MyCity » Ambulanta -> Arhiva Ambulante » Slika na monitoru nestane

Slika na monitoru nestane

Napisano na dan: 29.6.2011
2

Slika na monitoru nestane
Pagination Prethodna strana
Sledeća strana Pagination

Idi na vrh

Poslao: 29 Jun 2011 21:42
Idi na vrh
offline
  • Pridružio: 02 Feb 2008
  • Poruke: 14018
  • Gde živiš: Nish

Pa to je normalno, traje skeniranje svih particija (za to je potrebno vreme). Ne shvatam, gde zuris?!










goran9888 (AMF Tim)



Poslao: 29 Jun 2011 22:12
Idi na vrh
offline
  • Pridružio: 29 Maj 2011
  • Poruke: 1444
  • Gde živiš: U svom svetu

Napisano: 29 Jun 2011 21:43

Pa ne zurim nigde,nego ne znam koliko to traje,pa da ne cekam ako je nesto blokiralo.Samo iz neznanja ti trazim odgovore

Dopuna: 29 Jun 2011 22:12

[Link mogu videti samo ulogovani korisnici]

Da li sam sve uradila?



Poslao: 29 Jun 2011 22:18
Idi na vrh
offline
  • Pridružio: 02 Feb 2008
  • Poruke: 14018
  • Gde živiš: Nish

Preuzmi sUBs-ov ComboFix sa sledeće adrese na Desktop:


Bleeping Computer
Klikni desnim tasterom na link i odaberi opciju Save Target As... (Save Link As..., Save Linked Content As... ili sličnu);
Kada se otvori dijalog za izbor lokacije na kojoj treba sačuvati file, odaberi Desktop i klikni Save.



Kada preuzimanje programa bude završeno:
deaktiviraj zaštitni softver (uputstvo);
zatvori pokrenute programe;
dvoklikom pokreni program ComboFix;
u prozoru koji se otvori klikni "I Agree".
U toku rada, ComboFix će:proveriti postoji li novija verzija programa:
klikni Yes ako bude ponuđeno preuzimanje iste.ako Recovery Console nije instalirana, ponuditi instalaciju:
obavezno prihvati klikom na Yes i isprati postupak.postaviti/dati određeni broj upita/obaveštenja:
prihvati klikom na Yes ili OK.po potrebi, restartovati Windows (više puta);
na kraju rada, otvoriti Notepad sa izveštajem o skeniranju.

Iskopiraj izveštaj koji je ComboFix napravio u temu na forumu:
klikni desnim tasterom miša u prozor Notepad-a i izaberi Select All;
klikni desnim tasterom miša na obeleženi tekst i izaberi Copy;
klikni desnim tasterom miša u polje za pisanje poruke i izaberi Paste.

Napomena:Izveštaj će biti sačuvan pod nazivom ComboFix.txt na sistemskoj particiji (tipična lokacija: C:\ComboFix.txt);
Ukoliko nakon slanja poruke primetiš da izveštaj nije kompletan, iskoristi opciju Prikači fajl za prilaganje file-a C:\ComboFix.txt uz poruku.

Poslao: 02 Jul 2011 19:29
Idi na vrh
offline
  • Pridružio: 29 Maj 2011
  • Poruke: 1444
  • Gde živiš: U svom svetu

ComboFix 11-07-01.02 - Ivana 02.07.2011 19:09:58.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1250.385.1033.18.511.193 [GMT 2:00]
Running from: c:\documents and settings\Ivana\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Ivana\Application Data\facemoods.com
c:\documents and settings\Ivana\Cookies\cupox.vbs
c:\program files\AskSearch\bin\DeFAultsearch.dll
c:\windows\down.txt
c:\windows\system32\_000008_.tmp.dll
c:\windows\system32\_004392_.tmp.dll
c:\windows\system32\shimg.dll
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_usnjsvc
.
.
((((((((((((((((((((((((( Files Created from 2011-06-02 to 2011-07-02 )))))))))))))))))))))))))))))))
.
.
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-01 09:13 . 2011-06-01 09:13 348256 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\VSTAHost\CorelPHOTOPAINT\9.0\1033\ResourceCache.dll
2011-06-01 09:11 . 2011-06-01 09:11 348256 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\VSTAHost\CorelDRAW\9.0\1033\ResourceCache.dll
2011-06-01 09:10 . 2011-06-01 09:10 416 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\MSDN\9.0\1033\ResourceCache.dll
2011-04-13 22:40 . 2011-04-13 22:40 4284416 ----a-w- c:\windows\system32\GPhotos.scr
2009-09-16 07:06 . 2009-09-16 07:06 13644 ----a-w- c:\program files\Common Files\ycyhikodu.reg
2007-11-28 19:12 . 2009-07-05 23:14 67696 ----a-w- c:\program files\mozilla firefox\components\jar50.dll
2007-11-28 19:12 . 2009-07-05 23:14 54376 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2007-11-28 19:12 . 2009-07-05 23:14 34952 ----a-w- c:\program files\mozilla firefox\components\myspell.dll
2007-11-28 19:12 . 2009-07-05 23:14 46720 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll
2007-11-28 19:12 . 2009-07-05 23:14 172144 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[7] 2001-08-23 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\dllcache\beep.sys
.
c:\windows\System32\drivers\beep.sys ... is missing !!
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-01-26 15026056]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-07-20 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-11-04 2219184]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2010-11-10 35736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2011-05-23 126976]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 04:42 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Quick Search Box]
2011-05-23 22:37 126976 ----a-w- c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2010-12-20 17:08 443728 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-07-20 06:41 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\system32\\drivers\\svchost.exe"=
"c:\\Documents and Settings\\Ivana\\My Documents\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:Remote Desktop
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
"3407:TCP"= 3407:TCP:Services
"5314:TCP"= 5314:TCP:Services
"7963:TCP"= 7963:TCP:Services
"1048:TCP"= 1048:TCP:Akamai NetSession Interface
"5000:UDP"= 5000:UDP:Akamai NetSession Interface
.
R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [5.7.2009 23:49 77312]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [29.7.2010 13:31 115008]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [3.8.2010 13:28 95896]
R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [4.8.2004 0:56 14336]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [4.11.2010 18:15 810144]
R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;c:\program files\Firebird\Firebird_2_1\bin\fbguard.exe [21.2.2010 17:23 81920]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [16.6.2010 20:30 363344]
R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\program files\Firebird\Firebird_2_1\bin\fbserver.exe [21.2.2010 17:23 2723840]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [16.6.2010 20:30 20952]
S0 ehhwrnbkt;ehhwrnbkt;c:\windows\system32\drivers\ycdtdlixnw.sys --> c:\windows\system32\drivers\ycdtdlixnw.sys [?]
S2 gupdate;Usluga Google ažuriranje (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [19.9.2010 15:58 136176]
S3 gupdatem;Usluga Google ažuriranje (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [19.9.2010 15:58 136176]
S3 rkhdrv40;Rootkit Unhooker Driver; [x]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
Contents of the 'Scheduled Tasks' folder
.
2011-07-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-09-19 13:58]
.
2011-07-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-09-19 13:58]
.
.
------- Supplementary Scan -------
.
uStart Page = [Link mogu videti samo ulogovani korisnici]
uDefault_Search_URL = [Link mogu videti samo ulogovani korisnici]
uSearchAssistant = [Link mogu videti samo ulogovani korisnici]
uSearchURL,(Default) = [Link mogu videti samo ulogovani korisnici]
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
TCP: DhcpNameServer = 212.62.32.1 212.62.32.5
FF - ProfilePath - c:\documents and settings\Ivana\Application Data\Mozilla\Firefox\Profiles\gg8mftdn.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo! Search
FF - prefs.js: browser.startup.homepage - [Link mogu videti samo ulogovani korisnici]
FF - prefs.js: keyword.URL - [Link mogu videti samo ulogovani korisnici]{searchTerms}&f=4&hl={language}&src=chrm
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
AddRemove-HijackThis - g:\hbcd\WinTools\HijackThis.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2011-07-02 19:19
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\ESET\ESET Security\CurrentVersion\Info]
@Denied: (2) (LocalSystem)
"AppDataDir"="c:\\Documents and Settings\\All Users\\Application Data\\ESET\\ESET NOD32 Antivirus\\"
"DataDir"="ESET\\ESET NOD32 Antivirus\\"
"EditionName"=" "
"InstallDir"="c:\\Program Files\\ESET\\ESET NOD32 Antivirus\\"
"LanguageId"=dword:00000409
"PackageTag"=dword:6090e758
"ProductBase"=dword:00000000
"ProductCode"="{640BE6CD-9B4E-4FA4-98BC-E6975A30DC4F}"
"ProductName"="ESET NOD32 Antivirus"
"ProductType"="eav"
"ProductVersion"="4.2.67.10"
"UniqueId"="0004AB9E4D8B6DA2"
"ScannerBuild"=dword:00001fb8
"ScannerVersionId"=dword:000015d8
"ScannerVersion"="Open window for status."
"ei2"=hex(b):7d,49,8c,86,0f,d3,d6,1b
"ei1"=hex(b):1c,bd,b9,e0,21,29,00,00
"ei3"=hex(b):4d,6e,8b,4d,00,00,00,00
"ei4"=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(1964)
c:\windows\system32\WININET.dll
c:\program files\Google\Quick Search Box\bin\1.2.1151.245\qsb.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Protexis\License Service\PsiService_2.exe
c:\windows\system32\wscntfy.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Completion time: 2011-07-02 19:24:37 - machine was rebooted
ComboFix-quarantined-files.txt 2011-07-02 17:24
.
Pre-Run: 14.430.703.616 bytes free
Post-Run: 17.654.755.328 bytes free
.
- - End Of File - - D6E95ACB7065B54F97A5BE80F4C59334



Izvini sto kasnim smešak

Poslao: 03 Jul 2011 07:42
Idi na vrh
offline
  • Pridružio: 02 Feb 2008
  • Poruke: 14018
  • Gde živiš: Nish

Arrow

Otvoriti Notepad i iskopirati sledeci tekst:

FCopy::
c:\windows\system32\dllcache\beep.sys|c:\windows\system32\drivers\beep.sys

Firefox::
FF - ProfilePath - c:\documents and settings\Ivana\Application Data\Mozilla\Firefox\Profiles\gg8mftdn.default\
FF - prefs.js: browser.startup.homepage - hxxp://start.facemoods.com/?a=wbst
 FF - prefs.js: keyword.URL - hxxp://start.facemoods.com/?a=wbst&s={searchTerms}&f=4&hl={language}&src=chrm

Snimiti na Desktop fajl iz Notepada kao "CFScript"




Prevuci snimljeni skript/tekst na ComboFix ikonicu kao na slici.
Postaviti u sledecoj poruci log koji bude bio napravljen na kraju ciscenja/skeniranja.






goran9888 (AMF Tim)

Poslao: 03 Jul 2011 09:00
Idi na vrh
offline
  • Pridružio: 29 Maj 2011
  • Poruke: 1444
  • Gde živiš: U svom svetu

Kada sam povukla ikonicu na CF pocelo je skeniranje,ali onda se otvorio prpzor ,,Warning!Combofix has detected the following real time scanner to be active:
Antivirus eset nod32 antivirus 4.2
Antivirus and intrusion prevention programs are known to interfere with combofixs running.This may lead to unpredictable results or possible machine damage.
Please disable these scanners before clicking OK

Sta da radim?

Poslao: 03 Jul 2011 15:51
Idi na vrh
offline
  • Pridružio: 02 Feb 2008
  • Poruke: 14018
  • Gde živiš: Nish

Iskljuci Nod 32 AV pre pokretanja CF skripte. Ovde imas Uputstvo kako to da odradis: [Link mogu videti samo ulogovani korisnici]










goran9888 (AMF Tim)

Poslao: 03 Jul 2011 17:18
Idi na vrh
offline
  • Pridružio: 29 Maj 2011
  • Poruke: 1444
  • Gde živiš: U svom svetu

This machine does not have the Microsoft windows recovery console installed.Alternately an existing installation of the recovery console may be present but requires updating.
Without it,ComboFix shall not attempt the fixing of some serious infections.
Click yes to have combofix download/install it.
NOTE:this requires an active internet connection.


Taj prozor mi je izasao nakon ponovnog pokusaja,kada ikonicu stavim na CF.Iskljucila sam NOD32.

Poslao: 03 Jul 2011 18:07
Idi na vrh
offline
  • Pridružio: 02 Feb 2008
  • Poruke: 14018
  • Gde živiš: Nish

Da bi ti bilo jasnije sta zapravo CF radi, detaljno procitaj poruku u kojoj sam ti predlozio pokretanje CF-a: [Link mogu videti samo ulogovani korisnici]


Ovde radis isto to, samo sto prevlacis skriptu preko CF-a.










goran9888 (AMF Tim)

Poslao: 03 Jul 2011 18:24
Idi na vrh
offline
  • Pridružio: 29 Maj 2011
  • Poruke: 1444
  • Gde živiš: U svom svetu

ComboFix 11-07-01.02 - Ivana 03.07.2011 18:12:31.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1250.385.1033.18.511.197 [GMT 2:00]
Running from: c:\documents and settings\Ivana\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Ivana\Desktop\CFScript.txt
AV: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
--------------- FCopy ---------------
.
c:\windows\system32\dllcache\beep.sys --> c:\windows\system32\drivers\beep.sys
.
((((((((((((((((((((((((( Files Created from 2011-06-03 to 2011-07-03 )))))))))))))))))))))))))))))))
.
.
2011-07-03 16:12 . 2001-08-23 12:00 4224 -c--a-w- c:\windows\system32\dllcache\beep.sys
2011-07-03 16:12 . 2001-08-23 12:00 4224 ----a-w- c:\windows\system32\drivers\beep.sys
2011-07-03 11:24 . 2011-07-03 11:24 -------- d-----w- c:\documents and settings\All Users\Application Data\Protexis
2011-07-03 11:24 . 2011-07-03 11:24 -------- d-----w- c:\documents and settings\Ivana\Application Data\Corel
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-01 09:13 . 2011-06-01 09:13 348256 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\VSTAHost\CorelPHOTOPAINT\9.0\1033\ResourceCache.dll
2011-06-01 09:11 . 2011-06-01 09:11 348256 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\VSTAHost\CorelDRAW\9.0\1033\ResourceCache.dll
2011-06-01 09:10 . 2011-06-01 09:10 416 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\MSDN\9.0\1033\ResourceCache.dll
2011-04-13 22:40 . 2011-04-13 22:40 4284416 ----a-w- c:\windows\system32\GPhotos.scr
2009-09-16 07:06 . 2009-09-16 07:06 13644 ----a-w- c:\program files\Common Files\ycyhikodu.reg
2007-11-28 19:12 . 2009-07-05 23:14 67696 ----a-w- c:\program files\mozilla firefox\components\jar50.dll
2007-11-28 19:12 . 2009-07-05 23:14 54376 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2007-11-28 19:12 . 2009-07-05 23:14 34952 ----a-w- c:\program files\mozilla firefox\components\myspell.dll
2007-11-28 19:12 . 2009-07-05 23:14 46720 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll
2007-11-28 19:12 . 2009-07-05 23:14 172144 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll
.
.
((((((((((((((((((((((((((((( [Link mogu videti samo ulogovani korisnici] )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-07-03 06:31 . 2011-07-03 06:31 16384 c:\windows\Temp\Perflib_Perfdata_6b8.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-01-26 15026056]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-07-20 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-11-04 2219184]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2010-11-10 35736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2011-05-23 126976]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 04:42 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Quick Search Box]
2011-05-23 22:37 126976 ----a-w- c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2010-12-20 17:08 443728 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-07-20 06:41 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\system32\\drivers\\svchost.exe"=
"c:\\Documents and Settings\\Ivana\\My Documents\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:Remote Desktop
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
"3407:TCP"= 3407:TCP:Services
"5314:TCP"= 5314:TCP:Services
"7963:TCP"= 7963:TCP:Services
.
R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [5.7.2009 23:49 77312]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [29.7.2010 13:31 115008]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [3.8.2010 13:28 95896]
R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [4.8.2004 0:56 14336]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [4.11.2010 18:15 810144]
R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;c:\program files\Firebird\Firebird_2_1\bin\fbguard.exe [21.2.2010 17:23 81920]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [16.6.2010 20:30 363344]
R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\program files\Firebird\Firebird_2_1\bin\fbserver.exe [21.2.2010 17:23 2723840]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [16.6.2010 20:30 20952]
S0 ehhwrnbkt;ehhwrnbkt;c:\windows\system32\drivers\ycdtdlixnw.sys --> c:\windows\system32\drivers\ycdtdlixnw.sys [?]
S2 gupdate;Usluga Google ažuriranje (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [19.9.2010 15:58 136176]
S3 gupdatem;Usluga Google ažuriranje (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [19.9.2010 15:58 136176]
S3 rkhdrv40;Rootkit Unhooker Driver; [x]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
Contents of the 'Scheduled Tasks' folder
.
2011-07-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-09-19 13:58]
.
2011-07-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-09-19 13:58]
.
.
------- Supplementary Scan -------
.
uStart Page = [Link mogu videti samo ulogovani korisnici]
uDefault_Search_URL = [Link mogu videti samo ulogovani korisnici]
uSearchAssistant = [Link mogu videti samo ulogovani korisnici]
uSearchURL,(Default) = [Link mogu videti samo ulogovani korisnici]
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
TCP: DhcpNameServer = 212.62.32.1 212.62.32.5
FF - ProfilePath - c:\documents and settings\Ivana\Application Data\Mozilla\Firefox\Profiles\gg8mftdn.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo! Search
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2011-07-03 18:20
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\ESET\ESET Security\CurrentVersion\Info]
@Denied: (2) (LocalSystem)
"AppDataDir"="c:\\Documents and Settings\\All Users\\Application Data\\ESET\\ESET NOD32 Antivirus\\"
"DataDir"="ESET\\ESET NOD32 Antivirus\\"
"EditionName"=" "
"InstallDir"="c:\\Program Files\\ESET\\ESET NOD32 Antivirus\\"
"LanguageId"=dword:00000409
"PackageTag"=dword:6090e758
"ProductBase"=dword:00000000
"ProductCode"="{640BE6CD-9B4E-4FA4-98BC-E6975A30DC4F}"
"ProductName"="ESET NOD32 Antivirus"
"ProductType"="eav"
"ProductVersion"="4.2.67.10"
"UniqueId"="0004AB9E4D8B6DA2"
"ScannerBuild"=dword:00001fb8
"ScannerVersionId"=dword:000015d8
"ScannerVersion"="Open window for status."
"ei2"=hex(b):7d,49,8c,86,0f,d3,d6,1b
"ei1"=hex(b):1c,bd,b9,e0,21,29,00,00
"ei3"=hex(b):4d,6e,8b,4d,00,00,00,00
"ei4"=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(2868-)
c:\windows\system32\WININET.dll
c:\program files\Google\Quick Search Box\bin\1.2.1151.245\qsb.dll
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
Completion time: 2011-07-03 18:22:13
ComboFix-quarantined-files.txt 2011-07-03 16:22
ComboFix2.txt 2011-07-02 17:24
.
Pre-Run: 17.486.340.096 bytes free
Post-Run: 17.437.335.552 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - BD23394A37D000D7C78D2C0EE94A643C

MyCity » Ambulanta -> Arhiva Ambulante » Slika na monitoru nestane

Ko je trenutno na forumu
 

Ukupno su 1840 korisnika na forumu :: 89 registrovanih, 13 sakrivenih i 1738 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 5623 - dana 13 Dec 2025 19:56

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: acatomic, AF-1, Apok, bigfoot, blatruc82, bojank, bojcistv, bolimejoli, borya90, BrcakRS, Bubimir, Chainsaw, CikaKURE, colji, d.arsenal321, Darko Jovanovic, DejvTroter, dekan.m, Denaya, Despot Đurađ, Despot1, Dioniss, Dragan7777, draganl, dunavzed, dusanobr, Dzoni70, FGR, FOX, Galcom, Gitzherai, GrobarPovratak, Hardenberg, igorkozar83, Igritelj, Imperator_Aleksandr_lll, istokzapad, ivan1973, jarovitt, jodzula, Jonbonjovi, Kajzer Soze, kolle.the.kid, Kruger, lacko, laurusri, Leonov, Lep1na, lima, luka35, M74AB3, Macalone, Marija88, MarkoD, Maruti, MiljanXD, Milometer, Mitch22, mkukoleca, Mrav Obrad, Mzee, Obrenovic, Paklenica, Parker, Pekman, Peruta, ping15, pzoca, Razdroid, RileHerc, S94, savaskytec, synergia, tamno.nebo, Tandrkalo, tm, tooljan, tuf, User1234, Vaske8990, Vatreni Zmaj, virked, vobo, yagosh, yrraf, zivojin32, ZlatniRez, zoran77, Zukov