nesto nije uredu

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

u zadnjih 15 dana obaram 3 puta sistem nesto se uvuce neznam sta blokira mi internet programe prebacujem sa usb stika neznam da nije on zarazen pa molim vas provjerite Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:32:33, on 23.1.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Ovislink\Common\TurboG-UI.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Netscape\Navigator 9\navigator.exe
C:\Documents and Settings\Srdjan\Desktop\srdjan\TR3.exe..exe

O1 - Hosts: 66.98.148.65 auto.search.msn.com
O1 - Hosts: 66.98.148.65 auto.search.msn.es
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: AirLive Turbo-G Wireless Utility.lnk = C:\Program Files\Ovislink\Common\TurboG-UI.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{042BA14A-F148-4B9F-A8B4-430A3CC1E550}: NameServer = 81.93.85.152 81.93.85.132
O17 - HKLM\System\CS1\Services\Tcpip\..\{042BA14A-F148-4B9F-A8B4-430A3CC1E550}: NameServer = 81.93.85.152 81.93.85.132
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

--
End of file - 4756 bytes

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Skini ComboFix sa jedne od sledecih adresa na Desktop:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://www.forospyware.com/sUBs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe

Startuj ga i ne diraj prozor programa dok skenira.
Sledi uputstva na ekranu. Kada zavrsi pojavice se log (C:\ComboFix.txt) koji ces nam ovde iskopirati.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

ComboFix 09-01-21.04 - Srdjan 2009-01-23 17:13:49.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.205 [GMT 1:00]
Running from: c:\documents and settings\Srdjan\Desktop\ComboFix.exe
AV: AVG 7.5.524 *On-access scanning disabled* (Updated)
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-12-23 to 2009-01-23 )))))))))))))))))))))))))))))))
.

2009-01-23 15:13 . 2009-01-23 15:18 <DIR> d-------- c:\documents and settings\Srdjan\Application Data\Nero
2009-01-23 15:02 . 2009-01-23 15:02 4,767 --a------ c:\windows\Irremote.ini
2009-01-23 15:01 . 2009-01-23 15:01 <DIR> d-------- c:\program files\Windows Sidebar
2009-01-23 14:53 . 2009-01-23 15:01 <DIR> d-------- c:\program files\Nero
2009-01-23 14:53 . 2009-01-23 15:09 <DIR> d-------- c:\program files\Common Files\Nero
2009-01-23 14:53 . 2009-01-23 14:57 <DIR> d-------- c:\documents and settings\All Users\Application Data\Nero
2009-01-23 14:46 . 2009-01-23 14:46 <DIR> d-------- c:\windows\system32\Adobe
2009-01-23 14:46 . 2009-01-23 14:46 10 --a------ c:\windows\popcinfo.dat
2009-01-23 14:45 . 2009-01-23 14:45 <DIR> d-------- c:\program files\GameHouse
2009-01-23 14:44 . 2009-01-23 14:44 376 --a------ c:\windows\ODBC.INI
2009-01-23 14:43 . 2009-01-23 14:43 <DIR> d--h----- c:\windows\ShellNew
2009-01-23 14:43 . 2009-01-23 14:43 <DIR> d-------- c:\program files\Microsoft ActiveSync
2009-01-23 14:36 . 2009-01-23 15:26 <DIR> d-------- c:\documents and settings\Srdjan\Tracing
2009-01-23 14:25 . 2009-01-23 14:25 <DIR> d-------- c:\program files\Windows Live SkyDrive
2009-01-23 14:25 . 2009-01-23 14:25 <DIR> d-------- c:\program files\Windows Live
2009-01-23 14:25 . 2009-01-23 14:25 <DIR> d-------- c:\program files\Microsoft
2009-01-23 13:47 . 2009-01-23 13:47 <DIR> d-------- c:\program files\Winamp
2009-01-23 13:47 . 2009-01-23 13:48 <DIR> d-------- c:\documents and settings\Srdjan\Application Data\Winamp
2009-01-23 13:47 . 2008-08-20 18:58 129,520 --------- c:\windows\system32\pxafs.dll
2009-01-23 13:35 . 2009-01-23 13:35 <DIR> d-------- c:\program files\Foxit Software
2009-01-23 13:35 . 2009-01-23 13:35 <DIR> d-------- c:\documents and settings\Srdjan\Application Data\Foxit
2009-01-23 13:33 . 2009-01-23 13:33 <DIR> d-------- c:\program files\CCleaner
2009-01-23 13:26 . 2009-01-23 13:26 <DIR> d-------- c:\program files\Yahoo!
2009-01-23 13:26 . 2009-01-23 13:26 <DIR> d-------- c:\documents and settings\All Users\Application Data\Yahoo!
2009-01-23 13:25 . 2009-01-23 13:25 <DIR> d-------- c:\windows\system32\LogFiles
2009-01-23 13:25 . 2009-01-23 13:25 <DIR> d-------- c:\windows\system32\drivers\UMDF
2009-01-23 13:25 . 2009-01-23 13:25 <DIR> d-------- c:\program files\Windows Media Connect 2
2009-01-23 13:25 . 2006-09-25 17:58 23,856 --a------ c:\windows\system32\spupdsvc.exe
2009-01-23 13:21 . 2004-08-04 13:00 605,696 --a------ c:\windows\system32\getuname.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-23 15:26 --------- d-----w c:\documents and settings\Srdjan\Application Data\Skype
2009-01-23 15:06 --------- d-----w c:\documents and settings\Srdjan\Application Data\skypePM
2009-01-23 11:50 --------- d-----w c:\program files\Common Files\Windows Live
2009-01-23 11:48 --------- d-----w c:\program files\Skype
2009-01-23 11:48 --------- d-----w c:\program files\Google
2009-01-23 11:48 --------- d-----w c:\program files\Common Files\Skype
2009-01-23 11:48 --------- d-----w c:\documents and settings\All Users\Application Data\Skype
2009-01-23 11:44 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-01-23 11:44 --------- d-----w c:\documents and settings\Srdjan\Application Data\Malwarebytes
2009-01-23 11:44 --------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-23 11:31 --------- d-----w c:\program files\Netscape
2009-01-23 11:31 --------- d-----w c:\documents and settings\Srdjan\Application Data\Netscape
2009-01-23 11:30 --------- d-----w c:\program files\Lavasoft
2009-01-23 11:28 --------- d-----w c:\documents and settings\Srdjan\Application Data\AVG7
2009-01-23 11:25 --------- d-----w c:\documents and settings\All Users\Application Data\avg7
2009-01-23 11:01 499,712 ----a-w c:\windows\system32\msvcp71.dll
2009-01-23 11:01 348,160 ----a-w c:\windows\system32\msvcr71.dll
2009-01-23 11:01 --------- d-----w c:\documents and settings\LocalService\Application Data\AVG7
2009-01-23 11:01 --------- d-----w c:\documents and settings\All Users\Application Data\Grisoft
2009-01-23 10:56 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-23 10:56 --------- d-----w c:\program files\PLEOMAX PWC-2000
2009-01-23 10:56 --------- d-----w c:\program files\Common Files\PWC2000
2009-01-23 10:49 20,747 ----a-w c:\windows\system32\drivers\AegisP.sys
2009-01-23 10:49 --------- d-----w c:\program files\Ovislink
2009-01-23 10:47 --------- d-----w c:\program files\AMD
2009-01-23 10:45 --------- d-----w c:\program files\Realtek Sound Manager
2009-01-23 10:45 --------- d-----w c:\program files\Common Files\InstallShield
2009-01-23 10:45 --------- d-----w c:\program files\AvRack
2009-01-23 10:32 --------- d-----w c:\program files\microsoft frontpage
2009-01-14 15:11 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-14 15:11 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
2008-12-02 21:37 49,480 ----a-w c:\windows\system32\sirenacm.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-07-23 21738792]
"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-27 4670704]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2008-12-02 3882312]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="c:\progra~1\Grisoft\AVG7\avgcc.exe" [2009-01-23 579584]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2009-01-14 399504]
"SoundMan"="SOUNDMAN.EXE" [2004-06-18 c:\windows\SOUNDMAN.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"AVG7_Run"="c:\progra~1\Grisoft\AVG7\avgw.exe" [2009-01-23 219136]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
AirLive Turbo-G Wireless Utility.lnk - c:\program files\Ovislink\Common\TurboG-UI.exe [1/23/2009 11:49:46 AM 614400]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [1/23/2009 12:44:56 PM 15504]
R3 PAC7311;PLEOMAX PWC-2000;c:\windows\system32\drivers\PA707UCM.SYS [1/23/2009 11:56:37 AM 150272]

--- Other Services/Drivers In Memory ---

*Deregistered* - ALG
*Deregistered* - AudioSrv
*Deregistered* - Avg7Alrt
*Deregistered* - Avg7UpdSvc
*Deregistered* - AVGEMS
*Deregistered* - Browser
*Deregistered* - CryptSvc
*Deregistered* - DcomLaunch
*Deregistered* - Dhcp
*Deregistered* - dmserver
*Deregistered* - Dnscache
*Deregistered* - ERSvc
*Deregistered* - EventSystem
*Deregistered* - helpsvc
*Deregistered* - ImapiService
*Deregistered* - LanmanServer
*Deregistered* - lanmanworkstation
*Deregistered* - LmHosts
*Deregistered* - MBAMService
*Deregistered* - Nero BackItUp Scheduler 4.0
*Deregistered* - Netman
*Deregistered* - Nla
*Deregistered* - PolicyAgent
*Deregistered* - ProtectedStorage
*Deregistered* - RasMan
*Deregistered* - RemoteRegistry
*Deregistered* - RpcSs
*Deregistered* - SamSs
*Deregistered* - Schedule
*Deregistered* - seclogon
*Deregistered* - SENS
*Deregistered* - SharedAccess
*Deregistered* - ShellHWDetection
*Deregistered* - Spooler
*Deregistered* - srservice
*Deregistered* - SSDPSRV
*Deregistered* - STI Simulator
*Deregistered* - stisvc
*Deregistered* - TapiSrv
*Deregistered* - Themes
*Deregistered* - TrkWks
*Deregistered* - W32Time
*Deregistered* - WebClient
*Deregistered* - winmgmt
*Deregistered* - wscsvc
*Deregistered* - wuauserv

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
DcomLaunch REG_MULTI_SZ DcomLaunch

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fabe42c3-e93e-11dd-8782-806d6172696f}]
\Shell\AutoRun\command - d:\bin\Assetup.exe
.
.
------- Supplementary Scan -------
.
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
TCP: {042BA14A-F148-4B9F-A8B4-430A3CC1E550} = 81.93.85.152 81.93.85.132
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, gmer.net
Rootkit scan 2009-01-23 17:14:43
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-01-23 17:15:31
ComboFix-quarantined-files.txt 2009-01-23 16:15:29

Pre-Run: 151.717.134.336 bytes free
Post-Run: 153,475,076,096 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

177

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Nista, sve je cisto.

Jesi li siguran da neki program koji imas instaliran ne pravi trenutno update, pa ti je zato internet usporen?
Jesi li siguran da je problem do tvog kompa, a ne do provajdera?

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

znaci danas sam ga reinstalirao i ubacio programe sa stika samo sam htjeo da provjerim da oni nisu zarazeni jer sam mislio da je stik zarazen pa da mi on pravi probleme a, sto se tice interneta kada sam ukljucen na tren se izmjeni windows kao da je neka stara verzija i diskonektuje me posle moram resetovati da ponovo konektujem dok nije stao skroz i morao sam reinstalirati windows znaci sad je ok

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

U ovoj instalaciji Windowsa nema tragova malwarea sa USB sticka.

Jesi li ubacivao taj USB stick nakon ove nove instalacije Windowsa?

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

da jesam ubacivao sam programe sa ovog usb stika

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Ako si ih ubacivao pre nego sto si skenirao ComboFixom, onda nemoj da brines posto ComboFix nije pokazao nikakve znake zaraze USB sticka.

U tom slucaju je jos samo potrebno deinstalirati ComboFix:

Klikni START a zatim RUN
U liniju za unos teksta ukucaj Combofix /u i klikni OK





Sačekaj da se proces deinstalacije završi
Gornja procedura će:
Obrisati sledeće:
ComboFix i njegove file-ove i foldere
VundoFix Backups folder, ako postoji
C:\Deckard folder, ako postoji
C:\OtMoveIt folder, ako postoji
Resetovati podešavanja sata na kompjuteru
Sakriti ekstenzije file-ova, ako je potrebno
Sakriti sistemske/skrivene file-ove/foldere, ako je potrebno
Resetovati System Restore

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

deinstalirao sam posle skeniranja combofixom izgubio sam autoplay i u doljnjoj traci nemam strelice koja otvara i zatvara ikonice

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Da, ComboFix iskljucuje Autoplay posto se putem autoplaya siri ogroman broj infekcija.
Sto se tice te strelice, to je isto delo ComboFixa, da ti se ne bi skrivali nepozeljni programi.

Zelis li to da vratis kao sto je bilo ranije, ili se slazes da ostane ovako kako je to ComboFix uradio?