Molba za pomoc

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

ComboFix 08-04-18.3 - Media 2008-04-20 16:56:25.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.160 [GMT 2:00]
Running from: C:\Documents and Settings\Media\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Media\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\SYSTEM32\winopn32.dll
.

((((((((((((((((((((((((( Files Created from 2008-03-20 to 2008-04-20 )))))))))))))))))))))))))))))))
.

2008-04-20 12:30 . 2008-04-20 12:30 <DIR> d-------- C:\Program Files\Trend Micro
2008-04-20 08:56 . 2008-04-20 08:56 <DIR> d-------- C:\!KillBox
2008-04-18 21:44 . 2008-04-18 21:41 691,545 --a------ C:\WINDOWS\unins000.exe
2008-04-18 21:44 . 2008-04-18 21:44 2,541 --a------ C:\WINDOWS\unins000.dat
2008-04-14 23:00 . 2005-01-07 11:39 57,344 --a------ C:\WINDOWS\system32\Big Kahuna Reef.scr
2008-04-13 21:36 . 2008-04-13 21:36 <DIR> d-------- C:\Program Files\MITCalc
2008-04-11 17:12 . 2008-04-14 11:37 <DIR> d-------- C:\Program Files\Beltcomp
2008-04-11 17:06 . 2008-04-11 17:06 <DIR> d-------- C:\Program Files\Engineering Power Tools - v1.9.8
2008-04-11 17:06 . 2002-08-26 16:04 53,248 --a------ C:\WINDOWS\system32\GraphLite2.ocx
2008-04-11 17:05 . 2008-04-14 11:46 <DIR> d-------- C:\Program Files\mConveyor3
2008-04-11 17:05 . 2002-01-10 14:46 425,984 --a------ C:\WINDOWS\system32\vsflex7l.ocx
2008-04-05 20:31 . 2008-04-05 20:31 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Friday's games
2008-04-04 12:27 . 2008-04-04 12:27 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SiComponents
2008-04-04 12:10 . 2008-04-04 12:11 <DIR> d-------- C:\DVDVideoSoft
2008-04-04 12:09 . 2008-04-04 12:09 <DIR> d-------- C:\Program Files\DVDVideoSoft
2008-04-04 12:09 . 2008-04-04 12:09 <DIR> d-------- C:\Program Files\Common Files\DVDVideoSoft
2008-04-03 17:19 . 2008-04-03 17:19 <DIR> d-------- C:\Program Files\BestGameEver
2008-04-02 09:13 . 2008-04-02 10:03 <DIR> d-------- C:\Program Files\YouTube Downloader
2008-03-31 16:00 . 2008-04-18 16:48 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-03-31 16:00 . 2008-03-31 16:00 1,409 --a------ C:\WINDOWS\QTFont.for
2008-03-26 14:22 . 2008-03-26 14:22 <DIR> d-------- C:\Documents and Settings\Media\Application Data\GetRightToGo
2008-03-25 22:14 . 2008-03-25 22:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\EscapeTheMuseum

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-20 10:42 --------- d-----w C:\Documents and Settings\Media\Application Data\uTorrent
2008-04-20 08:12 --------- d-----w C:\Documents and Settings\Media\Application Data\AVG7
2008-04-20 06:54 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-04-19 09:32 --------- d-----w C:\Documents and Settings\Media\Application Data\Skype
2008-04-18 20:15 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-04-18 20:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-04-18 17:40 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-14 10:46 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-04-06 13:47 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-04-02 07:26 --------- d-----w C:\Documents and Settings\Media\Application Data\Orbit
2008-03-27 08:09 --------- d-----w C:\Program Files\Ricochet Infinity
2008-03-13 20:35 --------- d-----w C:\Documents and Settings\Media\Application Data\Reallusion
2008-03-13 10:05 --------- d-----w C:\Program Files\LimeWire
2008-03-09 13:23 --------- d-----w C:\Program Files\GameHouse
2008-03-05 16:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\GRETECH
2008-03-05 16:41 --------- d-----w C:\Documents and Settings\Media\Application Data\GRETECH
2008-03-05 16:39 --------- d-----w C:\Program Files\GRETECH
2008-03-04 21:00 --------- d-----w C:\Program Files\BitComet
2008-03-04 20:44 --------- d-----w C:\Program Files\Collectorz.com
2008-03-04 20:37 --------- d-----w C:\Program Files\uTorrent
2008-03-04 20:23 --------- d-----w C:\Program Files\EvilLyrics
2008-03-04 20:17 --------- d-----w C:\Program Files\Mv2Player
2008-03-04 15:13 --------- d-----w C:\Documents and Settings\Media\Application Data\Dev-Cpp
2008-03-03 14:36 --------- d-----w C:\Program Files\SecondLife
2008-03-03 11:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avg7
2008-03-03 11:33 --------- d-----w C:\Documents and Settings\LocalService\Application Data\AVG7
2008-03-03 11:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-24 20:37 --------- d-----w C:\Documents and Settings\Media\Application Data\SolidDocuments
2008-02-24 20:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\SolidDocuments
2008-02-24 00:38 --------- d-----w C:\Program Files\Sony
2008-02-23 18:50 --------- d-----w C:\Program Files\Google
2008-02-23 01:04 --------- d-----w C:\Documents and Settings\Media\Application Data\SecondLife
2008-02-20 14:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\ATI
2008-02-20 13:57 --------- d-----w C:\Program Files\ATI Technologies
2008-01-29 17:03 17,408 ----a-w C:\psapi.dll
2008-01-22 20:44 368,640 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll
2008-01-22 20:43 272,384 ----a-w C:\WINDOWS\system32\ati2dvag.dll
2008-01-22 20:39 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll
2008-01-22 20:36 9,949,184 ----a-w C:\WINDOWS\system32\atioglx2.dll
2008-01-22 20:35 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll
2008-01-22 20:35 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe
2008-01-22 20:35 147,456 ----a-w C:\WINDOWS\system32\atipdlxx.dll
2008-01-22 20:35 122,880 ----a-w C:\WINDOWS\system32\Oemdspif.dll
2008-01-22 20:35 122,880 ----a-w C:\WINDOWS\system32\ati2evxx.dll
2008-01-22 20:34 512,000 ----a-w C:\WINDOWS\system32\ati2evxx.exe
2008-01-22 20:33 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL
2008-01-22 20:25 3,121,920 ----a-w C:\WINDOWS\system32\ati3duag.dll
2008-01-22 20:14 1,664,256 ----a-w C:\WINDOWS\system32\ativvaxx.dll
2008-01-22 20:04 46,080 ----a-w C:\WINDOWS\system32\amdpcom32.dll
2008-01-22 20:01 385,024 ----a-w C:\WINDOWS\system32\atikvmag.dll
2008-01-22 19:59 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll
2008-01-22 19:58 5,435,392 ----a-w C:\WINDOWS\system32\atioglxx.dll
2008-01-22 19:57 163,840 ----a-w C:\WINDOWS\system32\atiok3x2.dll
2008-01-22 19:53 503,808 ----a-w C:\WINDOWS\system32\ati2cqag.dll
2008-01-22 13:42 593,920 ----a-w C:\WINDOWS\system32\ati2sgag.exe
2007-01-23 11:46 312 ----a-w C:\Documents and Settings\Media\Application Data\bbbconfig.dat
2007-02-25 15:48 3,350 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( snapshot@2008-04-20_13.56.45.60 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-04-20 11:52:53 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-04-20 14:06:10 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-04-20 14:06:30 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_2f8.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 17:30 81920]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 17:30 249856]
"DiskeeperSystray"="C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe" [2006-10-04 12:38 163840]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 13:35 90112]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-01 23:22 3739648]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-04-15 09:51 579584]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:56 15360]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 15:58 1744896]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-03-03 13:33 219136]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsNetHood"= 01000000

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]
backup=C:\WINDOWS\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Synchronizer.lnk]
backup=C:\WINDOWS\pss\Adobe Acrobat Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Watch.lnk]
backup=C:\WINDOWS\pss\Watch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinNC - Launch WinNC - multiplelicense (external programming station).lnk]
backup=C:\WINDOWS\pss\WinNC - Launch WinNC - multiplelicense (external programming station).lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Media^Start Menu^Programs^Startup^3DO Registration.lnk]
backup=C:\WINDOWS\pss\3DO Registration.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Media^Start Menu^Programs^Startup^H3 The Shadow of Death(TM).lnk]
backup=C:\WINDOWS\pss\H3 The Shadow of Death(TM).lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Media^Start Menu^Programs^Startup^MostFun.lnk]
backup=C:\WINDOWS\pss\MostFun.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 23:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
-ra------ 2003-09-23 11:06 88363 C:\WINDOWS\AGRSMMSG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
-ra------ 2005-05-03 12:43 69632 C:\WINDOWS\Alcmtr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDAgent]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDMCon]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2007-05-16 09:27 153136 C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitDefender Antiphishing Helper]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DiskeeperSystray]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2005-05-12 00:12 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ Lite]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
--a------ 2006-09-29 22:58 49152 C:\Program Files\CyberLink\PowerDVD\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-01 15:57 153136 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
--a------ 2007-03-23 13:20 227328 C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
--a------ 2006-03-18 04:24 184320 C:\Program Files\PowerISO\PWRISOVM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 2005-12-07 23:57 30208 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
-ra------ 2006-05-18 08:27 16207872 C:\WINDOWS\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-07-12 04:00 132496 C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\system32WXBP Agent]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"LIVESRV"=2 (0x2)
"VSSERV"=2 (0x2)
"avast! Web Scanner"=3 (0x3)
"avast! Mail Scanner"=3 (0x3)
"avast! Antivirus"=2 (0x2)
"aswUpdSv"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"10317:TCP"= 10317:TCP:BitComet 10317 TCP
"10317:UDP"= 10317:UDP:BitComet 10317 UDP

R1 SSHDRV65;SSHDRV65;C:\WINDOWS\system32\drivers\SSHDRV65.sys [2007-03-18 22:29]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, gmer.net
Rootkit scan 2008-04-20 16:57:37
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-04-20 16:58:37
ComboFix-quarantined-files.txt 2008-04-20 14:58:05
ComboFix2.txt 2008-04-20 14:13:05
ComboFix3.txt 2008-04-20 13:42:23
ComboFix4.txt 2008-04-20 11:57:05

Pre-Run: 4,611,072,000 bytes free
Post-Run: 4,599,066,624 bytes free

217

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Ok. Sada izgleda da se infekcija ne vraća. Jedno pitanje pre nego krenemo da privodimo kraju ovu temu:
Jesi li ti instalirao na sistem neki od proizvoda ove kompanije?
http://www.ardamax.com/

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Evo, sada sam proverila link. Nista odavde nije instalirano mojom voljom. Sigurno.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Neizmerno sam zahvalna na ulozenom trudu i brzini kojom ste reagovali. Javim se, cim odradim sve sto je potrebno.

Dopuna: 20 Apr 2008 20:51

Nadam se da je ovo moj poslednji post u vezi sa ovim problemom. Uradila sam sve sto ste mi preporucili, i za sada, sve funkcionise kako treba. Mozda treba da napomenem, da mi prilikom skeniranja, na bitdefender.com/scan8/ie.html nije otkriveno nista.
Jos jednom, veeeeeeliko hvala, i svako dobro!

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Tu smo pri kraju. Moram samo jos nesto da proverim.

Uključi prikaz skrivenih fajlova.
http://www.mycity.rs/Uputstva-sa-ex-SuperSajta/Kako-videti-skrivene-fajlove.html

Kada to uradiš, probaj da lociraš ovaj fajl u Windows direktorijumu
C:\WINDOWS\system32WXBP.exe

Izvesti me o ishodu..

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Izvini sto ti tek sada odgovaram, nadam se da nisam zakasnila. Proverila sam, i ne postoji fajl system32WXBP.exe, ali postoje sledeca dva fajla:
system32WXBP.001 i system32WXBP.002. To je sve sto mi lici na tvoje pitanje.
Veliki pozdrav!

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Zato BitDefender i nije nasao ovaj keylogger. Neki zaštitni softver ga je već ranije našao i disejblovao promenivši mu extenziju. Briši to ne treba ti.

btw. Kako se snalaziš sa registry bazom? Dao bih ti putanju do jednog ključa da ga obrišeš da ne moramo ponovo preko ComboFix-a ili nekog sličnog alata.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Snacicu se, mislim da mi nece biti problem. Slobodno mi posalji putanju.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Brišeš samo boldovan deo iz ovog ključa
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\system32WXBP Agent