MyCity » Ambulanta -> Arhiva Ambulante » "Win32\TrojanProxy.Small.NDB.trojan

"Win32\TrojanProxy.Small.NDB.trojan

Napisano na dan: 2.3.2009

"Win32\TrojanProxy.Small.NDB.trojan
Sledeća strana Pagination

Idi na vrh

Poslao: 02 Mar 2009 20:29
Idi na vrh
offline
  • Pridružio: 25 Okt 2006
  • Poruke: 93
  • Gde živiš: VOJVODINA/BANAT

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:02:23 PM, on 3/2/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\NVIDIA Corporation\System Update\UpdateCenterService.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\jwtch32.exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\GIGABYTE\Common\GNConfig.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Documents and Settings\Administrator\Desktop\New Folder\Tr3.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = [Link mogu videti samo ulogovani korisnici]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [Link mogu videti samo ulogovani korisnici]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [Link mogu videti samo ulogovani korisnici]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [Link mogu videti samo ulogovani korisnici]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [Link mogu videti samo ulogovani korisnici]
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {3711EEB0-1851-42C2-9ABD-C29470A5035C} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Microsoft netswitch] C:\WINDOWS\system32\jwtch32.exe
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_01] cmd.exe /c md "%USERPROFILE%\Local Settings\Temp" (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_02] rundll32 advpack.dll,DelNodeRunDLL32 "%SystemRoot%\System32\dllcache" (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_03] cmd.exe /c md "%SystemRoot%\System32\dllcache" (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_04] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_05] rundll32 advpack.dll,LaunchINFSection nlite.inf,nLiteReg (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_06] rundll32 advpack.dll,LaunchINFSection nlite.inf,S (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nlpo_01] cmd.exe /c md "%USERPROFILE%\Local Settings\Temp" (User 'NETWORK SERVICE')
O4 - Global Startup: Gigabyte Wireless Utility.lnk = C:\Program Files\GIGABYTE\Common\GNConfig.exe
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xport to Microsoft Excel - [Link mogu videti samo ulogovani korisnici]\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - [Link mogu videti samo ulogovani korisnici]\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: urqrpmkh - C:\WINDOWS\
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: Performance Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: Update Center Service (UpdateCenterService) - NVIDIA - C:\Program Files\NVIDIA Corporation\System Update\UpdateCenterService.exe

--
End of file - 6301 bytes

Tokom svakog startovanja Windowsa antivirus prijavljuje C:\Program Files\spooler.com da je zarazen"Win32\TrojanProxy.Small.NDB.trojan
Automatski se otvaraju non stop web stranice tipa, Universal101.com, pa neka reklama za igru, "Igraj bezplatno TRAVIAN".



Poslao: 02 Mar 2009 20:31
Idi na vrh
offline
  • diarno  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 15 Jun 2007
  • Poruke: 5572

* Pokreni ESET Smart Security/ESET NOD32 na sledeci nacin :
Start>All Programs>ESET>ESET Smart Security ili pak ESET NOD32 Antivirus(ukoliko koristis samo Antivirus resenje).

* Kada ti se otvori glavni prozor programa, klikni na Setup opciju sa leve strane prozora;
* Izaberi Antivirus and antispyware opciju i klikni na Temporarily disable Antivirus and antispyware protection.
* Na sledece pitanje klikni Yes.

Napomena: Ne zaboravi da ukljuciš ovu opciju po završetku cišcenja.

Skini ComboFix sa jedne od sledecih adresa na Desktop:
[Link mogu videti samo ulogovani korisnici]
[Link mogu videti samo ulogovani korisnici]
[Link mogu videti samo ulogovani korisnici]

Startuj ga i ne diraj prozor programa dok skenira.
Sledi uputstva na ekranu. Kada zavrsi pojavice se log (C:\ComboFix.txt) koji ces nam ovde iskopirati.



Poslao: 02 Mar 2009 21:41
Idi na vrh
offline
  • Pridružio: 25 Okt 2006
  • Poruke: 93
  • Gde živiš: VOJVODINA/BANAT

ComboFix 09-03-02.01 - Administrator 2009-03-02 21:31:05.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1358 [GMT 0:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
AV: ESET Smart Security 3.0 *On-access scanning disabled* (Updated)
FW: ESET Personal firewall *enabled*
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\system32\mcrh.tmp
c:\windows\system32\naoqmlqa.ini

----- BITS: Possible infected sites -----

[Link mogu videti samo ulogovani korisnici]
.
((((((((((((((((((((((((( Files Created from 2009-02-02 to 2009-03-02 )))))))))))))))))))))))))))))))
.

2009-03-02 21:03 . 2009-03-02 21:03 <DIR> d-------- c:\program files\Prevx
2009-03-02 21:03 . 2009-03-02 21:05 <DIR> d-------- c:\documents and settings\All Users\Application Data\PrevxCSI
2009-03-02 21:03 . 2009-03-02 21:03 22,536 --a------ c:\windows\system32\drivers\pxscan.sys
2009-03-02 21:03 . 2009-03-02 21:03 67 --a------ c:\windows\wininit.ini
2009-03-02 20:46 . 2009-03-02 20:46 <DIR> d-------- c:\program files\AVG
2009-03-02 20:46 . 2009-03-02 20:46 <DIR> d-------- c:\documents and settings\All Users\Application Data\avg8
2009-03-02 19:57 . 2009-03-02 19:57 1,355 --a------ c:\windows\imsins.BAK
2009-03-01 22:14 . 2009-03-01 22:16 9,910 --a------ c:\windows\system32\tmp.avi
2009-03-01 22:14 . 2009-03-01 22:14 118 --a------ c:\windows\system32\test.aok
2009-03-01 21:21 . 2009-03-01 21:22 <DIR> d-------- c:\program files\NVIDIA Corporation
2009-03-01 14:49 . 2009-03-01 14:49 <DIR> d-------- C:\OutputFolder
2009-03-01 14:47 . 2002-10-05 07:04 921,600 --a------ c:\windows\system32\vorbisenc.dll
2009-03-01 14:47 . 2004-01-11 08:02 258,048 --a------ c:\windows\system32\GplMpgDec.ax
2009-03-01 14:47 . 2002-10-07 02:42 237,568 --a------ c:\windows\system32\OggDS.dll
2009-03-01 14:47 . 2002-10-05 07:04 188,416 --a------ c:\windows\system32\vorbis.dll
2009-03-01 14:47 . 2002-10-05 07:04 45,056 --a------ c:\windows\system32\ogg.dll
2009-03-01 14:46 . 2009-03-01 14:47 <DIR> d-------- c:\program files\Ultra MP4 Video Converter
2009-03-01 14:46 . 2007-04-12 14:19 129,024 --a------ c:\windows\system32\AVERM.dll
2009-03-01 14:46 . 2006-09-26 13:57 28,672 --a------ c:\windows\system32\AVEQT.dll
2009-03-01 12:13 . 2009-03-01 12:13 <DIR> d-------- c:\documents and settings\Administrator\Application Data\fretsonfire
2009-03-01 10:26 . 2009-03-02 21:31 162 --a------ c:\windows\pop.htm
2009-03-01 10:18 . 2009-02-13 10:07 23,552 --a------ c:\windows\system32\jwtch32.exe
2009-03-01 10:03 . 2009-03-01 13:31 <DIR> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2009-02-27 10:04 . 2009-02-27 10:04 54,156 --ah----- c:\windows\QTFont.qfn
2009-02-27 10:04 . 2009-02-27 10:04 1,409 --a------ c:\windows\QTFont.for
2009-02-25 12:00 . 2009-02-25 12:00 <DIR> d-------- c:\windows\system32\AGEIA
2009-02-25 12:00 . 2009-02-25 12:00 <DIR> d-------- c:\program files\AGEIA Technologies
2009-02-24 11:09 . 2009-02-24 11:09 <DIR> d-------- c:\program files\Nokia
2009-02-24 11:09 . 2009-02-24 11:09 <DIR> d-------- c:\program files\Common Files\PCSuite
2009-02-24 11:09 . 2009-02-24 11:09 <DIR> d-------- c:\program files\Common Files\Nokia
2009-02-23 23:10 . 2009-02-23 23:22 <DIR> d-------- c:\program files\Freelang Dictionary
2009-02-23 11:20 . 2009-02-23 11:20 <DIR> d-------- c:\windows\45235788142C44BE8A4DDDE9A84492E5.TMP
2009-02-22 20:46 . 2009-02-22 20:47 <DIR> d-------- c:\program files\K-Lite Codec Pack
2009-02-21 18:19 . 2009-02-21 18:19 <DIR> d-------- c:\program files\ImTOO
2009-02-19 21:03 . 2009-02-19 21:03 <DIR> d-------- c:\program files\Microsoft ActiveSync
2009-02-19 21:00 . 2009-02-19 21:03 <DIR> d-------- c:\windows\SHELLNEW
2009-02-19 21:00 . 2009-02-19 21:00 <DIR> d-------- c:\program files\Microsoft.NET
2009-02-19 16:56 . 2009-02-19 16:56 <DIR> d-------- c:\documents and settings\All Users\Application Data\nView_Profiles
2009-02-18 21:26 . 2009-02-18 21:26 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Codemasters
2009-02-18 18:17 . 2009-02-18 18:17 <DIR> d-------- c:\windows\nview
2009-02-18 18:17 . 2009-03-02 21:33 212,075 --a------ c:\windows\system32\nvapps.xml
2009-02-18 18:17 . 2009-02-09 13:18 18,795 --a------ c:\windows\system32\nvdisp.nvu
2009-02-12 10:19 . 2009-02-12 10:35 <DIR> d-------- c:\program files\BSR Screen Recorder 4
2009-02-12 10:19 . 2009-02-12 10:23 2,048 --a------ c:\windows\system32\Tr_sttool.dat
2009-02-12 09:45 . 2008-04-14 00:16 61,696 --a------ c:\windows\system32\drivers\ohci1394.sys
2009-02-12 09:45 . 2008-04-14 00:16 61,696 --a------ c:\windows\system32\DllCache\ohci1394.sys
2009-02-12 09:45 . 2008-04-14 00:16 53,376 --a------ c:\windows\system32\drivers\1394bus.sys
2009-02-12 09:45 . 2008-04-14 00:16 53,376 --a------ c:\windows\system32\DllCache\1394bus.sys
2009-02-12 09:45 . 2006-09-17 06:48 6,400 --a------ c:\windows\system32\drivers\enum1394.sys
2009-02-12 09:45 . 2006-09-17 06:48 6,400 --a------ c:\windows\system32\DllCache\enum1394.sys
2009-02-08 22:11 . 2009-02-08 22:11 14,336 --a------ c:\windows\system32\drivers\PN31Snoop.sys
2009-02-08 13:41 . 2009-02-08 13:41 664 --a------ c:\windows\system32\d3d9caps.dat
2009-02-08 13:40 . 2009-02-08 13:40 552 --a------ c:\windows\system32\d3d8caps.dat
2009-02-08 13:31 . 2009-02-08 13:31 0 --a------ c:\windows\msicpl.ini
2009-02-08 12:49 . 2009-02-08 12:49 <DIR> d-------- c:\documents and settings\Administrator\Application Data\GRETECH
2009-02-07 21:26 . 2009-02-07 21:26 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Media Player Classic
2009-02-06 22:19 . 2009-02-06 22:19 <DIR> d-------- c:\windows\system32\Futuremark
2009-02-06 22:19 . 1999-10-21 09:12 20,400 --------- c:\windows\system32\drivers\Entech.sys
2009-02-06 22:19 . 2001-11-19 18:05 3,972 --------- c:\windows\system32\drivers\PciBus.sys
2009-02-06 22:18 . 2009-02-06 22:18 <DIR> d-------- c:\program files\Futuremark
2009-02-06 13:41 . 2009-02-08 21:08 69 --a------ c:\windows\NeroDigital.ini
2009-02-06 13:23 . 2009-02-06 13:23 <DIR> d-------- c:\program files\HardwareOC BenchTools
2009-02-04 20:55 . 2009-02-04 20:55 <DIR> d--h-c--- c:\documents and settings\All Users\Application Data\{0691F710-1ECA-4B5A-9727-25554F1BFDC6}
2009-02-04 20:39 . 2009-02-04 20:39 3,860 --a------ c:\windows\system32\ealregsnapshot1.reg
2009-02-03 20:12 . 2009-02-08 12:43 <DIR> d-------- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-02-03 17:16 . 2009-02-03 17:16 <DIR> d-------- c:\documents and settings\All Users\Application Data\Codemasters
2009-02-03 17:13 . 2009-02-03 17:13 <DIR> d-------- c:\program files\OpenAL
2009-02-03 17:13 . 2008-04-28 15:53 805,400 -ra------ c:\windows\system32\tmp2F7.tmp
2009-02-03 17:13 . 2008-04-28 15:53 805,400 -ra------ c:\windows\system32\tmp2F6.tmp
2009-02-03 17:13 . 2009-02-03 17:13 444,952 --a------ c:\windows\system32\wrap_oal.dll
2009-02-03 17:13 . 2009-02-03 17:13 109,080 --a------ c:\windows\system32\OpenAL32.dll
2009-02-03 17:08 . 2009-02-03 17:08 36 --a------ c:\windows\plugSpk.INI
2009-02-02 19:00 . 2009-02-02 19:00 <DIR> d-------- c:\windows\system32\LogFiles
2009-02-02 19:00 . 2009-02-18 18:27 183,112 --a------ c:\windows\system32\PnkBstrB.exe
2009-02-02 19:00 . 2009-02-18 18:27 138,184 --a------ c:\windows\system32\drivers\PnkBstrK.sys
2009-02-02 19:00 . 2009-02-02 19:00 66,872 --a------ c:\windows\system32\PnkBstrA.exe
2009-02-02 18:58 . 2009-02-02 18:58 <DIR> d-------- c:\documents and settings\All Users\Application Data\Fallout3
2009-02-02 18:57 . 2009-02-08 12:36 <DIR> d-------- c:\program files\MSBuild
2009-02-02 18:55 . 2009-02-02 18:55 <DIR> d-------- c:\windows\system32\XPSViewer
2009-02-02 18:54 . 2009-02-02 18:54 <DIR> d-------- c:\program files\Reference Assemblies
2009-02-02 18:54 . 2006-06-29 13:07 14,048 --a------ c:\windows\system32\spmsg2.dll
2009-02-02 18:53 . 2009-02-02 18:53 <DIR> d-------- c:\windows\system32\xlive
2009-02-02 18:53 . 2009-02-04 18:50 <DIR> d-------- c:\program files\Common Files\InstallShield
2009-02-02 17:55 . 2009-02-02 17:55 <DIR> d--h----- c:\windows\PIF
2009-02-02 17:44 . 2009-02-08 18:48 <DIR> d-------- C:\Audio
2009-02-02 17:44 . 2009-02-08 16:08 613 --a------ c:\windows\smrpro.INI
2009-02-02 17:42 . 2009-02-02 17:42 <DIR> d-------- c:\program files\Admiresoft
2009-02-02 15:44 . 2009-02-02 15:44 <DIR> d-------- c:\program files\ASIO4ALL v2
2009-02-02 15:43 . 2009-02-02 15:43 52 --a------ c:\windows\STYLEWRK.INI
2009-02-02 15:42 . 2009-02-10 10:14 <DIR> d-------- c:\program files\Style Works 2000 Universal
2009-02-02 15:42 . 2009-02-02 15:42 249,856 --------- c:\windows\Setup1.exe
2009-02-02 15:42 . 2009-02-02 15:42 101,888 --a------ c:\windows\system32\VB6STKIT.DLL
2009-02-02 15:42 . 2009-02-02 15:42 73,216 --a------ c:\windows\ST6UNST.EXE
2009-02-02 15:41 . 2009-02-02 15:41 <DIR> d-------- c:\program files\MMISoft
2009-02-02 15:41 . 2009-02-02 15:41 <DIR> d-------- c:\documents and settings\Administrator\WINDOWS
2009-02-02 15:41 . 2003-04-03 13:39 3,502,080 --a------ c:\windows\system32\KatTbl.dll
2009-02-02 15:41 . 2004-10-07 14:21 182,272 --a------ c:\windows\system32\OposRf.dll
2009-02-02 15:38 . 2009-02-02 15:38 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Publish Providers
2009-02-02 15:37 . 2009-02-02 15:40 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Sony
2009-02-02 15:21 . 2009-02-02 15:21 <DIR> d-------- c:\program files\Vstplugins
2009-02-02 15:21 . 2009-02-02 15:21 <DIR> d-------- c:\program files\Sony
2009-02-02 15:20 . 2009-02-02 15:20 <DIR> d-------- c:\program files\Sony Setup
2009-02-02 15:20 . 1999-09-28 09:00 5,727 --a------ c:\windows\system32\VcakeD.vxd
2009-02-02 15:19 . 2009-02-02 15:19 <DIR> d-------- c:\program files\Cakewalk
2009-02-02 15:17 . 2009-02-02 15:17 <DIR> d-------- c:\program files\Microangelo
2009-02-02 14:51 . 2006-10-01 12:00 17,920 --a------ c:\windows\system32\mdimon.dll
2009-02-02 14:51 . 2009-02-19 21:04 376 --a------ c:\windows\ODBC.INI

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-02 20:28 --------- d-----w c:\documents and settings\Administrator\Application Data\uTorrent
2009-03-01 21:22 --------- d--h--w c:\program files\InstallShield Installation Information
2009-03-01 14:46 --------- d-----w c:\program files\GRETECH
2009-03-01 13:25 --------- d-----w c:\documents and settings\Administrator\Application Data\Winamp
2009-02-25 11:59 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-02-23 23:22 43,920 ----a-w c:\windows\AVI32HLM.DLL
2009-02-10 12:28 --------- d-----w c:\program files\RivaTuner v2.22
2009-02-09 13:18 6,307,328 ----a-w c:\windows\system32\drivers\nv4_mini.sys
2009-02-03 16:02 --------- d-----w c:\documents and settings\Administrator\Application Data\Nero
2009-02-02 14:42 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-02-01 19:58 --------- d-----w c:\program files\Common Files\Nero
2009-02-01 19:44 --------- d-----w c:\program files\Nero
2009-02-01 19:43 --------- d-----w c:\program files\Windows Sidebar
2009-02-01 19:38 --------- d-----w c:\documents and settings\All Users\Application Data\Nero
2009-02-01 16:45 --------- d-----w c:\program files\Spybot - Search & Destroy
2009-02-01 16:04 --------- d-----w c:\program files\ESET
2009-02-01 15:49 --------- d-----w c:\documents and settings\Administrator\Application Data\Nokia
2009-01-31 12:13 717,296 ----a-w c:\windows\system32\drivers\sptd.sys
2009-01-31 05:12 --------- d-----w c:\program files\Alcohol Soft
2009-01-30 12:13 --------- d-----w c:\documents and settings\Administrator\Application Data\Red Alert 3
2009-01-29 22:30 --------- d-----w c:\documents and settings\Administrator\Application Data\PC Suite
2009-01-29 22:29 0 ---ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2009-01-29 22:29 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
2009-01-29 22:29 --------- d-----w c:\documents and settings\All Users\Application Data\PC Suite
2009-01-29 22:28 --------- d-----w c:\program files\PC Connectivity Solution
2009-01-29 22:27 --------- d-----w c:\documents and settings\All Users\Application Data\Installations
2009-01-29 11:11 --------- d-----w c:\documents and settings\All Users\Application Data\ESET
2009-01-29 10:25 --------- d-----w c:\program files\microsoft frontpage
2009-01-28 11:28 --------- d-----w c:\program files\Winamp
2009-01-28 11:26 --------- d-----w c:\program files\Lavalys
2009-01-28 11:24 --------- d-----w c:\program files\QuickTime
2009-01-28 11:23 --------- d-----w c:\program files\Apple Software Update
2009-01-28 11:23 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2009-01-28 11:23 --------- d-----w c:\documents and settings\All Users\Application Data\Apple
2009-01-28 11:20 --------- d-----w c:\program files\Common Files\Adobe
2009-01-28 11:17 --------- d-----w c:\program files\TuneUp Utilities 2008
2009-01-28 11:16 --------- d-----w c:\documents and settings\All Users\Application Data\TuneUp Software
2009-01-28 11:16 --------- d-----w c:\documents and settings\Administrator\Application Data\TuneUp Software
2009-01-28 10:59 --------- d-----w c:\documents and settings\All Users\Application Data\WinZip
2009-01-28 10:58 --------- d-----w c:\program files\VDOWNLOADER
2009-01-28 10:55 --------- d-----w c:\program files\Common Files\ACD Systems
2009-01-28 10:55 --------- d-----w c:\program files\ACD Systems
2009-01-28 10:55 --------- d-----w c:\documents and settings\All Users\Application Data\ACD Systems
2009-01-28 10:55 --------- d-----w c:\documents and settings\Administrator\Application Data\ACD Systems
2009-01-28 10:36 --------- d-----w c:\documents and settings\Administrator\Application Data\ESET
2009-01-28 10:22 29,280 ----a-w c:\windows\MSWHLP16.DLL
2009-01-28 10:16 21,419 ----a-w c:\windows\system32\drivers\AegisP.sys
2009-01-28 10:16 --------- d-----w c:\program files\GIGABYTE
2009-01-28 10:16 --------- d-----w c:\documents and settings\Administrator\Application Data\InstallShield
2009-01-27 11:45 --------- d-----w c:\program files\DVDx
2009-01-27 11:37 --------- d-----w c:\program files\DIFX
2009-01-27 11:35 15,600 ----a-w c:\windows\gdrv.sys
2009-01-27 11:30 --------- d-----w c:\program files\Creative
2009-01-27 11:16 --------- d-----w c:\program files\uTorrent
2009-01-27 11:15 --------- d---a-w c:\program files\(XPAmp)
2009-01-27 11:13 --------- d-----w c:\program files\WPIclose
2009-01-27 11:13 --------- d-----w c:\program files\MSN Messenger
2009-01-27 11:10 --------- d-----w c:\program files\eXPerience
2009-01-27 11:06 --------- d-----w c:\program files\Windows Media Connect 2
2009-01-07 16:20 36,896 ----a-w c:\windows\nvflash.sys
2009-01-06 15:51 36,640 ----a-w c:\windows\nvoclock.sys
2009-01-06 15:47 430,080 ----a-w c:\windows\ntuneoem.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AudioHQ"="c:\program files\Creative\SBLive\AudioHQ\AHQTB.EXE" [2000-05-11 205312]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-02-09 13680640]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-02-09 86016]
"Microsoft netswitch"="c:\windows\system32\jwtch32.exe" [2009-02-13 23552]
"nwiz"="nwiz.exe" [2009-02-09 c:\windows\system32\nwiz.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Gigabyte Wireless Utility.lnk - c:\program files\GIGABYTE\Common\GNConfig.exe [2009-01-28 753664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"= ctwdm32.dll
"msacm.divxa32"= msaud32_divx.acm

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
--a------ 2008-02-22 15:58 217544 c:\program files\Alcohol Soft\Alcohol 120\AxCmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\egui]
--a------ 2007-12-21 08:21 1443072 c:\program files\ESET\ESET Smart Security\egui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft netswitch]
--a------ 2009-02-13 10:07 23552 c:\windows\system32\jwtch32.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nodenable]
--a------ 2008-08-05 08:11 359463 c:\program files\ESET\nodenable.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
--a------ 2008-12-03 12:47 1205760 c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-01-31 23:13 385024 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
-rahs---- 2009-01-26 15:31 2144088 c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Games\\Ubisoft\\Far Cry 2\\bin\\FarCry2.exe"=
"c:\\Games\\Ubisoft\\Far Cry 2\\bin\\FC2Launcher.exe"=
"c:\\Games\\Ubisoft\\Far Cry 2\\bin\\FC2Editor.exe"=
"c:\\Games\\Codemasters\\GRID\\GRID.exe"=
"c:\\Games\\Ubisoft\\Prince of Persia\\Prince of Persia.exe"=
"c:\\Games\\Ubisoft\\Prince of Persia\\PrinceOfPersia_Launcher.exe"=
"c:\\Games\\EA Games\\Mirror's Edge\\Binaries\\MirrorsEdge.exe"=

R0 pxscan;pxscan;c:\windows\system32\drivers\pxscan.sys [2009-03-02 22536]
R2 CSIScanner;CSIScanner;c:\program files\Prevx\prevx.exe [2009-03-02 4150840]
R2 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2007-12-21 468224]
S1 StarPortLite;StarPort Storage Controller (Lite);c:\windows\system32\drivers\StarPortLite.sys [2009-01-31 93544]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder

2009-02-20 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2008\OneClick.exe [2008-01-08 13:31]
.
- - - - ORPHANS REMOVED - - - -

Notify-urqrpmkh - (no file)
MSConfigStartUp-14b8323a - c:\windows\system32\aqlmqoan.dll
MSConfigStartUp-WinampAgent - c:\program files\Winamp\winampa.exe


.
------- Supplementary Scan -------
.
uStart Page = [Link mogu videti samo ulogovani korisnici]
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: {A8F2B5E8-0E82-4BEF-83DC-96FCE5107B1D} = 212.200.41.1 93.92.248.225
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\j443fzk5.default\
FF - prefs.js: browser.search.selectedEngine - Rocket Division Search
FF - prefs.js: browser.startup.homepage - [Link mogu videti samo ulogovani korisnici]
FF - component: c:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2009-03-02 21:34:06
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Nero\Nero BackItUp 4\NBService.exe
c:\program files\NVIDIA Corporation\nTune\nTuneService.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\NVIDIA Corporation\System Update\UpdateCenterService.exe
c:\windows\system32\devldr32.exe
c:\windows\system32\rundll32.exe
.
**************************************************************************
.
Completion time: 2009-03-02 21:35:21 - machine was rebooted
ComboFix-quarantined-files.txt 2009-03-02 21:35:18

Pre-Run: 6,313,160,704 bytes free
Post-Run: 6,249,566,208 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer

319

Poslao: 02 Mar 2009 23:11
Idi na vrh
offline
  • diarno  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 15 Jun 2007
  • Poruke: 5572

Otvoriti Notepad i iskopirati sledeci tekst:

File::
c:\windows\system32\jwtch32.exe
c:\windows\pop.htm

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Microsoft netswitch"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft netswitch]

Snimiti na Desktop fajl iz Notepada kao "CFScript"




Prevuci snimljeni skript/tekst na ComboFix ikonicu kao na slici.
Postaviti u sledecoj poruci log koji bude bio napravljen na kraju ciscenja/skeniranja.

Poslao: 03 Mar 2009 17:58
Idi na vrh
offline
  • Pridružio: 25 Okt 2006
  • Poruke: 93
  • Gde živiš: VOJVODINA/BANAT

ComboFix 09-03-02.01 - Administrator 2009-03-03 17:47:51.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1604 [GMT 0:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\Cfscript.txt
AV: ESET Smart Security 3.0 *On-access scanning disabled* (Updated)
FW: ESET Personal firewall *enabled*
* Created a new restore point

FILE ::
c:\windows\pop.htm
c:\windows\system32\jwtch32.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\pop.htm

.
((((((((((((((((((((((((( Files Created from 2009-02-03 to 2009-03-03 )))))))))))))))))))))))))))))))
.

2009-03-03 16:47 . 2009-03-03 17:00 <DIR> d-------- c:\windows\LastGood
2009-03-02 22:05 . 2009-03-02 22:05 <DIR> d-------- c:\program files\PrevxCSI
2009-03-02 22:05 . 2009-03-02 22:08 <DIR> d-------- c:\documents and settings\All Users\Application Data\PrevxCSI
2009-03-02 22:05 . 2009-03-02 22:06 25,400 --a------ c:\windows\system32\drivers\pxark.sys
2009-03-02 21:03 . 2009-03-02 21:03 67 --a------ c:\windows\wininit.ini
2009-03-02 20:46 . 2009-03-02 20:46 <DIR> d-------- c:\program files\AVG
2009-03-02 20:46 . 2009-03-02 20:46 <DIR> d-------- c:\documents and settings\All Users\Application Data\avg8
2009-03-02 19:57 . 2009-03-02 19:57 1,355 --a------ c:\windows\imsins.BAK
2009-03-01 22:14 . 2009-03-01 22:16 9,910 --a------ c:\windows\system32\tmp.avi
2009-03-01 22:14 . 2009-03-01 22:14 118 --a------ c:\windows\system32\test.aok
2009-03-01 21:21 . 2009-03-01 21:22 <DIR> d-------- c:\program files\NVIDIA Corporation
2009-03-01 14:49 . 2009-03-01 14:49 <DIR> d-------- C:\OutputFolder
2009-03-01 14:47 . 2002-10-05 07:04 921,600 --a------ c:\windows\system32\vorbisenc.dll
2009-03-01 14:47 . 2004-01-11 08:02 258,048 --a------ c:\windows\system32\GplMpgDec.ax
2009-03-01 14:47 . 2002-10-07 02:42 237,568 --a------ c:\windows\system32\OggDS.dll
2009-03-01 14:47 . 2002-10-05 07:04 188,416 --a------ c:\windows\system32\vorbis.dll
2009-03-01 14:47 . 2002-10-05 07:04 45,056 --a------ c:\windows\system32\ogg.dll
2009-03-01 14:46 . 2009-03-01 14:47 <DIR> d-------- c:\program files\Ultra MP4 Video Converter
2009-03-01 14:46 . 2007-04-12 14:19 129,024 --a------ c:\windows\system32\AVERM.dll
2009-03-01 14:46 . 2006-09-26 13:57 28,672 --a------ c:\windows\system32\AVEQT.dll
2009-03-01 12:13 . 2009-03-01 12:13 <DIR> d-------- c:\documents and settings\Administrator\Application Data\fretsonfire
2009-03-01 10:03 . 2009-03-01 13:31 <DIR> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2009-02-27 10:04 . 2009-02-27 10:04 54,156 --ah----- c:\windows\QTFont.qfn
2009-02-27 10:04 . 2009-02-27 10:04 1,409 --a------ c:\windows\QTFont.for
2009-02-25 12:00 . 2009-02-25 12:00 <DIR> d-------- c:\windows\system32\AGEIA
2009-02-25 12:00 . 2009-02-25 12:00 <DIR> d-------- c:\program files\AGEIA Technologies
2009-02-24 11:09 . 2009-02-24 11:09 <DIR> d-------- c:\program files\Nokia
2009-02-24 11:09 . 2009-02-24 11:09 <DIR> d-------- c:\program files\Common Files\PCSuite
2009-02-24 11:09 . 2009-02-24 11:09 <DIR> d-------- c:\program files\Common Files\Nokia
2009-02-23 23:10 . 2009-02-23 23:22 <DIR> d-------- c:\program files\Freelang Dictionary
2009-02-23 11:20 . 2009-02-23 11:20 <DIR> d-------- c:\windows\45235788142C44BE8A4DDDE9A84492E5.TMP
2009-02-22 20:46 . 2009-02-22 20:47 <DIR> d-------- c:\program files\K-Lite Codec Pack
2009-02-21 18:19 . 2009-02-21 18:19 <DIR> d-------- c:\program files\ImTOO
2009-02-19 21:03 . 2009-02-19 21:03 <DIR> d-------- c:\program files\Microsoft ActiveSync
2009-02-19 21:00 . 2009-02-19 21:03 <DIR> d-------- c:\windows\SHELLNEW
2009-02-19 21:00 . 2009-02-19 21:00 <DIR> d-------- c:\program files\Microsoft.NET
2009-02-19 16:56 . 2009-02-19 16:56 <DIR> d-------- c:\documents and settings\All Users\Application Data\nView_Profiles
2009-02-18 21:26 . 2009-02-18 21:26 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Codemasters
2009-02-18 18:17 . 2009-02-18 18:17 <DIR> d-------- c:\windows\nview
2009-02-18 18:17 . 2009-03-03 16:46 212,075 --a------ c:\windows\system32\nvapps.xml
2009-02-18 18:17 . 2009-02-09 13:18 18,795 --a------ c:\windows\system32\nvdisp.nvu
2009-02-12 10:19 . 2009-02-12 10:35 <DIR> d-------- c:\program files\BSR Screen Recorder 4
2009-02-12 10:19 . 2009-02-12 10:23 2,048 --a------ c:\windows\system32\Tr_sttool.dat
2009-02-12 09:45 . 2008-04-14 00:16 61,696 --a------ c:\windows\system32\drivers\ohci1394.sys
2009-02-12 09:45 . 2008-04-14 00:16 61,696 --a------ c:\windows\system32\DllCache\ohci1394.sys
2009-02-12 09:45 . 2008-04-14 00:16 53,376 --a------ c:\windows\system32\drivers\1394bus.sys
2009-02-12 09:45 . 2008-04-14 00:16 53,376 --a------ c:\windows\system32\DllCache\1394bus.sys
2009-02-12 09:45 . 2006-09-17 06:48 6,400 --a------ c:\windows\system32\drivers\enum1394.sys
2009-02-12 09:45 . 2006-09-17 06:48 6,400 --a------ c:\windows\system32\DllCache\enum1394.sys
2009-02-08 22:11 . 2009-02-08 22:11 14,336 --a------ c:\windows\system32\drivers\PN31Snoop.sys
2009-02-08 13:41 . 2009-02-08 13:41 664 --a------ c:\windows\system32\d3d9caps.dat
2009-02-08 13:40 . 2009-02-08 13:40 552 --a------ c:\windows\system32\d3d8caps.dat
2009-02-08 13:31 . 2009-02-08 13:31 0 --a------ c:\windows\msicpl.ini
2009-02-08 12:49 . 2009-02-08 12:49 <DIR> d-------- c:\documents and settings\Administrator\Application Data\GRETECH
2009-02-07 21:26 . 2009-02-07 21:26 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Media Player Classic
2009-02-06 22:19 . 2009-02-06 22:19 <DIR> d-------- c:\windows\system32\Futuremark
2009-02-06 22:19 . 1999-10-21 09:12 20,400 --------- c:\windows\system32\drivers\Entech.sys
2009-02-06 22:19 . 2001-11-19 18:05 3,972 --------- c:\windows\system32\drivers\PciBus.sys
2009-02-06 22:18 . 2009-02-06 22:18 <DIR> d-------- c:\program files\Futuremark
2009-02-06 13:41 . 2009-02-08 21:08 69 --a------ c:\windows\NeroDigital.ini
2009-02-06 13:23 . 2009-02-06 13:23 <DIR> d-------- c:\program files\HardwareOC BenchTools
2009-02-04 20:55 . 2009-02-04 20:55 <DIR> d--h-c--- c:\documents and settings\All Users\Application Data\{0691F710-1ECA-4B5A-9727-25554F1BFDC6}
2009-02-04 20:39 . 2009-02-04 20:39 3,860 --a------ c:\windows\system32\ealregsnapshot1.reg
2009-02-03 20:12 . 2009-02-08 12:43 <DIR> d-------- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-02-03 17:16 . 2009-02-03 17:16 <DIR> d-------- c:\documents and settings\All Users\Application Data\Codemasters
2009-02-03 17:13 . 2009-02-03 17:13 <DIR> d-------- c:\program files\OpenAL
2009-02-03 17:13 . 2008-04-28 15:53 805,400 -ra------ c:\windows\system32\tmp2F7.tmp
2009-02-03 17:13 . 2008-04-28 15:53 805,400 -ra------ c:\windows\system32\tmp2F6.tmp
2009-02-03 17:13 . 2009-02-03 17:13 444,952 --a------ c:\windows\system32\wrap_oal.dll
2009-02-03 17:13 . 2009-02-03 17:13 109,080 --a------ c:\windows\system32\OpenAL32.dll
2009-02-03 17:08 . 2009-02-03 17:08 36 --a------ c:\windows\plugSpk.INI

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-02 22:17 --------- d-----w c:\documents and settings\Administrator\Application Data\uTorrent
2009-03-01 21:22 --------- d--h--w c:\program files\InstallShield Installation Information
2009-03-01 14:46 --------- d-----w c:\program files\GRETECH
2009-03-01 13:25 --------- d-----w c:\documents and settings\Administrator\Application Data\Winamp
2009-02-25 11:59 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-02-23 23:22 43,920 ----a-w c:\windows\AVI32HLM.DLL
2009-02-18 18:27 183,112 ----a-w c:\windows\system32\PnkBstrB.exe
2009-02-18 18:27 138,184 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2009-02-10 12:28 --------- d-----w c:\program files\RivaTuner v2.22
2009-02-10 10:14 --------- d-----w c:\program files\Style Works 2000 Universal
2009-02-09 18:56 67,584 ----a-w c:\windows\system32\ff_vfw.dll
2009-02-08 12:36 --------- d-----w c:\program files\MSBuild
2009-02-04 18:50 --------- d-----w c:\program files\Common Files\InstallShield
2009-02-03 16:02 --------- d-----w c:\documents and settings\Administrator\Application Data\Nero
2009-02-02 19:00 66,872 ----a-w c:\windows\system32\PnkBstrA.exe
2009-02-02 18:58 --------- d-----w c:\documents and settings\All Users\Application Data\Fallout3
2009-02-02 18:54 --------- d-----w c:\program files\Reference Assemblies
2009-02-02 17:42 --------- d-----w c:\program files\Admiresoft
2009-02-02 15:44 --------- d-----w c:\program files\ASIO4ALL v2
2009-02-02 15:42 73,216 ----a-w c:\windows\ST6UNST.EXE
2009-02-02 15:42 249,856 ------w c:\windows\Setup1.exe
2009-02-02 15:42 101,888 ----a-w c:\windows\system32\VB6STKIT.DLL
2009-02-02 15:41 --------- d-----w c:\program files\MMISoft
2009-02-02 15:40 --------- d-----w c:\documents and settings\Administrator\Application Data\Sony
2009-02-02 15:38 --------- d-----w c:\documents and settings\Administrator\Application Data\Publish Providers
2009-02-02 15:21 --------- d-----w c:\program files\Vstplugins
2009-02-02 15:21 --------- d-----w c:\program files\Sony
2009-02-02 15:20 --------- d-----w c:\program files\Sony Setup
2009-02-02 15:19 --------- d-----w c:\program files\Cakewalk
2009-02-02 15:17 --------- d-----w c:\program files\Microangelo
2009-02-02 14:42 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-02-01 19:58 --------- d-----w c:\program files\Common Files\Nero
2009-02-01 19:44 --------- d-----w c:\program files\Nero
2009-02-01 19:43 --------- d-----w c:\program files\Windows Sidebar
2009-02-01 19:38 --------- d-----w c:\documents and settings\All Users\Application Data\Nero
2009-02-01 16:45 --------- d-----w c:\program files\Spybot - Search & Destroy
2009-02-01 16:04 --------- d-----w c:\program files\ESET
2009-02-01 15:49 --------- d-----w c:\documents and settings\Administrator\Application Data\Nokia
2009-01-31 12:13 717,296 ----a-w c:\windows\system32\drivers\sptd.sys
2009-01-31 05:12 --------- d-----w c:\program files\Alcohol Soft
2009-01-30 12:13 --------- d-----w c:\documents and settings\Administrator\Application Data\Red Alert 3
2009-01-29 22:30 --------- d-----w c:\documents and settings\Administrator\Application Data\PC Suite
2009-01-29 22:29 0 ---ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2009-01-29 22:29 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
2009-01-29 22:29 --------- d-----w c:\documents and settings\All Users\Application Data\PC Suite
2009-01-29 22:28 --------- d-----w c:\program files\PC Connectivity Solution
2009-01-29 22:27 --------- d-----w c:\documents and settings\All Users\Application Data\Installations
2009-01-29 11:11 --------- d-----w c:\documents and settings\All Users\Application Data\ESET
2009-01-29 10:25 --------- d-----w c:\program files\microsoft frontpage
2009-01-28 11:49 107,888 ----a-w c:\windows\system32\CmdLineExt.dll
2009-01-28 11:28 --------- d-----w c:\program files\Winamp
2009-01-28 11:26 --------- d-----w c:\program files\Lavalys
2009-01-28 11:24 --------- d-----w c:\program files\QuickTime
2009-01-28 11:23 --------- d-----w c:\program files\Apple Software Update
2009-01-28 11:23 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2009-01-28 11:23 --------- d-----w c:\documents and settings\All Users\Application Data\Apple
2009-01-28 11:20 --------- d-----w c:\program files\Common Files\Adobe
2009-01-28 11:17 --------- d-----w c:\program files\TuneUp Utilities 2008
2009-01-28 11:16 306,432 ----a-w c:\windows\system32\TuneUpDefragService.exe
2009-01-28 11:16 --------- d-----w c:\documents and settings\All Users\Application Data\TuneUp Software
2009-01-28 11:16 --------- d-----w c:\documents and settings\Administrator\Application Data\TuneUp Software
2009-01-28 10:59 --------- d-----w c:\documents and settings\All Users\Application Data\WinZip
2009-01-28 10:58 --------- d-----w c:\program files\VDOWNLOADER
2009-01-28 10:55 --------- d-----w c:\program files\Common Files\ACD Systems
2009-01-28 10:55 --------- d-----w c:\program files\ACD Systems
2009-01-28 10:55 --------- d-----w c:\documents and settings\All Users\Application Data\ACD Systems
2009-01-28 10:55 --------- d-----w c:\documents and settings\Administrator\Application Data\ACD Systems
2009-01-28 10:36 --------- d-----w c:\documents and settings\Administrator\Application Data\ESET
2009-01-28 10:22 29,280 ----a-w c:\windows\MSWHLP16.DLL
2009-01-28 10:16 21,419 ----a-w c:\windows\system32\drivers\AegisP.sys
2009-01-28 10:16 --------- d-----w c:\program files\GIGABYTE
2009-01-28 10:16 --------- d-----w c:\documents and settings\Administrator\Application Data\InstallShield
2009-01-27 11:45 --------- d-----w c:\program files\DVDx
2009-01-27 11:37 --------- d-----w c:\program files\DIFX
2009-01-27 11:35 15,600 ----a-w c:\windows\gdrv.sys
2009-01-27 11:30 --------- d-----w c:\program files\Creative
2009-01-27 11:16 --------- d-----w c:\program files\uTorrent
2009-01-27 11:15 --------- d---a-w c:\program files\(XPAmp)
2009-01-27 11:13 --------- d-----w c:\program files\WPIclose
2009-01-27 11:13 --------- d-----w c:\program files\MSN Messenger
2009-01-27 11:10 --------- d-----w c:\program files\eXPerience
2009-01-27 11:06 --------- d-----w c:\program files\Windows Media Connect 2
2009-01-16 18:24 70,936 ----a-w c:\windows\system32\PhysXLoader.dll
2009-01-07 16:20 36,896 ----a-w c:\windows\nvflash.sys
2009-01-06 15:51 36,640 ----a-w c:\windows\nvoclock.sys
2009-01-06 15:47 430,080 ----a-w c:\windows\ntuneoem.dll
2008-12-26 00:08 453,152 ----a-w c:\windows\system32\nvudisp.exe
2008-12-23 21:58 453,152 ----a-w c:\windows\system32\NVUNINST.EXE
2008-12-11 00:33 86,016 ----a-w c:\windows\system32\dpl100.dll
2008-12-07 18:08 795,648 ----a-w c:\windows\system32\xvidcore.dll
2008-12-07 18:08 130,048 ----a-w c:\windows\system32\xvidvfw.dll
2008-12-04 09:28 24,344 ----a-w c:\windows\system32\PhysXDevice.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AudioHQ"="c:\program files\Creative\SBLive\AudioHQ\AHQTB.EXE" [2000-05-11 205312]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-02-09 13680640]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-02-09 86016]
"MSConfig"="c:\windows\pchealth\helpctr\Binaries\MSCONFIG.EXE" [2008-04-14 169984]
"nwiz"="nwiz.exe" [2009-02-09 c:\windows\system32\nwiz.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Gigabyte Wireless Utility.lnk - c:\program files\GIGABYTE\Common\GNConfig.exe [2009-01-28 753664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"= ctwdm32.dll
"msacm.divxa32"= msaud32_divx.acm

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
--a------ 2008-02-22 15:58 217544 c:\program files\Alcohol Soft\Alcohol 120\AxCmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\egui]
--a------ 2007-12-21 08:21 1443072 c:\program files\ESET\ESET Smart Security\egui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nodenable]
--a------ 2008-08-05 08:11 359463 c:\program files\ESET\nodenable.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
--a------ 2008-12-03 12:47 1205760 c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PrevxCSI]
--a------ 2009-03-02 22:05 880696 c:\program files\PrevxCSI\prevxcsi.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-01-31 23:13 385024 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
-rahs---- 2009-01-26 15:31 2144088 c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Games\\Ubisoft\\Far Cry 2\\bin\\FarCry2.exe"=
"c:\\Games\\Ubisoft\\Far Cry 2\\bin\\FC2Launcher.exe"=
"c:\\Games\\Ubisoft\\Far Cry 2\\bin\\FC2Editor.exe"=
"c:\\Games\\Codemasters\\GRID\\GRID.exe"=
"c:\\Games\\Ubisoft\\Prince of Persia\\Prince of Persia.exe"=
"c:\\Games\\Ubisoft\\Prince of Persia\\PrinceOfPersia_Launcher.exe"=
"c:\\Games\\EA Games\\Mirror's Edge\\Binaries\\MirrorsEdge.exe"=

R2 CSIScanner;CSIScanner;c:\program files\PrevxCSI\prevxcsi.exe [2009-03-02 880696]
R2 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2007-12-21 468224]
S1 StarPortLite;StarPort Storage Controller (Lite);c:\windows\system32\drivers\StarPortLite.sys [2009-01-31 93544]

--- Other Services/Drivers In Memory ---

*Deregistered* - pxark

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder

2009-02-20 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2008\OneClick.exe [2008-01-08 13:31]
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-AVG8_TRAY - c:\progra~1\AVG\AVG8\avgtray.exe


.
------- Supplementary Scan -------
.
uStart Page = [Link mogu videti samo ulogovani korisnici]
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\j443fzk5.default\
FF - prefs.js: browser.search.selectedEngine - Rocket Division Search
FF - prefs.js: browser.startup.homepage - [Link mogu videti samo ulogovani korisnici]
FF - component: c:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2009-03-03 17:49:21
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-03-03 17:50:27
ComboFix-quarantined-files.txt 2009-03-03 17:50:25

Pre-Run: 5,943,459,840 bytes free
Post-Run: 6,056,910,848 bytes free

291

Poslao: 03 Mar 2009 18:14
Idi na vrh
offline
  • diarno  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 15 Jun 2007
  • Poruke: 5572

Jel sad stanje bolje?

Poslao: 03 Mar 2009 20:14
Idi na vrh
offline
  • Pridružio: 25 Okt 2006
  • Poruke: 93
  • Gde živiš: VOJVODINA/BANAT

Jeste. Sad je sve u redu! Hvala!
Uninstalirao sam Eset Smart Security i stavio AVG 8.5, posto sam primetio da NOD ignorise dosta virusa.

Poslao: 04 Mar 2009 00:07
Idi na vrh
offline
  • diarno  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 15 Jun 2007
  • Poruke: 5572

Nista. to je to..

Uradi jos sledece :


Klikni START a zatim RUN
U liniju za unos teksta ukucaj Combofix /u i klikni OK





Sačekaj da se proces deinstalacije završi
Gornja procedura će:
Obrisati sledeće:
ComboFix i njegove file-ove i foldere
VundoFix Backups folder, ako postoji
C:\Deckard folder, ako postoji
C:\OtMoveIt folder, ako postoji
Resetovati podešavanja sata na kompjuteru
Sakriti ekstenzije file-ova, ako je potrebno
Sakriti sistemske/skrivene file-ove/foldere, ako je potrebno
Resetovati System Restore

Poslao: 04 Mar 2009 16:39
Idi na vrh
offline
  • Pridružio: 25 Okt 2006
  • Poruke: 93
  • Gde živiš: VOJVODINA/BANAT

Ok. Hvala jos jednom.

MyCity » Ambulanta -> Arhiva Ambulante » "Win32\TrojanProxy.Small.NDB.trojan

Ko je trenutno na forumu
 

Ukupno su 1073 korisnika na forumu :: 114 registrovanih, 8 sakrivenih i 951 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: _Rade, _stipa_, Alexa77, Alexandar-1973, alexbr, ArchaBasha, Aristotle2002, bgs, BLACKBIRD201284, bokisha253, Boris BM, BORUTUS, Cian, Cigi, Cirkon, colji, crazydkure, CrazyNorth, cyprus, DalmatinacMF, darkangel, darkojbn, Dimitrise93, Django777, Dogma21, Dorcolac, Dzoni Stek, feanor, Feller, Fullback, gacesam, GandorCC, goran.vvv, ikan, ivan_8282, Jakonjveliki, jalos, Jose, Josef, Konda, KonstantinR, krkalon, Krusarac, Kukuvaja, Leonov, Lieutenant, ljuba.b, macak44, MaksicZoran, mercedesamg, Metanoja, miki kv, mikrimaus, Miletić Zoran, milikonst, Milo97, Milos1389, mist-mist, mkukoleca, mocnijogurt, moldway, Mrav Obrad, mrav pesadinac, Mskok, nebojsag, Nomica, novator, obsc, oldtimer, orah, panzerwaffe, pceklic, pein, pisac12, PrincipL, raketaš, Ranutovac, raykan, Razdroid, rovac, Sančo, sekretar, Shinobi, shone34, Sr.Stat., stalja, stegonosa, suton, TalicniTom, TBoy, tecataki, tehnika, tenkiasta71, tihi-posmatrac, Tribal, ujke, uruk, vensla, voja64, Vojkan Petrovic, vrag81, Vzor50, X3, XBMC, XiaomiX, zeo, ZetaMan, ZlatniRez, zmajbre, zokizemun, Zorge, Zrcalo, 787, 1453