MyCity » Ambulanta -> Arhiva Ambulante » killVBS.vbs i autorun.inf

killVBS.vbs i autorun.inf

Napisano na dan: 31.10.2008
1

killVBS.vbs i autorun.inf
Sledeća strana Pagination

Idi na vrh

Poslao: 31 Okt 2008 17:16
Idi na vrh
offline
  • l00ney  Male
  • Novi MyCity građanin
  • Pridružio: 26 Jan 2008
  • Poruke: 6

NOD 32 mi prijavljuje da imam virus na flashu postoje dva fajla autorun.inf i killvbs.vbs kakvi su to fajlovi ja ih obrisem a oni se ponovo pojave. Jel moze neko da pomogne kako da se resim toga?

Poslao: 31 Okt 2008 17:27
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

http://www.mycity.rs/Ambulanta/Kako-otvoriti-temu-u-Ambulanti.html

Uputstvo za otvaranje teme...

Poslao: 31 Okt 2008 17:49
Idi na vrh
offline
  • l00ney  Male
  • Novi MyCity građanin
  • Pridružio: 26 Jan 2008
  • Poruke: 6

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:47:00, on 31.10.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Memory Washer\MemoryWasher.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Opera\Opera.exe
C:\Documents and Settings\fim1\Desktop\bla\few.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\wscript.exe C:\WINDOWS\system32\killVBS.vbs
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [RemoteControl8] "C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe"
O4 - HKLM\..\Run: [PDVD8LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Spanish] C:\Program Files\Learn To Speak Russian Demo V3.1\Study Conversation.exe
O4 - HKCU\..\Run: [MemoryWasher] C:\Program Files\Memory Washer\MemoryWasher.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Picture Package Menu.lnk = ?
O4 - Global Startup: Picture Package VCD Maker.lnk = ?
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.15\AMVConverter\grab.html
O8 - Extra context menu item: Add to Media Manager... - C:\Program Files\MP3 Player Utilities 4.15\MediaManager\grab.html
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Microsoft Network Message Service (msmsnkd) - Unknown owner - C:\WINDOWS\system32\msmsn.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 6729 bytes

Poslao: 31 Okt 2008 18:20
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Otvori Nod32 Control Center (Klik na njegovu tray ikonicu ( ) u donjem desnom uglu ekrana).
* Izaberi AMON iz Threat Protection grupe opcija.
* Na desnom panelu deštikliraj opciju File system monitor (AMON) enabled.
* Gašenje ove opcije pokazaće se kroz promenu boje Control Center-a iz zelene u crvenu.

Napomena: Ne zaboravi da uključiš ovu opciju po završetku čišćenja.



Arrow Skini ComboFix sa jedne od sledecih adresa na Desktop:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://www.forospyware.com/sUBs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe


Priključi taj inficirani USB flash drive (i nemoj ga isključivati pre kraja postupka).

Startuj ComboFix i ne diraj prozor programa dok skenira.
Sledi uputstva na ekranu. Kada zavrsi pojavice se log (C:\ComboFix.txt) koji ces nam ovde iskopirati.

Poslao: 31 Okt 2008 18:40
Idi na vrh
offline
  • l00ney  Male
  • Novi MyCity građanin
  • Pridružio: 26 Jan 2008
  • Poruke: 6

ComboFix 08-10-30.13 - fim1 2008-10-31 18:33:49.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.150 [GMT 1:00]
Running from: C:\Documents and Settings\fim1\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
/wow section - STAGE 41


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\IE4 Error Log.txt
C:\WINDOWS\system32\Cfx32.lic
C:\WINDOWS\system32\cfx32.ocx
C:\WINDOWS\system32\comsa32.sys
C:\WINDOWS\system32\tmp0_721325162490.bk
C:\WINDOWS\system32\tpszxyd.sys

.
((((((((((((((((((((((((( Files Created from 2008-09-28 to 2008-10-31 )))))))))))))))))))))))))))))))
.

2008-10-31 17:26 . 2008-10-31 17:26 <DIR> d-------- C:\Program Files\AVG
2008-10-31 17:26 . 2008-10-31 17:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8
2008-10-31 17:03 . 2008-10-31 17:03 <DIR> d-------- C:\Program Files\Trend Micro
2008-10-20 13:16 . 2008-10-22 22:00 61,952 --a------ C:\WINDOWS\system32\msudf.exe
2008-10-02 22:52 . 2008-10-02 22:52 <DIR> d-------- C:\Program Files\Real
2008-10-02 22:52 . 2008-10-02 22:52 <DIR> d-------- C:\Program Files\PeerWeb DC++
2008-10-02 22:46 . 2008-10-02 22:46 <DIR> d-------- C:\Program Files\MP4Tool
2008-10-02 22:46 . 2008-10-02 22:46 <DIR> d-------- C:\Program Files\Audio Mid Recorder
2008-10-02 22:46 . 2008-10-02 22:46 <DIR> d-------- C:\Program Files\Any Audio Converter
2008-10-02 22:42 . 2008-10-02 22:42 <DIR> d-------- C:\Program Files\Common Files\xing shared
2008-10-02 22:42 . 2008-10-02 22:42 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-09-26 23:00 . 2008-09-26 23:00 <DIR> d-------- C:\Documents and Settings\fim1\.borland
2008-09-26 20:39 . 2008-09-26 20:39 1,129,472 --a------ C:\WINDOWS\system32\vclAbsDbd7.bpl
2008-09-22 22:20 . 2008-10-26 21:24 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-09-22 22:20 . 2008-09-22 22:20 1,409 --a------ C:\WINDOWS\QTFont.for
2008-09-14 11:23 . 2008-09-14 11:23 <DIR> d-------- C:\Program Files\%temp&
2008-09-13 23:33 . 2008-09-13 23:33 <DIR> d-------- C:\Program Files\GSpot

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-31 15:59 --------- d-----w C:\Program Files\Search Settings
2008-10-31 15:53 --------- d-----w C:\Documents and Settings\fim1\Application Data\Skype
2008-10-31 15:46 --------- d-----w C:\Documents and Settings\fim1\Application Data\skypePM
2008-10-31 15:44 --------- d-----w C:\Documents and Settings\fim1\Application Data\MegauploadToolbar
2008-10-31 14:50 --------- d-----w C:\Program Files\ESET
2008-10-31 14:47 --------- d-----w C:\Documents and Settings\fim1\Application Data\uTorrent
2008-10-31 13:47 1,820,672 ----a-w C:\WINDOWS\Internet Logs\xDB253.tmp
2008-10-31 13:45 3,279,872 ----a-w C:\WINDOWS\Internet Logs\xDB252.tmp
2008-10-27 18:21 --------- d-----w C:\Documents and Settings\fim1\Application Data\TransRender
2008-10-26 19:46 3,171,840 ----a-w C:\WINDOWS\Internet Logs\xDB250.tmp
2008-10-26 19:46 1,699,328 ----a-w C:\WINDOWS\Internet Logs\xDB251.tmp
2008-10-19 14:38 1,595,904 ----a-w C:\WINDOWS\Internet Logs\xDB24F.tmp
2008-10-19 14:20 3,137,536 ----a-w C:\WINDOWS\Internet Logs\xDB24E.tmp
2008-10-12 20:55 3,140,096 ----a-w C:\WINDOWS\Internet Logs\xDB24D.tmp
2008-10-10 11:00 2,667,520 ----a-w C:\WINDOWS\Internet Logs\xDB24C.tmp
2008-10-10 10:59 3,131,392 ----a-w C:\WINDOWS\Internet Logs\xDB24B.tmp
2008-10-02 21:44 45,056 ----a-w C:\WINDOWS\Internet Logs\xDB24A.tmp
2008-10-02 21:44 3,124,224 ----a-w C:\WINDOWS\Internet Logs\xDB249.tmp
2008-10-02 21:36 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-10-02 21:28 --------- d-----w C:\Program Files\AudioConvert
2008-10-02 12:56 696,832 ----a-w C:\WINDOWS\Internet Logs\xDB248.tmp
2008-10-02 12:56 3,122,688 ----a-w C:\WINDOWS\Internet Logs\xDB247.tmp
2008-09-30 10:52 --------- d-----w C:\Program Files\Winamp
2008-09-27 09:15 225,280 ----a-w C:\WINDOWS\Internet Logs\xDB246.tmp
2008-09-27 09:14 3,223,552 ----a-w C:\WINDOWS\Internet Logs\xDB245.tmp
2008-09-26 21:46 --------- d-----w C:\Program Files\TP
2008-09-26 13:50 7,392,332 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip
2008-09-26 13:49 3,119,616 ----a-w C:\WINDOWS\Internet Logs\xDB243.tmp
2008-09-26 13:49 2,663,424 ----a-w C:\WINDOWS\Internet Logs\xDB244.tmp
2008-09-20 14:10 3,116,032 ----a-w C:\WINDOWS\Internet Logs\xDB241.tmp
2008-09-20 14:10 1,232,384 ----a-w C:\WINDOWS\Internet Logs\xDB242.tmp
2008-09-16 17:12 44,032 ----a-w C:\WINDOWS\Internet Logs\xDB240.tmp
2008-09-16 17:10 3,104,768 ----a-w C:\WINDOWS\Internet Logs\xDB23F.tmp
2008-09-16 12:08 651,776 ----a-w C:\WINDOWS\Internet Logs\xDB23E.tmp
2008-09-16 11:59 3,105,280 ----a-w C:\WINDOWS\Internet Logs\xDB23D.tmp
2008-09-12 11:56 3,104,768 ----a-w C:\WINDOWS\Internet Logs\xDB23B.tmp
2008-09-12 11:56 18,944 ----a-w C:\WINDOWS\Internet Logs\xDB23C.tmp
2008-09-12 11:48 429,056 ----a-w C:\WINDOWS\Internet Logs\xDB23A.tmp
2008-09-12 11:48 3,104,768 ----a-w C:\WINDOWS\Internet Logs\xDB239.tmp
2008-09-10 07:27 3,100,160 ----a-w C:\WINDOWS\Internet Logs\xDB237.tmp
2008-09-10 07:27 1,137,152 ----a-w C:\WINDOWS\Internet Logs\xDB238.tmp
2008-09-08 14:45 844,288 ----a-w C:\WINDOWS\Internet Logs\xDB236.tmp
2008-09-08 14:45 3,095,552 ----a-w C:\WINDOWS\Internet Logs\xDB235.tmp
2008-09-04 10:54 594,432 ----a-w C:\WINDOWS\Internet Logs\xDB234.tmp
2008-09-04 10:52 3,091,456 ----a-w C:\WINDOWS\Internet Logs\xDB233.tmp
2008-09-02 12:04 1,456,640 ----a-w C:\WINDOWS\Internet Logs\xDB232.tmp
2008-09-02 12:00 3,096,064 ----a-w C:\WINDOWS\Internet Logs\xDB231.tmp
2008-08-31 13:04 231,720 ----a-w C:\mediamp3.dat
2008-07-30 21:49 444,416 ----a-w C:\WINDOWS\Internet Logs\xDB230.tmp
2008-07-30 21:49 3,096,576 ----a-w C:\WINDOWS\Internet Logs\xDB22F.tmp
2008-07-29 21:33 3,082 ----a-w C:\WINDOWS\system32\affv11300p4now.sys
2008-07-29 18:24 95,232 ----a-w C:\WINDOWS\Internet Logs\xDB22E.tmp
2008-07-29 18:24 3,080,704 ----a-w C:\WINDOWS\Internet Logs\xDB22D.tmp
2008-07-18 07:42 506,368 ----a-w C:\WINDOWS\Internet Logs\xDB22C.tmp
2008-07-18 07:42 3,078,656 ----a-w C:\WINDOWS\Internet Logs\xDB22B.tmp
2008-07-14 19:55 3,078,144 ----a-w C:\WINDOWS\Internet Logs\xDB229.tmp
2008-07-14 19:55 263,168 ----a-w C:\WINDOWS\Internet Logs\xDB22A.tmp
2008-07-13 07:35 360,448 ----a-w C:\WINDOWS\Internet Logs\xDB228.tmp
2008-07-13 07:35 3,078,144 ----a-w C:\WINDOWS\Internet Logs\xDB227.tmp
2008-07-10 15:45 3,076,608 ----a-w C:\WINDOWS\Internet Logs\xDB225.tmp
2008-07-10 15:45 1,323,008 ----a-w C:\WINDOWS\Internet Logs\xDB226.tmp
2007-04-19 17:13 56 --sh--r C:\WINDOWS\system32\7DB451F885.sys
2008-04-11 15:14 1,838 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"MemoryWasher"="C:\Program Files\Memory Washer\MemoryWasher.exe" [2008-03-19 2088960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Smapp"="C:\Program Files\Analog Devices\SoundMAX\SMTray.exe" [2003-05-05 143360]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2004-06-10 81920]
"Zone Labs Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2004-11-28 902432]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-05-28 98304]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 81920]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-06-07 185896]
"RemoteControl8"="C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2008-03-20 83240]
"PDVD8LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe" [2007-12-14 50472]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-08-04 36352]
"egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2007-12-21 1443072]
"SoundMan"="SOUNDMAN.EXE" [2006-08-03 C:\WINDOWS\soundman.exe]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-04-03 65588]
Picture Package Menu.lnk - C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe [2007-11-28 151552]
Picture Package VCD Maker.lnk - C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe [2007-11-28 106496]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.xvid"= xvid.dll
"vidc.ffds"= ffdshow.ax

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"D:\\Miroslav\\programi\\utorrent.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"D:\\Nemanja\\Manager\\fm.exe"=
"D:\\pes 2008\\PES2008.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\CyberLink\\PowerDVD8\\PowerDVD8.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2007-12-21 33800]
R3 usnjsvc;Messenger Sharing Folders USN Journal Reader service;C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys [2005-08-30 58320]
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys [2005-08-30 8304]
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys [2005-08-30 94000]
S3 WebSTARNdis;WebSTAR DPX USB Cable Modem Adapter;C:\WINDOWS\system32\DRIVERS\WebSTAR.sys [2001-12-17 15417]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ea800f53-3b82-11dd-9bf2-001a4d761a5c}]
\Shell\Auto\command - H:\Autorun.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Autorun.exe

*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Spanish - C:\Program Files\Learn To Speak Russian Demo V3.1\Study Conversation.exe


.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\fim1\Application Data\Mozilla\Firefox\Profiles\phmwgiu4.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, gmer.net
Rootkit scan 2008-10-31 18:35:36
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-10-31 18:38:10
ComboFix-quarantined-files.txt 2008-10-31 17:37:26

Pre-Run: 1.898.057.728 bytes free
Post-Run: 2,923,307,008 bytes free

182 --- E O F --- 2007-10-10 07:41:57

Poslao: 31 Okt 2008 20:44
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Otvoriti Notepad i iskopirati sledeci tekst:

File::
C:\WINDOWS\system32\msmsn.exe
C:\WINDOWS\system32\msudf.exe

Folder::
C:\Program Files\Search Settings

Driver::
msmsnkd


Snimiti na Desktop fajl iz Notepada kao "CFScript"




Prevuci snimljeni skript/tekst na ComboFix ikonicu kao na slici.
Postaviti u sledecoj poruci log koji bude bio napravljen na kraju ciscenja/skeniranja.

Poslao: 31 Okt 2008 21:34
Idi na vrh
offline
  • l00ney  Male
  • Novi MyCity građanin
  • Pridružio: 26 Jan 2008
  • Poruke: 6

ComboFix 08-10-30.13 - fim1 2008-10-31 21:23:07.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.135 [GMT 1:00]
Running from: C:\Documents and Settings\fim1\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\fim1\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\system32\msmsn.exe
C:\WINDOWS\system32\msudf.exe
.
/wow section - STAGE 41


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Search Settings
C:\Program Files\Search Settings\kb127\SearchSettings.dll
C:\Program Files\Search Settings\kb127\SearchSettingsRes409.dll
C:\WINDOWS\system32\msmsn.exe
C:\WINDOWS\system32\msudf.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_MSMSNKD
-------\Service_msmsnkd


((((((((((((((((((((((((( Files Created from 2008-09-28 to 2008-10-31 )))))))))))))))))))))))))))))))
.

2008-10-31 17:26 . 2008-10-31 17:26 <DIR> d-------- C:\Program Files\AVG
2008-10-31 17:26 . 2008-10-31 17:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8
2008-10-31 17:03 . 2008-10-31 17:03 <DIR> d-------- C:\Program Files\Trend Micro
2008-10-02 22:52 . 2008-10-02 22:52 <DIR> d-------- C:\Program Files\Real
2008-10-02 22:52 . 2008-10-02 22:52 <DIR> d-------- C:\Program Files\PeerWeb DC++
2008-10-02 22:46 . 2008-10-02 22:46 <DIR> d-------- C:\Program Files\MP4Tool
2008-10-02 22:46 . 2008-10-02 22:46 <DIR> d-------- C:\Program Files\Audio Mid Recorder
2008-10-02 22:46 . 2008-10-02 22:46 <DIR> d-------- C:\Program Files\Any Audio Converter
2008-10-02 22:42 . 2008-10-02 22:42 <DIR> d-------- C:\Program Files\Common Files\xing shared
2008-10-02 22:42 . 2008-10-02 22:42 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-09-26 23:00 . 2008-09-26 23:00 <DIR> d-------- C:\Documents and Settings\fim1\.borland
2008-09-26 20:39 . 2008-09-26 20:39 1,129,472 --a------ C:\WINDOWS\system32\vclAbsDbd7.bpl
2008-09-22 22:20 . 2008-10-26 21:24 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-09-22 22:20 . 2008-09-22 22:20 1,409 --a------ C:\WINDOWS\QTFont.for
2008-09-14 11:23 . 2008-09-14 11:23 <DIR> d-------- C:\Program Files\%temp&
2008-09-13 23:33 . 2008-09-13 23:33 <DIR> d-------- C:\Program Files\GSpot

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-31 20:18 --------- d-----w C:\Documents and Settings\fim1\Application Data\MegauploadToolbar
2008-10-31 15:53 --------- d-----w C:\Documents and Settings\fim1\Application Data\Skype
2008-10-31 15:46 --------- d-----w C:\Documents and Settings\fim1\Application Data\skypePM
2008-10-31 14:50 --------- d-----w C:\Program Files\ESET
2008-10-31 14:47 --------- d-----w C:\Documents and Settings\fim1\Application Data\uTorrent
2008-10-31 13:47 1,820,672 ----a-w C:\WINDOWS\Internet Logs\xDB253.tmp
2008-10-31 13:45 3,279,872 ----a-w C:\WINDOWS\Internet Logs\xDB252.tmp
2008-10-27 18:21 --------- d-----w C:\Documents and Settings\fim1\Application Data\TransRender
2008-10-26 19:46 3,171,840 ----a-w C:\WINDOWS\Internet Logs\xDB250.tmp
2008-10-26 19:46 1,699,328 ----a-w C:\WINDOWS\Internet Logs\xDB251.tmp
2008-10-19 14:38 1,595,904 ----a-w C:\WINDOWS\Internet Logs\xDB24F.tmp
2008-10-19 14:20 3,137,536 ----a-w C:\WINDOWS\Internet Logs\xDB24E.tmp
2008-10-12 20:55 3,140,096 ----a-w C:\WINDOWS\Internet Logs\xDB24D.tmp
2008-10-10 11:00 2,667,520 ----a-w C:\WINDOWS\Internet Logs\xDB24C.tmp
2008-10-10 10:59 3,131,392 ----a-w C:\WINDOWS\Internet Logs\xDB24B.tmp
2008-10-02 21:44 45,056 ----a-w C:\WINDOWS\Internet Logs\xDB24A.tmp
2008-10-02 21:44 3,124,224 ----a-w C:\WINDOWS\Internet Logs\xDB249.tmp
2008-10-02 21:36 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-10-02 21:28 --------- d-----w C:\Program Files\AudioConvert
2008-10-02 12:56 696,832 ----a-w C:\WINDOWS\Internet Logs\xDB248.tmp
2008-10-02 12:56 3,122,688 ----a-w C:\WINDOWS\Internet Logs\xDB247.tmp
2008-09-30 10:52 --------- d-----w C:\Program Files\Winamp
2008-09-27 09:15 225,280 ----a-w C:\WINDOWS\Internet Logs\xDB246.tmp
2008-09-27 09:14 3,223,552 ----a-w C:\WINDOWS\Internet Logs\xDB245.tmp
2008-09-26 21:46 --------- d-----w C:\Program Files\TP
2008-09-26 13:50 7,392,332 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip
2008-09-26 13:49 3,119,616 ----a-w C:\WINDOWS\Internet Logs\xDB243.tmp
2008-09-26 13:49 2,663,424 ----a-w C:\WINDOWS\Internet Logs\xDB244.tmp
2008-09-20 14:10 3,116,032 ----a-w C:\WINDOWS\Internet Logs\xDB241.tmp
2008-09-20 14:10 1,232,384 ----a-w C:\WINDOWS\Internet Logs\xDB242.tmp
2008-09-16 17:12 44,032 ----a-w C:\WINDOWS\Internet Logs\xDB240.tmp
2008-09-16 17:10 3,104,768 ----a-w C:\WINDOWS\Internet Logs\xDB23F.tmp
2008-09-16 12:08 651,776 ----a-w C:\WINDOWS\Internet Logs\xDB23E.tmp
2008-09-16 11:59 3,105,280 ----a-w C:\WINDOWS\Internet Logs\xDB23D.tmp
2008-09-12 11:56 3,104,768 ----a-w C:\WINDOWS\Internet Logs\xDB23B.tmp
2008-09-12 11:56 18,944 ----a-w C:\WINDOWS\Internet Logs\xDB23C.tmp
2008-09-12 11:48 429,056 ----a-w C:\WINDOWS\Internet Logs\xDB23A.tmp
2008-09-12 11:48 3,104,768 ----a-w C:\WINDOWS\Internet Logs\xDB239.tmp
2008-09-10 07:27 3,100,160 ----a-w C:\WINDOWS\Internet Logs\xDB237.tmp
2008-09-10 07:27 1,137,152 ----a-w C:\WINDOWS\Internet Logs\xDB238.tmp
2008-09-08 14:45 844,288 ----a-w C:\WINDOWS\Internet Logs\xDB236.tmp
2008-09-08 14:45 3,095,552 ----a-w C:\WINDOWS\Internet Logs\xDB235.tmp
2008-09-04 10:54 594,432 ----a-w C:\WINDOWS\Internet Logs\xDB234.tmp
2008-09-04 10:52 3,091,456 ----a-w C:\WINDOWS\Internet Logs\xDB233.tmp
2008-09-02 12:04 1,456,640 ----a-w C:\WINDOWS\Internet Logs\xDB232.tmp
2008-09-02 12:00 3,096,064 ----a-w C:\WINDOWS\Internet Logs\xDB231.tmp
2008-08-31 13:04 231,720 ----a-w C:\mediamp3.dat
2008-07-30 21:49 444,416 ----a-w C:\WINDOWS\Internet Logs\xDB230.tmp
2008-07-30 21:49 3,096,576 ----a-w C:\WINDOWS\Internet Logs\xDB22F.tmp
2008-07-29 21:33 3,082 ----a-w C:\WINDOWS\system32\affv11300p4now.sys
2008-07-29 18:24 95,232 ----a-w C:\WINDOWS\Internet Logs\xDB22E.tmp
2008-07-29 18:24 3,080,704 ----a-w C:\WINDOWS\Internet Logs\xDB22D.tmp
2008-07-18 07:42 506,368 ----a-w C:\WINDOWS\Internet Logs\xDB22C.tmp
2008-07-18 07:42 3,078,656 ----a-w C:\WINDOWS\Internet Logs\xDB22B.tmp
2008-07-14 19:55 3,078,144 ----a-w C:\WINDOWS\Internet Logs\xDB229.tmp
2008-07-14 19:55 263,168 ----a-w C:\WINDOWS\Internet Logs\xDB22A.tmp
2008-07-13 07:35 360,448 ----a-w C:\WINDOWS\Internet Logs\xDB228.tmp
2008-07-13 07:35 3,078,144 ----a-w C:\WINDOWS\Internet Logs\xDB227.tmp
2008-07-10 15:45 3,076,608 ----a-w C:\WINDOWS\Internet Logs\xDB225.tmp
2008-07-10 15:45 1,323,008 ----a-w C:\WINDOWS\Internet Logs\xDB226.tmp
2007-04-19 17:13 56 --sh--r C:\WINDOWS\system32\7DB451F885.sys
2008-04-11 15:14 1,838 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( snapshot@2008-10-31_18.36.56,32 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-20 19:02:28 163,328 ----a-w C:\WINDOWS\ERDNT\subs\ERDNT.EXE
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"MemoryWasher"="C:\Program Files\Memory Washer\MemoryWasher.exe" [2008-03-19 2088960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Smapp"="C:\Program Files\Analog Devices\SoundMAX\SMTray.exe" [2003-05-05 143360]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2004-06-10 81920]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-05-28 98304]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 81920]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-06-07 185896]
"RemoteControl8"="C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2008-03-20 83240]
"PDVD8LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe" [2007-12-14 50472]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-08-04 36352]
"egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2007-12-21 1443072]
"SoundMan"="SOUNDMAN.EXE" [2006-08-03 C:\WINDOWS\soundman.exe]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-04-03 65588]
Picture Package Menu.lnk - C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe [2007-11-28 151552]
Picture Package VCD Maker.lnk - C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe [2007-11-28 106496]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.xvid"= xvid.dll
"vidc.ffds"= ffdshow.ax

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"D:\\Miroslav\\programi\\utorrent.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"D:\\Nemanja\\Manager\\fm.exe"=
"D:\\pes 2008\\PES2008.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\CyberLink\\PowerDVD8\\PowerDVD8.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2007-12-21 33800]
S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys [2005-08-30 58320]
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys [2005-08-30 8304]
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys [2005-08-30 94000]
S3 usnjsvc;Messenger Sharing Folders USN Journal Reader service;C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
S3 WebSTARNdis;WebSTAR DPX USB Cable Modem Adapter;C:\WINDOWS\system32\DRIVERS\WebSTAR.sys [2001-12-17 15417]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ea800f53-3b82-11dd-9bf2-001a4d761a5c}]
\Shell\Auto\command - H:\Autorun.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Autorun.exe
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, gmer.net
Rootkit scan 2008-10-31 21:25:50
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2008-10-31 21:32:20 - machine was rebooted
ComboFix-quarantined-files.txt 2008-10-31 20:31:39
ComboFix2.txt 2008-10-31 17:38:12

Pre-Run: 2.885.287.936 bytes free
Post-Run: 2,821,599,232 bytes free

190 --- E O F --- 2007-10-10 07:41:57

Poslao: 31 Okt 2008 23:35
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Kakvo je sada stanje? Postoji li neki problem?

Poslao: 01 Nov 2008 00:18
Idi na vrh
offline
  • l00ney  Male
  • Novi MyCity građanin
  • Pridružio: 26 Jan 2008
  • Poruke: 6

Pa sad vise ne javlja da ga registruje. Dobro je za sad. Hvala na pomoci. Ako ponovo bude problema cujemo se Wink

Poslao: 01 Nov 2008 09:45
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Zamolio bih te da zipuješ kompletan folder: C:\Qoobox\Quarantine

i da ga uploaduješ: http://www.mycity.rs/ambulanta-upload.php

Nakon toga uradi sledeće:
Klikni START a zatim RUN
U liniju za unos teksta ukucaj Combofix /u i klikni OK





Sačekaj da se proces deinstalacije završi
Gornja procedura će:
Obrisati sledeće:
ComboFix i njegove file-ove i foldere
VundoFix Backups folder, ako postoji
C:\Deckard folder, ako postoji
C:\OtMoveIt folder, ako postoji
Resetovati podešavanja sata na kompjuteru
Sakriti ekstenzije file-ova, ako je potrebno
Sakriti sistemske/skrivene file-ove/foldere, ako je potrebno
Resetovati System Restore


To je sve.

MyCity » Ambulanta -> Arhiva Ambulante » killVBS.vbs i autorun.inf

Ko je trenutno na forumu
 

Ukupno su 1174 korisnika na forumu :: 25 registrovanih, 7 sakrivenih i 1142 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: Brana01, comi_pfc, Denaya, draganl, gmlale, ikan, krkalon, kunktator, Lieutenant, mercedesamg, Metanoja, Mi lao shu, Mihajlo, Oscar, pape, pein, procesor, Sirius, sombrero, Steeeefan, virked, Vlada78, VladaKG1980, wolverined4, YugoSlav