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
.
- - - - - - - > 'explorer.exe'(3100)
c:\windows\system32\WININET.dll
c:\program files\Unlocker\UnlockerHook.dll
c:\program files\VisualTaskTips\VttHooks.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe
c:\windows\system32\RUNDLL32.EXE
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\nvsvc32.exe
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Avira\AntiVir Desktop\sched.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\dwwin.exe
c:\program files\Internet Explorer\IEXPLORE.EXE
c:\program files\Internet Explorer\IEXPLORE.EXE
.
**************************************************************************
.
Completion time: 2012-01-08 01:58:47 - machine was rebooted
ComboFix-quarantined-files.txt 2012-01-08 00:58
ComboFix2.txt 2012-01-06 03:26
.
Pre-Run: 34.653.261.824 bytes free
Post-Run: 34.566.922.240 bytes free
.
- - End Of File - - C5AC624AC62A5F9C1C9348E04371D0FD

Poslao: 08 Jan 2012 02:11
Idi na vrh
offline
  • Pridružio: 02 Feb 2008
  • Poruke: 14018
  • Gde živiš: Nish

Kakvo je sada stanje sistema? Imas li problema?




Arrow

- Preuzmi USBNoRisk na Desktop i pokreni ga duplim klikom na ikonicu programa.
- Sacekaj koji sekund dok program izvrsi inicijalno skeniranje.
- Ubacuj sve USB memorijske uredjaje redom u USB slot i svaki zadrzi u slotu po 10 sekundi.
- Ukoliko imas vise uredjaja za proveru, onda na parcetu papira zapisi kojim redom su ubacivani jer ce nam kasnije trebati taj podatak
- Kada zavrsis sa svim uredjajima, klikni desno dugme misa na sred prozora programa i odaberi opciju Save scrambled log. To ce automatski otvoriti log u Notepadu. Iskopiraj nam taj log iz Notepada na forum.

Objasnjenje: U USB memorijske uredjaje spadaju svi oni uredjaji koji po prikljucivanju na kompjuter dobijaju svoju oznaku particije. Tu spadaju USB flash drajvovi, eksterni hard-diskovi, memorijske kartice, MP3 i MP4 plejeri, neki mobilni telefoni, neki GPS (navigacioni) uredjaji itd.









goran9888 (AMF Tim)

Poslao: 08 Jan 2012 02:30
Idi na vrh
offline
  • Stefanovic
  • Pridružio: 02 Nov 2011
  • Poruke: 144
  • Gde živiš: Nis

Gorane hvala puno ,sad sam restartovao komp posle savega uiradjenog, prvo je sve ukocio ,znaci opet mrtav pa sam ponovo restartovao i izbacio je ova dva prozorcica









I upozorenje iz windows security alerts da mi je sistem nezasticen......

Da li trebam sada pustiti Malwarebytes Anti-Malware da proverim ili vec sta mi predlazes

Poslao: 08 Jan 2012 02:36
Idi na vrh
offline
  • Pridružio: 02 Feb 2008
  • Poruke: 14018
  • Gde živiš: Nish

Reinstaliraj Aviru - deinstaliraj je iz Control panel -> Add or Remove programs, restartuj sistem pa je ponovo instaliraj. Odavde mozes da je skines: http://www.avira.com/en/avira-free-antivirus


Pokreni slobodno MBAM i ostavi izvestaj ovde ako nesto bude detektovano. Samo idi na Quick Scan.










goran9888 (AMF Tim)

MyCity » Ambulanta -> Arhiva Ambulante » Problem sa virusom

Ko je trenutno na forumu
 

Ukupno su 1001 korisnika na forumu :: 31 registrovanih, 3 sakrivenih i 967 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: A.R.Chafee.Jr., babaroga, Ben Roj, bestguarder, Bobrock1, cifra, cikadeda, djboj, ILGromovnik, JimmyNapoli, Koridor, Kubovac, kunktator, LUDI, Marko Marković, mačković, Metanoja, Miki01, miodrag, moldway, Nemanja.M, nextyamb, pein, Prašinar, rovac, Shinobi, sombrero, theNedjeljko, vaso1, Viktor Petrenko, Vlada1389