MyCity » Ambulanta -> Arhiva Ambulante » Racunar mi je zarazen...

Racunar mi je zarazen...

Napisano na dan: 30.6.2009
1

Racunar mi je zarazen...
Sledeća strana Pagination

Idi na vrh

Poslao: 30 Jun 2009 19:47
Idi na vrh
offline
  • Jocic 
  • Novi MyCity građanin
  • Pridružio: 30 Jun 2009
  • Poruke: 6

AVG mi prijavljuje 2 virusa : win32/tanatos.M i win32/heur ...
Evo loga :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:45:28 PM, on 6/30/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\Ivan\temp\TeamViewer\Version4\TeamViewer.exe
D:\Anti virus\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = [Link mogu videti samo ulogovani korisnici]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [Link mogu videti samo ulogovani korisnici]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [Link mogu videti samo ulogovani korisnici]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [Link mogu videti samo ulogovani korisnici]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [Link mogu videti samo ulogovani korisnici]
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = [Link mogu videti samo ulogovani korisnici]
R3 - URLSearchHook: (no name) - {9CB65206-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Ask Search Assistant BHO - {9CB65201-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: Ask Toolbar BHO - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: Ask Toolbar - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [Gainward] C:\WINDOWS\TBPanel.exe /A
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Google Quick Search Box] "C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe" /autorun
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [yt8a] C:\WINDOWS\system32\yt8a.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Ivan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BlueSoleil.lnk = ?
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - Unknown owner - C:\PROGRA~1\AVG\AVG8\avgemc.exe (file missing)
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Google Software Updater (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Unknown owner - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe (file missing)
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe

--
End of file - 9782 bytes



Poslao: 30 Jun 2009 20:56
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Pozdrav...



Arrow Preuzmi sUBs-ov ComboFix sa jedne od sledećih adresa na Desktop:


Bleeping Computer . . . . . Geeks to Go!
Klikni desnim tasterom na neki od linkova i odaberi opciju Save Target As... (Save Link As..., Save Linked Content As... ili sličnu);
Kada se otvori dijalog za izbor lokacije na kojoj treba sačuvati file, odaberi Desktop i klikni Save.



Kada preuzimanje programa bude završeno:
zatvori pokrenute programe;
deaktiviraj zaštitni softver (uputstvo);
dvoklikom pokreni program ComboFix.
U toku rada, ComboFix će:proveriti postoji li novija verzija programa:
klikni Yes ako bude ponuđeno preuzimanje iste. prikazati DISCLAIMER OF WARRANTY ON SOFTWARE:
klikni Yes kako bi proces bio nastavljen.ako Recovery Console nije instalirana, ponuditi instalaciju:
prihvati klikom na Yes i isprati postupak.postaviti/dati određeni broj upita/obaveštenja:
prihvati klikom na Yes ili OK.po potrebi, restartovati Windows (više puta);
na kraju rada, otvoriti Notepad sa izveštajem o skeniranju.

Iskopiraj izveštaj koji je ComboFix napravio u temu na forumu:
klikni desnim tasterom miša u prozor Notepad-a i izaberi Select All;
klikni desnim tasterom miša na obeleženi tekst i izaberi Copy;
klikni desnim tasterom miša u polje za pisanje poruke i izaberi Paste.

Napomena:Izveštaj će biti sačuvan pod nazivom ComboFix.txt na sistemskoj particiji (tipična lokacija: C:\ComboFix.txt);
Ukoliko nakon slanja poruke primetiš da izveštaj nije kompletan, iskoristi opciju Prikači fajl za prilaganje file-a C:\ComboFix.txt uz poruku.



Poslao: 01 Jul 2009 12:16
Idi na vrh
offline
  • Jocic 
  • Novi MyCity građanin
  • Pridružio: 30 Jun 2009
  • Poruke: 6

ComboFix 09-06-29.07 - Ivan 07/01/2009 12:06.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.564 [GMT 4.5:30]
Running from: c:\documents and settings\Ivan\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: Kaspersky Internet Security *On-access scanning disabled* (Outdated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\AutoRun.inf
D:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2009-06-01 to 2009-07-01 )))))))))))))))))))))))))))))))
.

2009-06-30 14:46 . 2009-07-01 07:30 -------- d--h--w- C:\$AVG8.VAULT$
2009-06-30 14:43 . 2009-06-30 14:43 -------- d-----w- c:\documents and settings\Ivan\Application Data\TeamViewer
2009-06-30 14:39 . 2009-06-30 14:39 -------- d-----w- c:\documents and settings\Ivan\temp
2009-06-30 11:41 . 2009-06-30 11:41 -------- d-----w- c:\documents and settings\Ivan\Local Settings\Application Data\AVG Security Toolbar
2009-06-30 11:31 . 2009-06-30 11:31 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-06-30 11:31 . 2009-06-30 11:31 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-06-30 11:31 . 2009-06-30 11:31 327688 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-06-30 11:31 . 2009-06-30 11:31 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-06-30 11:31 . 2009-06-30 12:34 -------- d-----w- c:\windows\system32\drivers\Avg
2009-06-30 11:31 . 2009-06-30 11:31 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2009-06-30 11:30 . 2009-06-30 11:30 -------- d-----w- c:\program files\AVG
2009-06-30 11:30 . 2009-06-30 11:30 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-06-30 11:12 . 2009-06-30 11:12 -------- d-----w- c:\documents and settings\Ivan\Application Data\Malwarebytes
2009-06-30 11:12 . 2009-06-17 06:57 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-30 11:12 . 2009-06-30 11:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-30 11:12 . 2009-06-17 06:57 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-28 12:58 . 2009-06-30 11:25 -------- d-sh--r- C:\Win
2009-06-22 15:18 . 2009-06-30 14:46 -------- d-----w- c:\program files\18 WoS Across America
2009-06-08 12:17 . 2009-06-08 12:17 -------- d-----w- c:\windows\Sun
2009-06-03 18:30 . 2009-06-30 14:46 110592 ----a-w- c:\documents and settings\Ivan\Application Data\U3\temp\cleanup.exe
2009-06-03 18:25 . 2009-06-03 18:25 -------- d-----w- c:\program files\Common Files\SWF Studio
2009-06-03 18:25 . 2009-06-03 18:30 -------- d-----w- c:\documents and settings\Ivan\Application Data\U3
2009-06-01 13:32 . 2009-06-01 13:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Bluetooth
2009-06-01 13:27 . 2009-06-01 13:27 -------- d-----w- c:\program files\IVT Corporation

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-01 07:39 . 2009-04-09 19:42 -------- d-----w- c:\documents and settings\Ivan\Application Data\Skype
2009-07-01 03:56 . 2009-04-10 08:47 -------- d-----w- c:\documents and settings\Ivan\Application Data\skypePM
2009-06-30 14:55 . 2009-04-10 11:43 -------- d-----w- c:\program files\Trend Micro
2009-06-30 14:54 . 2007-07-23 01:41 1699840 ----a-w- c:\windows\system32\nwiz.exe
2009-06-30 14:50 . 2009-04-08 19:24 2240512 ----a-w- c:\windows\TBPanel.exe
2009-06-30 14:47 . 2009-04-10 10:52 -------- d-----w- c:\program files\Valve
2009-06-30 14:46 . 2009-05-17 11:25 -------- d-----w- c:\program files\LimeWire
2009-06-30 12:15 . 2009-05-17 11:29 -------- d-----w- c:\documents and settings\Ivan\Application Data\LimeWire
2009-06-22 15:19 . 2009-04-10 10:52 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-22 14:36 . 2009-04-08 19:19 -------- d-----w- c:\program files\Common Files\InstallShield
2009-06-03 11:56 . 2009-05-09 05:30 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-05-25 14:29 . 2009-05-25 14:29 -------- d-----w- c:\program files\NeroInstall.bak
2009-05-25 14:28 . 2009-04-10 13:41 -------- d-----w- c:\documents and settings\Ivan\Application Data\Nero
2009-05-25 14:26 . 2009-04-10 13:06 -------- d-----w- c:\program files\Common Files\Nero
2009-05-25 14:25 . 2009-04-10 13:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Nero
2009-05-25 14:25 . 2009-04-10 13:07 -------- d-----w- c:\program files\Nero
2009-05-25 14:21 . 2009-05-25 14:21 -------- d-----w- c:\program files\AskTBar
2009-05-19 15:50 . 2009-04-08 19:58 -------- d-----w- c:\program files\Mozilla Firefox 3.1 Beta 2
2009-05-17 11:28 . 2009-05-17 11:28 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-05-17 11:28 . 2009-05-17 11:28 -------- d-----w- c:\program files\Java
2009-05-17 11:27 . 2009-05-17 11:27 152576 ----a-w- c:\documents and settings\Ivan\Application Data\Sun\Java\jre1.6.0_11\lzma.dll
2009-05-15 16:17 . 2009-05-15 16:16 -------- d-----w- c:\program files\Nero 7
2009-05-15 11:32 . 2009-05-15 11:32 -------- d-----w- c:\program files\Ahead
2009-05-14 05:35 . 2009-05-14 05:34 -------- d-----w- c:\program files\Google
2009-05-07 15:32 . 2008-04-14 08:00 345600 ----a-w- c:\windows\system32\localspl.dll
2009-04-29 04:56 . 2008-04-23 00:16 827392 ----a-w- c:\windows\system32\wininet.dll
2009-04-29 04:55 . 2008-07-12 19:10 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-04-17 16:10 . 2009-04-17 16:10 717296 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-04-17 12:26 . 2008-04-14 08:00 1847168 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 14:51 . 2008-04-14 08:00 585216 ----a-w- c:\windows\system32\rpcrt4.dll
2009-04-13 08:43 . 2009-04-08 19:10 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-04-10 12:30 . 2009-04-10 12:30 315392 ----a-w- c:\windows\HideWin.exe
2009-04-10 08:47 . 2009-04-10 08:47 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-04-08 20:18 . 2009-04-08 19:17 12912 ----a-w- c:\documents and settings\Ivan\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-08 19:58 . 2009-04-08 19:58 0 ----a-w- c:\windows\nsreg.dat
2009-04-08 19:07 . 2009-04-08 19:07 21640 ----a-w- c:\windows\system32\emptyregdb.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-06-14 11:37 1004800 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-09-23 21755688]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-29 687560]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-05-14 39408]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2009-06-30 1896448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gainward"="c:\windows\TBPanel.exe" [2009-06-30 2240512]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-07-23 8466432]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-07-23 81920]
"Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-05-14 68592]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-17 206232]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2009-06-30 2289664]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-06-30 1948440]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2009-06-30 1699840]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-05-10 16342528]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-06-30 11:31 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"UacDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"c:\\WINDOWS\\system32\\nwiz.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\WINDOWS\\system32\\svchost.exe"=
"c:\\WINDOWS\\TBPanel.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\jusched.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgtray.exe"=
"d:\\Anti virus\\Malwarebytes' Anti-Malware\\mbam.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [6/30/2009 4:01 PM 327688]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [6/30/2009 4:01 PM 108552]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [6/30/2009 4:00 PM 298776]
S2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe --> c:\progra~1\AVG\AVG8\avgemc.exe [?]
.
Contents of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Google Update - c:\documents and settings\Ivan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
HKLM-Run-WinampAgent - c:\program files\Winamp\winampa.exe
HKLM-Run-NeroFilterCheck - c:\program files\Common Files\Nero\Lib\NeroCheck.exe
HKLM-Run-yt8a - c:\windows\system32\yt8a.exe


.
------- Supplementary Scan -------
.
uStart Page = [Link mogu videti samo ulogovani korisnici]
FF - ProfilePath - c:\documents and settings\Ivan\Application Data\Mozilla\Firefox\Profiles\rvu6uyjc.default\
FF - prefs.js: browser.startup.homepage - [Link mogu videti samo ulogovani korisnici]
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll
FF - plugin: c:\documents and settings\Ivan\Local Settings\Application Data\Google\Update\1.2.145.5\npGoogleOneClick8.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2009-07-01 12:09
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-07-01 12:11
ComboFix-quarantined-files.txt 2009-07-01 07:41

Pre-Run: 8,405,090,304 bytes free
Post-Run: 11,214,057,472 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer

182 --- E O F --- 2009-06-10 20:27

Poslao: 01 Jul 2009 16:43
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Kako glase nazivi file-ova koje AVG detektuje?

Poslao: 01 Jul 2009 21:31
Idi na vrh
offline
  • Jocic 
  • Novi MyCity građanin
  • Pridružio: 30 Jun 2009
  • Poruke: 6

"C:\Program Files\AVG\AVG8\avgcfgex.exe";"Virus found Win32/Heur";"Infected"
"C:\Program Files\AVG\AVG8\avgcmgr.exe";"Virus found Win32/Heur";"Infected"
"C:\Program Files\AVG\AVG8\avgdumpx.exe";"Virus identified Win32/Tanatos.M";"Infected"

Poslao: 01 Jul 2009 21:53
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Upload-uj ta tri file-a preko ovog linka: [Link mogu videti samo ulogovani korisnici]

Poslao: 01 Jul 2009 22:14
Idi na vrh
offline
  • Jocic 
  • Novi MyCity građanin
  • Pridružio: 30 Jun 2009
  • Poruke: 6

fajl je previse veliki, virus mi nije samo tu vec se prosirio po svim programima, sada ne mogu da ukljucim igrice neke....

Poslao: 01 Jul 2009 22:40
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Preuzmi Dr.Web CureIt (~13 MB).
Restartuj kompjuter u Safe Mode (uputstvo za Safe Mode)

Dvoklikom pokreni launch.exe, nakon čega će se pojaviti uvodni prozor - klikni Start

Pojaviće se obaveštenje o započinjanju uvodnog skeniranja - klikni OK

Sačekaj nekoliko minuta da Dr.Web CureIt izvrši Express Scan; ukoliko malware bude pronađen, klikom na taster Yes to All u prozoru koji se pojavi dozvoli programu da izvrši dezinfekciju

Klikni Options > Change settings F9; u prozoru koji će se otvoriti, dečekiraj opciju Heuristic Analysis a zatim klikni OK

U glavnom prozoru obeleži opciju Complete scan a zatim klikni i Dr.Web CureIt će započeti skeniranje

Ukoliko malware bude pronađen, klikom na taster Yes to All u prozoru koji se pojavi dozvoli programu da izvrši dezinfekciju

Kada skeniranje bude završeno, klikni Select all taster (ukoliko je dostupan), a zatim klikni Cure i,
u meniju koji se otvori, klikni Move incurable:


Po završetku procesa, klikni File > Save report list i sačuvaj log na Desktopu

Iskopiraj sadržaj Dr.Web CureIt loga u temu na forumu.

Poslao: 01 Jul 2009 23:09
Idi na vrh
offline
  • Jocic 
  • Novi MyCity građanin
  • Pridružio: 30 Jun 2009
  • Poruke: 6

ne mogu da udjem u safe mode, stalno mi restartuje komp kad god pokusam da ga startujem preko safe-a, jel moze drugacije da se odradi to....?

Poslao: 02 Jul 2009 16:21
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Skeniraj u Normal Mode-u.

MyCity » Ambulanta -> Arhiva Ambulante » Racunar mi je zarazen...

Ko je trenutno na forumu
 

Ukupno su 1141 korisnika na forumu :: 99 registrovanih, 11 sakrivenih i 1031 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 15694 - dana 01 Feb 2026 12:23

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: 100jan, 33 bren, acatomic, AF-1, Aristotle2002, bigvlada, bojan313, boro975, Borski1977, BOXRR, Brada64, Cirkon, debeli, del boy, desmeki, Df410, Djokislav, djonsule, DJUNTA, Djuza, DonRumataEstorski, draganl, Duk011, Dzoni70, EVIDENTICAR, fićo32, g_g, galerija, Georgius, GrobarPovratak, Herman Terrance Aubrey, Imperator_Aleksandr_lll, Jager715510, Jaz, Jester, jodzula, Kalu128338, Kobrim, kybonacci, LeGrandCharles, leopard83, Levi, Marko Marković, mercedesamg, Mercury, Miha79, mikrimaus, MiljanXD, Milo97, Milovan Dinic, Mis uz pusku, moldway, MrNo, nebkv, nelezele, Nepopravljivi, neutrino, nick79, nightwish 01, nixos, nuke92, OgnjenMitric, pablojepao, Panter, pceklic, Primus17, probisic, proka89, RajkoB, raso76, Resad76, rovac, sajorg, samo_srpski, Sarmat, sasics, Shilok, Sin Boskic, Sir Budimir, Sirius, SR-3m, Srki94, Srky Boy, srđan, StankoVrankovic, Steeeefan, t84dar, tooljan, Tragač, uruk, USSVoyager, VaRvArI 85, Velizar Laro, vidra boy, Vlada78, vobo, vuksa72, Zrcalo, Zuna77