MyCity » Ambulanta -> Arhiva Ambulante » USB

USB

Napisano na dan: 29.9.2009
1

USB
Sledeća strana Pagination

Idi na vrh

Poslao: 29 Sep 2009 11:32
Idi na vrh
offline
  • Pridružio: 10 Sep 2009
  • Poruke: 24

Ja se izvinjavam imam jos jedan problem ... kada ubacim usb od mob.telefona nece da mi prikaze nista znaci ne otvara ni memorijsku ni nistta...a i kad ubacim cd nece da mi radi auto run


DDS (Ver_09-09-29.01) - NTFSx86
Run by Admin at 11:16:36,09 on uto 29.09.2009
Internet Explorer: 6.0.2900.2180
Microsoft Windows XP Professional 5.1.2600.2.1250.381.1033.18.894.500 [GMT 2:00]

AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
svchost.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
C:\Program Files\DNA\btdna.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Winamp\winamp.exe
C:\Documents and Settings\Admin\My Documents\Downloads\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://search.mywebsearch.com/mywebsearch/default.jhtml?ptnrS=GRfox000&ptb=NqTEAGZA2vyOdz.WaV..FA
uSearch Page = hxxp://search.live.com
uDefault_Page_URL = hxxp://www.msn.com
uSearchMigratedDefaultUrl = hxxp://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=GRfox000&fl=0&ptb=An6ArYFISwpcJXC4pj4LQg&url=http://search.mywebsearch.com/mywebsearch/dft_redir.jhtml&st=sb&searchfor={searchTerms}
uInternet Connection Wizard,ShellNext = iexplore
mSearchAssistant = hxxp://search.live.com/sphome.aspx
uURLSearchHooks: N/A: {00a6faf6-072e-44cf-8957-5838f569a31d} - c:\program files\mywebsearch\bar\1.bin\MWSSRCAS.DLL
BHO: MyWebSearch Search Assistant BHO: {00a6faf1-072e-44cf-8957-5838f569a31d} - c:\program files\mywebsearch\bar\1.bin\MWSSRCAS.DLL
BHO: mwsBar BHO: {07b18ea1-a523-4961-b6bb-170de4475cca} - c:\program files\mywebsearch\bar\1.bin\MWSBAR.DLL
TB: My Web Search: {07b18ea9-a523-4961-b6bb-170de4475cca} - c:\program files\mywebsearch\bar\1.bin\MWSBAR.DLL
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
uRun: [BitTorrent DNA] "c:\program files\dna\btdna.exe"
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [MsnMsgr] "c:\program files\msn messenger\MsnMsgr.Exe" /background
uRun: [MyWebSearch Email Plugin] c:\progra~1\mywebs~1\bar\1.bin\mwsoemon.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [SkyTel] SkyTel.EXE
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [MyWebSearch Plugin] rundll32 c:\progra~1\mywebs~1\bar\1.bin\M3PLUGIN.DLL,UPF
mRun: [My Web Search Bar] rundll32 c:\progra~1\mywebs~1\bar\1.bin\MWSBAR.DLL,S
mRun: [MyWebSearch Email Plugin] c:\progra~1\mywebs~1\bar\1.bin\mwsoemon.exe
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
uPolicies-explorer: NoInstrumentation = 1 (0x1)
IE: &Search - edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=GRfox000
IE: Download with GetRight - c:\program files\getright\GRdownload.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: Open with GetRight Browser - c:\program files\getright\GRbrowse.htm
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0_04\bin\npjpi150_04.dll
DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} - hxxp://msn.worldwinner.com/games/v47/shared/FunGamesLoader.cab
DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} - hxxp://www.worldwinner.com/games/shared/wwlaunch.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {C5326A4D-E9AA-40AD-A09A-E74304D86B47} - hxxp://www.worldwinner.com/games/v50/dinerdash/dinerdash.cab
DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab
Name-Space Handler: ftp\GetRightIEClickCatcher - {73BA8F12-723E-11D1-A9E2-00403320FCF2} - c:\program files\getright\xx2gr.dll
Name-Space Handler: http\GetRightIEClickCatcher - {73BA8F12-723E-11D1-A9E2-00403320FCF2} - c:\program files\getright\xx2gr.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\admin\applic~1\mozilla\firefox\profiles\ta7mzuo1.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - MyWebSearch
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=GRfox000&fl=0&ptb=NqTEAGZA2vyOdz.WaV..FA&url=http://search.mywebsearch.com/mywebsearch/dft_redir.jhtml&st=kwd&searchfor=
FF - plugin: c:\program files\java\jre1.5.0_04\bin\NPJava11.dll
FF - plugin: c:\program files\java\jre1.5.0_04\bin\NPJava12.dll
FF - plugin: c:\program files\java\jre1.5.0_04\bin\NPJava13.dll
FF - plugin: c:\program files\java\jre1.5.0_04\bin\NPJava14.dll
FF - plugin: c:\program files\java\jre1.5.0_04\bin\NPJava32.dll
FF - plugin: c:\program files\java\jre1.5.0_04\bin\NPJPI150_04.dll
FF - plugin: c:\program files\java\jre1.5.0_04\bin\NPOJI610.dll
FF - plugin: c:\program files\microsoft\office live\npOLW.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPMyWebS.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

============= SERVICES / DRIVERS ===============

R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-9-11 11608]
R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [2008-9-1 13696]
R1 BS_I2cIo;BS_I2cIo;c:\windows\system32\drivers\BS_I2cIo.sys [2008-9-3 8192]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-9-11 108289]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-9-11 185089]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-9-9 55656]
R2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2008-6-1 34064]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2009-3-16 24652]
S2 MyWebSearchService;My Web Search Service;c:\progra~1\mywebs~1\bar\1.bin\mwssvc.exe [2009-9-29 28762]
S3 BS_Flash;BS_Flash;c:\program files\bios\bios flash\BS_Flash.sys [2008-9-3 3604]

=============== Created Last 30 ================

2009-09-29 11:04 <DIR> --d----- c:\windows\Modio
2009-09-29 11:03 <DIR> --d----- c:\windows\PCTEL
2009-09-29 11:03 50,040 -------- c:\windows\system32\ptPTT.dat
2009-09-29 11:03 308 -------- c:\windows\system32\pthsp.dat
2009-09-29 10:54 <DIR> --d----- c:\program files\Driver
2009-09-29 10:28 28,672 a------- c:\windows\system32\f3PSSavr.scr
2009-09-29 10:28 <DIR> --d----- c:\program files\FunWebProducts
2009-09-29 10:28 <DIR> --d----- c:\program files\MyWebSearch
2009-09-28 20:32 <DIR> --dsh--- c:\documents and settings\admin\IECompatCache
2009-09-28 20:32 <DIR> --dsh--- c:\documents and settings\admin\PrivacIE
2009-09-28 20:30 <DIR> --dsh--- c:\documents and settings\admin\IETldCache
2009-09-28 20:28 81,920 a------- c:\windows\system32\ieencode.dll
2009-09-28 20:28 81,920 a------- c:\windows\system32\dllcache\ieencode.dll
2009-09-28 20:28 <DIR> --d-h--- c:\windows\msdownld.tmp
2009-09-28 19:24 294,912 -c------ c:\windows\system32\dllcache\msctf.dll
2009-09-26 17:48 54,156 a---h--- c:\windows\QTFont.qfn
2009-09-26 17:48 1,409 a------- c:\windows\QTFont.for
2009-09-19 18:17 <DIR> --d----- c:\program files\Virtual Trumpet
2009-09-19 18:14 249,856 -------- c:\windows\Setup1.exe
2009-09-19 18:14 73,216 a------- c:\windows\ST6UNST.EXE
2009-09-19 18:14 1,608 a------- c:\windows\ST6UNST.000
2009-09-19 00:09 140,488 a------- c:\windows\system32\COMDLG32.OCX
2009-09-19 00:09 115,920 a------- c:\windows\system32\MSINET.OCX
2009-09-17 23:22 <DIR> --ds---- C:\ComboFix
2009-09-16 18:03 <DIR> --d----- c:\program files\Microsoft Office Outlook Connector
2009-09-16 18:01 <DIR> --d----- c:\program files\Microsoft
2009-09-14 21:09 45,056 a------- c:\windows\system32\vusetup.dll
2009-09-14 21:09 11,264 a------- c:\windows\system32\drivers\vulfntr.sys
2009-09-14 21:09 6,912 a------- c:\windows\system32\drivers\vulfnth.sys
2009-09-14 21:09 307,200 a------- c:\windows\IsUn041a.exe
2009-09-14 20:53 69,632 a------- c:\windows\Alcmtr.exe
2009-09-12 20:31 <DIR> --d----- c:\docume~1\admin\applic~1\BSplayer Pro
2009-09-12 20:31 <DIR> --d----- c:\docume~1\admin\applic~1\BSplayer
2009-09-11 17:28 <DIR> --d----- C:\Lop SD
2009-09-11 00:06 <DIR> --d----- c:\program files\Avira
2009-09-11 00:06 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Avira
2009-09-10 21:41 <DIR> --d----- c:\windows\system32\wbem\Repository
2009-09-10 21:40 <DIR> --d----- C:\games
2009-09-10 21:40 <DIR> --d----- c:\program files\Solsoft
2009-09-09 12:35 55,656 a------- c:\windows\system32\drivers\avgntflt.sys
2009-09-09 12:24 124,688 a------- c:\windows\system32\MSWINSCK.OCX
2009-09-09 12:05 153,088 -c------ c:\windows\system32\dllcache\triedit.dll
2009-09-08 22:55 <DIR> --d----- c:\program files\Multi Password Recovery
2009-09-08 22:41 786 ---sh--- c:\windows\system\actualspystart.lnk
2009-09-08 16:04 <DIR> --d----- c:\docume~1\admin\applic~1\TeamViewer
2009-09-08 16:04 <DIR> --d----- c:\program files\TeamViewer
2009-09-08 16:04 <DIR> --d----- c:\documents and settings\admin\temp
2009-09-07 22:02 <DIR> --d----- c:\program files\Polyhedric Software
2009-09-07 22:02 299,520 a------- c:\windows\uninst.exe
2009-09-07 22:02 <DIR> --d----- c:\documents and settings\admin\WINDOWS
2009-09-07 21:59 <DIR> --d----- c:\docume~1\admin\applic~1\fltk.org
2009-09-06 12:54 <DIR> --d----- c:\program files\NetTVPlus Player

==================== Find3M ====================

2009-08-05 11:11 204,800 a------- c:\windows\system32\mswebdvd.dll
2009-07-17 20:55 58,880 a------- c:\windows\system32\atl.dll
2009-07-13 02:18 233,472 a------- c:\windows\system32\wmpdxm.dll

============= FINISH: 11:16:59,03 ===============



mycity.rs/must-login.png


a device manager mi izgleda ovako


Poslao: 29 Sep 2009 12:21
Idi na vrh
offline
  • helen1  Male
  • Anti Malware Fighter
    Rank 2
  • Master učitelj
  • Pridružio: 27 Avg 2005
  • Poruke: 8620
  • Gde živiš: Novi Beograd

Zdravo,

kad si pre uspeo da se zarazis?

Preuzmi sUBs-ov ComboFix sa sledeće adrese na Desktop:


Bleeping Computer
Klikni desnim tasterom na link i odaberi opciju Save Target As... (Save Link As..., Save Linked Content As... ili sličnu);
Kada se otvori dijalog za izbor lokacije na kojoj treba sačuvati file, odaberi Desktop i klikni Save.



Kada preuzimanje programa bude završeno:
deaktiviraj zaštitni softver (uputstvo);
zatvori pokrenute programe;
dvoklikom pokreni program ComboFix.
U toku rada, ComboFix će:proveriti postoji li novija verzija programa:
klikni Yes ako bude ponuđeno preuzimanje iste. prikazati DISCLAIMER OF WARRANTY ON SOFTWARE:
klikni Yes kako bi proces bio nastavljen.ako Recovery Console nije instalirana, ponuditi instalaciju:
obavezno prihvati klikom na Yes i isprati postupak.postaviti/dati određeni broj upita/obaveštenja:
prihvati klikom na Yes ili OK.po potrebi, restartovati Windows (više puta);
na kraju rada, otvoriti Notepad sa izveštajem o skeniranju.

Iskopiraj izveštaj koji je ComboFix napravio u temu na forumu:
klikni desnim tasterom miša u prozor Notepad-a i izaberi Select All;
klikni desnim tasterom miša na obeleženi tekst i izaberi Copy;
klikni desnim tasterom miša u polje za pisanje poruke i izaberi Paste.

Napomena:Izveštaj će biti sačuvan pod nazivom ComboFix.txt na sistemskoj particiji (tipična lokacija: C:\ComboFix.txt);
Ukoliko nakon slanja poruke primetiš da izveštaj nije kompletan, iskoristi opciju Prikači fajl za prilaganje file-a C:\ComboFix.txt uz poruku.

Poslao: 29 Sep 2009 13:22
Idi na vrh
offline
  • Pridružio: 10 Sep 2009
  • Poruke: 24

Napisano: 29 Sep 2009 13:08

ne znam na koju foru ...al auto run nije radio ni onda... evo izvestaj sa combofix-a

ComboFix 09-09-28.01 - Admin 29.09.2009 12:53.5.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.381.1033.18.894.468 [GMT 2:00]
Running from: c:\documents and settings\Admin\My Documents\Downloads\ComboFix.exe
AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Admin\Application Data\Desktopicon
c:\documents and settings\Admin\Application Data\Desktopicon\config.ini
c:\documents and settings\Admin\Application Data\Desktopicon\eBayShortcuts.exe
c:\program files\driver
c:\program files\FunWebProducts
c:\program files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html
c:\program files\MyWebSearch
c:\program files\MyWebSearch\bar\1.bin\F3BKGERR.JPG
c:\program files\MyWebSearch\bar\1.bin\F3CJPEG.DLL
c:\program files\MyWebSearch\bar\1.bin\F3DTACTL.DLL
c:\program files\MyWebSearch\bar\1.bin\F3HISTSW.DLL
c:\program files\MyWebSearch\bar\1.bin\F3HKSTUB.DLL
c:\program files\MyWebSearch\bar\1.bin\F3HTmlmu.dll
c:\program files\MyWebSearch\bar\1.bin\F3HTtpct.dll
c:\program files\MyWebSearch\bar\1.bin\F3POPSWT.DLL
c:\program files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR
c:\program files\MyWebSearch\bar\1.bin\F3REGHK.DLL
c:\program files\MyWebSearch\bar\1.bin\F3REPROX.DLL
c:\program files\MyWebSearch\bar\1.bin\F3RESTUB.DLL
c:\program files\MyWebSearch\bar\1.bin\F3SCHMON.EXE
c:\program files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL
c:\program files\MyWebSearch\bar\1.bin\F3SPACER.WMV
c:\program files\MyWebSearch\bar\1.bin\F3WALLPP.DAT
c:\program files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL
c:\program files\MyWebSearch\bar\1.bin\FWPBUDDY.PNG
c:\program files\MyWebSearch\bar\1.bin\M3AUXSTB.DLL
c:\program files\MyWebSearch\bar\1.bin\M3DLGHK.DLL
c:\program files\MyWebSearch\bar\1.bin\M3FFXTBR.JAR
c:\program files\MyWebSearch\bar\1.bin\M3FFXTBR.MANIFEST
c:\program files\MyWebSearch\bar\1.bin\M3HIGHIN.EXE
c:\program files\MyWebSearch\bar\1.bin\M3HTml.dll
c:\program files\MyWebSearch\bar\1.bin\M3IDLE.DLL
c:\program files\MyWebSearch\bar\1.bin\M3IMPIPE.EXE
c:\program files\MyWebSearch\bar\1.bin\M3MEDINT.EXE
c:\program files\MyWebSearch\bar\1.bin\M3MSG.DLL
c:\program files\MyWebSearch\bar\1.bin\M3NTSTBR.JAR
c:\program files\MyWebSearch\bar\1.bin\M3NTSTBR.MANIFEST
c:\program files\MyWebSearch\bar\1.bin\M3OUTLCN.DLL
c:\program files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL
c:\program files\MyWebSearch\bar\1.bin\M3SKIN.DLL
c:\program files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE
c:\program files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE
c:\program files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE
c:\program files\MyWebSearch\bar\1.bin\MWSBAR.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
c:\program files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSOESTB.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSSVC.EXE
c:\program files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL
c:\program files\MyWebSearch\bar\Avatar\COMMON.F3S
c:\program files\MyWebSearch\bar\Cache\000D4A58.FA
c:\program files\MyWebSearch\bar\Cache\000D51CA
c:\program files\MyWebSearch\bar\Cache\000D5350.bin
c:\program files\MyWebSearch\bar\Cache\000D5573.bin
c:\program files\MyWebSearch\bar\Cache\000D57D5.bin
c:\program files\MyWebSearch\bar\Cache\000D59C9.bin
c:\program files\MyWebSearch\bar\Cache\000D5B8E.bin
c:\program files\MyWebSearch\bar\Cache\000D5CF5.bin
c:\program files\MyWebSearch\bar\Cache\files.ini
c:\program files\MyWebSearch\bar\Game\CHECKERS.F3S
c:\program files\MyWebSearch\bar\Game\CHESS.F3S
c:\program files\MyWebSearch\bar\Game\REVERSI.F3S
c:\program files\MyWebSearch\bar\History\search3
c:\program files\MyWebSearch\bar\icons\CM.ICO
c:\program files\MyWebSearch\bar\icons\MFC.ICO
c:\program files\MyWebSearch\bar\icons\PSS.ICO
c:\program files\MyWebSearch\bar\icons\SMILEY.ICO
c:\program files\MyWebSearch\bar\icons\WB.ICO
c:\program files\MyWebSearch\bar\icons\ZWINKY.ICO
c:\program files\MyWebSearch\bar\Message\COMMON.F3S
c:\program files\MyWebSearch\bar\Notifier\COMMON.F3S
c:\program files\MyWebSearch\bar\Notifier\DOG.F3S
c:\program files\MyWebSearch\bar\Notifier\FISH.F3S
c:\program files\MyWebSearch\bar\Notifier\KUNGFU.F3S
c:\program files\MyWebSearch\bar\Notifier\LIFEGARD.F3S
c:\program files\MyWebSearch\bar\Notifier\MAID.F3S
c:\program files\MyWebSearch\bar\Notifier\MAILBOX.F3S
c:\program files\MyWebSearch\bar\Notifier\OPERA.F3S
c:\program files\MyWebSearch\bar\Notifier\ROBOT.F3S
c:\program files\MyWebSearch\bar\Notifier\SEDUCT.F3S
c:\program files\MyWebSearch\bar\Notifier\SURFER.F3S
c:\program files\MyWebSearch\bar\Settings\prevcfg2.htm
c:\program files\MyWebSearch\bar\Settings\s_pid.dat
c:\windows\system32\f3PSSavr.scr

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_MYWEBSEARCHSERVICE
-------\Service_MyWebSearchService


((((((((((((((((((((((((( Files Created from 2009-08-28 to 2009-09-29 )))))))))))))))))))))))))))))))
.

2009-09-29 09:04 . 2009-09-29 09:04 -------- d-----w- c:\windows\Modio
2009-09-29 09:03 . 2009-09-29 09:03 -------- d-----w- c:\windows\LastGood.Tmp
2009-09-29 09:03 . 2009-09-29 09:03 -------- d-----w- c:\windows\PCTEL
2009-09-29 09:03 . 2003-11-25 03:26 308 ------w- c:\windows\system32\pthsp.dat
2009-09-29 09:03 . 2002-09-27 07:16 50040 ------w- c:\windows\system32\ptPTT.dat
2009-09-28 18:32 . 2009-09-28 18:32 -------- d-sh--w- c:\documents and settings\Admin\IECompatCache
2009-09-28 18:32 . 2009-09-28 18:32 -------- d-sh--w- c:\documents and settings\Admin\PrivacIE
2009-09-28 18:30 . 2009-09-28 18:30 -------- d-sh--w- c:\documents and settings\Admin\IETldCache
2009-09-28 18:28 . 2009-06-26 16:18 81920 ----a-w- c:\windows\system32\ieencode.dll
2009-09-28 18:28 . 2009-06-26 16:18 81920 ----a-w- c:\windows\system32\dllcache\ieencode.dll
2009-09-28 18:28 . 2009-09-28 18:28 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-28 18:28 . 2009-09-28 18:29 -------- d--h--w- c:\windows\msdownld.tmp
2009-09-28 17:24 . 2008-02-26 11:59 294912 -c----w- c:\windows\system32\dllcache\msctf.dll
2009-09-19 16:17 . 2009-09-19 16:17 -------- d-----w- c:\program files\Virtual Trumpet
2009-09-19 16:14 . 2009-09-19 16:19 249856 ------w- c:\windows\Setup1.exe
2009-09-19 16:14 . 2009-09-19 16:19 73216 ----a-w- c:\windows\ST6UNST.EXE
2009-09-16 16:03 . 2009-09-16 16:03 -------- d-----w- c:\program files\Microsoft Office Outlook Connector
2009-09-16 16:01 . 2009-09-16 17:20 -------- d-----w- c:\program files\Microsoft
2009-09-14 19:09 . 2005-06-06 15:51 11264 ----a-w- c:\windows\system32\drivers\vulfntr.sys
2009-09-14 19:09 . 2005-01-05 16:02 6912 ----a-w- c:\windows\system32\drivers\vulfnth.sys
2009-09-14 19:09 . 2003-10-03 14:28 45056 ----a-w- c:\windows\system32\vusetup.dll
2009-09-14 19:09 . 1998-11-13 11:11 307200 ----a-w- c:\windows\IsUn041a.exe
2009-09-14 18:53 . 2005-05-03 16:43 69632 ----a-w- c:\windows\Alcmtr.exe
2009-09-12 18:31 . 2009-09-12 20:50 -------- d-----w- c:\documents and settings\Admin\Application Data\BSplayer
2009-09-12 18:31 . 2009-09-12 18:31 -------- d-----w- c:\documents and settings\Admin\Application Data\BSplayer Pro
2009-09-11 15:28 . 2009-09-12 15:30 -------- d-----w- C:\Lop SD
2009-09-10 22:06 . 2009-03-30 08:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-09-10 22:06 . 2009-02-13 10:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-09-10 22:06 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-09-10 22:06 . 2009-09-10 22:06 -------- d-----w- c:\program files\Avira
2009-09-10 22:06 . 2009-09-10 22:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-09-10 19:41 . 2009-09-10 19:41 -------- d-----w- c:\windows\system32\wbem\Repository
2009-09-10 19:40 . 2009-09-10 19:40 -------- d-----w- C:\games
2009-09-10 19:40 . 2009-09-10 19:40 -------- d-----w- c:\program files\Solsoft
2009-09-09 10:35 . 2009-07-28 14:33 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-09-09 10:05 . 2009-06-21 22:04 153088 -c----w- c:\windows\system32\dllcache\triedit.dll
2009-09-08 20:55 . 2009-09-08 20:57 -------- d-----w- c:\program files\Multi Password Recovery
2009-09-08 14:04 . 2009-09-08 14:04 -------- d-----w- c:\documents and settings\Admin\Application Data\TeamViewer
2009-09-08 14:04 . 2009-09-08 14:05 -------- d-----w- c:\program files\TeamViewer
2009-09-08 14:04 . 2009-09-08 14:04 -------- d-----w- c:\documents and settings\Admin\temp
2009-09-07 20:02 . 2009-09-07 20:02 -------- d-----w- c:\program files\Polyhedric Software
2009-09-07 20:02 . 1998-02-06 19:37 299520 ----a-w- c:\windows\uninst.exe
2009-09-07 20:02 . 2009-09-07 20:02 -------- d-----w- c:\documents and settings\Admin\WINDOWS
2009-09-07 19:59 . 2009-09-07 19:59 -------- d-----w- c:\documents and settings\Admin\Application Data\fltk.org
2009-09-06 10:54 . 2009-09-06 11:07 -------- d-----w- c:\program files\NetTVPlus Player

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-29 10:58 . 2009-04-21 17:45 -------- d-----w- c:\program files\DNA
2009-09-29 10:58 . 2009-04-21 17:45 -------- d-----w- c:\documents and settings\Admin\Application Data\DNA
2009-09-29 09:00 . 2008-09-03 21:21 -------- d-----w- c:\program files\UIU
2009-09-16 18:18 . 2009-01-19 13:05 -------- d-----w- c:\program files\Opera
2009-09-16 17:42 . 2009-03-16 17:04 -------- d-----w- c:\documents and settings\Admin\Application Data\Windows Live Writer
2009-09-13 14:07 . 2009-07-24 12:33 -------- d-----w- c:\documents and settings\Admin\Application Data\Nokia
2009-09-12 21:01 . 2009-04-21 17:45 -------- d-----w- c:\documents and settings\Admin\Application Data\BitTorrent
2009-09-10 20:37 . 2005-10-03 19:44 -------- d-----w- c:\program files\Google
2009-09-10 20:02 . 2009-01-28 14:35 -------- d-----w- c:\program files\Valve
2009-09-09 10:01 . 2009-01-31 16:23 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-08-17 13:12 . 2005-10-03 20:53 39464 ----a-w- c:\documents and settings\Admin\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-15 08:45 . 2009-08-15 08:45 -------- d-----w- c:\program files\MSBuild
2009-08-15 08:45 . 2009-08-15 08:45 -------- d-----w- c:\program files\Reference Assemblies
2009-08-15 08:42 . 2009-08-15 08:42 -------- d-----w- c:\program files\MSXML 6.0
2009-08-05 09:11 . 2002-12-31 12:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-17 18:55 . 2002-12-31 12:00 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-13 00:18 . 2002-12-31 12:00 233472 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-06 15:33 . 2008-10-04 11:29 41 ----a-w- c:\windows\popcinfo.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-04-21 321344]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-31 7634944]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2007-10-11 1826816]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-10-16 16855552]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2002-12-31 15360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=
"c:\\WINDOWS\\system32\\rtcshare.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\WINDOWS\\system32\\ftp.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
"19199:TCP"= 19199:TCP:BitComet 19199 TCP
"19199:UDP"= 19199:UDP:BitComet 19199 UDP

R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [1.9.2008 19:15 13696]
R1 BS_I2cIo;BS_I2cIo;c:\windows\system32\drivers\BS_I2cIo.sys [3.9.2008 23:50 8192]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [11.9.2009 0:06 108289]
R2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [1.6.2008 9:13 34064]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [16.3.2009 12:54 24652]
S3 BS_Flash;BS_Flash;c:\program files\BIOS\BIOS Flash\BS_Flash.sys [3.9.2008 5:00 3604]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://search.mywebsearch.com/mywebsearch/default.jhtml?ptnrS=GRfox000&ptb=NqTEAGZA2vyOdz.WaV..FA
uSearchMigratedDefaultUrl = hxxp://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=GRfox000&fl=0&ptb=An6ArYFISwpcJXC4pj4LQg&url=http://search.mywebsearch.com/mywebsearch/dft_redir.jhtml&st=sb&searchfor={searchTerms}
uInternet Connection Wizard,ShellNext = iexplore
IE: &Search - edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=GRfox000
IE: Download with GetRight - c:\program files\GetRight\GRdownload.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Open with GetRight Browser - c:\program files\GetRight\GRbrowse.htm
Name-Space Handler: ftp\GetRightIEClickCatcher - {73BA8F12-723E-11D1-A9E2-00403320FCF2} - c:\program files\GetRight\xx2gr.dll
Name-Space Handler: http\GetRightIEClickCatcher - {73BA8F12-723E-11D1-A9E2-00403320FCF2} - c:\program files\GetRight\xx2gr.dll
FF - ProfilePath - c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\ta7mzuo1.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - MyWebSearch
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=GRfox000&fl=0&ptb=NqTEAGZA2vyOdz.WaV..FA&url=http://search.mywebsearch.com/mywebsearch/dft_redir.jhtml&st=kwd&searchfor=
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJPI150_04.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPOJI610.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPMyWebS.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
HKCU-Run-MsnMsgr - c:\program files\MSN Messenger\MsnMsgr.Exe
HKLM-Run-MyWebSearch Plugin - c:\progra~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL
AddRemove-Knob Mess Remote - c:\docume~1\Admin\APPLIC~1\VCFIVE~1\joy jugs.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, gmer.net
Rootkit scan 2009-09-29 12:58
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\System\ControlSet001\Enum\ACPI\PNP0F13\3&2411e6fe&0\LogConf]
@DACL=(02 0000)
"BasicConfigVector"=hex(a):48,00,00,00,0f,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,01,00,00,00,01,00,01,00,01,00,00,00,00,02,\
"BootConfig"=hex(Cool:01,00,00,00,0f,00,00,00,00,00,00,00,01,00,01,00,01,00,00,
00,02,01,01,00,0c,00,00,00,0c,00,00,00,ff,ff,ff,ff
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3336)
c:\windows\system32\msi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
c:\windows\system32\nvsvc32.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
.
**************************************************************************
.
Completion time: 2009-09-29 13:03 - machine was rebooted
ComboFix-quarantined-files.txt 2009-09-29 11:03
ComboFix2.txt 2009-09-12 21:45

Pre-Run: 4.164.882.432 bytes free
Post-Run: 4.154.966.016 bytes free

276 --- E O F --- 2009-09-10 07:47

Dopuna: 29 Sep 2009 13:22

e izvini i jos nesto kako da pojacam desni zvucnik posto je skroz smanjn na kompu negde a nmp gde u master volume je sve na sredini audio manager isto sve ok ...a zvucnik j smanjen ... nije do kabla .. jer sam ga nosila u servis i kod njih rade oba a kod mene radi ali je prigusen ...

Poslao: 29 Sep 2009 15:14
Idi na vrh
offline
  • helen1  Male
  • Anti Malware Fighter
    Rank 2
  • Master učitelj
  • Pridružio: 27 Avg 2005
  • Poruke: 8620
  • Gde živiš: Novi Beograd

Skini ovaj fajl na desktop, raspakuj ga i pokreni dvoklikom
Dobices takodje na desktopu showreg.txt fajl, koji ces mi prikaciti ovde na forumu.
https://www.mycity.rs/must-login.png

Poslao: 29 Sep 2009 18:15
Idi na vrh
offline
  • Pridružio: 10 Sep 2009
  • Poruke: 24

mycity.rs/must-login.png

Poslao: 29 Sep 2009 18:23
Idi na vrh
offline
  • helen1  Male
  • Anti Malware Fighter
    Rank 2
  • Master učitelj
  • Pridružio: 27 Avg 2005
  • Poruke: 8620
  • Gde živiš: Novi Beograd

Skini ovaj fajl, pokreni ga dvoklikom, yes pa ok.

https://www.mycity.rs/must-login.png

Poslao: 29 Sep 2009 19:51
Idi na vrh
offline
  • Pridružio: 10 Sep 2009
  • Poruke: 24

iii sta sad???posto ne mogu nista da ti kopiram"?

Poslao: 29 Sep 2009 20:01
Idi na vrh
offline
  • helen1  Male
  • Anti Malware Fighter
    Rank 2
  • Master učitelj
  • Pridružio: 27 Avg 2005
  • Poruke: 8620
  • Gde živiš: Novi Beograd

Otvoriti Notepad i iskopirati sledeci tekst:


Firefox::
FF - prefs.js: keyword.URL - hxxp://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=GRfox000&fl=0&ptb=NqTEAGZA2vyOdz.WaV..FA&url=http://search.mywebsearch.com/mywebsearch/dft_redir.jhtml&st=kwd&searchfor=
DDS::
IE: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=GRfox000



Snimiti na Desktop fajl iz Notepada kao "CFScript"




Prevuci snimljeni skript/tekst na ComboFix ikonicu kao na slici.
Postaviti u sledecoj poruci log koji bude bio napravljen na kraju ciscenja/skeniranja.

Poslao: 29 Sep 2009 20:26
Idi na vrh
offline
  • Pridružio: 10 Sep 2009
  • Poruke: 24

ComboFix 09-09-28.01 - Admin 29.09.2009 20:17.6.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.381.1033.18.894.486 [GMT 2:00]
Running from: c:\documents and settings\Admin\My Documents\Downloads\ComboFix.exe
Command switches used :: c:\documents and settings\Admin\Desktop\CFScript.txt
AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2009-08-28 to 2009-09-29 )))))))))))))))))))))))))))))))
.

2009-09-29 09:04 . 2009-09-29 09:04 -------- d-----w- c:\windows\Modio
2009-09-29 09:03 . 2009-09-29 09:03 -------- d-----w- c:\windows\PCTEL
2009-09-29 09:03 . 2003-11-25 03:26 308 ------w- c:\windows\system32\pthsp.dat
2009-09-29 09:03 . 2002-09-27 07:16 50040 ------w- c:\windows\system32\ptPTT.dat
2009-09-28 18:32 . 2009-09-28 18:32 -------- d-sh--w- c:\documents and settings\Admin\IECompatCache
2009-09-28 18:32 . 2009-09-28 18:32 -------- d-sh--w- c:\documents and settings\Admin\PrivacIE
2009-09-28 18:30 . 2009-09-28 18:30 -------- d-sh--w- c:\documents and settings\Admin\IETldCache
2009-09-28 18:28 . 2009-06-26 16:18 81920 ----a-w- c:\windows\system32\ieencode.dll
2009-09-28 18:28 . 2009-06-26 16:18 81920 ----a-w- c:\windows\system32\dllcache\ieencode.dll
2009-09-28 18:28 . 2009-09-29 15:40 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-28 18:28 . 2009-09-28 18:29 -------- d--h--w- c:\windows\msdownld.tmp
2009-09-28 17:24 . 2008-02-26 11:59 294912 -c----w- c:\windows\system32\dllcache\msctf.dll
2009-09-19 16:17 . 2009-09-19 16:17 -------- d-----w- c:\program files\Virtual Trumpet
2009-09-19 16:14 . 2009-09-19 16:19 249856 ------w- c:\windows\Setup1.exe
2009-09-19 16:14 . 2009-09-19 16:19 73216 ----a-w- c:\windows\ST6UNST.EXE
2009-09-16 16:03 . 2009-09-16 16:03 -------- d-----w- c:\program files\Microsoft Office Outlook Connector
2009-09-16 16:01 . 2009-09-16 17:20 -------- d-----w- c:\program files\Microsoft
2009-09-14 19:09 . 2005-06-06 15:51 11264 ----a-w- c:\windows\system32\drivers\vulfntr.sys
2009-09-14 19:09 . 2005-01-05 16:02 6912 ----a-w- c:\windows\system32\drivers\vulfnth.sys
2009-09-14 19:09 . 2003-10-03 14:28 45056 ----a-w- c:\windows\system32\vusetup.dll
2009-09-14 19:09 . 1998-11-13 11:11 307200 ----a-w- c:\windows\IsUn041a.exe
2009-09-14 18:53 . 2005-05-03 16:43 69632 ----a-w- c:\windows\Alcmtr.exe
2009-09-12 18:31 . 2009-09-12 20:50 -------- d-----w- c:\documents and settings\Admin\Application Data\BSplayer
2009-09-12 18:31 . 2009-09-12 18:31 -------- d-----w- c:\documents and settings\Admin\Application Data\BSplayer Pro
2009-09-11 15:28 . 2009-09-12 15:30 -------- d-----w- C:\Lop SD
2009-09-10 22:06 . 2009-03-30 08:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-09-10 22:06 . 2009-02-13 10:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-09-10 22:06 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-09-10 22:06 . 2009-09-10 22:06 -------- d-----w- c:\program files\Avira
2009-09-10 22:06 . 2009-09-10 22:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-09-10 19:41 . 2009-09-10 19:41 -------- d-----w- c:\windows\system32\wbem\Repository
2009-09-10 19:40 . 2009-09-10 19:40 -------- d-----w- C:\games
2009-09-10 19:40 . 2009-09-10 19:40 -------- d-----w- c:\program files\Solsoft
2009-09-09 10:35 . 2009-07-28 14:33 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-09-09 10:05 . 2009-06-21 22:04 153088 -c----w- c:\windows\system32\dllcache\triedit.dll
2009-09-08 20:55 . 2009-09-08 20:57 -------- d-----w- c:\program files\Multi Password Recovery
2009-09-08 14:04 . 2009-09-08 14:04 -------- d-----w- c:\documents and settings\Admin\Application Data\TeamViewer
2009-09-08 14:04 . 2009-09-08 14:05 -------- d-----w- c:\program files\TeamViewer
2009-09-08 14:04 . 2009-09-08 14:04 -------- d-----w- c:\documents and settings\Admin\temp
2009-09-07 20:02 . 2009-09-07 20:02 -------- d-----w- c:\program files\Polyhedric Software
2009-09-07 20:02 . 1998-02-06 19:37 299520 ----a-w- c:\windows\uninst.exe
2009-09-07 20:02 . 2009-09-07 20:02 -------- d-----w- c:\documents and settings\Admin\WINDOWS
2009-09-07 19:59 . 2009-09-07 19:59 -------- d-----w- c:\documents and settings\Admin\Application Data\fltk.org
2009-09-06 10:54 . 2009-09-06 11:07 -------- d-----w- c:\program files\NetTVPlus Player

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-29 18:15 . 2009-04-21 17:45 -------- d-----w- c:\documents and settings\Admin\Application Data\DNA
2009-09-29 18:05 . 2009-04-21 17:45 -------- d-----w- c:\program files\DNA
2009-09-29 09:00 . 2008-09-03 21:21 -------- d-----w- c:\program files\UIU
2009-09-16 18:18 . 2009-01-19 13:05 -------- d-----w- c:\program files\Opera
2009-09-16 17:42 . 2009-03-16 17:04 -------- d-----w- c:\documents and settings\Admin\Application Data\Windows Live Writer
2009-09-13 14:07 . 2009-07-24 12:33 -------- d-----w- c:\documents and settings\Admin\Application Data\Nokia
2009-09-12 21:01 . 2009-04-21 17:45 -------- d-----w- c:\documents and settings\Admin\Application Data\BitTorrent
2009-09-10 20:37 . 2005-10-03 19:44 -------- d-----w- c:\program files\Google
2009-09-10 20:02 . 2009-01-28 14:35 -------- d-----w- c:\program files\Valve
2009-09-09 10:01 . 2009-01-31 16:23 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-08-17 13:12 . 2005-10-03 20:53 39464 ----a-w- c:\documents and settings\Admin\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-15 08:45 . 2009-08-15 08:45 -------- d-----w- c:\program files\MSBuild
2009-08-15 08:45 . 2009-08-15 08:45 -------- d-----w- c:\program files\Reference Assemblies
2009-08-15 08:42 . 2009-08-15 08:42 -------- d-----w- c:\program files\MSXML 6.0
2009-08-05 09:11 . 2002-12-31 12:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-17 18:55 . 2002-12-31 12:00 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-13 00:18 . 2002-12-31 12:00 233472 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-06 15:33 . 2008-10-04 11:29 41 ----a-w- c:\windows\popcinfo.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-04-21 321344]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-31 7634944]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2007-10-11 1826816]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-10-16 16855552]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2002-12-31 15360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=
"c:\\WINDOWS\\system32\\rtcshare.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\WINDOWS\\system32\\ftp.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
"19199:TCP"= 19199:TCP:BitComet 19199 TCP
"19199:UDP"= 19199:UDP:BitComet 19199 UDP

R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [1.9.2008 19:15 13696]
R1 BS_I2cIo;BS_I2cIo;c:\windows\system32\drivers\BS_I2cIo.sys [3.9.2008 23:50 8192]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [11.9.2009 0:06 108289]
R2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [1.6.2008 9:13 34064]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [16.3.2009 12:54 24652]
S3 BS_Flash;BS_Flash;c:\program files\BIOS\BIOS Flash\BS_Flash.sys [3.9.2008 5:00 3604]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://search.mywebsearch.com/mywebsearch/default.jhtml?ptnrS=GRfox000&ptb=NqTEAGZA2vyOdz.WaV..FA
uSearchMigratedDefaultUrl = hxxp://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=GRfox000&fl=0&ptb=An6ArYFISwpcJXC4pj4LQg&url=http://search.mywebsearch.com/mywebsearch/dft_redir.jhtml&st=sb&searchfor={searchTerms}
uInternet Connection Wizard,ShellNext = iexplore
IE: Download with GetRight - c:\program files\GetRight\GRdownload.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Open with GetRight Browser - c:\program files\GetRight\GRbrowse.htm
Name-Space Handler: ftp\GetRightIEClickCatcher - {73BA8F12-723E-11D1-A9E2-00403320FCF2} - c:\program files\GetRight\xx2gr.dll
Name-Space Handler: http\GetRightIEClickCatcher - {73BA8F12-723E-11D1-A9E2-00403320FCF2} - c:\program files\GetRight\xx2gr.dll
FF - ProfilePath - c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\ta7mzuo1.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJPI150_04.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPOJI610.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPMyWebS.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, gmer.net
Rootkit scan 2009-09-29 20:21
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\System\ControlSet001\Enum\ACPI\PNP0F13\3&2411e6fe&0\LogConf]
@DACL=(02 0000)
"BasicConfigVector"=hex(a):48,00,00,00,0f,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,01,00,00,00,01,00,01,00,01,00,00,00,00,02,\
"BootConfig"=hex(Cool:01,00,00,00,0f,00,00,00,00,00,00,00,01,00,01,00,01,00,00,
00,02,01,01,00,0c,00,00,00,0c,00,00,00,ff,ff,ff,ff
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(1796)
c:\windows\system32\msi.dll
.
Completion time: 2009-09-29 20:23
ComboFix-quarantined-files.txt 2009-09-29 18:23
ComboFix2.txt 2009-09-29 11:03
ComboFix3.txt 2009-09-12 21:45

Pre-Run: 3.883.384.832 bytes free
Post-Run: 3.884.830.720 bytes free

167 --- E O F --- 2009-09-10 07:47

Poslao: 29 Sep 2009 21:56
Idi na vrh
offline
  • helen1  Male
  • Anti Malware Fighter
    Rank 2
  • Master učitelj
  • Pridružio: 27 Avg 2005
  • Poruke: 8620
  • Gde živiš: Novi Beograd

Otvoriti Notepad i iskopirati sledeci tekst:


Registry::
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"=-
"SearchMigratedDefaultName"=-
"SearchMigratedDefaultUrl"=-
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\&Search]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0}]



Snimiti na Desktop fajl iz Notepada kao "CFScript"




Prevuci snimljeni skript/tekst na ComboFix ikonicu kao na slici.
Postaviti u sledecoj poruci log koji bude bio napravljen na kraju ciscenja/skeniranja.

MyCity » Ambulanta -> Arhiva Ambulante » USB

Ko je trenutno na forumu
 

Ukupno su 1059 korisnika na forumu :: 13 registrovanih, 2 sakrivenih i 1044 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: babaroga, Bobrock1, drimer, hyla, JohnnyBoii, Koca Popovic, oldtimer, operniki, Sass Drake, Trpe Grozni, Vlad000, vladulns, VP6919