MyCity » Ambulanta -> Arhiva Ambulante » C:windows/sistem32/cvo0.dll TR/Vundo.gen

C:windows/sistem32/cvo0.dll TR/Vundo.gen

Napisano na dan: 9.11.2008
1

C:windows/sistem32/cvo0.dll TR/Vundo.gen
Sledeća strana Pagination

Idi na vrh

Poslao: 09 Nov 2008 09:21
Idi na vrh
offline
  • Ričard  Male
  • Lavlje srce
  • Supermoderator
  • Zver!
  • Electro maintenance engineer
  • Pridružio: 28 Nov 2006
  • Poruke: 13745
  • Gde živiš: Vršac

Pozdarv.
Po svakom ukljucenju racunara Avira izbaci upozorenje o Virusu: C:Windows/sistem32/cvo0.dll TR/Vndo.gen. Obrisem ga i sve lepo radi do ponovnog ukljucelja racunara, kada ga avira ponovo pronadje. Nakon brisanja tog virusa odradim scan Avirom i ona ne nadje nista.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:13:05, on 9.11.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\sm56hlpr.exe
C:\Siemens\Common\S7ubtoox\s7ubtstx.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
D:\PROGRAMI\ObjectDock\ObjectDock\ObjectDock.exe
C:\Siemens\Common\Sqlany\dbsrv50.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\PROGRA~1\FREEDO~1\fdm.exe
C:\Documents and Settings\Novum\Desktop\New Folder (2)\kraj.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [S7UB Start] "C:\Siemens\Common\S7ubtoox\s7ubtstx.exe" -StartDB
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [kamsoft] C:\WINDOWS\system32\ckvo.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Stardock ObjectDock.lnk = D:\PROGRAMI\ObjectDock\ObjectDock\ObjectDock.exe
O8 - Extra context menu item: Download video with Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Preuzmi odabrano Free Download Manager-om - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Preuzmi sa Free Download Managerom - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Preuzmi sve sa Free Download Manager-om - file://C:\Program Files\Free Download Manager\dlall.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @c:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @c:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.apple.com.edgesuite.net/content.in.....plugin.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V.....1136490421
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{ECD91C86-B41C-4745-8A3A-08819DC6A155}: NameServer = 80.93.224.1,80.93.224.2
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 5963 bytes

Poslao: 09 Nov 2008 13:00
Idi na vrh
offline
  • Piksi  Male
  • Elitni građanin
  • Pridružio: 13 Nov 2003
  • Poruke: 2435

Pozdrav...

Klikni desnim tasterom na Avira ikonicu ( ) u donjem, desnom uglu ekrana i deštikliraj AntiVir Guard Enable.

Napomena: Ne zaboravi da uključiš ovu opciju po završetku čišćenja.

Arrow Skini ComboFix sa jedne od sledecih adresa na Desktop:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://www.forospyware.com/sUBs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe

Startuj ga i ne diraj prozor programa dok skenira.
Sledi uputstva na ekranu. Kada zavrsi pojavice se log (C:\ComboFix.txt) koji ces nam ovde iskopirati.

Poslao: 09 Nov 2008 13:37
Idi na vrh
offline
  • Ričard  Male
  • Lavlje srce
  • Supermoderator
  • Zver!
  • Electro maintenance engineer
  • Pridružio: 28 Nov 2006
  • Poruke: 13745
  • Gde živiš: Vršac

Ne znam da li ovo nesto znaci, ali cu napisati. Nakon sto je ComboFix zavrsio skeniranje nestale su sve precice i folderi sa desktopa, start linija se ne pojavljulje ni sa misom, ni uz pomoc tastera, windows logo. IE sam pokrenuo iz Task Managera, to radi, mislim Task Manager.

ComboFix 08-11-07.01 - Novum 2008-11-09 13:22:14.8 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.204 [GMT 1:00]
Running from: c:\documents and settings\Novum\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\autorun.inf
c:\windows\system32\ckvo.exe
D:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2008-10-09 to 2008-11-09 )))))))))))))))))))))))))))))))
.

2008-11-09 08:45 . 2008-11-09 08:45 <DIR> d--hs---- c:\documents and settings\Administrator\PrivacIE
2008-11-09 08:15 . 2008-11-09 08:16 110,013 -r-hs---- C:\sq.com
2008-11-07 17:14 . 2008-11-07 17:15 <DIR> d-------- c:\documents and settings\Novum\.dvdcss
2008-11-07 16:56 . 2008-11-07 16:57 <DIR> d-------- c:\program files\FormatFactory
2008-11-07 08:00 . 1980-01-01 00:00 149,000 --a------ C:\grldr
2008-11-07 08:00 . 2008-11-05 21:52 829 -ra------ C:\menu.lst
2008-11-07 07:59 . 2008-11-09 08:38 <DIR> d-------- C:\boot1
2008-11-04 17:36 . 2008-11-04 17:36 <DIR> d-------- c:\documents and settings\Novum\Application Data\XBMC
2008-11-04 17:35 . 2008-11-05 08:28 <DIR> d-------- c:\program files\XBMC
2008-11-03 08:42 . 2008-11-03 08:42 <DIR> d-------- c:\documents and settings\Novum\Application Data\Thinstall
2008-10-27 21:40 . 2008-10-27 21:40 <DIR> d-------- c:\program files\QuickTime
2008-10-25 06:13 . 2008-10-25 06:13 98,934 ---h----- C:\TREEINFO.WC
2008-10-25 06:10 . 2008-10-25 06:10 <DIR> d-------- C:\wincmd
2008-10-25 06:10 . 2008-11-03 10:52 952 --a------ c:\windows\wincmd.ini
2008-10-25 06:10 . 2002-01-21 04:00 545 --a------ c:\windows\UC.PIF
2008-10-25 06:10 . 2002-01-21 04:00 545 --a------ c:\windows\RAR.PIF
2008-10-25 06:10 . 2002-01-21 04:00 545 --a------ c:\windows\PKZIP.PIF
2008-10-25 06:10 . 2002-01-21 04:00 545 --a------ c:\windows\PKUNZIP.PIF
2008-10-25 06:10 . 2002-01-21 04:00 545 --a------ c:\windows\NOCLOSE.PIF
2008-10-25 06:10 . 2002-01-21 04:00 545 --a------ c:\windows\LHA.PIF
2008-10-25 06:10 . 2002-01-21 04:00 545 --a------ c:\windows\ARJ.PIF
2008-10-24 07:40 . 2008-10-24 07:40 0 --a------ c:\windows\CDMIMPRT.INI
2008-10-14 07:13 . 2008-10-17 09:52 65,536 --a------ c:\windows\IFinst27.exe
2008-10-13 07:17 . 2008-11-08 10:51 <DIR> d-------- c:\program files\AIMP2
2008-10-11 13:06 . 2008-10-11 13:44 <DIR> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2008-10-11 13:05 . 2008-10-11 13:44 <DIR> d-------- c:\program files\SpywareBlaster
2008-10-09 16:25 . 2008-10-09 16:30 <DIR> d-------- c:\windows\system32\Adobe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-09 12:26 --------- d-----w c:\documents and settings\Novum\Application Data\Free Download Manager
2008-11-08 13:03 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-06 07:49 --------- d-----w c:\documents and settings\Novum\Application Data\OpenOffice.org2
2008-10-19 18:33 --------- d-----w c:\documents and settings\Novum\Application Data\uTorrent
2008-10-16 19:54 --------- d-----w c:\program files\OMRON
2008-10-13 06:58 --------- d-----w c:\documents and settings\Novum\Application Data\XnView
2008-10-11 09:24 --------- d-----w c:\program files\Opera
2008-10-07 10:35 --------- d-----w c:\program files\Free Download Manager
2008-10-07 10:34 --------- d-----w c:\documents and settings\All Users\Application Data\FreeDownloadManager.ORG
2008-10-07 10:18 --------- d-----w c:\documents and settings\Novum\Application Data\Uniblue
2008-10-07 10:18 --------- d-----w c:\documents and settings\Novum\Application Data\Sony
2008-10-07 10:18 --------- d-----w c:\documents and settings\Novum\Application Data\BSplayer
2008-10-07 10:18 --------- d-----w c:\documents and settings\Novum\Application Data\Autodesk
2008-10-07 10:18 --------- d-----w c:\documents and settings\Novum\Application Data\ACD Systems
2008-10-07 10:18 --------- d-----w c:\documents and settings\All Users\Application Data\PC Suite
2008-10-07 10:18 --------- d-----w c:\documents and settings\All Users\Application Data\Autodesk
2008-10-07 10:12 --------- d-----w c:\documents and settings\Novum\Application Data\AdobeUM
2008-09-29 05:44 --------- d-----w c:\program files\CCleaner
2008-09-28 18:36 --------- d-----w c:\program files\Common Files\Stardock
2008-09-16 17:45 --------- d-----w c:\program files\COMODO
2008-09-15 06:30 45,696 ----a-w c:\documents and settings\Novum\Application Data\GDIPFONTCACHEV1.DAT
2008-09-13 08:32 --------- d-----w c:\program files\AML Products
2008-09-12 13:06 --------- d-----w c:\program files\uTorrent
2008-09-11 13:03 --------- d-----w c:\program files\Windows Live
2008-09-11 12:59 --------- dcsh--w c:\program files\Common Files\WindowsLiveInstaller
2008-09-11 12:47 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller
2008-09-11 12:26 --------- d-----w c:\program files\Microsoft VM
2008-09-10 21:23 10,488 ----a-w c:\windows\system32\crcnat.exe
2008-09-04 12:34 155,995 ----a-w c:\windows\java\Packages\WAXJNRJ1.ZIP
2008-08-22 01:08 878,592 ----a-w c:\windows\system32\wininet.dll
2008-08-22 01:08 43,008 ----a-w c:\windows\system32\licmgr10.dll
2008-08-22 01:07 18,944 ----a-w c:\windows\system32\corpol.dll
2008-08-22 01:06 72,704 ----a-w c:\windows\system32\admparse.dll
2008-08-22 01:06 71,680 ----a-w c:\windows\system32\iesetup.dll
2008-08-22 01:06 434,176 ----a-w c:\windows\system32\vbscript.dll
2008-08-22 01:05 48,640 ------w c:\windows\system32\PrivacIE.dll
2008-08-22 01:05 48,128 ----a-w c:\windows\system32\mshtmler.dll
2008-08-22 01:05 35,840 ----a-w c:\windows\system32\imgutil.dll
2008-08-22 01:04 45,568 ----a-w c:\windows\system32\mshta.exe
2008-08-22 00:57 156,160 ----a-w c:\windows\system32\msls31.dll
2007-03-20 12:26 106 ----a-w c:\documents and settings\Novum\Application Data\wklnhst.dat
1998-04-27 19:15 570,128 ------w c:\program files\Common Files\dao350.dll
1998-04-26 23:00 570,128 ----a-w c:\program files\DAO350.DLL
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"S7UB Start"="c:\siemens\Common\S7ubtoox\s7ubtstx.exe" [2000-10-25 102400]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-11-23 180269]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_02\bin\jusched.exe" [2007-06-14 132760]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 262401]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-10-27 413696]
"SoundMan"="SOUNDMAN.EXE" [2005-08-01 c:\windows\SOUNDMAN.EXE]
"SMSERIAL"="sm56hlpr.exe" [2005-07-06 c:\windows\sm56hlpr.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

c:\documents and settings\Novum\Start Menu\Programs\Startup\
Stardock ObjectDock.lnk - d:\programi\ObjectDock\ObjectDock\ObjectDock.exe [2006-03-12 1802309]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\fxsclnt.exe"=
"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"c:\\Program Files\\Messenger\\Msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Free Download Manager\\fdm.exe"=
"c:\\Program Files\\Java\\jre1.6.0_02\\launch4j-tmp\\JDownloader.exe"=

R2 Dpmtrcdd;Dpmtrcdd;c:\windows\system32\DRIVERS\dpmtrcdd.sys [2001-06-27 30080]
R2 s7osmcax;s7osmcax;c:\windows\system32\Drivers\s7osmcax.sys [2004-12-23 175159]
R2 s7otranx;s7otranx;c:\windows\system32\Drivers\S7otranx.sys [2004-12-23 494647]
R3 EKBfltr;ENE Keyboard Controller;c:\windows\system32\DRIVERS\EKBfltr.sys [2005-08-01 5504]
S3 s7oefs_x;SIMATIC MPI/EFS Driver;c:\windows\system32\drivers\s7oefs_x.sys [2000-03-28 30704]
S3 S7OUPC2X;SIMATIC PC Adapter USB Driver;c:\windows\system32\DRIVERS\s7oupc2x.sys [2005-01-14 21536]
S3 usbprint;Microsoft USB PRINTER Class;c:\windows\system32\DRIVERS\usbprint.sys [2004-08-03 25856]
S3 usnjsvc;Messenger Sharing Folders USN Journal Reader service;c:\program files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{726d49bf-ded5-11dc-9aab-0002e34a0ee9}]
\shell\Setup\command - setup.exe
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = about:blank
R1 -: HKCU-Internet Connection Wizard,ShellNext = iexplore
O8 -: Download video with Free Download Manager - file://c:\program files\Free Download Manager\dlfvideo.htm
O8 -: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 -: Preuzmi odabrano Free Download Manager-om - file://c:\program files\Free Download Manager\dlselected.htm
O8 -: Preuzmi sa Free Download Managerom - file://c:\program files\Free Download Manager\dllink.htm
O8 -: Preuzmi sve sa Free Download Manager-om - file://c:\program files\Free Download Manager\dlall.htm
O17 -: HKLM\CCS\Interface\{ECD91C86-B41C-4745-8A3A-08819DC6A155}: NameServer = 80.93.224.1,80.93.224.2

O16 -: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-09 13:26:05
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-11-09 13:28:10
ComboFix-quarantined-files.txt 2008-11-09 12:27:48

Pre-Run: 13.346.938.880 bytes free
Post-Run: 13,607,448,576 bytes free

159

Poslao: 09 Nov 2008 14:32
Idi na vrh
offline
  • Piksi  Male
  • Elitni građanin
  • Pridružio: 13 Nov 2003
  • Poruke: 2435

Aktiviraj prikaz skrivenih fajlova, i uploaduj mi na proveru sledeće fajlove:
C:\sq.com
c:\windows\java\Packages\WAXJNRJ1.ZIP

Upload ćeš izvršiti preko sledeće forme ->
http://www.mycity.rs/ambulanta-upload.php

Poslao: 09 Nov 2008 14:50
Idi na vrh
offline
  • Ričard  Male
  • Lavlje srce
  • Supermoderator
  • Zver!
  • Electro maintenance engineer
  • Pridružio: 28 Nov 2006
  • Poruke: 13745
  • Gde živiš: Vršac

Fajlovi su uploudovani.

Poslao: 09 Nov 2008 21:43
Idi na vrh
offline
  • Piksi  Male
  • Elitni građanin
  • Pridružio: 13 Nov 2003
  • Poruke: 2435

Aktiviraj prikaz skrivenih fajlova i obriši sledeći fajl ->
C:\sq.com

PS: Javi da li si uspeo da ga obrišeš...

Poslao: 10 Nov 2008 07:44
Idi na vrh
offline
  • Ričard  Male
  • Lavlje srce
  • Supermoderator
  • Zver!
  • Electro maintenance engineer
  • Pridružio: 28 Nov 2006
  • Poruke: 13745
  • Gde živiš: Vršac

Fajl je uspesno obrisan. Nakkon jucerasnjeg skena sa ComboFix-om doticno upozorenje se vise nije pojavljivalo.

Poslao: 10 Nov 2008 08:12
Idi na vrh
offline
  • Piksi  Male
  • Elitni građanin
  • Pridružio: 13 Nov 2003
  • Poruke: 2435

Ostaje nam još da deinstliramo ComboFix ->

Klikni START a zatim RUN
U liniju za unos teksta ukucaj Combofix /u i klikni OK





Sačekaj da se proces deinstalacije završi
Gornja procedura će:
Obrisati sledeće:
ComboFix i njegove file-ove i foldere
VundoFix Backups folder, ako postoji
C:\Deckard folder, ako postoji
C:\OtMoveIt folder, ako postoji
Resetovati podešavanja sata na kompjuteru
Sakriti ekstenzije file-ova, ako je potrebno
Sakriti sistemske/skrivene file-ove/foldere, ako je potrebno
Resetovati System Restore

To je sve.

Poslao: 11 Nov 2008 14:24
Idi na vrh
offline
  • Ričard  Male
  • Lavlje srce
  • Supermoderator
  • Zver!
  • Electro maintenance engineer
  • Pridružio: 28 Nov 2006
  • Poruke: 13745
  • Gde živiš: Vršac

Zahvaljujem puno.
Pozdarv.

Dopuna: 11 Nov 2008 14:24

Izgleda da problem nije resen. Naime sada se doticni TR\Vundo.gen poceo pojavljivati u Sistem volume information\_restore

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:20:28, on 11.11.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\sm56hlpr.exe
C:\Siemens\Common\S7ubtoox\s7ubtstx.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
D:\PROGRAMI\ObjectDock\ObjectDock\ObjectDock.exe
C:\Siemens\Common\Sqlany\dbsrv50.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\Novum\Desktop\New Folder (2)\kraj.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [S7UB Start] "C:\Siemens\Common\S7ubtoox\s7ubtstx.exe" -StartDB
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Stardock ObjectDock.lnk = D:\PROGRAMI\ObjectDock\ObjectDock\ObjectDock.exe
O8 - Extra context menu item: Download video with Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Preuzmi odabrano Free Download Manager-om - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Preuzmi sa Free Download Managerom - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Preuzmi sve sa Free Download Manager-om - file://C:\Program Files\Free Download Manager\dlall.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @c:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @c:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.apple.com.edgesuite.net/content.in.....plugin.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V.....1136490421
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{ECD91C86-B41C-4745-8A3A-08819DC6A155}: NameServer = 80.93.224.1,80.93.224.2
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 5929 bytes

Poslao: 11 Nov 2008 19:49
Idi na vrh
offline
  • Piksi  Male
  • Elitni građanin
  • Pridružio: 13 Nov 2003
  • Poruke: 2435

Log je čist.

Nisi ispratio uputstvo koje sam ti dao za deinstalaciju ComboFix-a?
Da si ispratio gore opisanu proceduru, resetovao bi ti se System Restore.

MyCity » Ambulanta -> Arhiva Ambulante » C:windows/sistem32/cvo0.dll TR/Vundo.gen

Ko je trenutno na forumu
 

Ukupno su 1160 korisnika na forumu :: 25 registrovanih, 5 sakrivenih i 1130 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: _Rade, A.R.Chafee.Jr., Ben Roj, cifra, dane007, Doca, DPera, havoc995, Kubovac, kvcali, lcc, leonard, Metanoja, MiG-29M2, milenko crazy north, MiroslavD, okopanja, panzerwaffe, Parker, pein, Udvar, vargas, vathra, VJ, Yellow Pinky