MyCity » Ambulanta -> Arhiva Ambulante » [bobby]antivirus 2009 - spyware

[bobby]antivirus 2009 - spyware

Napisano na dan: 20.11.2008

[bobby]antivirus 2009 - spyware
Sledeća strana Pagination

Idi na vrh

Poslao: 20 Nov 2008 18:48
Idi na vrh
offline
  • Pridružio: 20 Nov 2008
  • Poruke: 3

Logfile of HijackThis v1.99.1
Scan saved at 18:32:40, on 20.11.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Cyberlink\Shared files\RichVideo.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Winamp\winampa.exe
D:\Program Files\Skype\Phone\Skype.exe
D:\Program Files\Winamp Remote\bin\OrbTray.exe
D:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
D:\Program Files\Messenger\msmsgs.exe
D:\WINDOWS\system32\drivers\svchost.exe
D:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
D:\VSTASCAN\vsaccess.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
D:\WINDOWS\system32\wuauclt.exe
D:\WINDOWS\system32\drwtsn32.exe
D:\Program Files\Skype\Plugin Manager\skypePM.exe
D:\WINDOWS\system32\drwtsn32.exe
D:\WINDOWS\explorer.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\Documents and Settings\Sladja\My Documents\New Folder\FG5.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [Link mogu videti samo ulogovani korisnici]
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - D:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "D:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Orb] "D:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SVCHOST.EXE] D:\WINDOWS\system32\drivers\svchost.exe
O4 - HKCU\..\Run: [brastk] D:\WINDOWS\system32\brastk.exe
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Startup: UMAX VistaAccess.lnk = D:\VSTASCAN\vsaccess.exe
O4 - Startup: Yahoo! Widgets.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = D:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - [Link mogu videti samo ulogovani korisnici]\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - D:\Program Files\Yahoo!\Common\Yinsthelper.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - D:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - D:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - AppInit_DLLs: karna.dat
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - D:\Program Files\Cyberlink\Shared files\RichVideo.exe



Poslao: 20 Nov 2008 20:08
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Skini ComboFix sa jedne od sledecih adresa na Desktop:
[Link mogu videti samo ulogovani korisnici]
[Link mogu videti samo ulogovani korisnici]
[Link mogu videti samo ulogovani korisnici]

Startuj ga i ne diraj prozor programa dok skenira.
Sledi uputstva na ekranu. Kada zavrsi pojavice se log (C:\ComboFix.txt) koji ces nam ovde iskopirati.



Poslao: 20 Nov 2008 22:47
Idi na vrh
offline
  • Pridružio: 20 Nov 2008
  • Poruke: 3

Ne mogu da pokrenem ComboFix a ni Malwarebytes' Anti-Malware, a probao sam cak i Spyboot. Ne razumem sta se desava?

Poslao: 20 Nov 2008 22:51
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Skeniraj ponovo HijackThisom i stikliraj polja ispred sledecih linija:

O4 - HKCU\..\Run: [SVCHOST.EXE] D:\WINDOWS\system32\drivers\svchost.exe
O4 - HKCU\..\Run: [brastk] D:\WINDOWS\system32\brastk.exe
O20 - AppInit_DLLs: karna.dat

klikni Fix Checked

Restartuj komp.

Probaj sada skeniranje ComboFixom.

Poslao: 20 Nov 2008 23:05
Idi na vrh
offline
  • Pridružio: 20 Nov 2008
  • Poruke: 3

Uradio sam sve kako si rekao i opet ne funkcionise, medjutim primetio sam da se file O20 - AppInit_DLLs: karna.dat, posle restarta racunara ponovo vraca. Dva puta sam skenirao preko HijackThis i oba puta obrisao, medjutim opet se vratio. Da to nije taj virus?

Poslao: 21 Nov 2008 17:01
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Najverovatnije taj fajl jeste nas problem.

Probaj da skines ComboFix odavde i da ga pokrenes:
[Link mogu videti samo ulogovani korisnici]

MyCity » Ambulanta -> Arhiva Ambulante » [bobby]antivirus 2009 - spyware

Ko je trenutno na forumu
 

Ukupno su 1161 korisnika na forumu :: 86 registrovanih, 9 sakrivenih i 1066 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 15694 - dana 01 Feb 2026 12:23

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: 357magnum, Antoni S, ArmFPGA, Aska, Asteker, Bane san, berste23, bobo85, bokisha253, Brankojle, darkojovxp, djboj, Doc, Dorcolac, DragoslavS, ElvisP, Ercomero, Feller, Filip1, g_g, Gadafi1111, goxin, HrcAk47, ivanhoe31, Jeremiah, Jezekijel, JK, Kajzer Soze, Kalem, KimiMR, kolle.the.kid, Kubovac, Laluvr, laurusri, ljs, Ljusa, loon123, Lošmi, Makssd85, marsi, maveric43, menk, mercedesamg, Metanoja, miljannis, mir, mitja2512, MK10, mnn2, Nemanja.M, Niki2024, Nmr, Obrenovic, Orc, Permaldar, Pero Petković, Prečanin30, renvoi, RJ, S-lash, samocitam, SamoGledam, sasics, Semprini, Sharpshooter, Sir Budimir, skok, Solunac na steroidima, sspp, Stevan Visoki, Stoilkovic, Tafocus, tamno.nebo, taomaster, Tihi86, TripleTwo, Uros Cuore Sportivo, USSVoyager, Vanderx, vjetar, Vojin, yufighter, Zemunikola, ZlatniRez, zule2, Žrnov