Problem sa Smitfraudovima i WhenU i josh mnogim drugim

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Pozdrav, imam problem sa Smitfraud-C. Toolbar888 i Smitfraud-C...
WhenU.Search i WhenU.Search.Desktoptoolbar... TagASaurus.
Verovali ili ne to je to.

Imam NOD32 2.5 beta, AdAware SE Professional 1.05, (oba redovno updatujem). Ova dva mi nisu nalazila nishta iako mi se umesto homepage pojavljivalo ieupdate.com. Onda mi je jedan drug rekao da skinem Spybot sa net-a i update-ujem ga, i onda skeniram. I tako sam i nashao ova chuda. Spybot nije hteo da ih obrishe i ako je pisalo da ih je obrisao (skenirarm i popravim(fix), al kad ukljuchim drugo skeniranje on opet nadje iste).
Za Smitfraud pishe da treba da skinem Proces Explorer, shto sam i uradio, kliknem na dugme Threads i nadjem randomizovano ime fajla koji je nadjen pri skeniranju.

To je sve. Molim vas pomozite!!!


[mod by bobby] uklonjen deo poruke

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Procitaj temu http://www.mycity.rs/Ambulanta/Procitati-pre-otvaranja-teme.html i postavi nam ovde HJT log.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Valjda je ovo taj HJT log, ako nije brishi ovu poruku i kazhi mi shta je:


--- Report generated: 2006-12-02 23:23 ---

Smitfraud-C.Toolbar888: Settings (Registry key, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSMGR

WhenU.Search: Autorun settings (Registry value, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WhenUSearch

WhenU.Search.Desktoptoolbar: Autorun settings (Registry value, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WhenUSearchWHSE

Smitfraud-C.Toolbar888: Root class (Registry key, fixed)
HKEY_LOCAL_MACHINE\Software\Classes\LuckyToolBar.LuckyToolBarObj

Smitfraud-C.Toolbar888: Root class (Registry key, fixed)
HKEY_LOCAL_MACHINE\Software\Classes\LuckyToolBar.LuckyToolBarObj.1

Smitfraud-C.Toolbar888: Class ID (Registry key, fixed)
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{C004DEC2-2623-438e-9CA2-C9043AB28508}

Smitfraud-C.Toolbar888: Browser helper object (Registry key, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C004DEC2-2623-438e-9CA2-C9043AB28508}

Smitfraud-C.Toolbar888: Uninstall settings (Registry key, fixed)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\888Bar

Common Dialogs: History (37 files) (Registry key, nothing done)
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU

Log: Activity: SchedLgU.Txt (Backup file, nothing done)
C:\WINDOWS\SchedLgU.Txt

Log: Activity: imsins.log (Backup file, nothing done)
C:\WINDOWS\imsins.log

Log: Activity: OEWABLog.txt (Backup file, nothing done)
C:\WINDOWS\OEWABLog.txt

Log: Activity: ntbtlog.txt (Backup file, nothing done)
C:\WINDOWS\ntbtlog.txt

Log: Install: comsetup.log (Backup file, nothing done)
C:\WINDOWS\comsetup.log

Log: Install: Directx.log (Backup file, nothing done)
C:\WINDOWS\Directx.log

Log: Install: ocgen.log (Backup file, nothing done)
C:\WINDOWS\ocgen.log

Log: Install: setupact.log (Backup file, nothing done)
C:\WINDOWS\setupact.log

Log: Install: setupapi.log (Backup file, nothing done)
C:\WINDOWS\setupapi.log

Log: Install: setuplog.txt (Backup file, nothing done)
C:\WINDOWS\setuplog.txt

Log: Install: svcpack.log (Backup file, nothing done)
C:\WINDOWS\svcpack.log

Log: Install: wmsetup.log (Backup file, nothing done)
C:\WINDOWS\wmsetup.log

Log: Install: DtcInstall.log (Backup file, nothing done)
C:\WINDOWS\DtcInstall.log

Log: Shutdown: System32\wbem\logs\mofcomp.log (Backup file, nothing done)
C:\WINDOWS\System32\wbem\logs\mofcomp.log

Log: Shutdown: System32\wbem\logs\setup.log (Backup file, nothing done)
C:\WINDOWS\System32\wbem\logs\setup.log

Log: Shutdown: System32\wbem\logs\wbemcore.log (Backup file, nothing done)
C:\WINDOWS\System32\wbem\logs\wbemcore.log

Log: Shutdown: System32\wbem\logs\wbemess.lo_ (Backup file, nothing done)
C:\WINDOWS\System32\wbem\logs\wbemess.lo_

Log: Shutdown: System32\wbem\logs\wbemess.log (Backup file, nothing done)
C:\WINDOWS\System32\wbem\logs\wbemess.log

Log: Shutdown: System32\wbem\logs\wbemsnmp.log (Backup file, nothing done)
C:\WINDOWS\System32\wbem\logs\wbemsnmp.log

Log: Shutdown: System32\wbem\logs\winmgmt.log (Backup file, nothing done)
C:\WINDOWS\System32\wbem\logs\winmgmt.log

Log: Shutdown: System32\wbem\logs\wmiadap.log (Backup file, nothing done)
C:\WINDOWS\System32\wbem\logs\wmiadap.log

Log: Shutdown: System32\wbem\logs\wmiprov.log (Backup file, nothing done)
C:\WINDOWS\System32\wbem\logs\wmiprov.log

Ahead Nero Burning Rom: Browser directory (Registry change, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\Ahead\Nero - Burning Rom\Settings\BrowserDir!=

Ahead Nero Burning Rom: Working directory (Registry change, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\Ahead\Nero - Burning Rom\Settings\WorkingDir!=

Ahead Nero Burning Rom: Last ISO directory (Registry change, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\ahead\Nero - Burning Rom\General\OFDLastISODir!=

Internet Explorer: Last used directory (Registry change, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\Microsoft\Internet Explorer\Main\Save Directory!=

Internet Explorer: Download directory (Registry change, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\Microsoft\Internet Explorer\Download Directory!=

Internet Explorer: User agent (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent!=Mozilla/4.0 (compatible; MSIE; Win32)

Internet Explorer: User agent (Registry change, nothing done)
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent!=Mozilla/4.0 (compatible; MSIE; Win32)

Internet Explorer: User agent (Registry change, nothing done)
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent!=Mozilla/4.0 (compatible; MSIE; Win32)

Internet Explorer: User agent (Registry change, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent!=Mozilla/4.0 (compatible; MSIE; Win32)

Internet Explorer: User agent (Registry change, nothing done)
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent!=Mozilla/4.0 (compatible; MSIE; Win32)

MS Media Player: Recent file list (8 files) (Registry key, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\Microsoft\MediaPlayer\Player\RecentFileList

MS Media Player: Application data file (global) () (File, nothing done)
C:\Documents and Settings\All Users\Application Data\Microsoft\Media Index\wmplibrary_v_0_12.db

MS Media Player: Last opened playlist (Registry value, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\Microsoft\MediaPlayer\Preferences\LastPlaylist

MS Media Player: Last selected track index (Registry value, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\Microsoft\MediaPlayer\Preferences\LastPlaylistIndex

MS Media Player: Manually modified tags history (2 files) (Registry key, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\Microsoft\MediaPlayer\AutoComplete\MediaEdit

MS Media Player: Client ID (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\MediaPlayer\Player\Settings\Client ID!=

MS Media Player: Client ID (Registry change, nothing done)
HKEY_USERS\S-1-5-19\Software\Microsoft\MediaPlayer\Player\Settings\Client ID!=

MS Media Player: Client ID (Registry change, nothing done)
HKEY_USERS\S-1-5-20\Software\Microsoft\MediaPlayer\Player\Settings\Client ID!=

MS Media Player: Client ID (Registry change, nothing done)
HKEY_USERS\S-1-5-18\Software\Microsoft\MediaPlayer\Player\Settings\Client ID!=

MS Media Player: Anonymous ID (Registry change, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\Microsoft\MediaPlayer\Preferences\SendUserGUID!=B=0

MS DirectDraw: Most recent application (Registry change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication\Name!=

MS DirectInput: Most recent application (Registry change, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\Microsoft\DirectInput\MostRecentApplication\Name!=

MS DirectInput: Most recent application ID (Registry change, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\Microsoft\DirectInput\MostRecentApplication\Id!=

MS Office 11.0: Last opened-from-web file (Registry value, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\Microsoft\Office\11.0\Common\Internet\UseRWHlinkNavigation

MS Office 11.0 (Cliparts): Last search made (5 files) (Registry key, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\Microsoft\Office\11.0\Clip Organizer\Search\Last Query

MS Office 11.0 (Document Imaging): Persistent filename list (2 files) (Registry key, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\Microsoft\MSPaper 11.0\Persist File Name

MS Office 11.0 (Document Imaging): Recent file list (2 files) (Registry key, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\Microsoft\MSPaper 11.0\Recent File List

MS Office 11.0 (Excel): Recent file list (1 files) (Registry key, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\Microsoft\Office\11.0\Excel\Recent Files

MS Office 11.0 (Word): Recent file list (Registry value, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\Microsoft\Office\11.0\Word\Data\Settings

MS Search Assistant: Typed search terms history (Registry key, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\Microsoft\Search Assistant\ACMru

MS Windows Backup 5.0: Last created backup set (Registry change, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\Microsoft\Ntbackup\Hardware\Logical Disk File!=

Windows: Drivers installation paths (Registry change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Installation Sources!=

Windows.OpenWith: Open with list - .ASX extension (2 files) (Registry key, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ASX\OpenWithList

Windows.OpenWith: Open with list - .AVI extension (3 files) (Registry key, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AVI\OpenWithList

Windows.OpenWith: Open with list - .BAK extension (2 files) (Registry key, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.BAK\OpenWithList

Windows.OpenWith: Open with list - .BIN extension (3 files) (Registry key, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.BIN\OpenWithList

Windows.OpenWith: Open with list - .BMP extension (6 files) (Registry key, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.BMP\OpenWithList

Windows.OpenWith: Open with list - .CAB extension (3 files) (Registry key, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CAB\OpenWithList

Windows.OpenWith: Open with list - .CDA extension (3 files) (Registry key, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CDA\OpenWithList

Windows.OpenWith: Open with list - .CDR extension (2 files) (Registry key, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CDR\OpenWithList

Windows.OpenWith: Open with list - .CLASS extension (3 files) (Registry key, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CLASS\OpenWithList

Windows.OpenWith: Open with list - .CUE extension (3 files) (Registry key, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CUE\OpenWithList

Windows.OpenWith: Open with list - .CUR extension (2 files) (Registry key, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CUR\OpenWithList

Windows Explorer: Recent wallpaper list (38 files) (Registry key, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Wallpaper\MRU

Windows Explorer: Stream history (147 files) (Registry key, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU

Windows Explorer: User Assistant history IE (46 files) (Registry key, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count

Windows Explorer: User Assistant history files (954 files) (Registry key, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count

Windows Explorer: Last visited history (4 files) (Registry key, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU

Windows Explorer: Recent file global history (Registry key, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

Windows Media SDK: Computer name (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows Media\WMSDK\General\ComputerName!=ComputerName

Windows Media SDK: Computer name (Registry change, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\Microsoft\Windows Media\WMSDK\General\ComputerName!=ComputerName

Windows Media SDK: Computer name (Registry change, nothing done)
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows Media\WMSDK\General\ComputerName!=ComputerName

Windows Media SDK: Unique ID (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows Media\WMSDK\General\UniqueID!={00000000-0000-0000-0000-000000000000}

Windows Media SDK: Unique ID (Registry change, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\Microsoft\Windows Media\WMSDK\General\UniqueID!={00000000-0000-0000-0000-000000000000}

Windows Media SDK: Unique ID (Registry change, nothing done)
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows Media\WMSDK\General\UniqueID!={00000000-0000-0000-0000-000000000000}

Windows Media SDK: Volume serial number (Registry value, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows Media\WMSDK\General\VolumeSerialNumber

Windows Media SDK: Volume serial number (Registry value, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\Microsoft\Windows Media\WMSDK\General\VolumeSerialNumber

Windows Media SDK: Volume serial number (Registry value, nothing done)
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows Media\WMSDK\General\VolumeSerialNumber

WinRAR: Recent file list (4 files) (Registry key, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\WinRAR\ArcHistory

WinRAR: Recent exe file list (4 files) (Registry key, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\WinRAR\DialogEditHistory\ArcName

WinRAR: Last used directory (Registry change, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\WinRAR\General\LastFolder!=

WinRAR: Extraction directory history (2 files) (Registry key, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\WinRAR\DialogEditHistory\ExtrPath

WinZip: Number of times run (Registry change, nothing done)
HKEY_USERS\S-1-5-21-1935655697-448539723-725345543-1003\Software\Nico Mak Computing\WinZip\rrs\Opened!=

Cookie: Cookie ( (Cookie, nothing done)


Cache: Cache (183) (Cache, nothing done)

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

To nije log programa HijackThis.
Na linku koji ti je marko antonije se nalazi link ka uputstvu za koriscenje programa HijackThis (HJT): http://www.mycity.rs/Uputstva-sa-ex-SuperSajta/1-H.....tanje.html

Procitaj ponovo temu sa linka koji ti je marko antonije dao, i onda odradi postupak pravljenja loga uz pomoc programa HijackThis, kao sto je objasnjeno u temi na linku iz ove moje poruke.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Evo ga HJ:

Logfile of HijackThis v1.99.1
Scan saved at 17:01:36, on 3.12.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\AGRSMMSG.exe
C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Morpheus\Morpheus.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\{38A5D4BA-0647-2074-0216-06031401017d}\Update.exe
C:\WINDOWS\system32\ishost.exe
C:\WINDOWS\system32\ismini.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Nemanja\Desktop\Hijack This\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = multimedia-search.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {39f25b12-74ff-4079-a51f-1d70f5b08b84} - (no file)
O2 - BHO: NOW!Imaging - {9AA2F14F-E956-44B8-8694-A5B615CDF341} - C:\Program Files\Nitro\components\NOWImaging.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: 888Bar - {C004DEC2-2623-438e-9CA2-C9043AB28508} - C:\PROGRA~1\COMMON~1\{38A5D~1\888Bar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: 888Bar - {C004DEC2-2623-438e-9CA2-C9043AB28508} - C:\PROGRA~1\COMMON~1\{38A5D~1\888Bar.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [D_V_T] C:\\dvt.exe /S \C:\\d_v_t.reg\
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [AWMON] "C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP
O4 - HKLM\..\Run: [NapsterShell] C:\Program Files\Napster\napster.exe /systray
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [DaemonTools_WhenUSave_Installer] C:\Program Files\DaemonTools_WhenUSave_Installer\DaemonTools_WhenUSave_Installer.exe
O4 - HKLM\..\Run: [WhenUSearchWHSE] "C:\Program Files\WhenUSearch\whse.exe"
O4 - HKLM\..\Run: [WhenUSearch] "C:\Program Files\WhenUSearch\Search.exe"
O4 - HKLM\..\Run: [Device Detector] DevDetect.exe -autorun
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Morpheus.lnk = C:\Program Files\Morpheus\Morpheus.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\Program Files\VisualRoute\vrie.dll
O9 - Extra 'Tools' menuitem: VisualRoute Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\Program Files\VisualRoute\vrie.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: YU-MP3.COM Account Login - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - D:\Programmen Files\Authorization\YuMp3ComLogin.exe
O9 - Extra 'Tools' menuitem: &YU-MP3.COM User Login - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - D:\Programmen Files\Authorization\YuMp3ComLogin.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - support.asus.com/common/asusTek_sys_ctrl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1DCB6E5E-FEDD-43E9-BDB1-1FC4110DDC08}: NameServer = 194.247.192.33 194.247.192.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{1DCB6E5E-FEDD-43E9-BDB1-1FC4110DDC08}: NameServer = 194.247.192.33 194.247.192.1
O20 - Winlogon Notify: winwly32 - C:\WINDOWS\SYSTEM32\winwly32.dll
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\NVIDIA\NetworkAccessManager\bin\nSvcIp.exe (file missing)
O23 - Service: ForceWare user log service (nSvcLog) - Unknown owner - C:\NVIDIA\NetworkAccessManager\bin\nSvcLog.exe (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Ok. Rešavamo problem..


1) Preuzmi program SmitfraudFix sa ovog linka.

2.) Extract-uj program na desktop. (Takodje na ovaj način pripremi i program Hijack This koje će se kasnije koristiti)

3.) Restartuj računar i podigni sistem u Safe Mode-u. [ Safe Mode info link ]

4.) Pronadji na desktop-u folder gde si raspakovao SmitfraudFix program i dvoklikom pokreni fajl SmitfraudFix.cmd.
Kada se alat za uklanjanje prvi put startuje pokazaće ti se ekran za odobrenje. Jednostavno pretisni bilo koje dugme na tastaturi da bi prešao na sledeći nivo.

5.)



6.) Program će početi sa čišćenjem kompjutera. Posle završenog čišćenja SmitfraudFix-om
pokrenuće ti se Windows-ov program Disk Cleanup.



7.) Pokreni program Hijack This i idi na opciju "Do a system scan only". Pronadji sledeće linije čekiraj ih i klikni na "Fix checked".

C:\WINDOWS\system32\ishost.exe
C:\WINDOWS\system32\ismini.exe
C:\Program Files\Common Files\{38A5D4BA-0647-2074-0216-06031401017d}\ (znači ceo folder)

O2 - BHO: (no name) - {39f25b12-74ff-4079-a51f-1d70f5b08b84} - (no file)
O2 - BHO: NOW!Imaging - {9AA2F14F-E956-44B8-8694-A5B615CDF341} - C:\Program Files\Nitro\components\NOWImaging.dll (file missing) ,
O2 - BHO: 888Bar - {C004DEC2-2623-438e-9CA2-C9043AB28508} - C:\PROGRA~1\COMMON~1\{38A5D~1\888Bar.dll

O4 - HKLM\..\Run: [DaemonTools_WhenUSave_Installer] C:\Program
O4 - HKLM\..\Run: [WhenUSearchWHSE] "C:\Program Files\WhenUSearch\whse.exe"
O4 - HKLM\..\Run: [WhenUSearch] "C:\Program Files\WhenUSearch\Search.exe"

O20 - Winlogon Notify: winwly32 - C:\WINDOWS\SYSTEM32\winwly32.dll

8.) Resetuj rečunar i podigni sistem normalno.

9.) Pronadji fajlove koje sam ti naveo gore (imaš putanju i ime fajlova u HijackThis linijama) i obriši ih.
Ako ti nije problem pre toga upakuj ih sve zajedno u zip ili rar arhivu i upload-uj na ovaj link:
http://www.mycity.rs/ambulanta-upload.php
Posebno bi nam značio zapakovan ovaj ceo folder.
C:\Program Files\Common Files\{38A5D4BA-0647-2074-0216-06031401017d}\

10.) Isključi sve nepotrebne programe i napravi nov HijackThis log i pusti ga ovde.


[Veliko hvala za trud i zalaganje na ovoj temi @Marko Antonije čije sam informacije, screenshot-ove i matricu koristio da bih lakše i brže rešio problem]

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Dopuna:
Obavezno postavi log fajl kog bude napravio program SmitFraudFix.
Log fajl ce biti napravljen ili kao C:\rapport.txt ili pod istim imenom u folderu u kom si raspakovao SmitFraudFix.

Ovaj log nam je bitan, pa bih te zamolio da ga ne izostavis.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Ima nekoliko problema... Samo je neke sklonio...

Smitfraud log:

SmitFraudFix v2.128

Scan done at 23:18:59,43, pon 04.12.2006
Run from C:\Documents and Settings\Nemanja\My Documents\My Completed Downloads\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End

Dopuna: 05 Dec 2006 0:03

HijackThis log:

Logfile of HijackThis v1.99.1
Scan saved at 0:02:06, on 5.12.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Common Files\{38A5D4BA-0647-2074-0216-06031401017d}\Update.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Documents and Settings\Nemanja\Desktop\Hijack This\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = multimedia-search.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [D_V_T] C:\\dvt.exe /S \C:\\d_v_t.reg\
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [AWMON] "C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe"
O4 - HKLM\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP
O4 - HKLM\..\Run: [NapsterShell] C:\Program Files\Napster\napster.exe /systray
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [DaemonTools_WhenUSave_Installer] C:\Program Files\DaemonTools_WhenUSave_Installer\DaemonTools_WhenUSave_Installer.exe
O4 - HKLM\..\Run: [WhenUSearch] "C:\Program Files\WhenUSearch\Search.exe"
O4 - HKLM\..\Run: [WhenUSearchWHSE] "C:\Program Files\WhenUSearch\whse.exe"
O4 - HKLM\..\Run: [Device Detector] DevDetect.exe -autorun
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Morpheus.lnk = C:\Program Files\Morpheus\Morpheus.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\Program Files\VisualRoute\vrie.dll
O9 - Extra 'Tools' menuitem: VisualRoute Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\Program Files\VisualRoute\vrie.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: YU-MP3.COM Account Login - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - D:\Programmen Files\Authorization\YuMp3ComLogin.exe
O9 - Extra 'Tools' menuitem: &YU-MP3.COM User Login - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - D:\Programmen Files\Authorization\YuMp3ComLogin.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - support.asus.com/common/asusTek_sys_ctrl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1DCB6E5E-FEDD-43E9-BDB1-1FC4110DDC08}: NameServer = 194.247.192.33 194.247.192.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{1DCB6E5E-FEDD-43E9-BDB1-1FC4110DDC08}: NameServer = 194.247.192.33 194.247.192.1
O17 - HKLM\System\CS4\Services\Tcpip\..\{1DCB6E5E-FEDD-43E9-BDB1-1FC4110DDC08}: NameServer = 194.247.192.33 194.247.192.1
O20 - Winlogon Notify: winwly32 - C:\WINDOWS\SYSTEM32\winwly32.dll
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\NVIDIA\NetworkAccessManager\bin\nSvcIp.exe (file missing)
O23 - Service: ForceWare user log service (nSvcLog) - Unknown owner - C:\NVIDIA\NetworkAccessManager\bin\nSvcLog.exe (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

Dopuna: 05 Dec 2006 0:10

ismini i ishost nema nigde, a ovi ostali nemaju dobar path. Npr. U Program Files ne postoji DAEMON Tools\daemon.exe ili WhenUSearch\whse.exe... Tako da ih ne mogu obrisati.

P.S. Sve sam uradio po uputstvu. Uploadovao sam samo onaj najzanimljiviji "C:\Program Files\Common Files\{38A5D4BA-0647-2074-0216-06031401017d}\", jer sam samo njega nashao.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Sigurno ga nema C:\WINDOWS\SYSTEM32\winwly32.dll ?

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Evo posle konsultacija da i ja nastavim rešavanje problema u ovoj temi..

Nas zbunjuje da ti je log ostao isti skoro kao prekopiran. Fajlovi koje si nam posalo. prosledjeni su na analizu možda je u pitanju neka nova vrsta malware-a.

Zamolio bih te da mi odgovoriš na par pitanja:

Da li si 100% siguran da ni jedan od navedenih fajlova ne postoji na tvom računaru ?

Dali si posle čisćenja instalirao ponovo program Deamon Tools ?

Da li si ukljucio opciju Show Hidden Files pa onda tražio fajlove koje sam ti naveo gore ?

Da li ti se uopste SmitFraud i WhenU vizuelno manifestuju na računaru ?

Mora da ti se pojavljuju pop up reklame, redirektuje browser i sl..
Pogledaj link i slike možda se podsetiš.
http://www.mycity.rs/Ambulanta/Kako-prepoznati-SmitFraud.html
http://www.trendmicro.com/vinfo/images/ADW_WHENUSRCH_A_img2.gif
http://www.shareedge.com/spywareguide/images/2230/whenusearchtoolbar1.jpg
http://www.benedelman.org/spyware/whenu-privacy/whenusearch-052504.png
http://www.emsisoft.de/images/malware/Adware.Toolbar888_1.JPG

Kad budeš krenuo da pišeš odgovor na ova moja i na pitanje koje ti je bobby postavio pre toga uradi sledeće:

Prestaneš da koristiš Morpheus P2P program.

Isključi sve ostale nepotrebne programe u toku pravljenja loga. Ostavi samo Hijack This i daj mu drugo ime. (npr neko_ime.exe).

Pokreni program Hijack This i idi na opciju "Do a system scan only". Pronadji sledeće linije štikliraj ih (označi) i klikni na "Fix checked".

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.multimedia-search.com/

O4 - HKLM\..\Run: [DaemonTools_WhenUSave_Installer] C:\Program Files\DaemonTools_WhenUSave_Installer\DaemonTools_WhenUSave_Installer.exe O4 - HKLM\..\Run: [WhenUSearch] "C:\Program Files\WhenUSearch\Search.exe"
O4 - HKLM\..\Run: [WhenUSearchWHSE] "C:\Program Files\WhenUSearch\whse.exe"

O20 - Winlogon Notify: winwly32 - C:\WINDOWS\SYSTEM32\winwly32.dll

Pusti nam i svež log ponovo.

Ako ti bilo šta nije jasno u vezi postupka sa otklanjanjem malware-a sa tvog računara ili nešto ne znaš gde se nalazi ili kao se uključuje slobodno pitaj. Ok ?