[bobby]Brontok virus i trojanci

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

joj nisam ,treba burazeru i sestri komp ali kao sto rekoh juce ako treba bolje da ga donesem kod mene.A sta treba da se radi

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Moracu da te uputim da skines jedan program od 9mb. Komp je poprilicno zarazen, pa cemo morati da pokusamo da ga ocistimo uz pomoc jednog besplatnog antivirus programa.

Preuzmi Dr.Web CureIt (~9 MB).
Restartuj kompjuter u Safe Mode (uputstvo za Safe Mode)

Dvoklikom pokreni cureit.exe, nakon čega će se pojaviti uvodni prozor - klikni Start

Pojaviće se obaveštenje o započinjanju uvodnog skeniranja - klikni OK

Sačekaj nekoliko minuta da Dr.Web CureIt izvrši Express Scan; ukoliko malware bude pronađen, klikom na taster Yes to All u prozoru koji se pojavi dozvoli programu da izvrši dezinfekciju

Klikni Options > Change settings F9; u prozoru koji će se otvoriti, dečekiraj opciju Heuristic Analysis a zatim klikni OK

U glavnom prozoru obeleži opciju Complete scan a zatim klikni i Dr.Web CureIt će započeti skeniranje

Ukoliko malware bude pronađen, klikom na taster Yes to All u prozoru koji se pojavi dozvoli programu da izvrši dezinfekciju

Kada skeniranje bude završeno, klikni Select all taster (ukoliko je dostupan), a zatim klikni Cure i,
u meniju koji se otvori, klikni Move incurable:


Po završetku procesa, klikni File > Save report list i sačuvaj log na Desktopu

Iskopiraj sadržaj Dr.Web CureIt loga u temu na forumu.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Uloguj se preko Facebooka da bi skinuo fajl:

Ovaj fajl ima 11,9 MB ali nema veze samo ona predposlednja stavka da kliknem na taster SELECT ALL ako je dostupan .A sta ako nije?

Nadam se da ces biti strpljiv sa ovim mojim slucajem zbog fizicke udaljenosti mog racunara i zarazenog.Pozz

Dopuna: 28 Nov 2008 20:32

Pronasao je oko 3600 zarazenih fajlova.Nakon toga nije po podizanju sistema automatski otvorio tri My Documents foldera i nema vise nigde foldera koji je svuda bio a zarazen je .Ne znam da li je to to ali evo ispod Dr.Web CureIt loga koji je napravljen

mycity.rs/must-login.png

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Moguce je da je fajl sada veci. Mi smo ovo proverili pre par meseci, a od tada su sigurno dodali jos nesto.

Sto se tice loga - WOW

Zao mi je sto se nisam setio u prethodnoj poruci da napisem, ali bi mi sada posle ovog ciscenja bio potreban ComboFix log (nov) i HijackThis log, da vidim da li je ostalo jos necega sto mozda CureIt nije prepoznao, i da pocistimo registry kljuceve odakle su se ove napasti startovale.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Znaci prvo combo pa hijack this novi logovi .Odgovori mi samo da li je tako i idem da odradim a ti samo budi budan,brzo cu veruj mi.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Tako, tim redom.
Tu cu ja da budem. Sutra ne radim, tako da cu sigurno do ponoci biti ispred kompa

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Au izvini iskrsle mi neke obaveze ,ali ako sutra ne radis a ne radim ni ja postovacu logove pre podne negde do 12.Pozdrav i jos jednom hvala ti na trudu i strpljenju.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

OK. Citamo se onda sutra

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Evo novih Combofix i Hijackthis logova
Prvo combofix

ComboFix 08-11-27.07 - MiliMare 2008-11-29 11:14:42.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1251.381.1033.18.274 [GMT 1:00]
Running from: c:\documents and settings\MiliMare\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_POWERMANAGER


((((((((((((((((((((((((( Files Created from 2008-10-28 to 2008-11-29 )))))))))))))))))))))))))))))))
.

2008-11-28 16:20 . 2008-11-28 16:21 <DIR> d-------- c:\documents and settings\MiliMare\DoctorWeb
2008-11-24 19:21 . 2008-11-28 16:26 <DIR> d-------- c:\documents and settings\Administrator
2008-11-24 16:27 . 2008-11-24 16:27 <DIR> d-------- c:\program files\Microsoft Games
2008-11-24 15:46 . 2008-11-25 16:04 <DIR> d-------- c:\windows\system32\drivers\Avg
2008-11-24 15:46 . 2008-11-24 15:46 <DIR> d-------- c:\program files\AVG
2008-11-24 15:46 . 2008-11-24 15:46 <DIR> d-------- c:\documents and settings\MiliMare\Application Data\AVGTOOLBAR
2008-11-24 15:46 . 2008-11-25 16:04 <DIR> d-------- c:\documents and settings\All Users\Application Data\avg8
2008-11-24 15:46 . 2008-11-24 15:46 97,928 --a------ c:\windows\system32\drivers\avgldx86.sys
2008-11-24 15:46 . 2008-11-24 15:46 76,040 --a------ c:\windows\system32\drivers\avgtdix.sys
2008-11-22 16:46 . 2008-11-22 16:46 <DIR> d--h----- c:\windows\PIF
2008-11-15 12:03 . 2008-11-27 18:25 <DIR> d-------- c:\program files\Sistemska mapa
2008-11-12 22:19 . 2006-11-11 04:43 487,328 -ra------ c:\windows\system32\drivers\LV561AV.SYS

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-28 17:28 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-28 17:21 45,056 ----a-w c:\windows\NCUNINST.EXE
2008-11-28 16:52 --------- d-----w c:\program files\VVSN
2008-11-19 08:14 --------- d-----w c:\program files\SuperTux
2008-11-17 20:15 --------- d-----w c:\program files\Winamp
2008-11-17 20:15 --------- d-----w c:\program files\DecjaEnc
2008-11-17 20:15 --------- d-----w c:\program files\Canon
2008-11-12 22:02 --------- d-----w c:\program files\Izzy_CD
2008-10-24 17:38 --------- d-----w c:\program files\Common Files\Blizzard Entertainment
2008-10-24 17:32 --------- d-----w c:\program files\Delicious Deluxe
2008-10-24 17:29 --------- d-----w c:\program files\Word Emperor
2008-10-24 17:28 --------- d-----w c:\program files\Warblade
2008-10-01 12:13 --------- d-----w c:\program files\Midway
2008-09-29 13:36 223,128 ----a-w c:\windows\system32\drivers\dtscsi.sys
2008-09-21 17:01 7,168 --sha-w c:\program files\Thumbs.db
2008-09-01 14:39 107,888 ----a-w c:\windows\system32\CmdLineExt.dll
2007-12-10 19:14 317 ----a-w c:\documents and settings\MiliMare\Application Data\bbbconfig.dat
2004-08-03 23:56 1,392,671 --sh--r c:\windows\system32\msvbvm60.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-04 1667584]
"NBJ"="c:\progra~1\Ahead\NEROBA~1\NBJ.exe" [2005-02-10 1937408]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-11-22 118784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"LogitechCommunicationsManager"="c:\program files\Common Files\Logitech\LComMgr\Communications_Helper.exe" [2006-10-31 284184]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam10\QuickCam10.exe" [2006-11-15 746520]
"Easy-PrintToolBox"="c:\program files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" [2006-10-17 398944]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2005-12-10 133016]
"RTHDCPL"="RTHDCPL.EXE" [2007-05-10 c:\windows\RTHDCPL.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

c:\documents and settings\MiliMare\Start Menu\Programs\Startup\
PowerReg Scheduler V3.exe [2007-12-13 225280]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-22 734872]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Documents and Settings\\MiliMare\\Desktop\\hltv.exe"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"18137:TCP"= 18137:TCP:NortonAV
"18648:TCP"= 18648:TCP:NortonAV
"15967:TCP"= 15967:TCP:NortonAV
"16440:TCP"= 16440:TCP:NortonAV
"17876:TCP"= 17876:TCP:NortonAV
"18041:TCP"= 18041:TCP:NortonAV
"18892:TCP"= 18892:TCP:NortonAV
"13872:TCP"= 13872:TCP:NortonAV
"14952:TCP"= 14952:TCP:NortonAV
"12575:TCP"= 12575:TCP:NortonAV
"15259:TCP"= 15259:TCP:NortonAV
"14890:TCP"= 14890:TCP:NortonAV
"16366:TCP"= 16366:TCP:NortonAV
"14491:TCP"= 14491:TCP:NortonAV
"15611:TCP"= 15611:TCP:NortonAV
"17417:TCP"= 17417:TCP:NortonAV
"16113:TCP"= 16113:TCP:NortonAV
"13758:TCP"= 13758:TCP:NortonAV
"16236:TCP"= 16236:TCP:NortonAV
"15419:TCP"= 15419:TCP:NortonAV
"12942:TCP"= 12942:TCP:NortonAV
"14149:TCP"= 14149:TCP:NortonAV
"15619:TCP"= 15619:TCP:NortonAV
"17348:TCP"= 17348:TCP:NortonAV
"13660:TCP"= 13660:TCP:NortonAV
"14492:TCP"= 14492:TCP:NortonAV
"12010:TCP"= 12010:TCP:NortonAV
"13306:TCP"= 13306:TCP:NortonAV
"13628:TCP"= 13628:TCP:NortonAV
"18536:TCP"= 18536:TCP:NortonAV
"14896:TCP"= 14896:TCP:NortonAV
"17398:TCP"= 17398:TCP:NortonAV
"15074:TCP"= 15074:TCP:NortonAV
"15981:TCP"= 15981:TCP:NortonAV
"13020:TCP"= 13020:TCP:NortonAV
"13072:TCP"= 13072:TCP:NortonAV
"16899:TCP"= 16899:TCP:NortonAV
"16348:TCP"= 16348:TCP:NortonAV
"12032:TCP"= 12032:TCP:NortonAV
"18259:TCP"= 18259:TCP:NortonAV
"15646:TCP"= 15646:TCP:NortonAV
"14242:TCP"= 14242:TCP:NortonAV
"12279:TCP"= 12279:TCP:NortonAV
"15869:TCP"= 15869:TCP:NortonAV
"12901:TCP"= 12901:TCP:NortonAV
"13293:TCP"= 13293:TCP:NortonAV
"13191:TCP"= 13191:TCP:NortonAV
"13458:TCP"= 13458:TCP:NortonAV
"14991:TCP"= 14991:TCP:NortonAV
"18092:TCP"= 18092:TCP:NortonAV
"15786:TCP"= 15786:TCP:NortonAV
"17493:TCP"= 17493:TCP:NortonAV
"12781:TCP"= 12781:TCP:NortonAV
"14125:TCP"= 14125:TCP:NortonAV
"15163:TCP"= 15163:TCP:NortonAV
"17532:TCP"= 17532:TCP:NortonAV
"12598:TCP"= 12598:TCP:NortonAV
"16423:TCP"= 16423:TCP:NortonAV
"12197:TCP"= 12197:TCP:NortonAV
"13126:TCP"= 13126:TCP:NortonAV
"12225:TCP"= 12225:TCP:NortonAV
"13494:TCP"= 13494:TCP:NortonAV
"13457:TCP"= 13457:TCP:NortonAV
"18408:TCP"= 18408:TCP:NortonAV
"17608:TCP"= 17608:TCP:NortonAV
"14324:TCP"= 14324:TCP:NortonAV
"13152:TCP"= 13152:TCP:NortonAV
"14904:TCP"= 14904:TCP:NortonAV
"18330:TCP"= 18330:TCP:NortonAV
"12969:TCP"= 12969:TCP:NortonAV
"12774:TCP"= 12774:TCP:NortonAV
"16587:TCP"= 16587:TCP:NortonAV
"15001:TCP"= 15001:TCP:NortonAV
"16389:TCP"= 16389:TCP:NortonAV
"13217:TCP"= 13217:TCP:NortonAV
"13065:TCP"= 13065:TCP:NortonAV
"18693:TCP"= 18693:TCP:NortonAV
"14167:TCP"= 14167:TCP:NortonAV
"17703:TCP"= 17703:TCP:NortonAV
"15442:TCP"= 15442:TCP:NortonAV
"13871:TCP"= 13871:TCP:NortonAV
"18601:TCP"= 18601:TCP:NortonAV
"17511:TCP"= 17511:TCP:NortonAV
"12809:TCP"= 12809:TCP:NortonAV
"18727:TCP"= 18727:TCP:NortonAV
"13025:TCP"= 13025:TCP:NortonAV
"17116:TCP"= 17116:TCP:NortonAV
"18491:TCP"= 18491:TCP:NortonAV
"17655:TCP"= 17655:TCP:NortonAV
"15559:TCP"= 15559:TCP:NortonAV
"16626:TCP"= 16626:TCP:NortonAV
"18435:TCP"= 18435:TCP:NortonAV
"18310:TCP"= 18310:TCP:NortonAV
"15019:TCP"= 15019:TCP:NortonAV
"17432:TCP"= 17432:TCP:NortonAV
"14308:TCP"= 14308:TCP:NortonAV
"13076:TCP"= 13076:TCP:NortonAV
"12289:TCP"= 12289:TCP:NortonAV
"12815:TCP"= 12815:TCP:NortonAV
"14118:TCP"= 14118:TCP:NortonAV
"14981:TCP"= 14981:TCP:NortonAV
"16355:TCP"= 16355:TCP:NortonAV
"18555:TCP"= 18555:TCP:NortonAV
"17114:TCP"= 17114:TCP:NortonAV
"16914:TCP"= 16914:TCP:NortonAV
"18185:TCP"= 18185:TCP:NortonAV
"15160:TCP"= 15160:TCP:NortonAV
"12587:TCP"= 12587:TCP:NortonAV
"14576:TCP"= 14576:TCP:NortonAV
"12337:TCP"= 12337:TCP:NortonAV
"16978:TCP"= 16978:TCP:NortonAV
"14983:TCP"= 14983:TCP:NortonAV
"17708:TCP"= 17708:TCP:NortonAV
"17039:TCP"= 17039:TCP:NortonAV
"15240:TCP"= 15240:TCP:NortonAV
"15949:TCP"= 15949:TCP:NortonAV
"14039:TCP"= 14039:TCP:NortonAV
"17651:TCP"= 17651:TCP:NortonAV
"14363:TCP"= 14363:TCP:NortonAV
"17292:TCP"= 17292:TCP:NortonAV
"14449:TCP"= 14449:TCP:NortonAV
"12698:TCP"= 12698:TCP:NortonAV
"16985:TCP"= 16985:TCP:NortonAV
"12861:TCP"= 12861:TCP:NortonAV
"17304:TCP"= 17304:TCP:NortonAV
"13812:TCP"= 13812:TCP:NortonAV
"14786:TCP"= 14786:TCP:NortonAV
"18979:TCP"= 18979:TCP:NortonAV
"17847:TCP"= 17847:TCP:NortonAV
"18828:TCP"= 18828:TCP:NortonAV
"18575:TCP"= 18575:TCP:NortonAV
"15717:TCP"= 15717:TCP:NortonAV
"13227:TCP"= 13227:TCP:NortonAV
"15719:TCP"= 15719:TCP:NortonAV
"13258:TCP"= 13258:TCP:NortonAV
"12154:TCP"= 12154:TCP:NortonAV
"14320:TCP"= 14320:TCP:NortonAV
"13071:TCP"= 13071:TCP:NortonAV
"18506:TCP"= 18506:TCP:NortonAV
"13307:TCP"= 13307:TCP:NortonAV
"12669:TCP"= 12669:TCP:NortonAV
"18666:TCP"= 18666:TCP:NortonAV
"14954:TCP"= 14954:TCP:NortonAV
"15907:TCP"= 15907:TCP:NortonAV
"15013:TCP"= 15013:TCP:NortonAV
"12562:TCP"= 12562:TCP:NortonAV
"18905:TCP"= 18905:TCP:NortonAV
"16226:TCP"= 16226:TCP:NortonAV
"17918:TCP"= 17918:TCP:NortonAV
"13789:TCP"= 13789:TCP:NortonAV
"14057:TCP"= 14057:TCP:NortonAV
"12544:TCP"= 12544:TCP:NortonAV
"13145:TCP"= 13145:TCP:NortonAV
"18322:TCP"= 18322:TCP:NortonAV
"13473:TCP"= 13473:TCP:NortonAV
"13362:TCP"= 13362:TCP:NortonAV
"12740:TCP"= 12740:TCP:NortonAV
"13003:TCP"= 13003:TCP:NortonAV
"14111:TCP"= 14111:TCP:NortonAV
"13270:TCP"= 13270:TCP:NortonAV
"15367:TCP"= 15367:TCP:NortonAV
"13354:TCP"= 13354:TCP:NortonAV
"12433:TCP"= 12433:TCP:NortonAV
"14025:TCP"= 14025:TCP:NortonAV
"17797:TCP"= 17797:TCP:NortonAV
"13154:TCP"= 13154:TCP:NortonAV
"12909:TCP"= 12909:TCP:NortonAV
"13782:TCP"= 13782:TCP:NortonAV
"18300:TCP"= 18300:TCP:NortonAV
"15479:TCP"= 15479:TCP:NortonAV
"14275:TCP"= 14275:TCP:NortonAV
"16979:TCP"= 16979:TCP:NortonAV
"12704:TCP"= 12704:TCP:NortonAV
"15959:TCP"= 15959:TCP:NortonAV
"12964:TCP"= 12964:TCP:NortonAV
"14927:TCP"= 14927:TCP:NortonAV
"13622:TCP"= 13622:TCP:NortonAV
"12181:TCP"= 12181:TCP:NortonAV
"18424:TCP"= 18424:TCP:NortonAV
"16338:TCP"= 16338:TCP:NortonAV
"17844:TCP"= 17844:TCP:NortonAV
"16830:TCP"= 16830:TCP:NortonAV
"18397:TCP"= 18397:TCP:NortonAV
"12111:TCP"= 12111:TCP:NortonAV
"17390:TCP"= 17390:TCP:NortonAV
"14834:TCP"= 14834:TCP:NortonAV
"12303:TCP"= 12303:TCP:NortonAV
"18618:TCP"= 18618:TCP:NortonAV
"15032:TCP"= 15032:TCP:NortonAV
"18453:TCP"= 18453:TCP:NortonAV
"14412:TCP"= 14412:TCP:NortonAV
"17404:TCP"= 17404:TCP:NortonAV
"12031:TCP"= 12031:TCP:NortonAV
"16462:TCP"= 16462:TCP:NortonAV
"14012:TCP"= 14012:TCP:NortonAV
"16692:TCP"= 16692:TCP:NortonAV
"14968:TCP"= 14968:TCP:NortonAV
"18920:TCP"= 18920:TCP:NortonAV
"13082:TCP"= 13082:TCP:NortonAV
"16177:TCP"= 16177:TCP:NortonAV
"17087:TCP"= 17087:TCP:NortonAV
"15883:TCP"= 15883:TCP:NortonAV
"14655:TCP"= 14655:TCP:NortonAV
"12190:TCP"= 12190:TCP:NortonAV
"15234:TCP"= 15234:TCP:NortonAV
"12770:TCP"= 12770:TCP:NortonAV
"15592:TCP"= 15592:TCP:NortonAV
"18854:TCP"= 18854:TCP:NortonAV
"14622:TCP"= 14622:TCP:NortonAV
"16728:TCP"= 16728:TCP:NortonAV
"14441:TCP"= 14441:TCP:NortonAV
"13943:TCP"= 13943:TCP:NortonAV
"14018:TCP"= 14018:TCP:NortonAV
"14090:TCP"= 14090:TCP:NortonAV
"12203:TCP"= 12203:TCP:NortonAV
"15344:TCP"= 15344:TCP:NortonAV
"14914:TCP"= 14914:TCP:NortonAV
"14362:TCP"= 14362:TCP:NortonAV
"12245:TCP"= 12245:TCP:NortonAV
"14351:TCP"= 14351:TCP:NortonAV
"18308:TCP"= 18308:TCP:NortonAV
"16850:TCP"= 16850:TCP:NortonAV
"13459:TCP"= 13459:TCP:NortonAV
"12883:TCP"= 12883:TCP:NortonAV
"16410:TCP"= 16410:TCP:NortonAV
"16193:TCP"= 16193:TCP:NortonAV
"18392:TCP"= 18392:TCP:NortonAV
"15104:TCP"= 15104:TCP:NortonAV
"14095:TCP"= 14095:TCP:NortonAV
"13537:TCP"= 13537:TCP:NortonAV
"18843:TCP"= 18843:TCP:NortonAV
"18075:TCP"= 18075:TCP:NortonAV
"12589:TCP"= 12589:TCP:NortonAV
"14301:TCP"= 14301:TCP:NortonAV
"14805:TCP"= 14805:TCP:NortonAV
"14755:TCP"= 14755:TCP:NortonAV
"16200:TCP"= 16200:TCP:NortonAV
"18207:TCP"= 18207:TCP:NortonAV
"13049:TCP"= 13049:TCP:NortonAV
"14006:TCP"= 14006:TCP:NortonAV
"13931:TCP"= 13931:TCP:NortonAV
"13997:TCP"= 13997:TCP:NortonAV
"17789:TCP"= 17789:TCP:NortonAV
"18262:TCP"= 18262:TCP:NortonAV
"16801:TCP"= 16801:TCP:NortonAV
"12120:TCP"= 12120:TCP:NortonAV
"13555:TCP"= 13555:TCP:NortonAV
"14236:TCP"= 14236:TCP:NortonAV
"17501:TCP"= 17501:TCP:NortonAV
"17294:TCP"= 17294:TCP:NortonAV
"12912:TCP"= 12912:TCP:NortonAV
"13825:TCP"= 13825:TCP:NortonAV
"12558:TCP"= 12558:TCP:NortonAV
"16623:TCP"= 16623:TCP:NortonAV
"12801:TCP"= 12801:TCP:NortonAV
"18839:TCP"= 18839:TCP:NortonAV
"15986:TCP"= 15986:TCP:NortonAV
"16453:TCP"= 16453:TCP:NortonAV
"17381:TCP"= 17381:TCP:NortonAV
"18493:TCP"= 18493:TCP:NortonAV
"16776:TCP"= 16776:TCP:NortonAV
"13296:TCP"= 13296:TCP:NortonAV
"16700:TCP"= 16700:TCP:NortonAV
"15771:TCP"= 15771:TCP:NortonAV
"16093:TCP"= 16093:TCP:NortonAV
"12940:TCP"= 12940:TCP:NortonAV
"18811:TCP"= 18811:TCP:NortonAV
"15985:TCP"= 15985:TCP:NortonAV
"14422:TCP"= 14422:TCP:NortonAV
"12252:TCP"= 12252:TCP:NortonAV
"18769:TCP"= 18769:TCP:NortonAV
"14821:TCP"= 14821:TCP:NortonAV
"12468:TCP"= 12468:TCP:NortonAV
"17562:TCP"= 17562:TCP:NortonAV
"13264:TCP"= 13264:TCP:NortonAV
"13375:TCP"= 13375:TCP:NortonAV
"13701:TCP"= 13701:TCP:NortonAV
"12968:TCP"= 12968:TCP:NortonAV
"13336:TCP"= 13336:TCP:NortonAV
"15045:TCP"= 15045:TCP:NortonAV
"16893:TCP"= 16893:TCP:NortonAV
"13816:TCP"= 13816:TCP:NortonAV
"18273:TCP"= 18273:TCP:NortonAV
"14388:TCP"= 14388:TCP:NortonAV
"14886:TCP"= 14886:TCP:NortonAV
"12890:TCP"= 12890:TCP:NortonAV
"14773:TCP"= 14773:TCP:NortonAV
"13616:TCP"= 13616:TCP:NortonAV
"16023:TCP"= 16023:TCP:NortonAV
"15670:TCP"= 15670:TCP:NortonAV
"17812:TCP"= 17812:TCP:NortonAV
"12143:TCP"= 12143:TCP:NortonAV
"12321:TCP"= 12321:TCP:NortonAV
"15625:TCP"= 15625:TCP:NortonAV
"15357:TCP"= 15357:TCP:NortonAV
"14004:TCP"= 14004:TCP:NortonAV
"17293:TCP"= 17293:TCP:NortonAV
"12992:TCP"= 12992:TCP:NortonAV
"13774:TCP"= 13774:TCP:NortonAV
"14037:TCP"= 14037:TCP:NortonAV
"16593:TCP"= 16593:TCP:NortonAV
"13371:TCP"= 13371:TCP:NortonAV
"18441:TCP"= 18441:TCP:NortonAV
"15995:TCP"= 15995:TCP:NortonAV
"13734:TCP"= 13734:TCP:NortonAV
"14475:TCP"= 14475:TCP:NortonAV
"12664:TCP"= 12664:TCP:NortonAV
"12725:TCP"= 12725:TCP:NortonAV
"18542:TCP"= 18542:TCP:NortonAV
"14633:TCP"= 14633:TCP:NortonAV
"17490:TCP"= 17490:TCP:NortonAV
"16153:TCP"= 16153:TCP:NortonAV
"15872:TCP"= 15872:TCP:NortonAV
"17360:TCP"= 17360:TCP:NortonAV
"17746:TCP"= 17746:TCP:NortonAV
"13575:TCP"= 13575:TCP:NortonAV
"15217:TCP"= 15217:TCP:NortonAV
"13633:TCP"= 13633:TCP:NortonAV
"17937:TCP"= 17937:TCP:NortonAV
"13753:TCP"= 13753:TCP:NortonAV
"17785:TCP"= 17785:TCP:NortonAV
"17763:TCP"= 17763:TCP:NortonAV
"14706:TCP"= 14706:TCP:NortonAV
"12151:TCP"= 12151:TCP:NortonAV
"12762:TCP"= 12762:TCP:NortonAV
"15115:TCP"= 15115:TCP:NortonAV
"13840:TCP"= 13840:TCP:NortonAV
"12632:TCP"= 12632:TCP:NortonAV
"17406:TCP"= 17406:TCP:NortonAV
"12745:TCP"= 12745:TCP:NortonAV
"17365:TCP"= 17365:TCP:NortonAV
"18931:TCP"= 18931:TCP:NortonAV
"12535:TCP"= 12535:TCP:NortonAV
"13658:TCP"= 13658:TCP:NortonAV
"12454:TCP"= 12454:TCP:NortonAV
"18269:TCP"= 18269:TCP:NortonAV
"18019:TCP"= 18019:TCP:NortonAV
"16868:TCP"= 16868:TCP:NortonAV
"16879:TCP"= 16879:TCP:NortonAV
"17704:TCP"= 17704:TCP:NortonAV
"15931:TCP"= 15931:TCP:NortonAV
"13915:TCP"= 13915:TCP:NortonAV
"18862:TCP"= 18862:TCP:NortonAV
"15173:TCP"= 15173:TCP:NortonAV
"12959:TCP"= 12959:TCP:NortonAV
"12863:TCP"= 12863:TCP:NortonAV
"12427:TCP"= 12427:TCP:NortonAV
"18680:TCP"= 18680:TCP:NortonAV
"15293:TCP"= 15293:TCP:NortonAV
"13088:TCP"= 13088:TCP:NortonAV
"12552:TCP"= 12552:TCP:NortonAV
"18561:TCP"= 18561:TCP:NortonAV
"16866:TCP"= 16866:TCP:NortonAV
"16974:TCP"= 16974:TCP:NortonAV
"12965:TCP"= 12965:TCP:NortonAV
"12284:TCP"= 12284:TCP:NortonAV
"14870:TCP"= 14870:TCP:NortonAV
"15433:TCP"= 15433:TCP:NortonAV
"13834:TCP"= 13834:TCP:NortonAV
"15574:TCP"= 15574:TCP:NortonAV
"13255:TCP"= 13255:TCP:NortonAV
"16829:TCP"= 16829:TCP:NortonAV
"15345:TCP"= 15345:TCP:NortonAV
"12881:TCP"= 12881:TCP:NortonAV
"15758:TCP"= 15758:TCP:NortonAV
"17981:TCP"= 17981:TCP:NortonAV
"15729:TCP"= 15729:TCP:NortonAV
"13101:TCP"= 13101:TCP:NortonAV
"18778:TCP"= 18778:TCP:NortonAV
"15654:TCP"= 15654:TCP:NortonAV
"17164:TCP"= 17164:TCP:NortonAV
"14136:TCP"= 14136:TCP:NortonAV
"17516:TCP"= 17516:TCP:NortonAV
"13218:TCP"= 13218:TCP:NortonAV
"14543:TCP"= 14543:TCP:NortonAV
"17994:TCP"= 17994:TCP:NortonAV
"18578:TCP"= 18578:TCP:NortonAV
"15038:TCP"= 15038:TCP:NortonAV
"15953:TCP"= 15953:TCP:NortonAV
"15381:TCP"= 15381:TCP:NortonAV
"18323:TCP"= 18323:TCP:NortonAV
"16185:TCP"= 16185:TCP:NortonAV
"15689:TCP"= 15689:TCP:NortonAV
"15154:TCP"= 15154:TCP:NortonAV
"13746:TCP"= 13746:TCP:NortonAV
"14306:TCP"= 14306:TCP:NortonAV
"17509:TCP"= 17509:TCP:NortonAV
"15021:TCP"= 15021:TCP:NortonAV
"17447:TCP"= 17447:TCP:NortonAV
"16514:TCP"= 16514:TCP:NortonAV
"12775:TCP"= 12775:TCP:NortonAV
"18401:TCP"= 18401:TCP:NortonAV
"18082:TCP"= 18082:TCP:NortonAV
"16223:TCP"= 16223:TCP:NortonAV
"12212:TCP"= 12212:TCP:NortonAV
"12389:TCP"= 12389:TCP:NortonAV
"18032:TCP"= 18032:TCP:NortonAV
"16312:TCP"= 16312:TCP:NortonAV
"15090:TCP"= 15090:TCP:NortonAV
"18899:TCP"= 18899:TCP:NortonAV
"16563:TCP"= 16563:TCP:NortonAV
"14430:TCP"= 14430:TCP:NortonAV
"13762:TCP"= 13762:TCP:NortonAV
"18908:TCP"= 18908:TCP:NortonAV
"13184:TCP"= 13184:TCP:NortonAV
"18133:TCP"= 18133:TCP:NortonAV
"13509:TCP"= 13509:TCP:NortonAV
"12548:TCP"= 12548:TCP:NortonAV
"12680:TCP"= 12680:TCP:NortonAV
"14352:TCP"= 14352:TCP:NortonAV
"16011:TCP"= 16011:TCP:NortonAV

R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);c:\windows\system32\drivers\sfsync03.sys [2005-12-06 35328]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-11-24 97928]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-11-24 231704]
R2 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-11-24 76040]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1df8662f-5631-11dd-82a0-e6e40cb64f2b}]
\Shell\auto\command - J:\Knight.exe open
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Knight.exe open
\Shell\explore\command - J:\Knight.exe open
\Shell\find\command - J:\Knight.exe open
\Shell\install\command - J:\Knight.exe open
\Shell\open\command - J:\Knight.exe open

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{33dca452-d57c-11dc-bf5d-95a380f71925}]
\Shell\AutoRun\command - L:\juok3st.bat
\Shell\explore\Command - L:\juok3st.bat
\Shell\open\Command - L:\juok3st.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{678930ac-c9c1-11dc-bf2a-a515d25a3a2a}]
\Shell\auto\command - J:\Knight.exe open
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Knight.exe open
\Shell\explore\command - J:\Knight.exe open
\Shell\find\command - J:\Knight.exe open
\Shell\install\command - J:\Knight.exe open
\Shell\open\command - J:\Knight.exe open

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6e9724cc-783e-11dd-8326-fba86f64b12a}]
\Shell\auto\command - Knight.exe open
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Knight.exe open
\Shell\explore\command - J:\
\Shell\find\command - J:\
\Shell\install\command - J:\
\Shell\open\command - J:\Knight.exe open

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7e551124-8beb-11dd-836d-b47414c1b12a}]
\Shell\AutoRun\command - J:\juok3st.bat
\Shell\explore\Command - J:\juok3st.bat
\Shell\open\Command - J:\juok3st.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dd531bd3-eb73-11dc-bfd4-918c9e0a0c2a}]
\Shell\auto\command - L:\Knight.exe open
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Knight.exe open
\Shell\explore\command - L:\Knight.exe open
\Shell\find\command - L:\Knight.exe open
\Shell\install\command - L:\Knight.exe open
\Shell\open\command - L:\Knight.exe open

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f683d310-e795-11dc-bfb3-c2d59f7d7c2b}]
\Shell\AutoRun\command - Autorun.exe
.
Contents of the 'Scheduled Tasks' folder

2008-11-28 c:\windows\Tasks\At1.job
- c:\documents and settings\MiliMare\Templates\11760-NendangBro.com []

2008-11-29 c:\windows\Tasks\At2.job
- c:\documents and settings\MiliMare\Templates\11760-NendangBro.com []
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, gmer.net
Rootkit scan 2008-11-29 11:18:28
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(804)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\windows\system32\LEXBCES.EXE
c:\program files\Common Files\Logitech\LVMVFM\LVPrcSrv.exe
c:\windows\system32\LEXPPS.EXE
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\Common Files\Logitech\LComMgr\LVComSX.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\Common Files\Logishrd\LQCVFX\COCIManager.exe
.
**************************************************************************
.
Completion time: 2008-11-29 11:20:00 - machine was rebooted [MiliMare]
ComboFix-quarantined-files.txt 2008-11-29 10:19:57

Pre-Run: 55,285,796,864 bytes free
Post-Run: 55,280,472,064 bytes free

576

Dopuna: 29 Nov 2008 11:41

A evo i Hijackthis loga

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:21:20, on 29/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\MiliMare\Desktop\DETEKTIV.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = red.clientapps.yahoo.com/customize/ptec/defaults/su/*http://www.yahoo.com
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\ycomp5_6_2_0.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL (file missing)
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\ycomp5_6_2_0.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL (file missing)
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [NBJ] "C:\PROGRA~1\Ahead\NEROBA~1\NBJ.exe"
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\Logitech\SrvLnch\SrvLnch.exe

--
End of file - 5654 bytes

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Otvoriti Notepad i iskopirati sledeci tekst:

File::
c:\windows\Tasks\At1.job
c:\windows\Tasks\At2.job

Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"18137:TCP"=-
"18648:TCP"=-
"15967:TCP"=-
"16440:TCP"=-
"17876:TCP"=-
"18041:TCP"=-
"18892:TCP"=-
"13872:TCP"=-
"14952:TCP"=-
"12575:TCP"=-
"15259:TCP"=-
"14890:TCP"=-
"16366:TCP"=-
"14491:TCP"=-
"15611:TCP"=-
"17417:TCP"=-
"16113:TCP"=-
"13758:TCP"=-
"16236:TCP"=-
"15419:TCP"=-
"12942:TCP"=-
"14149:TCP"=-
"15619:TCP"=-
"17348:TCP"=-
"13660:TCP"=-
"14492:TCP"=-
"12010:TCP"=-
"13306:TCP"=-
"13628:TCP"=-
"18536:TCP"=-
"14896:TCP"=-
"17398:TCP"=-
"15074:TCP"=-
"15981:TCP"=-
"13020:TCP"=-
"13072:TCP"=-
"16899:TCP"=-
"16348:TCP"=-
"12032:TCP"=-
"18259:TCP"=-
"15646:TCP"=-
"14242:TCP"=-
"12279:TCP"=-
"15869:TCP"=-
"12901:TCP"=-
"13293:TCP"=-
"13191:TCP"=-
"13458:TCP"=-
"14991:TCP"=-
"18092:TCP"=-
"15786:TCP"=-
"17493:TCP"=-
"12781:TCP"=-
"14125:TCP"=-
"15163:TCP"=-
"17532:TCP"=-
"12598:TCP"=-
"16423:TCP"=-
"12197:TCP"=-
"13126:TCP"=-
"12225:TCP"=-
"13494:TCP"=-
"13457:TCP"=-
"18408:TCP"=-
"17608:TCP"=-
"14324:TCP"=-
"13152:TCP"=-
"14904:TCP"=-
"18330:TCP"=-
"12969:TCP"=-
"12774:TCP"=-
"16587:TCP"=-
"15001:TCP"=-
"16389:TCP"=-
"13217:TCP"=-
"13065:TCP"=-
"18693:TCP"=-
"14167:TCP"=-
"17703:TCP"=-
"15442:TCP"=-
"13871:TCP"=-
"18601:TCP"=-
"17511:TCP"=-
"12809:TCP"=-
"18727:TCP"=-
"13025:TCP"=-
"17116:TCP"=-
"18491:TCP"=-
"17655:TCP"=-
"15559:TCP"=-
"16626:TCP"=-
"18435:TCP"=-
"18310:TCP"=-
"15019:TCP"=-
"17432:TCP"=-
"14308:TCP"=-
"13076:TCP"=-
"12289:TCP"=-
"12815:TCP"=-
"14118:TCP"=-
"14981:TCP"=-
"16355:TCP"=-
"18555:TCP"=-
"17114:TCP"=-
"16914:TCP"=-
"18185:TCP"=-
"15160:TCP"=-
"12587:TCP"=-
"14576:TCP"=-
"12337:TCP"=-
"16978:TCP"=-
"14983:TCP"=-
"17708:TCP"=-
"17039:TCP"=-
"15240:TCP"=-
"15949:TCP"=-
"14039:TCP"=-
"17651:TCP"=-
"14363:TCP"=-
"17292:TCP"=-
"14449:TCP"=-
"12698:TCP"=-
"16985:TCP"=-
"12861:TCP"=-
"17304:TCP"=-
"13812:TCP"=-
"14786:TCP"=-
"18979:TCP"=-
"17847:TCP"=-
"18828:TCP"=-
"18575:TCP"=-
"15717:TCP"=-
"13227:TCP"=-
"15719:TCP"=-
"13258:TCP"=-
"12154:TCP"=-
"14320:TCP"=-
"13071:TCP"=-
"18506:TCP"=-
"13307:TCP"=-
"12669:TCP"=-
"18666:TCP"=-
"14954:TCP"=-
"15907:TCP"=-
"15013:TCP"=-
"12562:TCP"=-
"18905:TCP"=-
"16226:TCP"=-
"17918:TCP"=-
"13789:TCP"=-
"14057:TCP"=-
"12544:TCP"=-
"13145:TCP"=-
"18322:TCP"=-
"13473:TCP"=-
"13362:TCP"=-
"12740:TCP"=-
"13003:TCP"=-
"14111:TCP"=-
"13270:TCP"=-
"15367:TCP"=-
"13354:TCP"=-
"12433:TCP"=-
"14025:TCP"=-
"17797:TCP"=-
"13154:TCP"=-
"12909:TCP"=-
"13782:TCP"=-
"18300:TCP"=-
"15479:TCP"=-
"14275:TCP"=-
"16979:TCP"=-
"12704:TCP"=-
"15959:TCP"=-
"12964:TCP"=-
"14927:TCP"=-
"13622:TCP"=-
"12181:TCP"=-
"18424:TCP"=-
"16338:TCP"=-
"17844:TCP"=-
"16830:TCP"=-
"18397:TCP"=-
"12111:TCP"=-
"17390:TCP"=-
"14834:TCP"=-
"12303:TCP"=-
"18618:TCP"=-
"15032:TCP"=-
"18453:TCP"=-
"14412:TCP"=-
"17404:TCP"=-
"12031:TCP"=-
"16462:TCP"=-
"14012:TCP"=-
"16692:TCP"=-
"14968:TCP"=-
"18920:TCP"=-
"13082:TCP"=-
"16177:TCP"=-
"17087:TCP"=-
"15883:TCP"=-
"14655:TCP"=-
"12190:TCP"=-
"15234:TCP"=-
"12770:TCP"=-
"15592:TCP"=-
"18854:TCP"=-
"14622:TCP"=-
"16728:TCP"=-
"14441:TCP"=-
"13943:TCP"=-
"14018:TCP"=-
"14090:TCP"=-
"12203:TCP"=-
"15344:TCP"=-
"14914:TCP"=-
"14362:TCP"=-
"12245:TCP"=-
"14351:TCP"=-
"18308:TCP"=-
"16850:TCP"=-
"13459:TCP"=-
"12883:TCP"=-
"16410:TCP"=-
"16193:TCP"=-
"18392:TCP"=-
"15104:TCP"=-
"14095:TCP"=-
"13537:TCP"=-
"18843:TCP"=-
"18075:TCP"=-
"12589:TCP"=-
"14301:TCP"=-
"14805:TCP"=-
"14755:TCP"=-
"16200:TCP"=-
"18207:TCP"=-
"13049:TCP"=-
"14006:TCP"=-
"13931:TCP"=-
"13997:TCP"=-
"17789:TCP"=-
"18262:TCP"=-
"16801:TCP"=-
"12120:TCP"=-
"13555:TCP"=-
"14236:TCP"=-
"17501:TCP"=-
"17294:TCP"=-
"12912:TCP"=-
"13825:TCP"=-
"12558:TCP"=-
"16623:TCP"=-
"12801:TCP"=-
"18839:TCP"=-
"15986:TCP"=-
"16453:TCP"=-
"17381:TCP"=-
"18493:TCP"=-
"16776:TCP"=-
"13296:TCP"=-
"16700:TCP"=-
"15771:TCP"=-
"16093:TCP"=-
"12940:TCP"=-
"18811:TCP"=-
"15985:TCP"=-
"14422:TCP"=-
"12252:TCP"=-
"18769:TCP"=-
"14821:TCP"=-
"12468:TCP"=-
"17562:TCP"=-
"13264:TCP"=-
"13375:TCP"=-
"13701:TCP"=-
"12968:TCP"=-
"13336:TCP"=-
"15045:TCP"=-
"16893:TCP"=-
"13816:TCP"=-
"18273:TCP"=-
"14388:TCP"=-
"14886:TCP"=-
"12890:TCP"=-
"14773:TCP"=-
"13616:TCP"=-
"16023:TCP"=-
"15670:TCP"=-
"17812:TCP"=-
"12143:TCP"=-
"12321:TCP"=-
"15625:TCP"=-
"15357:TCP"=-
"14004:TCP"=-
"17293:TCP"=-
"12992:TCP"=-
"13774:TCP"=-
"14037:TCP"=-
"16593:TCP"=-
"13371:TCP"=-
"18441:TCP"=-
"15995:TCP"=-
"13734:TCP"=-
"14475:TCP"=-
"12664:TCP"=-
"12725:TCP"=-
"18542:TCP"=-
"14633:TCP"=-
"17490:TCP"=-
"16153:TCP"=-
"15872:TCP"=-
"17360:TCP"=-
"17746:TCP"=-
"13575:TCP"=-
"15217:TCP"=-
"13633:TCP"=-
"17937:TCP"=-
"13753:TCP"=-
"17785:TCP"=-
"17763:TCP"=-
"14706:TCP"=-
"12151:TCP"=-
"12762:TCP"=-
"15115:TCP"=-
"13840:TCP"=-
"12632:TCP"=-
"17406:TCP"=-
"12745:TCP"=-
"17365:TCP"=-
"18931:TCP"=-
"12535:TCP"=-
"13658:TCP"=-
"12454:TCP"=-
"18269:TCP"=-
"18019:TCP"=-
"16868:TCP"=-
"16879:TCP"=-
"17704:TCP"=-
"15931:TCP"=-
"13915:TCP"=-
"18862:TCP"=-
"15173:TCP"=-
"12959:TCP"=-
"12863:TCP"=-
"12427:TCP"=-
"18680:TCP"=-
"15293:TCP"=-
"13088:TCP"=-
"12552:TCP"=-
"18561:TCP"=-
"16866:TCP"=-
"16974:TCP"=-
"12965:TCP"=-
"12284:TCP"=-
"14870:TCP"=-
"15433:TCP"=-
"13834:TCP"=-
"15574:TCP"=-
"13255:TCP"=-
"16829:TCP"=-
"15345:TCP"=-
"12881:TCP"=-
"15758:TCP"=-
"17981:TCP"=-
"15729:TCP"=-
"13101:TCP"=-
"18778:TCP"=-
"15654:TCP"=-
"17164:TCP"=-
"14136:TCP"=-
"17516:TCP"=-
"13218:TCP"=-
"14543:TCP"=-
"17994:TCP"=-
"18578:TCP"=-
"15038:TCP"=-
"15953:TCP"=-
"15381:TCP"=-
"18323:TCP"=-
"16185:TCP"=-
"15689:TCP"=-
"15154:TCP"=-
"13746:TCP"=-
"14306:TCP"=-
"17509:TCP"=-
"15021:TCP"=-
"17447:TCP"=-
"16514:TCP"=-
"12775:TCP"=-
"18401:TCP"=-
"18082:TCP"=-
"16223:TCP"=-
"12212:TCP"=-
"12389:TCP"=-
"18032:TCP"=-
"16312:TCP"=-
"15090:TCP"=-
"18899:TCP"=-
"16563:TCP"=-
"14430:TCP"=-
"13762:TCP"=-
"18908:TCP"=-
"13184:TCP"=-
"18133:TCP"=-
"13509:TCP"=-
"12548:TCP"=-
"12680:TCP"=-
"14352:TCP"=-
"16011:TCP"=-
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1df8662f-5631-11dd-82a0-e6e40cb64f2b}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{33dca452-d57c-11dc-bf5d-95a380f71925}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{678930ac-c9c1-11dc-bf2a-a515d25a3a2a}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6e9724cc-783e-11dd-8326-fba86f64b12a}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7e551124-8beb-11dd-836d-b47414c1b12a}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dd531bd3-eb73-11dc-bfd4-918c9e0a0c2a}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f683d310-e795-11dc-bfb3-c2d59f7d7c2b}]


Snimiti na Desktop fajl iz Notepada kao "CFScript"




Prevuci snimljeni skript/tekst na ComboFix ikonicu kao na slici.
Postaviti u sledecoj poruci log koji bude bio napravljen na kraju ciscenja/skeniranja.


Dalje, rekao bih da su neki USB stickovi inficirani.
Ne mora da bude bas stick, moze bilo koji uredjaj koji se ubada u USB port i nakon toga se na kompu pojavljuje kao nova particija.
Znaci, to moze biti i mobilni, foto-aparat sa SD karticom, MP3 plejer itd.

Skini sledeci program - http://amf.mycity.rs/personal/bobby/USB_blocker/usb_blocker.exe
- startuj ga i odaberi opciju Auto block
- ubaci USB stick u komp i sacekaj koji sekund (recimo 5-10 sekundi)
- program je sada uradio analizu sticka (vidi se u donjem delu programa, u logu)
- gore levo klikni duplo na slovo koje oznacava particiju, tj. tvoj USB stick
- dole kraj sata ce se pojaviti poruka da smes da izvadis USB stick iz kompa
- ne gasi program, vec ubaci sledeci USB stick i za njega isto sacekaj par sekundi, i tako redom za sve stickove, MP3 plejere, mobilni
- zapamti kojim redom su ubacivani stickovi

Kada sve to zavrsis, log u donjem delu programa ce sadrzati sve podatke koji su meni potrebni da bih video koji stick je zarazen.
Klikni desnim dugmetom misa na log/izvestaj i odaberi Save log.
Automatski ce se otvoriti Notepad i u njemu izvestaj.
Iskopiraj mi taj izvestaj ovde na forum.