MyCity » Ambulanta -> Arhiva Ambulante » Malware ili sta drugo???

Malware ili sta drugo???

Napisano na dan: 1.10.2008
1

Malware ili sta drugo???
Sledeća strana Pagination

Idi na vrh

Poslao: 01 Okt 2008 22:13
Idi na vrh
offline
  • Pridružio: 21 Sep 2008
  • Poruke: 238
  • Gde živiš: Bačka Palanka

Treba mi pomoc.Sta mi se desava sa particijama.Svaki put kad hocu da otvorim neku particiju u Windows Explorer-u pojavi mi se ovakav prozor(na slici).Dok npr. u TC-ju mi normalno otvara.

Thnks!

Poslao: 01 Okt 2008 22:39
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Poz...


Isprati uputstvo za otvaranje teme:

http://www.mycity.rs/Ambulanta/Kako-otvoriti-temu-u-Ambulanti.html

Poslao: 02 Okt 2008 22:18
Idi na vrh
offline
  • Pridružio: 21 Sep 2008
  • Poruke: 238
  • Gde živiš: Bačka Palanka

stefannn ::Treba mi pomoc.Sta mi se desava sa particijama.Svaki put kad hocu da otvorim neku particiju u Windows Explorer-u pojavi mi se ovakav prozor(na slici).Dok npr. u TC-ju mi normalno otvara.

Thnks!
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:14:57, on 2.10.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\MMTrayLSI.exe
C:\WINDOWS\system32\MMTray2k.exe
C:\WINDOWS\system32\MMTray.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Documents and Settings\Stefan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Stefan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Stefan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\Stefan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Winamp\winamp.exe
C:\WINDOWS\system32\msiexec.exe
C:\PROGRA~1\FREEDO~1\fdm.exe
C:\Documents and Settings\Stefan\Desktop\My City Folder\TR3.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: ShoppingReport - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [MMTrayLSI] C:\WINDOWS\system32\MMTrayLSI.exe
O4 - HKLM\..\Run: [MMTray2K] C:\WINDOWS\system32\MMTray2k.exe
O4 - HKLM\..\Run: [MMTray] C:\WINDOWS\system32\MMTray.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdfkb.exe] C:\WINDOWS\system32\kdfkb.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Download video with Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Preuzmi odabrano Free Download Manager-om - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Preuzmi sa Free Download Managerom - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Preuzmi sve sa Free Download Manager-om - file://C:\Program Files\Free Download Manager\dlall.htm
O9 - Extra button: Istraživanje - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll (file missing)
O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4F6198DD-FBC9-4ECF-9259-B28F52C27765}: NameServer = 85.255.114.44,85.255.112.237
O17 - HKLM\System\CCS\Services\Tcpip\..\{97AEFD99-BE41-420A-8762-D66809A15379}: NameServer = 85.255.114.44,85.255.112.237
O17 - HKLM\System\CCS\Services\Tcpip\..\{BB1E1F62-F0A8-4A55-B2F3-DDB50197BA0B}: NameServer = 85.255.114.44,85.255.112.237
O17 - HKLM\System\CS1\Services\Tcpip\..\{4F6198DD-FBC9-4ECF-9259-B28F52C27765}: NameServer = 85.255.114.44,85.255.112.237
O17 - HKLM\System\CS2\Services\Tcpip\..\{4F6198DD-FBC9-4ECF-9259-B28F52C27765}: NameServer = 85.255.114.44,85.255.112.237
O23 - Service: Atheros Configuration Service (ACS) - Atheros - C:\WINDOWS\system32\acs.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: Power Manager (PowerManager) - Unknown owner - C:\WINDOWS\svchost.exe (file missing)

--
End of file - 7436 bytes

Poslao: 02 Okt 2008 22:33
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Redom isprati sledeća uputstva.


1) Preuzmi FixWareOut.
Dvoklikom pokreni Fixwareout.exe
U prozoru koji se otvori, klikni Next >, a nakon toga Install
Kada instalacija bude gotova, klikni Finish
Otvoriće se prozor - pritisni bilo koji taster za nastavak
Kada se pojavi upit o restartovanju kompjutera, klikni OK
Kompjuter će se restartovati, nakon čega će biti nastavljen proces čišćenja
Kada se pojavi obaveštenje o započinjanju čišćenja, klikni OK
Kada proces bude završen, pojaviće se obaveštenje koje treba zatvoriti klikom na OK i otvoriće se logfile u Notepad-u (C:\fixwareout\report.txt) koji je potrebno iskopirati u temu na forumu.



-------------------------------------------------------------------------------------



2) Skini ComboFix sa jedne od sledecih adresa na Desktop:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://www.forospyware.com/sUBs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe

Startuj ga i ne diraj prozor programa dok skenira.
Sledi uputstva na ekranu. Kada zavrsi pojavice se log (C:\ComboFix.txt) koji ces nam ovde iskopirati.

Poslao: 04 Okt 2008 20:04
Idi na vrh
offline
  • Pridružio: 21 Sep 2008
  • Poruke: 238
  • Gde živiš: Bačka Palanka

Report iz Combofix-a:


ComboFix 08-10-04.01 - Stefan 2008-10-04 19:51:35.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.533 [GMT 2:00]
Running from: C:\Documents and Settings\Stefan\Desktop\ComboFix.exe
* Created a new restore point
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\DOCUME~1\Stefan\LOCALS~1\Temp\install_flash_player.exe
D:\Autorun.inf
F:\Autorun.inf
J:\autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_POWERMANAGER
-------\Service_PowerManager


((((((((((((((((((((((((( Files Created from 2008-09-04 to 2008-10-04 )))))))))))))))))))))))))))))))
.

2008-10-04 19:45 . 2008-10-04 19:49 <DIR> d-------- C:\fixwareout
2008-10-04 15:55 . 2008-10-04 16:13 14 --a------ C:\WINDOWS\popcinfot.dat
2008-10-04 15:54 . 2008-10-04 16:21 <DIR> d-------- C:\Program Files\PopCap Games
2008-10-04 15:54 . 2008-10-04 15:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PopCap Games
2008-10-04 15:41 . 2008-10-04 15:44 <DIR> d-------- C:\Program Files\TuneUp Utilities 2008
2008-10-04 15:41 . 2008-10-04 15:41 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-10-04 15:41 . 2008-10-04 15:41 306,432 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe
2008-10-04 15:41 . 2007-12-20 10:41 29,440 --a------ C:\WINDOWS\system32\uxtuneup.dll
2008-10-04 15:40 . 2008-10-04 15:40 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-10-04 15:12 . 2008-10-04 15:12 <DIR> d-------- C:\Documents and Settings\Stefan\Application Data\vlc
2008-10-04 15:00 . 2008-10-04 15:15 <DIR> d-------- C:\Program Files\VideoLAN
2008-10-02 22:37 . 2008-10-03 20:38 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-02 22:37 . 2008-10-02 22:37 <DIR> d-------- C:\Documents and Settings\Stefan\Application Data\Malwarebytes
2008-10-02 22:37 . 2008-10-02 22:37 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-02 22:37 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-02 22:37 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-10-02 10:51 . 2008-10-02 10:51 <DIR> d-------- C:\Program Files\Common Files\SWF Studio
2008-09-27 19:34 . 2008-09-29 22:18 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-09-27 19:34 . 2008-09-29 22:18 1,409 --a------ C:\WINDOWS\QTFont.for
2008-09-27 13:29 . 2006-05-15 15:35 97,184 -ra------ C:\WINDOWS\system32\drivers\SE27mdm.sys
2008-09-27 13:29 . 2006-05-15 15:35 9,360 -ra------ C:\WINDOWS\system32\drivers\SE27mdfl.sys
2008-09-27 13:29 . 2006-05-15 15:35 6,240 -ra------ C:\WINDOWS\system32\drivers\SE27cmnt.sys
2008-09-27 13:29 . 2006-05-15 15:35 6,240 -ra------ C:\WINDOWS\system32\drivers\SE27cm.sys
2008-09-23 21:12 . 2007-05-03 17:42 364,629 --a------ C:\WINDOWS\system32\acs.exe
2008-09-23 21:12 . 2007-05-03 17:44 73,801 --a------ C:\WINDOWS\system32\athgina.dll
2008-09-23 21:11 . 2008-09-23 21:11 <DIR> d-------- C:\Program Files\Atheros
2008-09-18 14:35 . 2008-09-18 14:35 <DIR> d-------- C:\Program Files\Common Files\Windows Live
2008-09-13 22:22 . 2008-09-13 22:22 <DIR> d-------- C:\Program Files\DivXCodec
2008-09-12 16:50 . 2008-09-24 15:31 <DIR> d-------- C:\Program Files\Ahead
2008-09-11 14:55 . 2005-05-03 12:43 69,632 -r------- C:\WINDOWS\Alcmtr.exe
2008-09-08 21:55 . 2008-09-08 21:55 <DIR> d-------- C:\Program Files\AngelPotion Video Codec V1
2008-09-08 21:55 . 1998-10-29 16:45 306,688 --a------ C:\WINDOWS\IsUninst.exe
2008-09-08 21:55 . 2000-08-09 21:26 177,241 --a------ C:\WINDOWS\system32\APmpg4v1.apl
2008-09-08 21:55 . 2000-08-23 07:26 106,496 --a------ C:\WINDOWS\system32\APmpg4v1.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-04 14:21 --------- d-----w C:\Documents and Settings\Stefan\Application Data\Free Download Manager
2008-10-04 12:23 --------- d-----w C:\Program Files\ESET
2008-10-02 19:52 --------- d-----w C:\Program Files\ICQToolbar
2008-09-27 14:30 --------- d-----w C:\Program Files\Nero
2008-09-24 13:39 --------- d-----w C:\Program Files\Common Files\Nero
2008-09-23 19:11 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-19 14:20 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-09-19 14:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
2008-09-18 13:48 --------- d-----w C:\Program Files\VirtualDJ
2008-09-18 13:47 --------- d-----w C:\Program Files\MSN Messenger
2008-09-11 12:55 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-09-02 18:51 --------- d-----w C:\Program Files\Maxima-5.16.3
2008-08-30 16:03 --------- d-----w C:\Documents and Settings\Stefan\Application Data\Ahead
2008-08-30 14:22 --------- d-----w C:\Program Files\Windows Live Safety Center
2008-08-28 18:16 --------- d-----w C:\Program Files\Common Files\Adobe
2008-08-28 12:20 --------- d-----w C:\Program Files\Microsoft.NET
2008-08-28 12:20 --------- d-----w C:\Program Files\Microsoft Works
2008-08-27 12:34 --------- d-----w C:\Documents and Settings\Stefan\Application Data\Hamachi
2008-08-25 12:52 --------- d-----w C:\Documents and Settings\Stefan\Application Data\Corel
2008-08-25 12:49 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-08-25 12:49 --------- d-----w C:\Program Files\Common Files\Corel
2008-08-25 12:48 --------- d-----w C:\Program Files\Corel
2008-08-24 22:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\SweetIM
2008-08-24 09:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-08-20 15:58 11,973 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2008-08-19 17:58 223,128 ----a-w C:\WINDOWS\system32\drivers\dtscsi.sys
2008-08-17 12:27 --------- d-----w C:\Program Files\Webteh
2008-08-16 10:34 --------- d-----w C:\Documents and Settings\Stefan\Application Data\ICQ
2008-08-16 10:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype
2008-08-16 10:26 --------- d-----w C:\Documents and Settings\Stefan\Application Data\skypePM
2008-08-13 23:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\LogMeIn
2008-08-08 22:12 --------- d-----w C:\Program Files\MSXML 4.0
2008-08-07 12:56 --------- d-----w C:\Documents and Settings\Stefan\Application Data\Nero
2008-08-04 12:42 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-08-04 12:33 --------- d-----w C:\Documents and Settings\Stefan\Application Data\ICQ Toolbar
2008-07-14 16:01 81,920 ----a-w C:\Documents and Settings\Stefan\Application Data\ezpinst.exe
2008-07-14 16:01 47,360 ----a-w C:\Documents and Settings\Stefan\Application Data\pcouffin.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"MMTrayLSI"="C:\WINDOWS\system32\MMTrayLSI.exe" [2003-03-25 53248]
"MMTray2K"="C:\WINDOWS\system32\MMTray2k.exe" [2003-03-25 57344]
"MMTray"="C:\WINDOWS\system32\MMTray.exe" [2003-03-25 53248]
"egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2007-12-21 1443072]
"AGRSMMSG"="AGRSMMSG.exe" [2006-06-29 C:\WINDOWS\AGRSMMSG.exe]
"RTHDCPL"="RTHDCPL.EXE" [2007-11-30 C:\WINDOWS\RTHDCPL.exe]
"Tweak UI"="TWEAKUI.CPL" [2003-03-25 C:\WINDOWS\system32\tweakui.cpl]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"=hex(2):76,69,73,74,61,75,69,2e,65,78,65,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2008-05-28 12:32 87352 C:\WINDOWS\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.iv41"= ir41_32.dll
"msacm.l3acm"= L3codecp.acm
"msacm.divxa32"= DivXa32.acm
"vidc.asv2"= asusasv2.dll
"vidc.div3"= DivXc32.dll
"vidc.div4"= DivXc32f.dll
"vidc.ap41"= APmpg4v1.dll
"vidc.mjpg"= m3jpeg32.dll
"vidc.dmb1"= m3jpeg32.dll
"vidc.rud0"= rududu.dll
"vidc.mj2c"= M3JP2K32.dll
"vidc.mmes"= DigiVCap.dll
"vidc.vixl"= Miroxl32.dll
"vidc.sony"= sonydv.dll
"vidc.dv25"= DigiVCap.dll
"vidc.dv50"= DigiVCap.dll
"vidc.msmc"= DigiVCap.dll
"vidc.mmjp"= DigiVCap.dll
"vidc.3ivx"= 3ivxVfWCodec.dll
"vidc.vssv"= vsscodec.dll
"vidc.pim1"= pclepim1.dll
"vidc.advs"= Dvc.dll
"vidc.asv1"= asusasv1.dll
"vidc.vcr1"= ativcr1.dll
"vidc.vcr2"= ativcr2.dll
"vidc.aflc"= flccodec32.dll
"vidc.aasc"= Aasc32.dll
"vidc.avrn"= AvidAVICodec.dll
"VIDC.mszh"= avimszh.dll
"vidc.zlib"= avizlib.dll
"vidc.mwv1"= icmw_32.dll
"vidc.bt20"= btvvc32.drv
"vidc.y41p"= btvvc32.drv
"vidc.cscd"= camcodec.dll
"vidc.cdvc"= CSCCDVC.DLL
"vidc.ddvc"= CSCdvsd.DLL
"vidc.dps0"= DpsAviCC.dll
"vidc.dvx4"= divx4.dll
"vidc.em2v"= EtxCodec.dll
"vidc.frwd"= frwd.dll
"vidc.frwt"= frwt.dll
"vidc.frwu"= frwu.dll
"vidc.glzw"= GLZW.dll
"vidc.gpeg"= GPEG.dll
"vidc.hfyu"= huffyuv.dll
"vidc.i263"= i263_32.drv
"vidc.ir21"= IR21_R.DLL
"vidc.rt21"= IR21_R.DLL
"vidc.dcmj"= MCMJPG32.DLL
"vidc.tvmj"= MMTVMJ.dll
"vidc.fljp"= MMTVMJ.dll
"vidc.nt00"= NTCodec.dll
"vidc.vp31"= vp31vfw.dll
"vidc.pdvc"= idvcodec.dll
"vidc.ipdv"= idvcodec.dll
"vidc.sjpg"= pmjpeg32.dll
"vidc.pvw2"= pvwv220.dll
"vidc.pimj"= pvljpg20.dll
"vidc.mjpx"= pvmjpg21.dll
"vidc.miro"= mirodv2avi.dll
"vidc.mjpa"= rtmjpgcdc.dll
"msacm.qmpeg"= qmpeg.acm
"vidc.qpeg"= Qpeg32.dll
"vidc.rmp4"= rmp4.dll
"vidc.s422"= tekyuv.dll
"vidc.wnv1"= WNVPLAY1.DLL
"msacm.pcdv"= pcdv.acm
"msacm.imc"= IMC32.ACM
"msacm.wrpr"= aviwrap.dll
"vidc.wrpr"= aviwrap.dll
"vidc.png1"= CorePNG_vfw.dll
"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Free Download Manager]
--a------ 2008-09-09 15:06 2465839 C:\Program Files\Free Download Manager\fdm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
--a----t- 2008-09-09 15:06 133104 C:\Documents and Settings\Stefan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
--a------ 2007-12-03 14:21 2213160 C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R2 LMIRfsDriver;LogMeIn Remote File System Driver;C:\WINDOWS\system32\drivers\LMIRfsDriver.sys [2008-03-07 45848]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2004-08-04 14336]
R3 RMSPPPOE;WAN Miniport (PPP over Ethernet Protocol);C:\WINDOWS\system32\DRIVERS\RMSPPPOE.SYS [2002-06-10 31232]
R3 WSIMD;wsimd Service;C:\WINDOWS\system32\DRIVERS\wsimd.sys [2007-03-28 57024]
S2 LMIInfo;LogMeIn Kernel Information Provider;C:\Program Files\LogMeIn\x86\RaInfo.sys [ ]
S3 RTSTOR;USB Mass Stroage Device;C:\WINDOWS\system32\drivers\RTSTOR.SYS [ ]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-10-04 306432]
S3 usnjsvc;Usluga Messenger Sharing Folders USN Journal Reader;C:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 97136]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7bd6e20e-8cba-11dd-b83a-0015af99d8cd}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL resycled\boot.com i:
\Shell\Open\command - I:\resycled\boot.com i:

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{98fbfdef-51f7-11dd-b7bc-0015af99d8cd}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL resycled\boot.com h:
\Shell\Open\command - K:\resycled\boot.com h:
.
Contents of the 'Scheduled Tasks' folder

2008-10-04 C:\WINDOWS\Tasks\1-Click Maintenance.job
- C:\Program Files\TuneUp Utilities 2008\OneClick.exe [2008-01-08 13:31]

2008-10-04 C:\WINDOWS\Tasks\GoogleUpdateTaskUser.job
- C:\Documents and Settings\Stefan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-09 15:06]
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
HKLM-Run-C:\WINDOWS\system32\kdfkb.exe - C:\WINDOWS\system32\kdfkb.exe
MSConfigStartUp-DAEMON Tools - C:\Program Files\DAEMON Tools\daemon.exe
MSConfigStartUp-LClock - C:\Program Files\LClock\LClock.exe
MSConfigStartUp-LogMeIn GUI - C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
MSConfigStartUp-SweetIM - C:\Program Files\SweetIM\Messenger\SweetIM.exe


.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\6797vdyr.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://google.rs
FF -: plugin - C:\Documents and Settings\Stefan\Local Settings\Application Data\Google\Update\1.2.131.11\npGoogleOneClick5.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-04 19:55:29
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ASPI32]
"ImagePath"="hex(2):53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,64,00,72,00,69,00,76,00,65,00,72,00,73,00,5c,00,61,00,73,00,70,00,69,00,33,00,32,00,2e,00,73,00,79,00,73,00,00,00"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ASPI32]
"ImagePath"="hex(2):53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,64,00,72,00,69,00,76,00,65,00,72,00,73,00,5c,00,61,00,73,00,70,00,69,00,33,00,32,00,2e,00,73,00,79,00,73,00,00,00"
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\ComboFix\pv.cfexe
.
**************************************************************************
.
Completion time: 2008-10-04 19:57:51 - machine was rebooted
ComboFix-quarantined-files.txt 2008-10-04 17:57:48

Pre-Run: 22.345.007.104 bytes free
Post-Run: 23,658,688,512 bytes free

283 --- E O F --- 2008-09-25 13:03:00









---







Report iz Fixwareout-a:




Username "Stefan" - 04.10.2008 19:45:46 [Fixwareout edited 9/01/2007]

~~~~~ Prerun check

Successfully flushed the DNS Resolver Cache.


System was rebooted successfully.

~~~~~ Postrun check
HKLM\SOFTWARE\~\Winlogon\ "System"=""
....
....
~~~~~ Misc files.
....
~~~~~ Checking for older varients.
....

~~~~~ Current runs (hklm hkcu "run" Keys Only)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\Core-Static\\CLIStart.exe\""
"MMTrayLSI"="C:\\WINDOWS\\system32\\MMTrayLSI.exe"
"MMTray2K"="C:\\WINDOWS\\system32\\MMTray2k.exe"
"MMTray"="C:\\WINDOWS\\system32\\MMTray.exe"
"AGRSMMSG"="AGRSMMSG.exe"
"egui"="\"C:\\Program Files\\ESET\\ESET Smart Security\\egui.exe\" /hide /waitservice"
"RTHDCPL"="RTHDCPL.EXE"
"Alcmtr"="ALCMTR.EXE"
"C:\\WINDOWS\\system32\\kdfkb.exe"="C:\\WINDOWS\\system32\\kdfkb.exe"
"Tweak UI"="RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
....
Hosts file was reset, If you use a custom hosts file please replace it...
~~~~~ End report ~~~~~

Poslao: 04 Okt 2008 20:53
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Ukoliko imaš USB flash drive, priključi ga pre narednog postupka (samo ga priključi - nemoj da ga otvaraš).


Otvoriti Notepad i iskopirati sledeci tekst:

Folder::
C:\resycled
D:\resycled
E:\resycled
F:\resycled
H:\resycled

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7bd6e20e-8cba-11dd-b83a-0015af99d8cd}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{98fbfdef-51f7-11dd-b7bc-0015af99d8cd}]


Snimiti na Desktop fajl iz Notepada kao "CFScript"




Prevuci snimljeni skript/tekst na ComboFix ikonicu kao na slici.
Postaviti u sledecoj poruci log koji bude bio napravljen na kraju ciscenja/skeniranja.

Poslao: 05 Okt 2008 13:28
Idi na vrh
offline
  • Pridružio: 21 Sep 2008
  • Poruke: 238
  • Gde živiš: Bačka Palanka

ComboFix 08-10-04.07 - Stefan 2008-10-05 13:15:12.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.518 [GMT 2:00]
Running from: C:\Documents and Settings\Stefan\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Stefan\Desktop\CFScript.txt
* Created a new restore point
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

D:\resycled
D:\resycled\boot.com
E:\resycled
E:\resycled\boot.com
F:\resycled
F:\resycled\boot.com
H:\autorun.inf
H:\resycled
H:\resycled\boot.com

.
((((((((((((((((((((((((( Files Created from 2008-09-05 to 2008-10-05 )))))))))))))))))))))))))))))))
.

2008-10-04 19:45 . 2008-10-04 19:59 <DIR> d-------- C:\fixwareout
2008-10-04 15:55 . 2008-10-04 16:13 14 --a------ C:\WINDOWS\popcinfot.dat
2008-10-04 15:54 . 2008-10-04 16:21 <DIR> d-------- C:\Program Files\PopCap Games
2008-10-04 15:54 . 2008-10-04 15:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PopCap Games
2008-10-04 15:41 . 2008-10-04 15:44 <DIR> d-------- C:\Program Files\TuneUp Utilities 2008
2008-10-04 15:41 . 2008-10-04 15:41 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-10-04 15:41 . 2008-10-04 15:41 306,432 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe
2008-10-04 15:41 . 2007-12-20 10:41 29,440 --a------ C:\WINDOWS\system32\uxtuneup.dll
2008-10-04 15:40 . 2008-10-04 15:40 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-10-04 15:12 . 2008-10-04 15:12 <DIR> d-------- C:\Documents and Settings\Stefan\Application Data\vlc
2008-10-04 15:00 . 2008-10-04 15:15 <DIR> d-------- C:\Program Files\VideoLAN
2008-10-02 22:37 . 2008-10-03 20:38 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-02 22:37 . 2008-10-02 22:37 <DIR> d-------- C:\Documents and Settings\Stefan\Application Data\Malwarebytes
2008-10-02 22:37 . 2008-10-02 22:37 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-02 22:37 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-02 22:37 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-10-02 10:51 . 2008-10-02 10:51 <DIR> d-------- C:\Program Files\Common Files\SWF Studio
2008-09-27 19:34 . 2008-09-29 22:18 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-09-27 19:34 . 2008-09-29 22:18 1,409 --a------ C:\WINDOWS\QTFont.for
2008-09-27 13:29 . 2006-05-15 15:35 97,184 -ra------ C:\WINDOWS\system32\drivers\SE27mdm.sys
2008-09-27 13:29 . 2006-05-15 15:35 9,360 -ra------ C:\WINDOWS\system32\drivers\SE27mdfl.sys
2008-09-27 13:29 . 2006-05-15 15:35 6,240 -ra------ C:\WINDOWS\system32\drivers\SE27cmnt.sys
2008-09-27 13:29 . 2006-05-15 15:35 6,240 -ra------ C:\WINDOWS\system32\drivers\SE27cm.sys
2008-09-23 21:12 . 2007-05-03 17:42 364,629 --a------ C:\WINDOWS\system32\acs.exe
2008-09-23 21:12 . 2007-05-03 17:44 73,801 --a------ C:\WINDOWS\system32\athgina.dll
2008-09-23 21:11 . 2008-09-23 21:11 <DIR> d-------- C:\Program Files\Atheros
2008-09-18 14:35 . 2008-09-18 14:35 <DIR> d-------- C:\Program Files\Common Files\Windows Live
2008-09-13 22:22 . 2008-09-13 22:22 <DIR> d-------- C:\Program Files\DivXCodec
2008-09-12 16:50 . 2008-09-24 15:31 <DIR> d-------- C:\Program Files\Ahead
2008-09-11 14:55 . 2005-05-03 12:43 69,632 -r------- C:\WINDOWS\Alcmtr.exe
2008-09-08 21:55 . 2008-09-08 21:55 <DIR> d-------- C:\Program Files\AngelPotion Video Codec V1
2008-09-08 21:55 . 1998-10-29 16:45 306,688 --a------ C:\WINDOWS\IsUninst.exe
2008-09-08 21:55 . 2000-08-09 21:26 177,241 --a------ C:\WINDOWS\system32\APmpg4v1.apl
2008-09-08 21:55 . 2000-08-23 07:26 106,496 --a------ C:\WINDOWS\system32\APmpg4v1.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-04 14:21 --------- d-----w C:\Documents and Settings\Stefan\Application Data\Free Download Manager
2008-10-04 12:23 --------- d-----w C:\Program Files\ESET
2008-10-02 19:52 --------- d-----w C:\Program Files\ICQToolbar
2008-09-27 14:30 --------- d-----w C:\Program Files\Nero
2008-09-24 13:39 --------- d-----w C:\Program Files\Common Files\Nero
2008-09-23 19:11 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-19 14:20 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-09-19 14:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
2008-09-18 13:48 --------- d-----w C:\Program Files\VirtualDJ
2008-09-18 13:47 --------- d-----w C:\Program Files\MSN Messenger
2008-09-11 12:55 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-09-02 18:51 --------- d-----w C:\Program Files\Maxima-5.16.3
2008-08-30 16:03 --------- d-----w C:\Documents and Settings\Stefan\Application Data\Ahead
2008-08-30 14:22 --------- d-----w C:\Program Files\Windows Live Safety Center
2008-08-28 18:16 --------- d-----w C:\Program Files\Common Files\Adobe
2008-08-28 12:20 --------- d-----w C:\Program Files\Microsoft.NET
2008-08-28 12:20 --------- d-----w C:\Program Files\Microsoft Works
2008-08-27 12:34 --------- d-----w C:\Documents and Settings\Stefan\Application Data\Hamachi
2008-08-25 12:52 --------- d-----w C:\Documents and Settings\Stefan\Application Data\Corel
2008-08-25 12:49 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-08-25 12:49 --------- d-----w C:\Program Files\Common Files\Corel
2008-08-25 12:48 --------- d-----w C:\Program Files\Corel
2008-08-24 22:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\SweetIM
2008-08-24 09:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-08-20 15:58 11,973 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2008-08-19 17:58 223,128 ----a-w C:\WINDOWS\system32\drivers\dtscsi.sys
2008-08-17 12:27 --------- d-----w C:\Program Files\Webteh
2008-08-16 10:34 --------- d-----w C:\Documents and Settings\Stefan\Application Data\ICQ
2008-08-16 10:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype
2008-08-16 10:26 --------- d-----w C:\Documents and Settings\Stefan\Application Data\skypePM
2008-08-13 23:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\LogMeIn
2008-08-08 22:12 --------- d-----w C:\Program Files\MSXML 4.0
2008-08-07 12:56 --------- d-----w C:\Documents and Settings\Stefan\Application Data\Nero
2008-08-04 12:42 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-07-14 16:01 81,920 ----a-w C:\Documents and Settings\Stefan\Application Data\ezpinst.exe
2008-07-14 16:01 47,360 ----a-w C:\Documents and Settings\Stefan\Application Data\pcouffin.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"MMTrayLSI"="C:\WINDOWS\system32\MMTrayLSI.exe" [2003-03-25 53248]
"MMTray2K"="C:\WINDOWS\system32\MMTray2k.exe" [2003-03-25 57344]
"MMTray"="C:\WINDOWS\system32\MMTray.exe" [2003-03-25 53248]
"egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2007-12-21 1443072]
"AGRSMMSG"="AGRSMMSG.exe" [2006-06-29 C:\WINDOWS\AGRSMMSG.exe]
"RTHDCPL"="RTHDCPL.EXE" [2007-11-30 C:\WINDOWS\RTHDCPL.exe]
"Tweak UI"="TWEAKUI.CPL" [2003-03-25 C:\WINDOWS\system32\tweakui.cpl]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"=hex(2):76,69,73,74,61,75,69,2e,65,78,65,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2008-05-28 12:32 87352 C:\WINDOWS\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.iv41"= ir41_32.dll
"msacm.l3acm"= L3codecp.acm
"msacm.divxa32"= DivXa32.acm
"vidc.asv2"= asusasv2.dll
"vidc.div3"= DivXc32.dll
"vidc.div4"= DivXc32f.dll
"vidc.ap41"= APmpg4v1.dll
"vidc.mjpg"= m3jpeg32.dll
"vidc.dmb1"= m3jpeg32.dll
"vidc.rud0"= rududu.dll
"vidc.mj2c"= M3JP2K32.dll
"vidc.mmes"= DigiVCap.dll
"vidc.vixl"= Miroxl32.dll
"vidc.sony"= sonydv.dll
"vidc.dv25"= DigiVCap.dll
"vidc.dv50"= DigiVCap.dll
"vidc.msmc"= DigiVCap.dll
"vidc.mmjp"= DigiVCap.dll
"vidc.3ivx"= 3ivxVfWCodec.dll
"vidc.vssv"= vsscodec.dll
"vidc.pim1"= pclepim1.dll
"vidc.advs"= Dvc.dll
"vidc.asv1"= asusasv1.dll
"vidc.vcr1"= ativcr1.dll
"vidc.vcr2"= ativcr2.dll
"vidc.aflc"= flccodec32.dll
"vidc.aasc"= Aasc32.dll
"vidc.avrn"= AvidAVICodec.dll
"VIDC.mszh"= avimszh.dll
"vidc.zlib"= avizlib.dll
"vidc.mwv1"= icmw_32.dll
"vidc.bt20"= btvvc32.drv
"vidc.y41p"= btvvc32.drv
"vidc.cscd"= camcodec.dll
"vidc.cdvc"= CSCCDVC.DLL
"vidc.ddvc"= CSCdvsd.DLL
"vidc.dps0"= DpsAviCC.dll
"vidc.dvx4"= divx4.dll
"vidc.em2v"= EtxCodec.dll
"vidc.frwd"= frwd.dll
"vidc.frwt"= frwt.dll
"vidc.frwu"= frwu.dll
"vidc.glzw"= GLZW.dll
"vidc.gpeg"= GPEG.dll
"vidc.hfyu"= huffyuv.dll
"vidc.i263"= i263_32.drv
"vidc.ir21"= IR21_R.DLL
"vidc.rt21"= IR21_R.DLL
"vidc.dcmj"= MCMJPG32.DLL
"vidc.tvmj"= MMTVMJ.dll
"vidc.fljp"= MMTVMJ.dll
"vidc.nt00"= NTCodec.dll
"vidc.vp31"= vp31vfw.dll
"vidc.pdvc"= idvcodec.dll
"vidc.ipdv"= idvcodec.dll
"vidc.sjpg"= pmjpeg32.dll
"vidc.pvw2"= pvwv220.dll
"vidc.pimj"= pvljpg20.dll
"vidc.mjpx"= pvmjpg21.dll
"vidc.miro"= mirodv2avi.dll
"vidc.mjpa"= rtmjpgcdc.dll
"msacm.qmpeg"= qmpeg.acm
"vidc.qpeg"= Qpeg32.dll
"vidc.rmp4"= rmp4.dll
"vidc.s422"= tekyuv.dll
"vidc.wnv1"= WNVPLAY1.DLL
"msacm.pcdv"= pcdv.acm
"msacm.imc"= IMC32.ACM
"msacm.wrpr"= aviwrap.dll
"vidc.wrpr"= aviwrap.dll
"vidc.png1"= CorePNG_vfw.dll
"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Free Download Manager]
--a------ 2008-09-09 15:06 2465839 C:\Program Files\Free Download Manager\fdm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
--a----t- 2008-09-09 15:06 133104 C:\Documents and Settings\Stefan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
--a------ 2007-12-03 14:21 2213160 C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R2 LMIRfsDriver;LogMeIn Remote File System Driver;C:\WINDOWS\system32\drivers\LMIRfsDriver.sys [2008-03-07 45848]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2004-08-04 14336]
R3 RMSPPPOE;WAN Miniport (PPP over Ethernet Protocol);C:\WINDOWS\system32\DRIVERS\RMSPPPOE.SYS [2002-06-10 31232]
R3 WSIMD;wsimd Service;C:\WINDOWS\system32\DRIVERS\wsimd.sys [2007-03-28 57024]
S2 LMIInfo;LogMeIn Kernel Information Provider;C:\Program Files\LogMeIn\x86\RaInfo.sys [ ]
S3 RTSTOR;USB Mass Stroage Device;C:\WINDOWS\system32\drivers\RTSTOR.SYS [ ]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-10-04 306432]
S3 usnjsvc;Usluga Messenger Sharing Folders USN Journal Reader;C:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 97136]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder

2008-10-04 C:\WINDOWS\Tasks\1-Click Maintenance.job
- C:\Program Files\TuneUp Utilities 2008\OneClick.exe [2008-01-08 13:31]

2008-10-05 C:\WINDOWS\Tasks\GoogleUpdateTaskUser.job
- C:\Documents and Settings\Stefan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-09 15:06]
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-05 13:19:14
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ASPI32]
"ImagePath"="hex(2):53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,64,00,72,00,69,00,76,00,65,00,72,00,73,00,5c,00,61,00,73,00,70,00,69,00,33,00,32,00,2e,00,73,00,79,00,73,00,00,00"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ASPI32]
"ImagePath"="hex(2):53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,64,00,72,00,69,00,76,00,65,00,72,00,73,00,5c,00,61,00,73,00,70,00,69,00,33,00,32,00,2e,00,73,00,79,00,73,00,00,00"
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\ComboFix\pv.cfexe
.
**************************************************************************
.
Completion time: 2008-10-05 13:21:56 - machine was rebooted [Stefan]
ComboFix-quarantined-files.txt 2008-10-05 11:21:52
ComboFix2.txt 2008-10-04 17:57:53

Pre-Run: 23.631.761.408 bytes free
Post-Run: 23,626,903,552 bytes free

265 --- E O F --- 2008-09-25 13:03:00

Poslao: 05 Okt 2008 20:10
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Postavi svež HijackThis logfile.

Poslao: 05 Okt 2008 20:43
Idi na vrh
offline
  • Pridružio: 21 Sep 2008
  • Poruke: 238
  • Gde živiš: Bačka Palanka

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:41:43, on 5.10.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\MMTrayLSI.exe
C:\WINDOWS\system32\MMTray2k.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\WINDOWS\system32\MMTray.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\Stefan\Desktop\-HijackThis-.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [MMTrayLSI] C:\WINDOWS\system32\MMTrayLSI.exe
O4 - HKLM\..\Run: [MMTray2K] C:\WINDOWS\system32\MMTray2k.exe
O4 - HKLM\..\Run: [MMTray] C:\WINDOWS\system32\MMTray.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: Download video with Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Preuzmi odabrano Free Download Manager-om - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Preuzmi sa Free Download Managerom - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Preuzmi sve sa Free Download Manager-om - file://C:\Program Files\Free Download Manager\dlall.htm
O17 - HKLM\System\CCS\Services\Tcpip\..\{BB1E1F62-F0A8-4A55-B2F3-DDB50197BA0B}: NameServer = 194.247.192.33 194.247.192.1
O23 - Service: Atheros Configuration Service (ACS) - Atheros - C:\WINDOWS\system32\acs.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 4255 bytes

Poslao: 05 Okt 2008 20:58
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Ok, ovo je čisto.

Ukoliko sada nema nekih problema, uradi sledeće:
Klikni START a zatim RUN
U liniju za unos teksta ukucaj Combofix /u i klikni OK





Sačekaj da se proces deinstalacije završi
Gornja procedura će:
Obrisati sledeće:
ComboFix i njegove file-ove i foldere
VundoFix Backups folder, ako postoji
C:\Deckard folder, ako postoji
C:\OtMoveIt folder, ako postoji
Resetovati podešavanja sata na kompjuteru
Sakriti ekstenzije file-ova, ako je potrebno
Sakriti sistemske/skrivene file-ove/foldere, ako je potrebno
Resetovati System Restore

MyCity » Ambulanta -> Arhiva Ambulante » Malware ili sta drugo???

Ko je trenutno na forumu
 

Ukupno su 959 korisnika na forumu :: 13 registrovanih, 3 sakrivenih i 943 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: bobomicek, Bubimir, galijot, hyla, ILGromovnik, indja, jukeboxer, Lazarus, Mi lao shu, panzerwaffe, suton, Tvrtko I, voja64