Poslao: 15 Nov 2008 23:33
|
offline
- vasa.93
- Moderator foruma
- Pridružio: 17 Dec 2007
- Poruke: 14822
- Gde živiš: Niš
|
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:16:17, on 15.11.2007
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\360desktop\360desktop.exe
C:\Program Files\360desktop\360desktopd.exe
I:\Milan\Hijack This\TR3.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live pomagac za prijavljivanje - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe" /min
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [360desktop] "C:\Program Files\360desktop\360desktop.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{68920EEE-8CA0-4CED-8E70-F4C6BFB64C52}: NameServer = 10.1.1.10,10.1.1.11
O20 - AppInit_DLLs:
O23 - Service: AntiVir PersonalEdition Premium MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avmailc.exe
O23 - Service: AntiVir PersonalEdition Premium Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe
O23 - Service: AntiVir PersonalEdition Premium Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avguard.exe
O23 - Service: Avira AntiVir Premium WebGuard (antivirwebservice) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE
O23 - Service: AntiVir PersonalEdition Premium MailGuard helper service (AVEService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 6098 bytes
|
|
|
Registruj se da bi učestvovao u diskusiji. Registrovanim korisnicima se NE prikazuju reklame unutar poruka.
|
|
|
Poslao: 16 Nov 2008 12:58
|
offline
- vasa.93
- Moderator foruma
- Pridružio: 17 Dec 2007
- Poruke: 14822
- Gde živiš: Niš
|
Moram samo da kazem da se prilikom zavrsetka skeniranja otvorio folder My Documents. Koliko mi se cini, ranije nije bilo tako.
ComboFix 08-11-14.01 - Wasa 2008-11-16 12:50:24.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1704 [GMT 1:00]
Running from: I:\ComboFix.exe
* Created a new restore point
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-10-16 to 2008-11-16 )))))))))))))))))))))))))))))))
.
2008-10-18 13:15 . 2005-03-25 17:24 9,600 --a------ c:\windows\system32\drivers\winfoxiobackup.sys
2008-10-18 11:22 . 2007-11-15 23:14 <DIR> d-------- c:\program files\Folder Lock
2008-10-18 11:22 . 2004-05-10 11:42 110,592 --a------ c:\windows\system32\suppdll.dll
2008-10-18 11:22 . 2008-10-18 11:22 35,363 --a------ c:\windows\system32\windrvNT.sys
2008-10-16 18:47 . 2008-10-16 18:47 <DIR> d--h----- c:\windows\system32\GroupPolicy
2008-10-16 17:58 . 2008-03-20 17:46 334,792 --a------ c:\windows\system32\_AxShlEx.dll
2008-10-16 17:56 . 2008-10-16 17:56 716,272 --a------ c:\windows\system32\drivers\sptd.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-18 14:09 --------- d-----w c:\program files\nLite
2008-10-17 15:05 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2008-10-10 08:15 --------- d-----w c:\documents and settings\Wasa\Application Data\Ahead
2008-10-10 08:13 --------- d-----w c:\program files\Common Files\Ahead
2008-10-10 08:13 --------- d-----w c:\program files\Ahead
2008-10-09 19:54 --------- d-----w c:\program files\Intel
2008-10-05 11:01 --------- d-----w c:\documents and settings\Wasa\Application Data\Thinstall
2008-10-04 08:50 --------- d-----w c:\documents and settings\All Users\Application Data\TEMP
2008-09-29 15:00 --------- d-----w c:\program files\Common Files\DiskTrix
2008-09-29 14:00 --------- d-----w c:\documents and settings\Wasa\Application Data\Publish Providers
2008-09-29 13:38 --------- d-----w c:\program files\Sony
2008-09-29 13:38 --------- d-----w c:\documents and settings\Wasa\Application Data\Sony
2008-09-26 22:42 --------- d-----w c:\documents and settings\All Users\Application Data\nView_Profiles
2008-09-26 21:44 --------- d-----w c:\program files\Opera
2008-09-25 20:38 --------- d-----w c:\program files\Reference Assemblies
2008-09-25 20:38 --------- d-----w c:\program files\MSBuild
2008-09-25 19:33 --------- d-----w c:\program files\CCleaner
2008-09-25 11:37 --------- d-----w c:\program files\Common Files\Adobe
2008-09-25 11:37 --------- d-----w c:\program files\Bonjour
2008-09-25 11:21 --------- d-----w c:\documents and settings\Wasa\Application Data\Winamp
2008-09-25 11:17 --------- d-----w c:\program files\Microsoft Works
2008-09-25 10:51 --------- d-----w c:\documents and settings\All Users\Application Data\FLEXnet
2008-09-25 10:49 --------- d-----w c:\program files\Common Files\Macrovision Shared
2008-09-25 10:27 --------- d-----w c:\program files\Windows Live
2008-09-25 10:26 --------- d-----w c:\program files\Common Files\NSV
2008-09-25 10:23 --------- d-----w c:\program files\Winamp
2008-09-25 10:22 --------- dcsh--w c:\program files\Common Files\WindowsLiveInstaller
2008-09-25 10:19 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller
2008-09-25 10:13 --------- d-----w c:\documents and settings\All Users\Application Data\Avira
2008-09-24 23:41 --------- d-----w c:\documents and settings\Wasa\Application Data\AntiVir PersonalEdition Premium
2008-09-24 23:39 --------- d-----w c:\program files\Avira
2008-09-24 23:32 --------- d-----w c:\program files\MT882
2008-09-24 23:24 --------- d-----w c:\program files\Realtek
2008-09-24 23:24 --------- d-----w c:\documents and settings\Wasa\Application Data\InstallShield
2008-09-24 22:54 --------- d-----w c:\program files\microsoft frontpage
2008-09-15 12:12 1,846,400 ----a-w c:\windows\system32\win32k.sys
2008-08-20 05:30 666,112 ----a-w c:\windows\system32\wininet.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Premium\avgnt.exe" [2008-09-25 266497]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-06-28 8466432]
"MSConfig"="c:\windows\pchealth\helpctr\Binaries\MSCONFIG.EXE" [2008-04-14 169984]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\360desktop]
--a------ 2008-07-25 14:54 1217792 c:\program files\360desktop\360desktop.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
--a------ 2007-05-10 21:46 624248 c:\program files\Adobe\Acrobat 8.0\Acrobat\acrotray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 21:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DWQueuedReporting]
--a------ 2006-10-26 18:48 434528 c:\progra~1\COMMON~1\MICROS~1\DW\DWTRIG20.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core]
--a------ 2006-06-09 02:35 1851392 c:\program files\Electronic Arts\EA Downloader\Core.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSConfig]
--a------ 2008-04-14 04:42 169984 c:\windows\pchealth\helpctr\binaries\msconfig.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2008-04-14 04:42 1695232 c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-10-18 10:35 5724184 c:\program files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
--a------ 2001-07-09 10:50 155648 c:\windows\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2007-06-28 23:43 8466432 c:\windows\system32\nvcpl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 2007-06-28 23:43 81920 c:\windows\system32\nvmctray.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2008-08-04 00:02 36352 c:\program files\Winamp\winampa.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFast2KLoadDefault]
--a------ 2005-09-16 13:35 616448 c:\windows\system32\WF2KCPL.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFoxV2]
--a------ 2007-08-03 15:25 1490944 c:\windows\system32\wf2k.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
-r------- 2005-05-03 11:43 69632 c:\windows\Alcmtr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
-r------- 2006-11-14 10:21 16270848 c:\windows\RTHDCPL.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
-r------- 2006-05-16 11:04 2879488 c:\windows\SkyTel.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"e:\\Program Files\\Valve\\hl.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"e:\\Program Files\\EA SPORTS\\Madden NFL 07\\mainapp.exe"=
"c:\\Program Files\\360desktop\\360desktop.exe"=
"c:\\Program Files\\360desktop\\360manager.exe"=
R2 AVEService;AntiVir PersonalEdition Premium MailGuard helper service;"c:\program files\Avira\AntiVir PersonalEdition Premium\avesvc.exe" [2008-09-25 41217]
S2 AntiVirMailService;AntiVir PersonalEdition Premium MailGuard;"c:\program files\Avira\AntiVir PersonalEdition Premium\avmailc.exe" [2008-09-25 164097]
S2 antivirwebservice;Avira AntiVir Premium WebGuard;"c:\program files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE" [2008-09-25 258305]
S3 iadusb;MT882;c:\windows\system32\DRIVERS\glauiad.sys [2008-09-25 30336]
S4 usnjsvc;Usluga Messenger Sharing Folders USN Journal Reader;"c:\program files\Windows Live\Messenger\usnsvc.exe" [2007-10-18 98328]
.
Contents of the 'Scheduled Tasks' folder
2008-10-16 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2008\OneClickStarter.exe []
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\documents and settings\Wasa\Application Data\Mozilla\Firefox\Profiles\3byw0r71.default\
FF -: plugin - c:\program files\Opera\program\plugins\NPOFF12.DLL
FF -: plugin - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-16 12:51:17
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files:
**************************************************************************
.
Completion time: 2008-11-16 12:51:41
ComboFix-quarantined-files.txt 2008-11-16 11:51:39
Pre-Run: 4.882.395.136 bytes free
Post-Run: 4,871,344,128 bytes free
152 --- E O F --- 2008-10-15 23:00:29
|
|
|
|
Poslao: 16 Nov 2008 13:03
|
offline
- bobby
- Administrator
- Pridružio: 04 Sep 2003
- Poruke: 24135
- Gde živiš: Wien
|
Preuzmi gmer.zip sa ovog linka i sačuvaj na Desktopu.
Raspakuj ga u neki folder.
Dupli klik na gmer.exe za početak: Izaberi Rootkit/Malware Tab na vrhu.
Klikni na Scan.
Kada je skeniranje završeno, klik na Copy dugme ispod - ovo će sačuvati rezultate skeniranja u Clipboard.
Iskoristi opciju Paste u Notepad-u da bi to prebacio u tekst. Snimi taj tekst iz Notepada kao file1.txt.
Ponovi ovo isto sa Autostart Tab-om. Snimi taj tekst iz Notepada kao file2.txt.
Iskoristi opciju Prikači fajl ispod polja za pisanje poruke na forumu, i prikači nam ovde ta dva fajla koja smo malopre snimili
|
|
|
|
|
|
Poslao: 16 Nov 2008 20:29
|
offline
- bobby
- Administrator
- Pridružio: 04 Sep 2003
- Poruke: 24135
- Gde živiš: Wien
|
Mozes li malo da opises problem, posto se iz logova ne vidi nista odredjeno, tj. cisti su?
|
|
|
|
Poslao: 17 Nov 2008 20:51
|
offline
- vasa.93
- Moderator foruma
- Pridružio: 17 Dec 2007
- Poruke: 14822
- Gde živiš: Niš
|
Radi se o tome sto u startu > All Programs imam programe koje sam ranije instalirao i koristio, a racunar prikazuje kao da ih nisam koristio.
U sustini, nije to neki veliki problem, ali zasto ga ne resiti kad je to moguce, a ,iskreno, nervira me.
|
|
|
|
Poslao: 17 Nov 2008 21:04
|
offline
- bobby
- Administrator
- Pridružio: 04 Sep 2003
- Poruke: 24135
- Gde živiš: Wien
|
To ne pokazuje da ih nisi koristio, vec da si ih manje koristio nego ostale.
Mozes da iskljucis tu opciju, pa da ti svi programi budu uvek prikazani.
Elem, ovo ti je bio problem za Windows forum, a ne za Ambulantu.
|
|
|
|
Poslao: 18 Nov 2008 22:08
|
offline
- vasa.93
- Moderator foruma
- Pridružio: 17 Dec 2007
- Poruke: 14822
- Gde živiš: Niš
|
Mene zbunjuje crvenom uokvireno
Inace, nisam znao da je moguce iskljucivanje te opcije. Kako to da uradim?
|
|
|
|