USB i recycler

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Izvini sto si cekao, bolestan sam pa me zato nije bilo.

Otvoriti Notepad i iskopirati sledeci tekst:

File::
C:\WINDOWS\Tasks\Low Battery Alarm Program.job
F:\AdobeR.exe

Driver::
<NtDriverName>
C745PROG

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fe41d73e-53b4-11dc-99f5-0002e34a0ee9}]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"12759:TCP"=-
"13972:TCP"=-
"17450:TCP"=-
"18174:TCP"=-
"18302:TCP"=-
"12122:TCP"=-
"18271:TCP"=-
"18545:TCP"=-
"12506:TCP"=-
"15488:TCP"=-
"14631:TCP"=-
"18514:TCP"=-
"12775:TCP"=-
"14325:TCP"=-
"14113:TCP"=-
"12537:TCP"=-
"15710:TCP"=-
"12093:TCP"=-
"16681:TCP"=-
"13757:TCP"=-
"15273:TCP"=-
"17090:TCP"=-
"13761:TCP"=-
"17206:TCP"=-
"14505:TCP"=-
"15409:TCP"=-
"14585:TCP"=-
"17310:TCP"=-
"17230:TCP"=-
"13686:TCP"=-
"17052:TCP"=-
"17163:TCP"=-
"17613:TCP"=-
"17243:TCP"=-
"12684:TCP"=-
"15025:TCP"=-
"14334:TCP"=-
"12696:TCP"=-
"16658:TCP"=-
"17612:TCP"=-
"15831:TCP"=-
"13314:TCP"=-
"17020:TCP"=-
"14354:TCP"=-
"17424:TCP"=-
"15295:TCP"=-
"18485:TCP"=-
"15167:TCP"=-
"14047:TCP"=-
"15057:TCP"=-
"18850:TCP"=-
"12020:TCP"=-
"17434:TCP"=-
"12443:TCP"=-
"18433:TCP"=-
"15727:TCP"=-
"17745:TCP"=-
"14863:TCP"=-
"13211:TCP"=-
"16450:TCP"=-
"16023:TCP"=-
"15618:TCP"=-
"14183:TCP"=-


Snimiti na Desktop fajl iz Notepada kao "CFScript"




Prevuci snimljeni skript/tekst na ComboFix ikonicu kao na slici.
Postaviti u sledecoj poruci log koji bude bio napravljen na kraju ciscenja/skeniranja.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Izvinjavam se, malo sam bio odsutan od kuce i posla. Evo loga.

ComboFix 08-07-17.4 - Novum 2008-07-25 6:56:11.6 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.133 [GMT 2:00]
Running from: C:\Documents and Settings\Novum\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Novum\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\Tasks\Low Battery Alarm Program.job
F:\AdobeR.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\Tasks\Low Battery Alarm Program.job

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_<NtDriverName>
-------\Service_C745PROG


((((((((((((((((((((((((( Files Created from 2008-06-25 to 2008-07-25 )))))))))))))))))))))))))))))))
.

2008-07-19 06:54 . 2008-07-19 06:54 <DIR> d-------- C:\Program Files\Avira
2008-07-19 06:54 . 2008-07-19 06:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-07-12 07:11 . 2008-07-13 17:19 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-07-11 08:20 . 2004-08-03 22:58 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
2008-07-11 08:20 . 2004-08-03 22:58 14,848 --a--c--- C:\WINDOWS\system32\dllcache\kbdhid.sys
2008-07-11 08:00 . 2008-07-11 08:00 <DIR> d-------- C:\Program Files\Avanquest update
2008-07-11 08:00 . 2008-07-11 08:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\BVRP Software
2008-07-11 07:59 . 2008-07-11 07:59 <DIR> d-------- C:\Program Files\Sony Ericsson
2008-07-11 07:59 . 2008-07-11 07:59 <DIR> d-------- C:\Documents and Settings\Novum\Application Data\InstallShield
2008-07-11 07:59 . 2008-07-11 07:59 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Sony Ericsson
2008-07-07 10:24 . 2008-07-07 10:24 <DIR> d-------- C:\games
2008-07-06 08:12 . 2008-07-06 08:12 <DIR> d-------- C:\Program Files\MOSoft
2008-07-06 08:12 . 1996-01-09 10:38 283,648 --a------ C:\WINDOWS\uninst.exe
2008-07-03 17:03 . 2008-07-03 17:03 <DIR> d-------- C:\Documents and Settings\Novum\Application Data\Autodesk
2008-07-03 17:03 . 2008-07-12 07:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Autodesk

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-18 05:24 --------- d-----w C:\Program Files\Sony Setup
2008-07-15 10:20 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-30 15:05 --------- d-----w C:\Documents and Settings\Novum\Application Data\XnView
2008-04-18 13:22 46,552 ----a-w C:\Documents and Settings\Novum\Application Data\GDIPFONTCACHEV1.DAT
2007-03-20 12:26 106 ----a-w C:\Documents and Settings\Novum\Application Data\wklnhst.dat
1998-04-27 19:15 570,128 ------w C:\Program Files\Common Files\dao350.dll
1998-04-26 23:00 570,128 ----a-w C:\Program Files\DAO350.DLL
.

((((((((((((((((((((((((((((( snapshot@2008-07-19_ 7.27.03.58 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-20 18:02:28 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00 15360]
"MSMSGS"="c:\PROGRA~1\MESSEN~1\Msmsgs.exe" [2005-08-31 21:27 1658592]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2008-02-20 17:19 356352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"S7UB Start"="C:\Siemens\Common\S7ubtoox\s7ubtstx.exe" [2000-10-26 00:02 102400]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-11-23 11:47 180269]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-06-14 19:32 132760]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]
"SoundMan"="SOUNDMAN.EXE" [2005-08-01 08:28 77824 C:\WINDOWS\SOUNDMAN.EXE]
"SMSERIAL"="sm56hlpr.exe" [2005-07-06 04:47 544768 C:\WINDOWS\sm56hlpr.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 14:00 15360]

C:\Documents and Settings\Novum\Start Menu\Programs\Startup\
Stardock ObjectDock.lnk - D:\PROGRAMI\ObjectDock\ObjectDock\ObjectDock.exe [2006-03-12 08:51:37 1802309]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\fxsclnt.exe"=
"C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"C:\\Program Files\\Messenger\\Msmsgs.exe"=

R2 Dpmtrcdd;Dpmtrcdd;C:\WINDOWS\system32\DRIVERS\dpmtrcdd.sys [2001-06-27 10:59]
R2 s7osmcax;s7osmcax;C:\WINDOWS\system32\Drivers\s7osmcax.sys [2004-12-23 11:24]
R2 s7otranx;s7otranx;C:\WINDOWS\system32\Drivers\S7otranx.sys [2004-12-23 11:24]
R3 EKBfltr;ENE Keyboard Controller;C:\WINDOWS\system32\DRIVERS\EKBfltr.sys [2005-08-01 08:29]
S3 s7oefs_x;SIMATIC MPI/EFS Driver;C:\WINDOWS\system32\drivers\s7oefs_x.sys [2000-03-28 12:05]
S3 S7OUPC2X;SIMATIC PC Adapter USB Driver;C:\WINDOWS\system32\DRIVERS\s7oupc2x.sys [2005-01-14 13:01]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\Auto\command - F:\AdobeR.exe e
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-25 07:02:52
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\explorer.exe
-> D:\PROGRAMI\ObjectDock\ObjectDock\DockShellHook.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Messenger\Msmsgs.exe
C:\Siemens\Common\sqlany\dbsrv50.exe
.
**************************************************************************
.
Completion time: 2008-07-25 7:06:59 - machine was rebooted [Novum]
ComboFix-quarantined-files.txt 2008-07-25 05:06:53
ComboFix2.txt 2008-07-19 09:06:54

Pre-Run: 4,914,171,904 bytes free
Post-Run: 4,828,766,208 bytes free

122

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Kazi mi kako se sada komp ponasa. Ima li jos simptoma?

Jedina stvar koja je ostala je jedno setovanje u reg. bazi.

Otvoriti Notepad i iskopirati sledeci tekst:

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F\Shell]


Snimiti na Desktop fajl iz Notepada kao "CFScript"




Prevuci snimljeni skript/tekst na ComboFix ikonicu kao na slici.
Postaviti u sledecoj poruci log koji bude bio napravljen na kraju ciscenja/skeniranja.

Ukoliko si prinudjen da od sada pa nadalje koristis USB flash da bi prenosio fajlove sa kompa u internet kafeu (koji je zarazen), onda uradi sledece:
- skini sledeci program
- startuj ga
- prebaci ga u "Auto block" rezim
- ukoliko uradis minimize programa, on ce otici u tray, da ti ne smeta na ekranu

Uvek ukljucivati ovaj program u Auto block rezimu pre nego sto u svoj komp ubodes USB flash drive. To ce spreciti sirenje infekcije sa flasha na tvoj komp. Infekcija sa flasha nece biti obrisana. To je iz razloga sto ovaj program ne pravi razliku izmedju legitimnih i malicioznih programa koji sa USB flash drajva pokusavaju da preprave Explorer Shell Menu - on ce ih samo blokirati. Ne brise da kojim slucajem ne bi obrisao i legitiman program.

Ukoliko ovim programom slucajno blokiras i neki legitiman program, javi se da ti objasnim kako da povratis na staro.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Formatirao sam flas i nakon toga se gore pomenuti fajlovi, RECYCLER i autorun.ini, vise nisu generisali. Moje skromno misljenje je da je problem bio u C:\runmgr.exe. No u svakom slucaju avira ostaje na mom racunaru, auto bloker instaliran. U kafeu sam skrenuo paznju administratorima na problem i otklonili su ga. A pre toga zelima da se zahvalim na ukazanoj pomoci i da se izvinim zbog mog neznanja, te nisam uspeo da trazene fajlove uploudujem, jer sam ih obrisao iz karantina. Jos jednim hvala bobby-u, AMF timu i celom Mycity-u. A sada log:

ComboFix 08-07-17.4 - Novum 2008-07-28 7:50:56.7 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.139 [GMT 2:00]
Running from: C:\Documents and Settings\Novum\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Novum\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-06-28 to 2008-07-28 )))))))))))))))))))))))))))))))
.

2008-07-19 06:54 . 2008-07-19 06:54 <DIR> d-------- C:\Program Files\Avira
2008-07-19 06:54 . 2008-07-19 06:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-07-12 07:11 . 2008-07-13 17:19 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-07-11 08:20 . 2004-08-03 22:58 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
2008-07-11 08:20 . 2004-08-03 22:58 14,848 --a--c--- C:\WINDOWS\system32\dllcache\kbdhid.sys
2008-07-11 08:00 . 2008-07-11 08:00 <DIR> d-------- C:\Program Files\Avanquest update
2008-07-11 08:00 . 2008-07-11 08:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\BVRP Software
2008-07-11 07:59 . 2008-07-11 07:59 <DIR> d-------- C:\Program Files\Sony Ericsson
2008-07-11 07:59 . 2008-07-11 07:59 <DIR> d-------- C:\Documents and Settings\Novum\Application Data\InstallShield
2008-07-11 07:59 . 2008-07-11 07:59 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Sony Ericsson
2008-07-07 10:24 . 2008-07-07 10:24 <DIR> d-------- C:\games
2008-07-06 08:12 . 2008-07-06 08:12 <DIR> d-------- C:\Program Files\MOSoft
2008-07-06 08:12 . 1996-01-09 10:38 283,648 --a------ C:\WINDOWS\uninst.exe
2008-07-03 17:03 . 2008-07-03 17:03 <DIR> d-------- C:\Documents and Settings\Novum\Application Data\Autodesk
2008-07-03 17:03 . 2008-07-12 07:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Autodesk

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-18 05:24 --------- d-----w C:\Program Files\Sony Setup
2008-07-15 10:20 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-30 15:05 --------- d-----w C:\Documents and Settings\Novum\Application Data\XnView
2008-04-18 13:22 46,552 ----a-w C:\Documents and Settings\Novum\Application Data\GDIPFONTCACHEV1.DAT
2007-03-20 12:26 106 ----a-w C:\Documents and Settings\Novum\Application Data\wklnhst.dat
1998-04-27 19:15 570,128 ------w C:\Program Files\Common Files\dao350.dll
1998-04-26 23:00 570,128 ----a-w C:\Program Files\DAO350.DLL
.

((((((((((((((((((((((((((((( snapshot@2008-07-19_ 7.27.03.58 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-20 18:02:28 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00 15360]
"MSMSGS"="c:\PROGRA~1\MESSEN~1\Msmsgs.exe" [2005-08-31 21:27 1658592]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2008-02-20 17:19 356352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"S7UB Start"="C:\Siemens\Common\S7ubtoox\s7ubtstx.exe" [2000-10-26 00:02 102400]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-11-23 11:47 180269]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-06-14 19:32 132760]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]
"SoundMan"="SOUNDMAN.EXE" [2005-08-01 08:28 77824 C:\WINDOWS\SOUNDMAN.EXE]
"SMSERIAL"="sm56hlpr.exe" [2005-07-06 04:47 544768 C:\WINDOWS\sm56hlpr.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 14:00 15360]

C:\Documents and Settings\Novum\Start Menu\Programs\Startup\
Stardock ObjectDock.lnk - D:\PROGRAMI\ObjectDock\ObjectDock\ObjectDock.exe [2006-03-12 08:51:37 1802309]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\fxsclnt.exe"=
"C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"C:\\Program Files\\Messenger\\Msmsgs.exe"=

R2 Dpmtrcdd;Dpmtrcdd;C:\WINDOWS\system32\DRIVERS\dpmtrcdd.sys [2001-06-27 10:59]
R2 s7osmcax;s7osmcax;C:\WINDOWS\system32\Drivers\s7osmcax.sys [2004-12-23 11:24]
R2 s7otranx;s7otranx;C:\WINDOWS\system32\Drivers\S7otranx.sys [2004-12-23 11:24]
R3 EKBfltr;ENE Keyboard Controller;C:\WINDOWS\system32\DRIVERS\EKBfltr.sys [2005-08-01 08:29]
S3 s7oefs_x;SIMATIC MPI/EFS Driver;C:\WINDOWS\system32\drivers\s7oefs_x.sys [2000-03-28 12:05]
S3 S7OUPC2X;SIMATIC PC Adapter USB Driver;C:\WINDOWS\system32\DRIVERS\s7oupc2x.sys [2005-01-14 13:01]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{726d49bf-ded5-11dc-9aab-0002e34a0ee9}]
\shell\Setup\command - setup.exe

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-28 07:53:31
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-07-28 7:55:30
ComboFix-quarantined-files.txt 2008-07-28 05:55:28
ComboFix2.txt 2008-07-25 05:07:01
ComboFix3.txt 2008-07-19 09:06:54

Pre-Run: 4,815,917,056 bytes free
Post-Run: 4,804,198,400 bytes free

94

Jos jednom hvala svima. Nadam se da je ovde kraj mojim problemima.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Jos jednom puno hvala na pomoci. Problem je resen pa i samim tim naslov se moze prepraviti i dodati reseno.

Srdacno zahvaljujem