|
Napisano: 19 Dec 2010 16:22
Pozdravlam sve, evo problema:
prvo mi strada schedule, ne mogu da npr. snimam neke dogadjaje na TV-u.
Onda mi se ponekad javljaju neki neuobicajeni zvuci.
Sa hijack sam `ocistio` 1 trojanca.
Tek posle se setih ambulante, izvinjavam se.
Evo logova:
DDS (Ver_10-12-12.02) - NTFSx86
Run by Ў¦Т·Ф at 15:28:57,56 on ФЁ¦ 19.12.2010
Internet Explorer: 7.0.5730.11
Microsoft Windows XP Professional 5.1.2600.3.1251.381.1033.18.1279.545 [GMT 1:00]
AV: ESET NOD32 Antivirus 4.0 *Enabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
============== Running Processes ===============
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\NetLimiter 3\nlsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\sstray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\DU Meter\DUMeter.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\DAEMON Tools Pro\DTShellHlp.exe
C:\Program Files\DAEMON Tools Pro\DTAgent.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\WINDOWS\system32\OSK.exe
C:\WINDOWS\system32\MSSWCHX.EXE
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Opera\opera.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Documents and Settings\Админ\Desktop\dds.scr
============== Pseudo HJT Report ===============
uStart Page = hxxp://users.iptelecom.net.ua/~codecs/
uInternet Connection Wizard,ShellNext = hxxp://go.eset.eu/versioninfo?lng=1033&version=4469
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\micros~2\office14\URLREDIR.DLL
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
uRun: [NetLimiter] c:\program files\netlimiter 3\NLClientApp.exe /tray
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [DAEMON Tools Pro Agent] "c:\program files\daemon tools pro\DTAgent.exe" -autorun
mRun: [nForce Tray Options] sstray.exe /r
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [WinDVR SchSvr] "c:\program files\common files\intervideo\schsvr\SchSvr.exe"
mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice
mRun: [DU Meter] c:\program files\du meter\DUMeter.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRunOnce: [TSC] "c:\docume~1\9226~1\locals~1\temp\housecall\tsc.exe" /HD
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
dRunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32
dRunOnce: [IE7-11] rundll32 advpack.dll,LaunchINFSection NR_IE7en.inf,AfterUserStart
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\interv~1.lnk - c:\program files\intervideo\common\bin\WinCinemaMgr.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office14\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\wpdshserviceobj.dll
Hosts: 127.0.0.1 www.spywareinfo.com
============= SERVICES / DRIVERS ===============
R0 si3112r;Silicon Image SiI 3112 SATARaid Controller;c:\windows\system32\drivers\SI3112r.sys [2010-9-19 116264]
R0 SiWinAcc;SiWinAcc;c:\windows\system32\drivers\SiWinAcc.sys [2010-9-19 19240]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [2010-12-12 219200]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-9-29 108792]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2009-9-29 96408]
R1 nltdi;nltdi;c:\program files\netlimiter 3\nltdi.sys [2010-8-30 5281672]
R2 CX88XBAR;MSI 8606 Crossbar;c:\windows\system32\drivers\CX88XBar.SYS [2010-11-19 9159]
R2 ekrn;ESET Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2009-9-29 735960]
R3 NLNdisMP;NLNdisMP;c:\windows\system32\drivers\nlndis.sys [2010-8-30 5230088]
R3 SKYNET;TechniSat DVB-PC TV Star PCI;c:\windows\system32\drivers\SkyNET.sys [2010-11-24 510992]
S3 NLNdisPT;NetLimiter Ndis Protocol Service;c:\windows\system32\drivers\nlndis.sys [2010-8-30 5230088]
S3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4640000]
S3 PSSDK42;PSSDK42;c:\windows\system32\drivers\pssdk42.sys [2010-11-19 38976]
=============== Created Last 30 ================
2010-12-15 19:56:47 92928 -c----w- c:\windows\system32\dllcache\ksecdd.sys
2010-12-15 19:56:47 54272 -c----w- c:\windows\system32\dllcache\wdigest.dll
2010-12-15 19:56:46 301568 -c----w- c:\windows\system32\dllcache\kerberos.dll
2010-12-15 19:56:46 149504 -c----w- c:\windows\system32\dllcache\schannel.dll
2010-12-15 19:56:40 974848 -c----w- c:\windows\system32\dllcache\mfc42.dll
2010-12-15 19:56:40 953856 -c----w- c:\windows\system32\dllcache\mfc40u.dll
2010-12-15 19:56:33 617472 -c----w- c:\windows\system32\dllcache\comctl32.dll
2010-12-15 19:55:50 40960 -c----w- c:\windows\system32\dllcache\ndproxy.sys
2010-12-15 19:54:28 45568 -c----w- c:\windows\system32\dllcache\wab.exe
2010-12-15 19:54:17 590848 -c----w- c:\windows\system32\dllcache\rpcrt4.dll
2010-12-15 18:08:01 -------- d-----w- c:\documents and settings\all users\Microsoft
2010-12-15 18:05:44 -------- d-----w- c:\program files\Microsoft Analysis Services
2010-12-15 18:05:33 -------- d-----w- c:\windows\SHELLNEW
2010-12-15 18:01:07 -------- d--h--r- c:\documents and settings\админ\Recent
2010-12-15 17:47:42 -------- d-----w- c:\docume~1\9226~1\locals~1\applic~1\Microsoft Help
2010-12-15 17:40:10 989696 -c----w- c:\windows\system32\dllcache\kernel32.dll
2010-12-15 17:40:10 56832 -c----w- c:\windows\system32\dllcache\secur32.dll
2010-12-15 17:40:06 80896 -c----w- c:\windows\system32\dllcache\tlntsess.exe
2010-12-15 17:40:06 76288 -c----w- c:\windows\system32\dllcache\telnet.exe
2010-12-15 17:40:03 75776 -c----w- c:\windows\system32\dllcache\strmfilt.dll
2010-12-15 17:40:02 265728 -c----w- c:\windows\system32\dllcache\http.sys
2010-12-15 17:40:02 25088 -c----w- c:\windows\system32\dllcache\httpapi.dll
2010-12-15 17:39:58 136192 -c----w- c:\windows\system32\dllcache\msv1_0.dll
2010-12-15 17:39:53 79872 -c----w- c:\windows\system32\dllcache\raschap.dll
2010-12-15 17:39:53 149504 -c----w- c:\windows\system32\dllcache\rastls.dll
2010-12-15 17:39:50 1435648 -c----w- c:\windows\system32\dllcache\query.dll
2010-12-15 17:39:44 33280 -c----w- c:\windows\system32\dllcache\csrsrv.dll
2010-12-15 17:39:41 474112 -c----w- c:\windows\system32\dllcache\shlwapi.dll
2010-12-15 17:39:36 132096 -c----w- c:\windows\system32\dllcache\wkssvc.dll
2010-12-15 17:39:32 100864 -c----w- c:\windows\system32\dllcache\6to4svc.dll
2010-12-15 17:39:29 345600 -c----w- c:\windows\system32\dllcache\localspl.dll
2010-12-15 17:39:25 58880 -c----w- c:\windows\system32\dllcache\msasn1.dll
2010-12-15 17:39:23 17920 -c----w- c:\windows\system32\dllcache\msyuv.dll
2010-12-15 17:39:11 8462336 -c----w- c:\windows\system32\dllcache\shell32.dll
2010-12-15 17:38:54 270336 -c----w- c:\windows\system32\dllcache\oakley.dll
2010-12-15 17:38:47 84992 -c----w- c:\windows\system32\dllcache\avifil32.dll
2010-12-15 17:38:47 11264 -c----w- c:\windows\system32\dllcache\msrle32.dll
2010-12-15 17:38:46 48128 -c----w- c:\windows\system32\dllcache\iyuv_32.dll
2010-12-15 17:38:43 692736 -c----w- c:\windows\system32\dllcache\inetcomm.dll
2010-12-15 17:38:34 65536 -c----w- c:\windows\system32\dllcache\asycfilt.dll
2010-12-15 17:38:31 343040 -c----w- c:\windows\system32\dllcache\mspaint.exe
2010-12-15 17:38:28 354816 -c----w- c:\windows\system32\dllcache\winhttp.dll
2010-12-15 17:38:24 204800 -c----w- c:\windows\system32\dllcache\mswebdvd.dll
2010-12-15 17:38:21 1291776 -c----w- c:\windows\system32\dllcache\quartz.dll
2010-12-15 17:38:07 455680 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2010-12-15 17:37:54 81920 -c----w- c:\windows\system32\dllcache\fontsub.dll
2010-12-15 17:37:54 119808 -c----w- c:\windows\system32\dllcache\t2embed.dll
2010-12-15 17:37:12 337408 -c----w- c:\windows\system32\dllcache\netapi32.dll
2010-12-15 17:36:39 177664 -c----w- c:\windows\system32\dllcache\wintrust.dll
2010-12-15 17:36:36 86016 -c----w- c:\windows\system32\dllcache\cabview.dll
2010-12-15 17:08:27 56623 ------w- c:\windows\system32\drivers\ati1btxx.sys
2010-12-15 17:05:54 19569 ----a-w- c:\windows\003255_.tmp
2010-12-12 13:09:33 219200 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2010-12-12 13:09:20 -------- d-----w- c:\program files\DAEMON Tools Pro
2010-12-12 13:08:41 -------- d-----w- c:\docume~1\alluse~1\applic~1\DAEMON Tools Pro
2010-12-12 13:08:41 -------- d-----w- c:\docume~1\9226~1\applic~1\DAEMON Tools Pro
2010-12-12 12:59:14 -------- d-----w- c:\docume~1\alluse~1\applic~1\DAEMON Tools Lite
2010-11-28 14:44:07 -------- d-----w- c:\program files\Nero
2010-11-28 14:43:38 -------- d-----w- c:\docume~1\alluse~1\applic~1\Nero
2010-11-28 14:36:57 -------- d-----w- c:\docume~1\9226~1\locals~1\applic~1\ESET
2010-11-28 13:42:51 -------- d-----w- c:\windows\system32\XPSViewer
2010-11-28 13:42:15 89088 ----a-w- c:\windows\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
2010-11-28 13:41:53 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2010-11-28 13:41:53 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2010-11-28 13:41:53 597504 ------w- c:\windows\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2010-11-28 13:41:53 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2010-11-28 13:41:53 575488 ------w- c:\windows\system32\xpsshhdr.dll
2010-11-28 13:41:53 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2010-11-28 13:41:53 1676288 ------w- c:\windows\system32\xpssvcs.dll
2010-11-28 13:41:53 117760 ------w- c:\windows\system32\prntvpt.dll
2010-11-28 13:27:12 -------- d-----w- c:\windows\SxsCaPendDel
2010-11-27 15:15:13 -------- d-----w- c:\program files\DScaler5
2010-11-27 14:59:20 -------- d-----w- c:\program files\Elecard MPEG2 Decoder Package 2.0
2010-11-27 14:59:20 -------- d-----w- c:\program files\common files\Elecard
2010-11-27 14:52:41 -------- d-----w- c:\windows\Logs
2010-11-27 08:43:23 208896 ----a-w- c:\windows\system32\nvudisp.exe
2010-11-27 08:43:23 -------- d-----w- c:\windows\nview
2010-11-27 08:42:59 69715 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\ctor.dll
2010-11-27 08:42:59 32768 ----a-w- c:\program files\common files\installshield\professional\runtime\Objectps.dll
2010-11-27 08:42:59 266240 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\iscript.dll
2010-11-27 08:42:59 192512 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\iuser.dll
2010-11-27 08:42:58 729088 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\iKernel.dll
2010-11-27 08:42:58 5632 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\DotNetInstaller.exe
2010-11-27 08:42:53 188548 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\iGdi.dll
2010-11-27 08:42:52 311428 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\setup.dll
2010-11-27 08:42:40 -------- d-----w- C:\NVIDIA
2010-11-26 12:48:42 165376 ----a-w- c:\windows\system32\unrar.dll
2010-11-26 12:48:40 839680 ----a-w- c:\windows\system32\lameACM.acm
2010-11-26 12:48:40 237568 ----a-w- c:\windows\system32\yv12vfw.dll
2010-11-26 12:48:40 151552 ----a-w- c:\windows\system32\ac3acm.acm
2010-11-26 12:48:40 121344 ----a-w- c:\windows\system32\lagarith.dll
2010-11-26 12:48:39 790528 ----a-w- c:\windows\system32\xvidcore.dll
2010-11-26 12:48:39 630784 ----a-w- c:\windows\system32\vp7vfw.dll
2010-11-26 12:48:39 134144 ----a-w- c:\windows\system32\xvidvfw.dll
2010-11-26 12:48:39 108032 ----a-w- c:\windows\system32\ff_vfw.dll
2010-11-26 12:48:34 -------- d-----w- c:\program files\K-Lite Codec Pack
2010-11-26 08:38:48 -------- d-----w- c:\docume~1\9226~1\locals~1\applic~1\Adobe
2010-11-24 17:54:00 -------- d-----w- c:\windows\system32\Codec
2010-11-24 17:52:38 510992 ----a-w- c:\windows\system32\drivers\SkyNET.sys
2010-11-24 17:50:39 -------- d-----w- c:\program files\common files\DVBViewer Shared
2010-11-24 17:45:26 -------- d-----w- c:\program files\DVBViewer
2010-11-24 17:45:26 -------- d-----w- c:\docume~1\alluse~1\applic~1\CMUV
2010-11-20 16:19:36 -------- d-----w- c:\windows\ServicePackFiles
2010-11-20 16:18:53 -------- d-----w- c:\program files\MSXML 6.0
2010-11-20 16:18:19 26488 ----a-w- c:\windows\system32\spupdsvc.exe
2010-11-20 16:13:48 -------- d-----w- c:\program files\MSXML 4.0
2010-11-20 16:13:10 -------- d-----w- c:\windows\$hf_mig$
2010-11-20 15:52:13 -------- d--h--w- c:\windows\system32\GroupPolicy
2010-11-20 12:29:35 -------- d-----w- c:\docume~1\alluse~1\applic~1\Hagel Technologies
2010-11-20 12:29:32 -------- d-----w- c:\program files\DU Meter
2010-11-20 10:27:12 -------- d-----w- c:\program files\WhereIsIt
2010-11-20 10:27:12 -------- d-----w- c:\docume~1\alluse~1\applic~1\WhereIsIt
2010-11-19 21:58:24 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-11-19 21:58:24 -------- d-----w- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2010-11-19 18:43:07 -------- d-----r- c:\program files\Skype
2010-11-19 16:32:42 -------- d-----w- c:\docume~1\9226~1\locals~1\applic~1\GHISLER
2010-11-19 16:30:47 545 ----a-w- c:\windows\UC.PIF
2010-11-19 16:30:47 545 ----a-w- c:\windows\RAR.PIF
2010-11-19 16:30:47 545 ----a-w- c:\windows\PKZIP.PIF
2010-11-19 16:30:47 545 ----a-w- c:\windows\PKUNZIP.PIF
2010-11-19 16:30:47 545 ----a-w- c:\windows\NOCLOSE.PIF
2010-11-19 16:30:47 545 ----a-w- c:\windows\LHA.PIF
2010-11-19 16:30:47 545 ----a-w- c:\windows\ARJ.PIF
2010-11-19 16:30:47 -------- d-----w- c:\program files\totalcmd
2010-11-19 16:30:47 -------- d-----w- c:\docume~1\9226~1\applic~1\GHISLER
2010-11-19 16:22:21 -------- d-----w- c:\program files\VS Revo Group
2010-11-19 16:21:46 -------- d-----w- c:\program files\CCleaner
2010-11-19 16:16:17 -------- d-----w- c:\docume~1\9226~1\locals~1\applic~1\Locktime
2010-11-19 16:15:40 -------- d-----w- c:\docume~1\alluse~1\applic~1\Locktime
2010-11-19 16:15:32 -------- d-----w- c:\program files\NetLimiter 3
2010-11-19 15:59:46 38976 ----a-w- c:\windows\system32\drivers\pssdk42.sys
2010-11-19 15:35:47 -------- d-----w- c:\docume~1\9226~1\locals~1\applic~1\Opera
2010-11-19 15:21:06 -------- d-----w- c:\program files\ESET
==================== Find3M ====================
2010-11-18 18:12:44 81920 ----a-w- c:\windows\system32\isign32.dll
2010-11-06 00:34:04 841216 ----a-w- c:\windows\system32\wininet.dll
2010-11-06 00:34:04 1830912 ----a-w- c:\windows\system32\inetcpl.cpl
2010-11-06 00:34:03 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-11-06 00:34:03 17408 ----a-w- c:\windows\system32\corpol.dll
2010-11-03 12:00:49 389120 ----a-w- c:\windows\system32\html.iec
2010-10-28 13:13:22 290048 ----a-w- c:\windows\system32\atmfd.dll
2010-10-26 13:25:00 1853312 ----a-w- c:\windows\system32\win32k.sys
============= FINISH: 15:29:48,81 ===============
mycity.rs/must-login.png
mycity.rs/must-login.png
mycity.rs/must-login.png
mycity.rs/must-login.png
Dopuna: 19 Dec 2010 16:31
Zaboravio sam: update radi sporadicno, vise ne, nego sto radi.
Dopuna: 19 Dec 2010 16:34
Jbg, zaboravih: nod32 i spybot nisu nista detektovali.
|
