bobby ::Onda je to temp fajl kog kreira Trend Micro, svaki put ima drugo ime.
Sto se tice loga, ne vidim nista sporno.
Skini ComboFix sa jedne od sledecih adresa:
http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Startuj ga i ne diraj prozor programa dok skenira.
Sledi uputstva na ekranu. Kada zavrsi pojavice se log koji ces nam ovde iskopirati.
OK bobby ali tek u subotu posto sam tad dezuran na poslu,hvala ti
Dopuna: 13 Okt 2007 8:32
bobby evo loga
ComboFix 07-10-12.4 - Golub 2007-10-13 8:28:22.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.66 [GMT 2:00]
Running from: C:\Documents and Settings\Golub\Desktop\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((( Files Created from 2007-09-13 to 2007-10-13 )))))))))))))))))))))))))))))))
.
2007-10-13 08:27 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-10 23:14 <DIR> d-------- C:\Program Files\BitLord
2007-10-10 23:09 <DIR> d-------- C:\WINDOWS\Desktop
2007-10-10 23:05 <DIR> d-------- C:\Program Files\FreshDevices
2007-10-01 09:49 <DIR> d-------- C:\Program Files\Mv2Player
2007-09-28 19:36 <DIR> d-------- C:\Program Files\MSXML 4.0
2007-09-27 22:00 <DIR> d-------- C:\Documents and Settings\Golub\Application Data\BSplayer Pro
2007-09-27 16:58 <DIR> d-------- C:\Program Files\The KMPlayer
2007-09-27 10:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Nokia
2007-09-26 17:18 <DIR> d-------- C:\Program Files\Oracle
2007-09-26 17:18 <DIR> d-------- C:\Documents and Settings\Golub\WINDOWS
2007-09-26 17:18 <DIR> d-------- C:\Documents and Settings\Golub\Oracle Jar Cache
2007-09-26 17:18 <DIR> d-------- C:\Documents and Settings\Golub\.jinit
2007-09-26 17:18 305,152 --a------ C:\WINDOWS\IsUninst.exe
2007-09-24 21:45 <DIR> d-------- C:\Documents and Settings\Golub\Phone Browser
2007-09-24 21:43 <DIR> d-------- C:\Program Files\Common Files\PCSuite
2007-09-24 21:43 <DIR> d-------- C:\Program Files\Common Files\Nokia
2007-09-24 21:43 <DIR> d-------- C:\Documents and Settings\Golub\Application Data\Nokia
2007-09-24 21:43 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PC Suite
2007-09-24 21:42 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2007-09-24 21:42 <DIR> d-------- C:\Program Files\PC Connectivity Solution
2007-09-24 21:42 <DIR> d-------- C:\Program Files\Nokia
2007-09-24 21:42 <DIR> d-------- C:\Program Files\DIFX
2007-09-24 21:42 <DIR> d-------- C:\Documents and Settings\Golub\Application Data\PC Suite
2007-09-24 21:42 137,216 --a------ C:\WINDOWS\system32\drivers\nmwcd.sys
2007-09-24 21:42 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll
2007-09-24 21:42 65,536 --a------ C:\WINDOWS\system32\nmwcdcocls.dll
2007-09-24 21:42 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys
2007-09-24 21:42 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcj.sys
2007-09-24 21:42 8,320 --a------ C:\WINDOWS\system32\drivers\nmwcdc.sys
2007-09-24 21:41 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Installations
2007-09-24 21:13 118,520 --------- C:\WINDOWS\system32\pxinsi64.exe
2007-09-24 21:13 118,056 --------- C:\WINDOWS\system32\pxcpyi64.exe
2007-09-20 21:17 <DIR> d-------- C:\Program Files\Common Files\Adobe
2007-09-20 21:08 66,592 --a------ C:\WINDOWS\unTMV.exe
2007-09-18 06:51 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2007-09-18 06:46 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2007-09-16 18:58 2,180,352 -----c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2007-09-16 18:58 2,136,064 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2007-09-16 18:58 2,057,600 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2007-09-16 18:58 2,015,744 -----c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2007-09-15 18:31 <DIR> d-------- C:\Documents and Settings\Golub\Application Data\AdobeUM
2007-09-15 11:54 <DIR> d-------- C:\Documents and Settings\Golub\Application Data\Ahead
2007-09-15 10:21 <DIR> d-------- C:\Program Files\Trend Micro
2007-09-14 20:16 545 --a------ C:\WINDOWS\UC.PIF
2007-09-14 20:16 545 --a------ C:\WINDOWS\RAR.PIF
2007-09-14 20:16 545 --a------ C:\WINDOWS\PKZIP.PIF
2007-09-14 20:16 545 --a------ C:\WINDOWS\PKUNZIP.PIF
2007-09-14 20:16 545 --a------ C:\WINDOWS\NOCLOSE.PIF
2007-09-14 20:16 545 --a------ C:\WINDOWS\LHA.PIF
2007-09-14 20:16 545 --a------ C:\WINDOWS\ARJ.PIF
2007-09-14 19:27 98,304 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2007-09-14 19:04 <DIR> d-------- C:\Program Files\Common Files\DirectX
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-19 11:45 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-09-19 11:45 --------- d-----w C:\Program Files\Yahoo!
2007-09-19 11:30 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-09-12 18:10 --------- d-----w C:\Program Files\ffdshow
2007-09-12 18:09 --------- d-----w C:\Program Files\XP Codec Pack
2007-09-12 18:01 --------- d-----w C:\Program Files\Ahead
2007-09-12 18:00 --------- d-----w C:\Program Files\Common Files\Ahead
2007-09-12 17:48 --------- d-----w C:\Program Files\Winamp
2007-09-12 09:27 --------- d-----w C:\Program Files\CONEXANT
2007-09-12 09:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip
2007-09-12 09:18 --------- d-----w C:\Program Files\Realtek Sound Manager
2007-09-12 09:18 --------- d-----w C:\Program Files\AvRack
2007-09-12 09:17 --------- d-----w C:\Program Files\SiS VGA Utilities V3.65f
2007-09-12 09:16 --------- d-----w C:\Program Files\sisagp
2007-09-12 09:15 17,801 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys
2007-09-12 09:15 --------- d-----w C:\Program Files\Atheros
2007-09-12 08:17 --------- d-----w C:\Program Files\microsoft frontpage
2007-08-30 04:33 43,528 ------w C:\WINDOWS\system32\drivers\PxHelp20.sys
2007-07-31 16:33 60,273 ----a-w C:\WINDOWS\system32\pthreadGC2.dll
2007-07-31 16:33 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2007-07-30 17:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-07-30 17:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-07-30 17:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-07-30 17:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
2007-07-30 17:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-07-30 17:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-07-30 17:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-07-30 17:18 33,624 ----a-w C:\WINDOWS\system32\wups.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ACU"="C:\Program Files\Atheros\ACU.exe" [2005-01-31 08:05]
"SiSPower"="SiSPower.dll" [2005-02-25 19:35 C:\WINDOWS\system32\SiSPower.dll]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 00:56 C:\WINDOWS\system32\bthprops.cpl]
"OfficeScanNT Monitor"="C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" [2006-10-27 16:08]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 15:10]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Nokia.PCSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Utility Tray.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Utility Tray.lnk
backup=C:\WINDOWS\pss\Utility Tray.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt]
"C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiS Windows KeyHook]
C:\WINDOWS\system32\keyhook.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
SOUNDMAN.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe
R2 ntrtscan;OfficeScanNT RealTime Scan;"C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe"
R2 tmlisten;OfficeScanNT Listener;"C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe"
R2 TmPreFilter;Trend Micro PreFilter;\??\C:\Program Files\Trend Micro\OfficeScan Client\TmPreFlt.sys
R3 HSFHWSIS;HSFHWSIS;C:\WINDOWS\system32\DRIVERS\HSFHWSIS.sys
*Newly Created Service* - CATCHME
.
**************************************************************************
catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-13 08:29:38
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-10-13 8:30:35
.
--- E O F ---
|