MyCity » Ambulanta -> Arhiva Ambulante » Moze li ko da protumaci ovaj HiJack Log

Moze li ko da protumaci ovaj HiJack Log

Napisano na dan: 20.6.2009

Moze li ko da protumaci ovaj HiJack Log
Sledeća strana Pagination

Idi na vrh

Poslao: 20 Jun 2009 21:33
Idi na vrh
offline
  • Pridružio: 20 Feb 2006
  • Poruke: 14

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:29:36 PM, on 6/20/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\Adobe\Shockwave 11\nssstub.exe
C:\DOCUME~1\marko\LOCALS~1\Temp\Setup.exe
C:\Documents and Settings\marko\Desktop\provera\TR3.exe
C:\DOCUME~1\marko\LOCALS~1\Temp\7ZipSfx.000\NSSSetup.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\MsiExec.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = theprizeday.com/today.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Ask.com Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\Supertoolbar\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: radiostanica Toolbar - {a10dc0cb-728f-456b-90f9-7fd1351e841a} - C:\Program Files\radiostanica\tbradi.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O3 - Toolbar: Ask.com Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\Supertoolbar\GenericAskToolbar.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\RunOnce: [NSSInstallation] C:\WINDOWS\system32\Adobe\Shockwave 11\nssstub.exe /RunOnce
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKLM\..\Policies\Explorer\Run: [A7278r] "C:\WINDOWS\_default45102.pif"
O4 - HKCU\..\Policies\Explorer\Run: [f1893mar] "C:\Documents and Settings\marko\Local Settings\Application Data\dv6118440x\yesbron.com"
O4 - HKUS\S-1-5-18\..\Run: [y3114SYS] "C:\WINDOWS\system32\n8127\sv711917030r.exe" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [y3114SYS] "C:\WINDOWS\system32\n8127\sv711917030r.exe" (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Unknown owner - C:\Program Files\Eset\nod32krn.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

--
End of file - 5059 bytes

Komp od mog prijatelja, bio je prepun virusa

Poslao: 20 Jun 2009 21:44
Idi na vrh
rip
  • argus  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 27 Apr 2008
  • Poruke: 9160
  • Gde živiš: Prokuplje

Preuzmi sUBs-ov ComboFix sa jedne od sledećih adresa na Desktop:


Bleeping Computer . . . . . Geeks to Go!
Klikni desnim tasterom na neki od linkova i odaberi opciju Save Target As... (Save Link As..., Save Linked Content As... ili sličnu);
Kada se otvori dijalog za izbor lokacije na kojoj treba sačuvati file, odaberi Desktop i klikni Save.



Kada preuzimanje programa bude završeno:
zatvori pokrenute programe;
deaktiviraj zaštitni softver (uputstvo);
dvoklikom pokreni program ComboFix.
U toku rada, ComboFix će:proveriti postoji li novija verzija programa:
klikni Yes ako bude ponuđeno preuzimanje iste. prikazati DISCLAIMER OF WARRANTY ON SOFTWARE:
klikni Yes kako bi proces bio nastavljen.ako Recovery Console nije instalirana, ponuditi instalaciju:
prihvati klikom na Yes i isprati postupak.postaviti/dati određeni broj upita/obaveštenja:
prihvati klikom na Yes ili OK.po potrebi, restartovati Windows (više puta);
na kraju rada, otvoriti Notepad sa izveštajem o skeniranju.

Iskopiraj izveštaj koji je ComboFix napravio u temu na forumu:
klikni desnim tasterom miša u prozor Notepad-a i izaberi Select All;
klikni desnim tasterom miša na obeleženi tekst i izaberi Copy;
klikni desnim tasterom miša u polje za pisanje poruke i izaberi Paste.

Napomena:Izveštaj će biti sačuvan pod nazivom ComboFix.txt na sistemskoj particiji (tipična lokacija: C:\ComboFix.txt);
Ukoliko nakon slanja poruke primetiš da izveštaj nije kompletan, iskoristi opciju Prikači fajl za prilaganje file-a C:\ComboFix.txt uz poruku.

Poslao: 20 Jun 2009 22:08
Idi na vrh
offline
  • Pridružio: 20 Feb 2006
  • Poruke: 14

ComboFix 09-06-20.02 - marko 06/20/2009 21:53.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.511.317 [GMT 2:00]
Running from: c:\documents and settings\marko\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090620-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: Eset NOD32 antivirus system 2.50 *On-access scanning enabled* (Outdated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2009-05-20 to 2009-06-20 )))))))))))))))))))))))))))))))
.

2009-06-20 19:29 . 2009-06-20 19:29 -------- d-----w- c:\program files\Norton Security Scan
2009-06-20 19:26 . 2004-02-22 23:00 1386496 ----a-w- c:\windows\system32\MSVBVM60.DLL
2009-06-20 18:56 . 2009-06-20 18:56 -------- d-----w- c:\documents and settings\Administrator\DoctorWeb
2009-06-16 16:51 . 2009-06-16 16:51 -------- d-----w- c:\documents and settings\marko\Application Data\Uniblue
2009-06-16 16:50 . 2009-06-16 16:50 -------- d-----w- c:\program files\Uniblue
2009-06-16 16:21 . 2009-06-16 16:46 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-06-16 16:21 . 2008-08-25 09:36 81288 ----a-w- c:\windows\system32\drivers\iksyssec.sys
2009-06-16 16:21 . 2008-08-25 09:36 66952 ----a-w- c:\windows\system32\drivers\iksysflt.sys
2009-06-16 16:21 . 2008-08-25 09:36 40840 ----a-w- c:\windows\system32\drivers\ikfilesec.sys
2009-06-16 16:21 . 2008-06-02 13:19 29576 ----a-w- c:\windows\system32\drivers\kcom.sys
2009-06-16 16:21 . 2009-06-16 16:38 -------- d-----w- c:\program files\Spyware Doctor
2009-06-16 16:21 . 2009-06-16 16:21 -------- d-----w- c:\documents and settings\marko\Application Data\PC Tools
2009-06-11 12:30 . 2009-06-11 12:30 -------- d-----w- c:\windows\system32\LogFiles
2009-06-07 16:56 . 2009-06-07 16:56 -------- d-----w- c:\documents and settings\marko\Local Settings\Application Data\Media Access Startup
2009-06-07 16:56 . 2009-06-07 16:56 -------- d-----w- c:\program files\Media Access Startup
2009-06-04 13:02 . 2009-06-04 13:02 -------- d-----w- c:\program files\System Search Dispatcher
2009-06-04 13:02 . 2009-03-30 06:26 2981479 -c--a-w- c:\documents and settings\All Users\Application Data\{DF76688D-9851-4919-AF6C-41291AA93164}\Setup.exe
2009-06-04 13:00 . 2009-06-04 13:00 -------- d-----w- c:\documents and settings\marko\Local Settings\Application Data\DoubleD
2009-05-26 13:16 . 2009-05-26 13:16 -------- d-----w- c:\windows\Sun
2009-05-24 11:54 . 2009-05-24 11:54 -------- d-----w- c:\program files\CCleaner

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-20 19:29 . 2008-11-16 13:29 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-06-16 17:17 . 2002-03-18 02:04 -------- d-----w- c:\program files\MSN Messenger
2009-06-15 22:26 . 2002-02-04 02:31 29 ----a-w- c:\windows\popcinfo.dat
2009-06-04 13:02 . 2009-06-04 13:01 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{DF76688D-9851-4919-AF6C-41291AA93164}
2008-10-31 09:02 . 2008-08-12 11:46 43072 --sh--r- c:\windows\j6451022.exe
2008-10-31 09:02 . 2008-08-12 11:46 43072 --sh--r- c:\windows\o4451027.exe
2008-10-31 09:02 . 2008-08-12 11:46 43072 --sh--r- c:\windows\_default45102.pif
2008-10-26 16:08 . 2008-08-13 15:08 43072 --sh--r- c:\windows\system32\config\systemprofile\Local Settings\Application Data\dv6191700x\yesbron.com
2008-10-26 16:08 . 2008-08-13 15:08 43072 --sh--r- c:\windows\system32\n8127\sv711917030r.exe
2008-10-31 09:02 . 2008-08-12 11:46 43072 --sh--r- c:\windows\system32\s5685\smss.exe
2008-10-31 09:02 . 2008-08-12 11:46 43072 --sh--r- c:\windows\system32\s5685\zh591184484y.exe
.

((((((((((((((((((((((((((((( SnapShot@2009-06-20_18.37.41 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-06-20 19:46 . 2009-06-20 19:46 16384 c:\windows\temp\Perflib_Perfdata_77c.dat
+ 2009-06-20 19:46 . 2009-06-20 19:46 16384 c:\windows\temp\Perflib_Perfdata_4d4.dat
+ 2009-06-20 19:29 . 2009-06-20 19:29 29184 c:\windows\Installer\{6FF543AB-99B3-4120-902C-70A38314ABD8}\Icon3FADAA191.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2008-10-21 11:13 741768 ----a-w- c:\program files\Ask.com\Supertoolbar\GenericAskToolbar.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-11 7630848]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"y3114SYS"="c:\windows\system32\n8127\sv711917030r.exe" [2008-10-26 43072]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
"A7278r"="c:\windows\_default45102.pif" [2008-10-31 43072]

[HKEY_CURRENT_USER\software\microsoft\windows\Currentversion\policies\explorer\Run]
"f1893mar"="c:\documents and settings\marko\Local Settings\Application Data\dv6118440x\yesbron.com" [2008-10-31 43072]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"MDM"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [3/18/2002 2:06 AM 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [3/18/2002 2:06 AM 20560]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [6/16/2009 6:21 PM 356920]
.
Contents of the 'Scheduled Tasks' folder

2009-06-20 c:\windows\Tasks\Norton Security Scan for marko.job
- c:\program files\Norton Security Scan\Nss.exe [2009-03-13 03:53]

2009-06-20 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\Supertoolbar\UpdateTask.exe [2008-10-21 11:13]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.theprizeday.com/today.php
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, gmer.net
Rootkit scan 2009-06-20 21:56
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(1056)
c:\windows\system32\msi.dll
.
Completion time: 2009-06-20 21:58
ComboFix-quarantined-files.txt 2009-06-20 19:58
ComboFix2.txt 2009-06-20 18:42
ComboFix3.txt 2008-11-16 14:07
ComboFix4.txt 2008-11-16 13:09

Pre-Run: 819,191,808 bytes free
Post-Run: 821,235,712 bytes free

129

Evo, samo da napomenem da sam skenirao komp spyware doctorom (obrisao preko 2500 infekcija), DrWeb Cure It (obrisao 3 trojanca).

Poslao: 20 Jun 2009 22:40
Idi na vrh
rip
  • argus  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 27 Apr 2008
  • Poruke: 9160
  • Gde živiš: Prokuplje

Otvoriti Notepad i iskopirati sledeci tekst:

File::
c:\windows\j6451022.exe
c:\windows\o4451027.exe
c:\windows\_default45102.pif
c:\windows\system32\config\systemprofile\Local Settings\Application Data\dv6191700x\yesbron.com
c:\windows\system32\n8127\sv711917030r.exe

Folder::
c:\windows\system32\s5685

Registry::
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"y3114SYS"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
"A7278r"=-
[HKEY_CURRENT_USER\software\microsoft\windows\Currentversion\policies\explorer\Run]
"f1893mar"=-

Snimiti na Desktop fajl iz Notepada kao "CFScript"




Prevuci snimljeni skript/tekst na ComboFix ikonicu kao na slici.
Postaviti u sledecoj poruci log koji bude bio napravljen na kraju ciscenja/skeniranja.

Poslao: 20 Jun 2009 22:56
Idi na vrh
offline
  • Pridružio: 20 Feb 2006
  • Poruke: 14

ComboFix 09-06-20.02 - marko 06/20/2009 22:48.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.511.140 [GMT 2:00]
Running from: c:\documents and settings\marko\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\marko\Desktop\CFScript.txt
AV: avast! antivirus 4.8.1335 [VPS 090620-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: Eset NOD32 antivirus system 2.50 *On-access scanning enabled* (Outdated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

FILE ::
"c:\windows\_default45102.pif"
"c:\windows\j6451022.exe"
"c:\windows\o4451027.exe"
"c:\windows\system32\config\systemprofile\Local Settings\Application Data\dv6191700x\yesbron.com"
"c:\windows\system32\n8127\sv711917030r.exe"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\s5685
c:\windows\_default45102.pif
c:\windows\j6451022.exe
c:\windows\o4451027.exe
c:\windows\system32\config\systemprofile\Local Settings\Application Data\dv6191700x\yesbron.com
c:\windows\system32\n8127\sv711917030r.exe
c:\windows\system32\s5685\c.bron.tok.txt
c:\windows\system32\s5685\domlist.txt
c:\windows\system32\s5685\smss.exe
c:\windows\system32\s5685\Spread.Mail.Bro\activisionsav@loisir.net.ini
c:\windows\system32\s5685\Spread.Mail.Bro\albert_so@terra.es.ini
c:\windows\system32\s5685\Spread.Mail.Bro\andrewja@home.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\armyofdoom@clanakoj.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\assistenza@halifax.it.ini
c:\windows\system32\s5685\Spread.Mail.Bro\auxois@nuclearbox.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\barf@zeelandnet.nl.ini
c:\windows\system32\s5685\Spread.Mail.Bro\blair@planetblair.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\cadaver@planethalflife.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\chris@barking-dog.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\cliffe@counter-strike.net.ini
c:\windows\system32\s5685\Spread.Mail.Bro\comercial@havasinteractive.es.ini
c:\windows\system32\s5685\Spread.Mail.Bro\countfloyd@botepidemic.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\COWCOWSPINK@AOL.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\coyote@eudoramail.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\crinity@email.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\CTL@CT-Lounge.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\D_Mike@soneramail.nl.ini
c:\windows\system32\s5685\Spread.Mail.Bro\Dackyy@gmx.de.ini
c:\windows\system32\s5685\Spread.Mail.Bro\Dackyy@hotmail.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\danjo@iprimus.com.au.ini
c:\windows\system32\s5685\Spread.Mail.Bro\DashKrehel@mediaone.net.ini
c:\windows\system32\s5685\Spread.Mail.Bro\digichaos@hotsheep.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\dj@prime8interactive.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\DMike@nmtrix.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\dv@btinternet.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\edwindz@bigfoot.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\efness@bol.com.br.ini
c:\windows\system32\s5685\Spread.Mail.Bro\emperorpalpatine@gmx.net.ini
c:\windows\system32\s5685\Spread.Mail.Bro\fronkel@gmx.de.ini
c:\windows\system32\s5685\Spread.Mail.Bro\glenc@hotsheep.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\gooseman@counter-strike.net.ini
c:\windows\system32\s5685\Spread.Mail.Bro\gunny@thegunslinger.de.ini
c:\windows\system32\s5685\Spread.Mail.Bro\Guntram.Schmidt@t-online.de.ini
c:\windows\system32\s5685\Spread.Mail.Bro\hansdup@intekom.co.za.ini
c:\windows\system32\s5685\Spread.Mail.Bro\hobbit@bellatlantic.net.ini
c:\windows\system32\s5685\Spread.Mail.Bro\hobbit6@bellatlantic.net.ini
c:\windows\system32\s5685\Spread.Mail.Bro\i_talk_with_you@hotmail.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\ido@dnai.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\illuminati@sezampro.rs.ini
c:\windows\system32\s5685\Spread.Mail.Bro\infoeater@CT-Lounge.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\jaz@koldkut.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\jmatches@hotmail.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\joesmoe@home.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\jogi@netads.de.ini
c:\windows\system32\s5685\Spread.Mail.Bro\kallus@cs-maps.co.uk.ini
c:\windows\system32\s5685\Spread.Mail.Bro\lmuur@dlc.fi.ini
c:\windows\system32\s5685\Spread.Mail.Bro\macmaninfi@aol.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\MEEEEDIC@gmx.net.ini
c:\windows\system32\s5685\Spread.Mail.Bro\metal-militia@gmx.net.ini
c:\windows\system32\s5685\Spread.Mail.Bro\mike@blitwise.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\mikezilla@mapcore.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\mlr32@cam.ac.uk.ini
c:\windows\system32\s5685\Spread.Mail.Bro\moco2k@gmx.net.ini
c:\windows\system32\s5685\Spread.Mail.Bro\mspss@gto.net.om.ini
c:\windows\system32\s5685\Spread.Mail.Bro\mts@lebanon-online.com.lb.ini
c:\windows\system32\s5685\Spread.Mail.Bro\n0th1ng@mailcity.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\nc-neustaha@netcologne.de.ini
c:\windows\system32\s5685\Spread.Mail.Bro\nicolaec@etc.tuiasi.ro.ini
c:\windows\system32\s5685\Spread.Mail.Bro\OKalhovd@hotmail.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\ook_22@hotmail.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\ozer_erdogan@hotmail.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\paul.murphy@ntlworld.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\Pescau@uol.com.ar.ini
c:\windows\system32\s5685\Spread.Mail.Bro\podbot@nuclearbox.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\pogipoints2k@edsamail.com.ph.ini
c:\windows\system32\s5685\Spread.Mail.Bro\pooshoes@mapcore.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\remclan@alltel.net.ini
c:\windows\system32\s5685\Spread.Mail.Bro\rpr@get2net.dk.ini
c:\windows\system32\s5685\Spread.Mail.Bro\runabout@crosswinds.net.ini
c:\windows\system32\s5685\Spread.Mail.Bro\RWM@zde.cz.ini
c:\windows\system32\s5685\Spread.Mail.Bro\Shotgunman@hotmail.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\Shtabmdr@aol.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\slyflyer32@aol.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\smok3@nuclearbox.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\sniperman@planethalflife.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\soporte@havasinteractive.es.ini
c:\windows\system32\s5685\Spread.Mail.Bro\soporte@proein.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\soporte@teleopcion.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\sparx@artlover.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\sphome@narod.ru.ini
c:\windows\system32\s5685\Spread.Mail.Bro\squid@cs-maps.co.uk.ini
c:\windows\system32\s5685\Spread.Mail.Bro\Steele@t-online.de.ini
c:\windows\system32\s5685\Spread.Mail.Bro\suporte@ea.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\telnets@mindsvirge.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\tyr@barking-dog.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\undertow@prascho.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\videcom@terra.com.br.ini
c:\windows\system32\s5685\Spread.Mail.Bro\warbeast@t-online.de.ini
c:\windows\system32\s5685\Spread.Mail.Bro\wilder@cleanweb.net.ini
c:\windows\system32\s5685\Spread.Mail.Bro\witchdawn@hotmail.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\zaphod@mapcore.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\zaphod_beeblebrox@eudoramail.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\ze0@botepidemic.com.ini
c:\windows\system32\s5685\Spread.Mail.Bro\Zipper@inetia.pl.ini
c:\windows\system32\s5685\zh591184484y.exe

.
((((((((((((((((((((((((( Files Created from 2009-05-20 to 2009-06-20 )))))))))))))))))))))))))))))))
.

2009-06-20 20:09 . 2009-06-20 20:09 -------- d-----w- c:\documents and settings\marko\Application Data\Malwarebytes
2009-06-20 20:09 . 2009-06-17 09:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-20 20:09 . 2009-06-20 20:09 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-20 20:09 . 2009-06-20 20:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-20 20:09 . 2009-06-17 09:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-20 19:26 . 2004-02-22 23:00 1386496 ----a-w- c:\windows\system32\MSVBVM60.DLL
2009-06-20 18:56 . 2009-06-20 18:56 -------- d-----w- c:\documents and settings\Administrator\DoctorWeb
2009-06-16 16:51 . 2009-06-16 16:51 -------- d-----w- c:\documents and settings\marko\Application Data\Uniblue
2009-06-16 16:50 . 2009-06-16 16:50 -------- d-----w- c:\program files\Uniblue
2009-06-16 16:21 . 2009-06-16 16:46 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-06-16 16:21 . 2008-08-25 09:36 81288 ----a-w- c:\windows\system32\drivers\iksyssec.sys
2009-06-16 16:21 . 2008-08-25 09:36 66952 ----a-w- c:\windows\system32\drivers\iksysflt.sys
2009-06-16 16:21 . 2008-08-25 09:36 40840 ----a-w- c:\windows\system32\drivers\ikfilesec.sys
2009-06-16 16:21 . 2008-06-02 13:19 29576 ----a-w- c:\windows\system32\drivers\kcom.sys
2009-06-16 16:21 . 2009-06-16 16:38 -------- d-----w- c:\program files\Spyware Doctor
2009-06-16 16:21 . 2009-06-16 16:21 -------- d-----w- c:\documents and settings\marko\Application Data\PC Tools
2009-06-11 12:30 . 2009-06-11 12:30 -------- d-----w- c:\windows\system32\LogFiles
2009-06-07 16:56 . 2009-06-07 16:56 -------- d-----w- c:\documents and settings\marko\Local Settings\Application Data\Media Access Startup
2009-06-07 16:56 . 2009-06-07 16:56 -------- d-----w- c:\program files\Media Access Startup
2009-06-04 13:02 . 2009-06-04 13:02 -------- d-----w- c:\program files\System Search Dispatcher
2009-06-04 13:02 . 2009-03-30 06:26 2981479 -c--a-w- c:\documents and settings\All Users\Application Data\{DF76688D-9851-4919-AF6C-41291AA93164}\Setup.exe
2009-06-04 13:00 . 2009-06-04 13:00 -------- d-----w- c:\documents and settings\marko\Local Settings\Application Data\DoubleD
2009-05-26 13:16 . 2009-05-26 13:16 -------- d-----w- c:\windows\Sun
2009-05-24 11:54 . 2009-05-24 11:54 -------- d-----w- c:\program files\CCleaner

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-20 19:29 . 2008-11-16 13:29 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-06-16 17:17 . 2002-03-18 02:04 -------- d-----w- c:\program files\MSN Messenger
2009-06-15 22:26 . 2002-02-04 02:31 29 ----a-w- c:\windows\popcinfo.dat
2009-06-04 13:02 . 2009-06-04 13:01 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{DF76688D-9851-4919-AF6C-41291AA93164}
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2008-10-21 11:13 741768 ----a-w- c:\program files\Ask.com\Supertoolbar\GenericAskToolbar.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-11 7630848]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"MDM"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [3/18/2002 2:06 AM 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [3/18/2002 2:06 AM 20560]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [6/20/2009 10:09 PM 38160]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [6/16/2009 6:21 PM 356920]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - MBAMSWISSARMY
.
Contents of the 'Scheduled Tasks' folder

2009-06-20 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\Supertoolbar\UpdateTask.exe [2008-10-21 11:13]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.theprizeday.com/today.php
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, gmer.net
Rootkit scan 2009-06-20 22:51
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-06-20 22:53
ComboFix-quarantined-files.txt 2009-06-20 20:53
ComboFix2.txt 2009-06-20 19:58

Pre-Run: 2,646,118,400 bytes free
Post-Run: 2,636,652,544 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

230

Napomena, nikako ne mogu da nadjem taj eset nod32 koji prijavljuje.
pozzz

Poslao: 20 Jun 2009 23:13
Idi na vrh
rip
  • argus  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 27 Apr 2008
  • Poruke: 9160
  • Gde živiš: Prokuplje

Citat:Napomena, nikako ne mogu da nadjem taj eset nod32 koji prijavljuje.
pozzz

Evo ti link za deinstalaciju AV programa http://www.mycity.rs/Antivirus-programi/Deinstalacija-antivirus-programa.html

Stanje ?

Poslao: 20 Jun 2009 23:26
Idi na vrh
offline
  • Pridružio: 20 Feb 2006
  • Poruke: 14

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:18:13 PM, on 6/20/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\marko\Desktop\provera\TR3.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = theprizeday.com/today.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: radiostanica Toolbar - {a10dc0cb-728f-456b-90f9-7fd1351e841a} - C:\Program Files\radiostanica\tbradi.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Uniblue Registry Booster] C:\Program Files\Uniblue\Registry Booster\RegistryBooster.exe /S
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Unknown owner - C:\Program Files\Eset\nod32krn.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

--
End of file - 4136 bytes

Sve deluje mnogo bolje...
hvala ti puno.
pozz

Poslao: 21 Jun 2009 08:18
Idi na vrh
rip
  • argus  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 27 Apr 2008
  • Poruke: 9160
  • Gde živiš: Prokuplje

Potrebno je deinstalirati ComboFix:
klikni start (ili ), a zatim RUN.

Na Visti koristiti Start Search polje ukoliko Run nije dostupan.

U liniju za unos teksta ukucaj (iskopiraj) sledeće:

combofix /u

Primeti da postoji razmak između "ComboFix" i "/u".



a zatim klikni OK (ili pritisni Enter).

Sačekaj da se proces deinstalacije završi.

MyCity » Ambulanta -> Arhiva Ambulante » Moze li ko da protumaci ovaj HiJack Log

Ko je trenutno na forumu
 

Ukupno su 1042 korisnika na forumu :: 33 registrovanih, 4 sakrivenih i 1005 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: arsa, CHARLIE JA., dekan.m, DonRumataEstorski, dule10savic, dzoni19, HogarStrashni, kobaja77, Kubovac, kulus, kybonacci, Marko Marković, mercedesamg, Metanoja, miljannis, Milos ZA, Milos1389, MiroslavD, Motocar, mrvica78, Niko Bitan, opt1, pacika, Petarvu, Povratak1912, rovac, Sirius, Stoilkovic, trajkoni018, tubular, Tvrtko I, wolf431, wolverined4