MyCity » Ambulanta -> Arhiva Ambulante » C:\resycled\boot.com is not valid Win32 application. SHTA???

C:\resycled\boot.com is not valid Win32 application. SHTA???

Napisano na dan: 27.1.2009
3

C:\resycled\boot.com is not valid Win32 application. SHTA???
Pagination Prethodna strana

Idi na vrh

Poslao: 29 Jan 2009 05:32
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Otvoriti Notepad i iskopirati sledeci tekst:

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3d8b55cd-a804-11dd-bc01-000c6ebca499}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3ddd1561-6481-11dd-bbd0-000c6ebca499}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3ddd1565-6481-11dd-bbd0-000c6ebca499}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5db39923-977b-11dd-bbf6-000c6ebca499}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7974d79b-66ef-11dd-bbd3-000c6ebca499}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7f01ca2b-7c33-11dd-bbe2-000c6ebca499}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{84991aa0-e4cb-11dd-bc3a-000c6ebca499}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c3f5087d-cd0d-11dd-bc26-000c6ebca499}]

Snimiti na Desktop fajl iz Notepada kao "CFScript"




Prevuci snimljeni skript/tekst na ComboFix ikonicu kao na slici.
Postaviti u sledecoj poruci log koji bude bio napravljen na kraju ciscenja/skeniranja.



Poslao: 29 Jan 2009 12:05
Idi na vrh
offline
  • Pridružio: 27 Jan 2009
  • Poruke: 41

ComboFix 09-01-21.04 - Microsoft 2009-01-29 11:53:28.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1536.1118 [GMT 1:00]
Running from: c:\documents and settings\Microsoft\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Microsoft\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2008-12-28 to 2009-01-29 )))))))))))))))))))))))))))))))
.

2009-01-27 19:53 . 2003-02-28 18:26 139,536 --a------ c:\windows\system32\javaee.dll
2009-01-27 19:41 . 2009-01-28 20:14 <DIR> d-------- C:\USBNoRisk
2009-01-27 04:55 . 2009-01-28 22:43 <DIR> d--h----- C:\$AVG8.VAULT$
2009-01-27 04:27 . 2009-01-27 13:53 233 --a------ C:\autorun.inf.blocked
2009-01-26 13:04 . 2009-01-29 11:46 <DIR> d-------- c:\windows\system32\drivers\Avg
2009-01-26 13:04 . 2009-01-26 13:04 <DIR> d-------- c:\program files\AVG
2009-01-26 13:04 . 2009-01-26 13:04 97,928 --a------ c:\windows\system32\drivers\avgldx86.sys
2009-01-26 13:04 . 2009-01-26 13:04 76,040 --a------ c:\windows\system32\drivers\avgtdix.sys
2009-01-26 13:04 . 2009-01-26 13:04 10,520 --a------ c:\windows\system32\avgrsstx.dll
2009-01-25 14:32 . 2009-01-25 14:32 <DIR> d-------- c:\program files\XviD
2009-01-23 21:21 . 2009-01-23 21:24 <DIR> d-------- c:\program files\Valve

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-27 23:32 --------- d-----w c:\documents and settings\Microsoft\Application Data\PC Suite
2009-01-26 12:04 --------- d-----w c:\documents and settings\All Users\Application Data\Avg8
2009-01-26 00:17 --------- d-----w c:\program files\Common Files\Adobe
2009-01-23 20:00 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-20 20:18 --------- d-----w c:\documents and settings\Microsoft\Application Data\Nokia
2009-01-01 03:27 --------- d-----w c:\program files\sXe Injected
2008-12-23 18:57 --------- d-----w c:\documents and settings\All Users\Application Data\nView_Profiles
2008-12-23 18:56 --------- d-----w c:\documents and settings\All Users\Application Data\NVIDIA
2008-12-11 14:15 --------- d-----w c:\documents and settings\All Users\Application Data\Adobe Systems
2008-12-11 14:14 --------- d-----w c:\program files\Common Files\Adobe Systems Shared
2008-12-11 11:57 333,184 ----a-w c:\windows\system32\drivers\srv.sys
2008-12-10 22:31 --------- d-----w c:\program files\VST
2008-12-10 22:31 --------- d-----w c:\program files\Common Files\Digidesign
2008-12-10 22:31 --------- d-----w c:\program files\Antares Audio Technologies
2008-12-09 16:32 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-12-07 13:58 --------- d-----w c:\program files\VirtualDJ
2008-11-02 23:41 155,995 ----a-w c:\windows\java\Packages\RZ7HJXZT.ZIP
.

((((((((((((((((((((((((((((( [Link mogu videti samo ulogovani korisnici] )))))))))))))))))))))))))))))))))))))))))
.
- 2008-08-28 10:04:17 333,056 -c--a-w c:\windows\system32\dllcache\srv.sys
+ 2008-12-11 11:57:21 333,184 -c--a-w c:\windows\system32\dllcache\srv.sys
- 2008-12-02 21:26:30 17,593,280 ----a-w c:\windows\system32\MRT.exe
+ 2009-01-09 16:35:30 20,853,704 ----a-w c:\windows\system32\MRT.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2008-07-16 1266992]
"{7c5c0f58-e061-457d-9033-77307f5ed00c}"= "c:\program files\TorrentMan\tbTorr.dll" [2008-05-20 1526296]
"{ecdee021-0d17-467f-a1ff-c7a115230949}"= "c:\program files\free-downloads.net\tbfree.dll" [2008-02-14 1555480]

[HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch]

[HKEY_CLASSES_ROOT\clsid\{7c5c0f58-e061-457d-9033-77307f5ed00c}]

[HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7c5c0f58-e061-457d-9033-77307f5ed00c}]
2008-05-20 23:43 1526296 --a------ c:\program files\TorrentMan\tbTorr.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ecdee021-0d17-467f-a1ff-c7a115230949}]
2008-02-14 13:54 1555480 --a------ c:\program files\free-downloads.net\tbfree.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{7c5c0f58-e061-457d-9033-77307f5ed00c}"= "c:\program files\TorrentMan\tbTorr.dll" [2008-05-20 1526296]
"{ecdee021-0d17-467f-a1ff-c7a115230949}"= "c:\program files\free-downloads.net\tbfree.dll" [2008-02-14 1555480]

[HKEY_CLASSES_ROOT\clsid\{7c5c0f58-e061-457d-9033-77307f5ed00c}]

[HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{7C5C0F58-E061-457D-9033-77307F5ED00C}"= "c:\program files\TorrentMan\tbTorr.dll" [2008-05-20 1526296]
"{ECDEE021-0D17-467F-A1FF-C7A115230949}"= "c:\program files\free-downloads.net\tbfree.dll" [2008-02-14 1555480]

[HKEY_CLASSES_ROOT\clsid\{7c5c0f58-e061-457d-9033-77307f5ed00c}]

[HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-08-25 68856]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2008-03-20 217544]
"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 7\PCSync2.exe" [2008-06-17 1249280]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-08-11 1124352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SiSUSBRG"="c:\windows\SiSUSBrg.exe" [2002-07-12 106496]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-12-08 32768]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-08-04 36352]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-01-26 1261336]
"nwiz"="nwiz.exe" [2006-10-22 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Server4PC.lnk - c:\program files\TechniSat DVB\bin\Server4PC.exe [2008-08-06 344064]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-01-26 13:04 10520 c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.I420"= i263_32.drv
"aux"= ctwdm32.dll
"vidc.3iv2"= 3ivxVfWCodec.dll
"msacm.divxa32"= divxa32.acm
"VIDC.HFYU"= huffyuv.dll
"VIDC.i263"= i263_32.drv
"msacm.imc"= imc32.acm
"VIDC.VP31"= vp31vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"c:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"c:\\Program Files\\Valve\\hl.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-01-26 97928]
R3 SKYNET;TechniSat DVB-PC TV Star PCI;c:\windows\system32\drivers\SkyNET.sys [2008-08-06 349184]
R3 usnjsvc;Usluga Messenger Sharing Folders USN Journal Reader;c:\program files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
R4 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-01-26 875288]
R4 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-01-26 231704]
R4 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-01-26 76040]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [2008-09-02 138112]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [2008-09-02 8320]
.
.
------- Supplementary Scan -------
.
uStart Page = [Link mogu videti samo ulogovani korisnici]
uSearch Page = [Link mogu videti samo ulogovani korisnici]
uSearch Bar = [Link mogu videti samo ulogovani korisnici]
uSearchURL,(Default) = [Link mogu videti samo ulogovani korisnici]
IE: &Winamp Search - c:\documents and settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
DPF: Microsoft XML Parser for Java - [Link mogu videti samo ulogovani korisnici]\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Microsoft\Application Data\Mozilla\Firefox\Profiles\011qkgvh.default\
FF - prefs.js: browser.startup.homepage - [Link mogu videti samo ulogovani korisnici]
FF - component: c:\documents and settings\Microsoft\Application Data\Mozilla\Firefox\Profiles\011qkgvh.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\BS.Player ControlBar\FirefoxDTT\components\BSToolbarFF.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2009-01-29 11:55:48
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\•€|ÿÿÿÿ"•€|þ»Ôw*]
"AB141C35E9F4BF344B9FC010BB17F68A"=""
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(772)
c:\windows\system32\avgrsstx.dll
.
Completion time: 2009-01-29 11:57:49
ComboFix-quarantined-files.txt 2009-01-29 10:57:35
ComboFix2.txt 2009-01-28 21:58:03

Pre-Run: 16.205.271.040 bytes free
Post-Run: 16,193,908,736 bytes free

173 --- E O F --- 2009-01-28 02:07:29



Poslao: 29 Jan 2009 19:50
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Ima li sada jos nekih simptoma?

Poslao: 29 Jan 2009 20:07
Idi na vrh
offline
  • Pridružio: 27 Jan 2009
  • Poruke: 41

ne razumem

Poslao: 29 Jan 2009 20:09
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Pa ima li na kompu jos bilo kakvih simptoma koji bi ukazivali da nesto nije u redu, tj. da jos ima neke infekcije.

Logovi su sada OK, ali zelim da cujem da li je stvarno sve sada OK.

Poslao: 29 Jan 2009 20:30
Idi na vrh
offline
  • Pridružio: 27 Jan 2009
  • Poruke: 41

ovako na prvi pogled je sve ok, nisam imao neke zezancije, chak i one gluposti oni smajliji i oni smarachki virus sajtovi koji se sami otvaraju se vise ne otvaraju... reci mi samo kako najbolje da zastitim i kontrolisem komp od tih raznih chuda? imam avg 8.0, ne znam da li mi se chini ali kao da sasvim nije dovoljan za zastitu... nemam pojma, aj mi reci tvoje sruchno mishljenje?

Poslao: 29 Jan 2009 20:42
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Savet oko izbora zastitnog softvera ces morati da potrazis u podforumima Zastite.
Politika naseg foruma je da zvanicna lica ovog foruma ne smeju da uticu na izbor zastitnog softvera nasih clanova.

Nama je ovde u ovoj temi jos ostalo da dovrsimo par stvari.
Deinstaliraj ComboFix prema sledecem uputstvu:

Klikni START a zatim RUN
U liniju za unos teksta ukucaj Combofix /u i klikni OK





Sačekaj da se proces deinstalacije završi
Gornja procedura će:
Obrisati sledeće:
ComboFix i njegove file-ove i foldere
VundoFix Backups folder, ako postoji
C:\Deckard folder, ako postoji
C:\OtMoveIt folder, ako postoji
Resetovati podešavanja sata na kompjuteru
Sakriti ekstenzije file-ova, ako je potrebno
Sakriti sistemske/skrivene file-ove/foldere, ako je potrebno
Resetovati System Restore


USBNoRisk nema posebu proceduru za deinstalaciju.
Obrisi USBNoRisk.exe, kao i ceo folder C:\USBNoRisk.

Poslao: 29 Jan 2009 22:03
Idi na vrh
offline
  • Pridružio: 27 Jan 2009
  • Poruke: 41

uradio sam al shto to brishem?

Poslao: 30 Jan 2009 05:37
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Combofix ce tek pri deinstalaciji da zavrsi ciscenje. Pre toga je radio samo privremene promene.

Poslao: 30 Jan 2009 12:03
Idi na vrh
offline
  • Pridružio: 27 Jan 2009
  • Poruke: 41

ok, hvala ti puno!!!

MyCity » Ambulanta -> Arhiva Ambulante » C:\resycled\boot.com is not valid Win32 application. SHTA???

Ko je trenutno na forumu
 

Ukupno su 1034 korisnika na forumu :: 73 registrovanih, 6 sakrivenih i 955 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: 357magnum, A.R.Chafee.Jr., babaroga, Belac91, Beria, bojankrstc, bojcistv, Boris BM, Bosnjo, brufen, Bushek, darkojovxp, djordje92sm, DonRumataEstorski, dovlafkcz, draganl, dragoljub11987, drale12, dule10savic, Frunze, g_g, Georgius, grunff2, Iskander, Jomini, Jozo74, kenny74, Kobrim, krkalon, Kubovac, lazicdb, Lester Freamon, lord sir giga, LostInSpaceandTime, Macalone, Makeitdrip, mercedesamg, MiG-29M2, mikrimaus, Milan A. Nikolic, Milo97, Milos ZA, nebidrag, nebojsag, nemkea71, novator, pablojepao, Pavle29L, Povratak1912, R_038, raf87, RD84, redstar72, RileHerc, Sir Budimir, stalja, starlights, Stoilkovic, Stoorb, superwhy, tamno.nebo, theNedjeljko, tubular, Tvrtko I, Underwood, uruk, wizzardone, wolverined4, XBMC, Yellow Pinky, YU-UKI, zombicar153, šumar bk2