MyCity » Ambulanta -> Arhiva Ambulante » Worm/ Autoit.MCJ

Worm/ Autoit.MCJ

Napisano na dan: 15.1.2009
2

Worm/ Autoit.MCJ
Pagination Prethodna strana
Sledeća strana Pagination

Idi na vrh

Poslao: 15 Jan 2009 23:00
Idi na vrh
offline
  • Pridružio: 15 Jan 2009
  • Poruke: 31

mycity.rs/must-login.png

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:52:01, on 15.1.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ASUS\ASUS Remote\RemoteControlAppl.exe
C:\Program Files\CyberLink\PowerCinema\PCMService.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\EXPERTool\TBPanel.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\WINDOWS\ATKKBService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgfws8.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Zorica\Desktop\pomoc\TR3.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [RemoteControl] C:\Program Files\ASUS\ASUS Remote\RemoteControlAppl.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\CyberLink\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [GAINWARD] C:\Program Files\EXPERTool\TBPanel.exe /A
O4 - Startup: Yahoo! Widgets.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
O4 - Global Startup: BlueSoleil.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: AVG8 Firewall (avgfws8-) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgfws8.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 6997 bytes

Poslao: 15 Jan 2009 23:07
Idi na vrh
offline
  • helen1  Male
  • Anti Malware Fighter
    Rank 2
  • Master učitelj
  • Pridružio: 27 Avg 2005
  • Poruke: 8620
  • Gde živiš: Novi Beograd

Izvini na gnjavazi.

Moze li i novi ComboFix log? Da potvrdimo da je ok.

Ne zaboravi da ugasis Antivirus.

Poslao: 15 Jan 2009 23:35
Idi na vrh
offline
  • Pridružio: 15 Jan 2009
  • Poruke: 31

mycity.rs/must-login.png

Pri skeniranju mi se pojavio prozor za error blue soleil -bluetoot, ali mislim da to nije nista zabrinjavajuce. U svakom slucaju evo ti log pa ti proveri jel sve uredu.

ComboFix 09-01-13.04 - Zorica 2009-01-15 23:10:37.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1535.956 [GMT 1:00]
Running from: d:\programi\Combofix\ComboFix.exe
AV: AVG Internet Security *On-access scanning disabled* (Updated)
FW: AVG Firewall *enabled*
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_AVG


((((((((((((((((((((((((( Files Created from 2008-12-15 to 2009-01-15 )))))))))))))))))))))))))))))))
.

2009-01-15 21:49 . 2009-01-15 21:58 250 --a------ c:\windows\gmer.ini
2009-01-15 10:52 . 2009-01-15 10:52 <DIR> d-------- c:\documents and settings\Zorica\Application Data\Uniblue
2009-01-15 10:21 . 2009-01-15 10:30 <DIR> d-------- c:\documents and settings\All Users\Application Data\SecTaskMan
2009-01-15 06:05 . 2009-01-15 21:23 <DIR> d-------- c:\program files\Common Files\Real
2009-01-14 23:42 . 2009-01-14 23:43 <DIR> d-------- c:\program files\Nero 9
2009-01-10 21:01 . 2009-01-15 03:13 <DIR> d-------- c:\program files\Picasa2
2009-01-10 18:23 . 2009-01-10 18:23 0 -rahs---- C:\khs
2009-01-10 18:14 . 2009-01-14 23:02 <DIR> d-------- c:\program files\Ahead
2009-01-10 17:50 . 2009-01-10 17:50 <DIR> d-------- c:\windows\Performance
2009-01-10 17:50 . 2009-01-10 17:58 <DIR> d-------- c:\documents and settings\All Users\Application Data\Microsoft Corporation
2009-01-06 23:16 . 2009-01-06 23:16 <DIR> d-------- c:\program files\Yahoo!
2008-12-23 18:06 . 2008-12-23 18:06 <DIR> d-------- c:\windows\system32\AGEIA
2008-12-23 18:06 . 2008-12-23 18:06 <DIR> d-------- c:\program files\AGEIA Technologies
2008-12-23 18:03 . 2009-01-15 23:12 200,819 --a------ c:\windows\system32\nvapps.xml
2008-12-23 18:02 . 2008-12-23 18:02 <DIR> d-------- c:\windows\nview
2008-12-23 18:02 . 2008-10-21 11:14 453,152 --a------ c:\windows\system32\nvudisp.exe
2008-12-23 18:02 . 2008-10-21 11:14 18,477 --a------ c:\windows\system32\nvdisp.nvu
2008-12-23 18:01 . 2008-12-23 18:01 <DIR> d-------- c:\program files\EXPERTool
2008-12-23 18:01 . 2007-03-16 10:11 12,256 --a------ c:\windows\system32\drivers\TBPanel.sys
2008-12-21 14:48 . 2008-12-21 14:50 <DIR> d-------- c:\program files\SystemRequirementsLab
2008-12-21 14:48 . 2008-12-21 14:48 <DIR> d-------- c:\documents and settings\Zorica\Application Data\SystemRequirementsLab
2008-12-20 01:52 . 2008-12-20 01:52 <DIR> d-------- c:\program files\NOS
2008-12-20 01:52 . 2008-12-20 01:52 <DIR> d-------- c:\documents and settings\All Users\Application Data\NOS
2008-12-19 00:15 . 2008-12-19 00:15 <DIR> d-------- c:\program files\TimeAdjuster
2008-12-17 23:11 . 2008-12-17 23:27 <DIR> d-------- c:\program files\GameFace Messenger
2008-12-17 23:11 . 2008-12-17 23:11 737,280 --a------ c:\windows\iun6002.exe
2008-12-17 22:52 . 2008-12-17 22:52 <DIR> d-------- C:\ATI
2008-12-17 04:02 . 2009-01-10 18:06 355,584 --a------ c:\windows\system32\TuneUpDefragService.exe
2008-12-17 04:02 . 2008-05-29 09:28 28,416 --a------ c:\windows\system32\uxtuneup.dll
2008-12-15 23:10 . 2004-09-20 16:00 802,816 --a------ c:\windows\FeedingFrenzy.scr
2008-12-15 23:10 . 2005-01-07 11:39 57,344 --a------ c:\windows\system32\Big Kahuna Reef.scr
2008-12-15 00:44 . 2008-12-15 00:44 <DIR> d-------- c:\documents and settings\Zorica\Application Data\URSoft
2008-12-15 00:44 . 2008-12-15 00:45 <DIR> d-a------ c:\documents and settings\All Users\Application Data\TEMP

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-15 16:03 325,128 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-01-15 09:04 --------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-01-15 05:05 499,712 ----a-w c:\windows\system32\msvcp71.dll
2009-01-15 05:05 348,160 ----a-w c:\windows\system32\msvcr71.dll
2009-01-14 22:43 --------- d-----w c:\program files\Common Files\Nero
2009-01-14 22:43 --------- d-----w c:\documents and settings\Zorica\Application Data\Nero
2009-01-10 17:15 --------- d-----w c:\documents and settings\Zorica\Application Data\Ahead
2009-01-10 17:06 --------- d-----w c:\program files\TuneUp Utilities 2008
2009-01-10 16:39 --------- d-----w c:\documents and settings\All Users\Application Data\Nero
2009-01-08 00:34 10,520 ----a-w c:\windows\system32\avgrsstx.dll
2009-01-08 00:33 12,552 ----a-w c:\windows\system32\drivers\avgrkx86.sys
2009-01-08 00:33 107,272 ----a-w c:\windows\system32\drivers\avgtdix.sys
2008-12-23 17:05 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-12-20 17:55 --------- d-----w c:\documents and settings\Zorica\Application Data\Wildfire
2008-12-18 01:49 --------- d-----w c:\program files\ASUS
2008-12-17 22:27 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-14 19:08 --------- d-----w c:\program files\Realtek
2008-12-14 18:35 --------- d-----w c:\program files\Driver-Soft
2008-12-12 00:43 --------- d-----w c:\documents and settings\Zorica\Application Data\Darwin
2008-12-12 00:40 --------- d-----w c:\documents and settings\Zorica\Application Data\Thinstall
2008-12-11 22:40 --------- d-----w c:\documents and settings\Zorica\Application Data\AdobeUM
2008-12-11 22:30 --------- d-----w c:\program files\Common Files\Adobe
2008-12-11 20:43 --------- d-----w c:\documents and settings\All Users\Application Data\Phenomedia
2008-12-11 11:57 333,184 ----a-w c:\windows\system32\drivers\srv.sys
2008-12-11 02:29 --------- d-----w c:\documents and settings\Zorica\Application Data\AVGTOOLBAR
2008-12-11 00:15 50,968 ----a-w c:\windows\system32\avgfwdx.dll
2008-12-11 00:15 29,208 ----a-w c:\windows\system32\drivers\avgfwdx.sys
2008-12-11 00:06 --------- d-----w c:\program files\Canon
2008-12-10 04:40 --------- d-----w c:\program files\MSXML 4.0
2008-12-10 03:32 218,624 ----a-w c:\windows\system32\uxtheme.dll
2008-12-09 23:45 --------- d-----w c:\program files\AVG
2008-12-09 23:42 --------- d-----w c:\program files\ESET
2008-12-09 20:51 --------- d-----w c:\program files\Common Files\Adobe AIR
2008-12-09 01:56 --------- d-----w c:\documents and settings\All Users\Application Data\Bluetooth
2008-12-09 01:50 --------- d-----w c:\program files\IVT Corporation
2008-12-08 23:57 410,984 ----a-w c:\windows\system32\deploytk.dll
2008-12-08 23:56 --------- d-----w c:\program files\Java
2008-12-08 14:59 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-12-08 02:55 --------- d-----w c:\documents and settings\All Users\Application Data\avg8(2)
2008-12-08 02:51 --------- d-----w c:\documents and settings\Zorica\Application Data\aAvgApi
2008-12-08 02:08 241,664 ----a-w c:\windows\system32\config\systemprofile\NTUSER(2).DAT
2008-12-07 21:18 --------- d-----w c:\program files\Rockstar Games
2008-12-07 21:18 --------- d-----w c:\documents and settings\Zorica\Application Data\InstallShield Installation Information
2008-12-04 22:44 --------- d-----w c:\program files\Microsoft
2008-12-02 09:55 --------- d-----w c:\documents and settings\Zorica\Application Data\Canon
2008-11-26 23:41 --------- d-----w c:\documents and settings\Zorica\Application Data\Media Player Classic
2008-11-25 15:37 4,952,576 ----a-w c:\windows\system32\drivers\RtkHDAud.sys
2008-11-24 02:14 --------- d-----w c:\program files\Winamp
2008-11-24 02:14 --------- d-----w c:\documents and settings\Zorica\Application Data\Winamp
2008-11-24 01:43 --------- d-----w c:\program files\K-Lite Codec Pack
2008-11-24 00:31 --------- d-----w c:\documents and settings\Zorica\Application Data\CyberLink
2008-11-24 00:31 --------- d-----w c:\documents and settings\All Users\Application Data\CyberLink
2008-11-24 00:27 --------- d-----w c:\program files\CyberLink
2008-11-23 22:18 --------- d-----w c:\program files\Microsoft ActiveSync
2008-11-23 22:14 --------- d-----w c:\program files\Microsoft.NET
2008-11-23 22:09 --------- d-----w c:\documents and settings\Zorica\Application Data\TuneUp Software
2008-11-23 22:09 --------- d-----w c:\documents and settings\All Users\Application Data\TuneUp Software
2008-11-23 22:04 --------- d-----w c:\program files\Webteh
2008-11-23 21:49 --------- d-----w c:\program files\My Company Name
2008-11-23 21:44 --------- d-----w c:\program files\Common Files\InstallShield
2008-11-23 21:29 --------- d-----w c:\program files\microsoft frontpage
2008-11-20 15:51 34,816 ----a-w c:\windows\system32\RtkCoInstXP.dll
2008-11-17 15:08 17,676,288 ----a-w c:\windows\RTHDCPL.EXE
2008-10-23 13:01 283,648 ----a-w c:\windows\system32\gdi32.dll
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 10:37 659,456 ----a-w c:\windows\system32\wininet.dll
.

((((((((((((((((((((((((((((( snapshot@2009-01-15_18.18.46.10 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-01-15 20:49:22 884,736 ----a-w c:\windows\gmer.dll
+ 2008-04-17 20:13:02 811,008 ----a-w c:\windows\gmer.exe
+ 2009-01-15 20:49:22 85,969 ----a-w c:\windows\system32\drivers\gmer.sys
+ 2009-01-15 22:13:32 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_1a8.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"GAINWARD"="c:\program files\EXPERTool\TBPanel.exe" [2008-10-21 2177576]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RemoteControl"="c:\program files\ASUS\ASUS Remote\RemoteControlAppl.exe" [2007-02-12 65536]
"PCMService"="c:\program files\CyberLink\PowerCinema\PCMService.exe" [2007-02-09 159744]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-09 136600]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-01-08 1601304]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-21 13574144]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-21 86016]
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2005-02-05 135168]
"RTHDCPL"="RTHDCPL.EXE" [2008-11-17 c:\windows\RTHDCPL.EXE]
"nwiz"="nwiz.exe" [2008-10-21 c:\windows\system32\nwiz.exe]

c:\documents and settings\Zorica\Start Menu\Programs\Startup\
Yahoo! Widgets.lnk - c:\program files\Yahoo!\Widgets\YahooWidgets.exe [2008-03-19 4742184]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
BlueSoleil.lnk - c:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2008-12-09 1183744]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-01-08 01:34 10520 c:\windows\system32\avgrsstx.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=c:\windows\system32\CTFMON.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"WinampAgent"=c:\program files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\CyberLink\\PowerCinema\\PowerCinema.exe"=
"c:\\Program Files\\CyberLink\\PowerCinema\\PCMService.exe"=
"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2008-12-10 12552]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-12-10 325128]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-12-10 107272]
R3 3xHybrid;ASUSTek SAA713x PCI Card;c:\windows\system32\drivers\3xHybrid.sys [2008-11-23 2831232]
R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [2008-12-10 29208]
R4 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-01-08 903960]
R4 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-01-08 298264]
R4 avgfws8;AVG8 Firewall;c:\progra~1\AVG\AVG8\avgfws8.exe [2009-01-08 1339600]
S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [2008-12-10 29208]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2008-12-20 33752]
S3 zlportio;zlportio;\??\c:\program files\UltraStar Deluxe\zlportio.sys --> c:\program files\UltraStar Deluxe\zlportio.sys [?]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder

2009-01-02 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2008\OneClick.exe [2008-06-20 09:09]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com
mStart Page = hxxp://www.yahoo.com
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Zorica\Application Data\Mozilla\Firefox\Profiles\u2mmkfgc.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.rs/
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npyaxmpb.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, gmer.net
Rootkit scan 2009-01-15 23:13:37
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
"ImagePath"="\"c:\program files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe\"\00\00\00\00\000c|\023\00\00\00\00\00E\02\18î|\00\00\00\00~\00\00\00?Öë\02’“€|~\00\00\00x\01\15\00 O
[\00E\1d€|ö\1b€|\00\00Ýs1?f|"

.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\rundll32.exe
c:\windows\ATKKBService.exe
c:\program files\IVT Corporation\BlueSoleil\BTNtService.exe
c:\program files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\program files\CyberLink\Shared files\RichVideo.exe
c:\progra~1\AVG\AVG8\avgam.exe
c:\windows\system32\wdfmgr.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\program files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
.
**************************************************************************
.
Completion time: 2009-01-15 23:14:52 - machine was rebooted
ComboFix-quarantined-files.txt 2009-01-15 22:14:48
ComboFix2.txt 2009-01-15 19:55:55
ComboFix3.txt 2009-01-15 17:19:20

Pre-Run: 12.527.452.160 bytes free
Post-Run: 12,515,667,968 bytes free

241 --- E O F --- 2009-01-13 22:29:49

Poslao: 16 Jan 2009 13:46
Idi na vrh
offline
  • helen1  Male
  • Anti Malware Fighter
    Rank 2
  • Master učitelj
  • Pridružio: 27 Avg 2005
  • Poruke: 8620
  • Gde živiš: Novi Beograd

Preuzmi The Avenger na Desktop.
Raspakuj arhivu u neki folder

Dvoklikom pokreni avenger.exe

Iskopiraj tekst koji se nalazi unutar Kod polja u (beli) prozor programa:

Drivers to delete:
AVG


Klikni Execute, a zatim Yes u sledeća dva prozora koji će se otvoriti

Kompjuter će se restartovati (u određenim slučajevima: dva puta) i započeti će proces čišćenja/skeniranja

Kada proces bude završen, logfile C:\avenger.txt će se otvoriti u Notepad-u
Iskopiraj sadržaj dobijenog loga u temu na forumu.

Poslao: 16 Jan 2009 15:30
Idi na vrh
offline
  • Pridružio: 15 Jan 2009
  • Poruke: 31

Nisam bas razumela. Da li posle restarta treba ponovo da pokrenem avenger,posto se nista nije desilo nakon 2 restarta?

Poslao: 16 Jan 2009 15:48
Idi na vrh
offline
  • helen1  Male
  • Anti Malware Fighter
    Rank 2
  • Master učitelj
  • Pridružio: 27 Avg 2005
  • Poruke: 8620
  • Gde živiš: Novi Beograd

A, jel ima mozda loga na C:\avenger.txt ?

Poslao: 16 Jan 2009 15:59
Idi na vrh
offline
  • Pridružio: 15 Jan 2009
  • Poruke: 31

Izvini,evo ga :

Logfile of The Avenger Version 2.0, (c) by Swandog46
swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

Driver "AVG" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.


Zanima me da li mogu sad da obrisem sve te programe?

Poslao: 16 Jan 2009 16:22
Idi na vrh
offline
  • helen1  Male
  • Anti Malware Fighter
    Rank 2
  • Master učitelj
  • Pridružio: 27 Avg 2005
  • Poruke: 8620
  • Gde živiš: Novi Beograd

Iskljuci Antivirus i ponovo skeniraj sa ComboFixom.

Poslao: 16 Jan 2009 16:50
Idi na vrh
offline
  • Pridružio: 15 Jan 2009
  • Poruke: 31

mycity.rs/must-login.png

ComboFix 09-01-13.04 - Zorica 2009-01-16 16:33:54.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1535.873 [GMT 1:00]
Running from: d:\programi\Combofix\ComboFix.exe
AV: AVG Internet Security *On-access scanning disabled* (Updated)
FW: AVG Firewall *enabled*
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_AVG


((((((((((((((((((((((((( Files Created from 2008-12-16 to 2009-01-16 )))))))))))))))))))))))))))))))
.

2009-01-16 15:16 . 2009-01-16 15:16 292 --a------ C:\backup.reg
2009-01-15 21:49 . 2009-01-15 21:58 250 --a------ c:\windows\gmer.ini
2009-01-15 10:52 . 2009-01-15 10:52 <DIR> d-------- c:\documents and settings\Zorica\Application Data\Uniblue
2009-01-15 10:21 . 2009-01-15 10:30 <DIR> d-------- c:\documents and settings\All Users\Application Data\SecTaskMan
2009-01-15 06:05 . 2009-01-15 21:23 <DIR> d-------- c:\program files\Common Files\Real
2009-01-14 23:42 . 2009-01-14 23:43 <DIR> d-------- c:\program files\Nero 9
2009-01-10 21:01 . 2009-01-15 03:13 <DIR> d-------- c:\program files\Picasa2
2009-01-10 18:23 . 2009-01-10 18:23 0 -rahs---- C:\khs
2009-01-10 18:14 . 2009-01-14 23:02 <DIR> d-------- c:\program files\Ahead
2009-01-10 17:50 . 2009-01-10 17:50 <DIR> d-------- c:\windows\Performance
2009-01-10 17:50 . 2009-01-10 17:58 <DIR> d-------- c:\documents and settings\All Users\Application Data\Microsoft Corporation
2009-01-06 23:16 . 2009-01-06 23:16 <DIR> d-------- c:\program files\Yahoo!
2008-12-23 18:06 . 2008-12-23 18:06 <DIR> d-------- c:\windows\system32\AGEIA
2008-12-23 18:06 . 2008-12-23 18:06 <DIR> d-------- c:\program files\AGEIA Technologies
2008-12-23 18:03 . 2009-01-16 16:36 200,819 --a------ c:\windows\system32\nvapps.xml
2008-12-23 18:02 . 2008-12-23 18:02 <DIR> d-------- c:\windows\nview
2008-12-23 18:02 . 2008-10-21 11:14 453,152 --a------ c:\windows\system32\nvudisp.exe
2008-12-23 18:02 . 2008-10-21 11:14 18,477 --a------ c:\windows\system32\nvdisp.nvu
2008-12-23 18:01 . 2008-12-23 18:01 <DIR> d-------- c:\program files\EXPERTool
2008-12-23 18:01 . 2007-03-16 10:11 12,256 --a------ c:\windows\system32\drivers\TBPanel.sys
2008-12-21 14:48 . 2008-12-21 14:50 <DIR> d-------- c:\program files\SystemRequirementsLab
2008-12-21 14:48 . 2008-12-21 14:48 <DIR> d-------- c:\documents and settings\Zorica\Application Data\SystemRequirementsLab
2008-12-20 01:52 . 2008-12-20 01:52 <DIR> d-------- c:\program files\NOS
2008-12-20 01:52 . 2008-12-20 01:52 <DIR> d-------- c:\documents and settings\All Users\Application Data\NOS
2008-12-19 00:15 . 2008-12-19 00:15 <DIR> d-------- c:\program files\TimeAdjuster
2008-12-17 23:11 . 2008-12-17 23:27 <DIR> d-------- c:\program files\GameFace Messenger
2008-12-17 23:11 . 2008-12-17 23:11 737,280 --a------ c:\windows\iun6002.exe
2008-12-17 22:52 . 2008-12-17 22:52 <DIR> d-------- C:\ATI
2008-12-17 04:02 . 2009-01-10 18:06 355,584 --a------ c:\windows\system32\TuneUpDefragService.exe
2008-12-17 04:02 . 2008-05-29 09:28 28,416 --a------ c:\windows\system32\uxtuneup.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-15 22:53 --------- d-----w c:\program files\TuneUp Utilities 2008
2009-01-15 16:03 325,128 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-01-15 09:04 --------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-01-15 05:05 499,712 ----a-w c:\windows\system32\msvcp71.dll
2009-01-15 05:05 348,160 ----a-w c:\windows\system32\msvcr71.dll
2009-01-14 22:43 --------- d-----w c:\program files\Common Files\Nero
2009-01-14 22:43 --------- d-----w c:\documents and settings\Zorica\Application Data\Nero
2009-01-10 17:15 --------- d-----w c:\documents and settings\Zorica\Application Data\Ahead
2009-01-10 16:39 --------- d-----w c:\documents and settings\All Users\Application Data\Nero
2009-01-08 00:34 10,520 ----a-w c:\windows\system32\avgrsstx.dll
2009-01-08 00:33 12,552 ----a-w c:\windows\system32\drivers\avgrkx86.sys
2009-01-08 00:33 107,272 ----a-w c:\windows\system32\drivers\avgtdix.sys
2008-12-23 17:05 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-12-20 17:55 --------- d-----w c:\documents and settings\Zorica\Application Data\Wildfire
2008-12-18 01:49 --------- d-----w c:\program files\ASUS
2008-12-17 22:27 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-14 23:45 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-12-14 23:44 --------- d-----w c:\documents and settings\Zorica\Application Data\URSoft
2008-12-14 19:08 --------- d-----w c:\program files\Realtek
2008-12-14 18:35 --------- d-----w c:\program files\Driver-Soft
2008-12-12 00:43 --------- d-----w c:\documents and settings\Zorica\Application Data\Darwin
2008-12-12 00:40 --------- d-----w c:\documents and settings\Zorica\Application Data\Thinstall
2008-12-11 22:40 --------- d-----w c:\documents and settings\Zorica\Application Data\AdobeUM
2008-12-11 22:30 --------- d-----w c:\program files\Common Files\Adobe
2008-12-11 20:43 --------- d-----w c:\documents and settings\All Users\Application Data\Phenomedia
2008-12-11 11:57 333,184 ----a-w c:\windows\system32\drivers\srv.sys
2008-12-11 02:29 --------- d-----w c:\documents and settings\Zorica\Application Data\AVGTOOLBAR
2008-12-11 00:15 50,968 ----a-w c:\windows\system32\avgfwdx.dll
2008-12-11 00:15 29,208 ----a-w c:\windows\system32\drivers\avgfwdx.sys
2008-12-11 00:06 --------- d-----w c:\program files\Canon
2008-12-10 04:40 --------- d-----w c:\program files\MSXML 4.0
2008-12-10 03:32 218,624 ----a-w c:\windows\system32\uxtheme.dll
2008-12-09 23:45 --------- d-----w c:\program files\AVG
2008-12-09 23:42 --------- d-----w c:\program files\ESET
2008-12-09 20:51 --------- d-----w c:\program files\Common Files\Adobe AIR
2008-12-09 01:56 --------- d-----w c:\documents and settings\All Users\Application Data\Bluetooth
2008-12-09 01:50 --------- d-----w c:\program files\IVT Corporation
2008-12-08 23:57 410,984 ----a-w c:\windows\system32\deploytk.dll
2008-12-08 23:56 --------- d-----w c:\program files\Java
2008-12-08 14:59 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-12-08 02:55 --------- d-----w c:\documents and settings\All Users\Application Data\avg8(2)
2008-12-08 02:51 --------- d-----w c:\documents and settings\Zorica\Application Data\aAvgApi
2008-12-08 02:08 241,664 ----a-w c:\windows\system32\config\systemprofile\NTUSER(2).DAT
2008-12-07 21:18 --------- d-----w c:\program files\Rockstar Games
2008-12-07 21:18 --------- d-----w c:\documents and settings\Zorica\Application Data\InstallShield Installation Information
2008-12-04 22:44 --------- d-----w c:\program files\Microsoft
2008-12-02 09:55 --------- d-----w c:\documents and settings\Zorica\Application Data\Canon
2008-11-26 23:41 --------- d-----w c:\documents and settings\Zorica\Application Data\Media Player Classic
2008-11-25 15:37 4,952,576 ----a-w c:\windows\system32\drivers\RtkHDAud.sys
2008-11-24 02:14 --------- d-----w c:\program files\Winamp
2008-11-24 02:14 --------- d-----w c:\documents and settings\Zorica\Application Data\Winamp
2008-11-24 01:43 --------- d-----w c:\program files\K-Lite Codec Pack
2008-11-24 00:31 --------- d-----w c:\documents and settings\Zorica\Application Data\CyberLink
2008-11-24 00:31 --------- d-----w c:\documents and settings\All Users\Application Data\CyberLink
2008-11-24 00:27 --------- d-----w c:\program files\CyberLink
2008-11-23 22:18 --------- d-----w c:\program files\Microsoft ActiveSync
2008-11-23 22:14 --------- d-----w c:\program files\Microsoft.NET
2008-11-23 22:09 --------- d-----w c:\documents and settings\Zorica\Application Data\TuneUp Software
2008-11-23 22:09 --------- d-----w c:\documents and settings\All Users\Application Data\TuneUp Software
2008-11-23 22:04 --------- d-----w c:\program files\Webteh
2008-11-23 21:49 --------- d-----w c:\program files\My Company Name
2008-11-23 21:44 --------- d-----w c:\program files\Common Files\InstallShield
2008-11-23 21:29 --------- d-----w c:\program files\microsoft frontpage
2008-11-20 15:51 34,816 ----a-w c:\windows\system32\RtkCoInstXP.dll
2008-11-17 15:08 17,676,288 ----a-w c:\windows\RTHDCPL.EXE
2008-10-23 13:01 283,648 ----a-w c:\windows\system32\gdi32.dll
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 10:37 659,456 ----a-w c:\windows\system32\wininet.dll
.

((((((((((((((((((((((((((((( snapshot@2009-01-15_18.18.46.10 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-01-15 20:49:22 884,736 ----a-w c:\windows\gmer.dll
+ 2008-04-17 20:13:02 811,008 ----a-w c:\windows\gmer.exe
+ 2009-01-15 20:49:22 85,969 ----a-w c:\windows\system32\drivers\gmer.sys
+ 2009-01-16 15:36:09 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_2ec.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"GAINWARD"="c:\program files\EXPERTool\TBPanel.exe" [2008-10-21 2177576]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RemoteControl"="c:\program files\ASUS\ASUS Remote\RemoteControlAppl.exe" [2007-02-12 65536]
"PCMService"="c:\program files\CyberLink\PowerCinema\PCMService.exe" [2007-02-09 159744]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-09 136600]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-01-08 1601304]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-21 13574144]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-21 86016]
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2005-02-05 135168]
"RTHDCPL"="RTHDCPL.EXE" [2008-11-17 c:\windows\RTHDCPL.EXE]
"nwiz"="nwiz.exe" [2008-10-21 c:\windows\system32\nwiz.exe]

c:\documents and settings\Zorica\Start Menu\Programs\Startup\
Yahoo! Widgets.lnk - c:\program files\Yahoo!\Widgets\YahooWidgets.exe [2008-03-19 4742184]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
BlueSoleil.lnk - c:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2008-12-09 1183744]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-01-08 01:34 10520 c:\windows\system32\avgrsstx.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=c:\windows\system32\CTFMON.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"WinampAgent"=c:\program files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\CyberLink\\PowerCinema\\PowerCinema.exe"=
"c:\\Program Files\\CyberLink\\PowerCinema\\PCMService.exe"=
"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2008-12-10 12552]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-12-10 325128]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-12-10 107272]
R3 3xHybrid;ASUSTek SAA713x PCI Card;c:\windows\system32\drivers\3xHybrid.sys [2008-11-23 2831232]
R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [2008-12-10 29208]
R4 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-01-08 903960]
R4 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-01-08 298264]
R4 avgfws8;AVG8 Firewall;c:\progra~1\AVG\AVG8\avgfws8.exe [2009-01-08 1339600]
S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [2008-12-10 29208]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2008-12-20 33752]
S3 zlportio;zlportio;\??\c:\program files\UltraStar Deluxe\zlportio.sys --> c:\program files\UltraStar Deluxe\zlportio.sys [?]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder

2009-01-02 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2008\OneClick.exe [2008-06-20 09:09]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com
mStart Page = hxxp://www.yahoo.com
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Zorica\Application Data\Mozilla\Firefox\Profiles\u2mmkfgc.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.rs/
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npyaxmpb.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, gmer.net
Rootkit scan 2009-01-16 16:36:15
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
"ImagePath"="\"c:\program files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe\"\00\00\00\00\000c|\023\00\00\00\00\00E\02\18î|\00\00\00\00~\00\00\00?Öë\02’“€|~\00\00\00x\01\15\00 O
[\00E\1d€|ö\1b€|\00\00Ýs1?f|"

.
------------------------ Other Running Processes ------------------------
.
c:\windows\ATKKBService.exe
c:\program files\IVT Corporation\BlueSoleil\BTNtService.exe
c:\program files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\program files\CyberLink\Shared files\RichVideo.exe
c:\windows\system32\wdfmgr.exe
c:\progra~1\AVG\AVG8\avgam.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\windows\system32\rundll32.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\program files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
.
**************************************************************************
.
Completion time: 2009-01-16 16:37:38 - machine was rebooted
ComboFix-quarantined-files.txt 2009-01-16 15:37:34
ComboFix2.txt 2009-01-15 22:14:53
ComboFix3.txt 2009-01-15 19:55:55
ComboFix4.txt 2009-01-15 17:19:20

Pre-Run: 13.285.924.864 bytes free
Post-Run: 13,274,169,344 bytes free

239 --- E O F --- 2009-01-13 22:29:49

Poslao: 16 Jan 2009 19:51
Idi na vrh
offline
  • helen1  Male
  • Anti Malware Fighter
    Rank 2
  • Master učitelj
  • Pridružio: 27 Avg 2005
  • Poruke: 8620
  • Gde živiš: Novi Beograd

Ovo se zakomplikovalo. Bebee Dol

Preuzmi The Avenger na Desktop.
Raspakuj arhivu u neki folder

Dvoklikom pokreni avenger.exe

Iskopiraj tekst koji se nalazi unutar Kod polja u (beli) prozor programa:

Files to delete:
c:\windows\avgav.exe

Drivers to delete:
AVG


Klikni Execute, a zatim Yes u sledeća dva prozora koji će se otvoriti

Kompjuter će se restartovati (u određenim slučajevima: dva puta) i započeti će proces čišćenja/skeniranja

Kada proces bude završen, logfile C:\avenger.txt će se otvoriti u Notepad-u
Iskopiraj sadržaj dobijenog loga u temu na forumu.

MyCity » Ambulanta -> Arhiva Ambulante » Worm/ Autoit.MCJ

Ko je trenutno na forumu
 

Ukupno su 1018 korisnika na forumu :: 39 registrovanih, 5 sakrivenih i 974 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: amaterSRB, bobomicek, bojankrstc, bojcistv, bokisha253, Dannyboy, Darko001, ILGromovnik, Joja, krasta, krkalon, ladro, leonard, ljuba, loon123, Lucije Kvint, M1los, mercedesamg, Metanoja, Mi lao shu, milenko crazy north, Milos ZA, mkukoleca, mnn2, nebkv, nesa1962, nextyamb, nikoladim, Parker, sokars, User98, vathra, Vlada78, vladaa012, voja64, Yellow Pinky, YU-UKI, zafon031, zhuki8