MyCity » Ambulanta -> Arhiva Ambulante » da li sam dobro proverio racunar?

da li sam dobro proverio racunar?

Napisano na dan: 11.9.2008
1

da li sam dobro proverio racunar?
Sledeća strana Pagination

Idi na vrh

Poslao: 11 Sep 2008 17:17
Idi na vrh
offline
  • Pridružio: 07 Jun 2008
  • Poruke: 46

Ima dva dana kako je uleteo virus a da ne znam ni koji je niti se nesto bas razumem. Jedino sto sam mogao da otvorim je ambulanta i to samo jedan post gde je pisalo da se preuzme ComboFix. Mozda to i nije bila dobra ideja ali nisam inao kud.

Uradim sve kako je napisano i jedno par sati racunar radi normalno a onda mi neda da pristupim pojedinim sajtovima.
Naravno, sledi ono poznato pitanje - STA DA RADIM???


ComboFix 08-09-10.04 - Aca 2008-09-11 16:58:43.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1250.1.1033.18.517 [GMT 2:00]
Running from: F:\Programi\ComboFix.exe
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\BM43e73f55.txt
C:\WINDOWS\BM43e73f55.xml
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\jiyaheee.dll
C:\WINDOWS\system32\nfjlukrx.dll
C:\WINDOWS\system32\xrkuljfn.ini
C:\WINDOWS\system32\ybJQBJjl.ini
C:\WINDOWS\system32\ybJQBJjl.ini2

.
((((((((((((((((((((((((( Files Created from 2008-08-11 to 2008-09-11 )))))))))))))))))))))))))))))))
.

2008-09-10 17:34 . 2008-09-10 17:34 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-09-10 17:31 . 2008-09-10 17:31 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-09-10 09:56 . 2008-06-23 18:57 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-09-10 09:56 . 2008-06-23 11:20 625,664 -----c--- C:\WINDOWS\system32\dllcache\iexplore.exe
2008-09-10 09:04 . 2008-06-13 13:05 272,128 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-09-10 09:04 . 2008-06-13 13:05 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-09-10 07:49 . 2008-09-10 17:36 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-09-10 07:49 . 2005-02-25 05:35 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-09-10 06:09 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-09-10 06:09 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-09-09 09:59 . 2008-09-09 09:59 237,056 --a------ C:\WINDOWS\system32\ljJBQJby.dll
2008-09-09 09:55 . 2008-09-09 09:55 <DIR> d-------- C:\Documents and Settings\Aca\Application Data\ArcSoft
2008-09-09 09:54 . 2008-09-09 09:54 135,299 --a------ C:\Setup_ver1.1662.0.exe
2008-09-08 15:48 . 2008-09-08 15:55 <DIR> d-------- C:\Program Files\CD Autorun Creator
2008-09-07 12:31 . 2008-09-07 12:31 <DIR> d-------- C:\WINDOWS\system32\IOSUBSYS
2008-09-05 20:02 . 2008-09-05 20:02 56,492 --ah----- C:\WINDOWS\system32\mlfcache.dat
2008-09-03 00:10 . 2008-09-03 00:11 <DIR> d-------- C:\Documents and Settings\Aca\Application Data\HateML
2008-08-29 19:18 . 2008-08-29 19:18 2,302,017 --a------ C:\WINDOWS\system32\GPhotos.scr
2008-08-25 07:31 . 2008-08-25 07:31 <DIR> d-------- C:\Program Files\PowerISO
2008-08-13 21:55 . 2008-08-13 21:55 <DIR> d-------- C:\Documents and Settings\Aca\Application Data\Nvu
2008-08-13 21:54 . 2008-08-13 21:54 <DIR> d-------- C:\Program Files\Nvu
2008-08-13 09:58 . 2008-08-13 09:58 <DIR> d-------- C:\My Media Files
2008-08-13 09:58 . 2008-08-13 09:58 43 --a------ C:\WINDOWS\Aurora Media Workshop.INI
2008-08-13 09:57 . 2002-05-06 11:01 45,056 --a------ C:\WINDOWS\system32\WNASPI32.DLL
2008-08-13 09:57 . 1999-09-10 12:06 45,056 --a------ C:\WINDOWS\system32\WNASPI2K.BAK
2008-08-13 09:57 . 1999-09-10 12:06 25,244 --a------ C:\WINDOWS\system32\drivers\ASPI2K.BAK
2008-08-13 09:57 . 2002-05-06 11:01 17,005 --a------ C:\WINDOWS\system32\drivers\ASPI32.SYS
2008-08-13 09:57 . 2001-04-19 17:34 5,600 --a------ C:\WINDOWS\system\WINASPI.DLL
2008-08-13 09:57 . 1999-09-10 12:06 5,600 --a------ C:\WINDOWS\system\WINASPI.BAK
2008-08-13 09:57 . 2001-04-19 17:34 4,672 --a------ C:\WINDOWS\system\WOWPOST.EXE
2008-08-13 09:57 . 1999-09-10 12:06 4,672 --a------ C:\WINDOWS\system\WOWPOST.BAK
2008-08-13 09:56 . 2008-08-13 09:57 <DIR> d-------- C:\Program Files\Aurora Media Workshop
2008-08-11 06:50 . 2008-08-11 06:50 <DIR> d-------- C:\Documents and Settings\Aca\Application Data\FastStone
2008-08-11 06:49 . 2008-08-11 06:49 <DIR> d-------- C:\Program Files\FastStone Capture

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-11 15:03 --------- d-----w C:\Documents and Settings\Aca\Application Data\Skype
2008-09-11 14:05 --------- d-----w C:\Documents and Settings\Aca\Application Data\skypePM
2008-09-11 13:35 --------- d-----w C:\Program Files\ACD Systems
2008-09-11 13:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\ACD Systems
2008-09-11 13:33 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-10 18:42 --------- d-----w C:\Program Files\Google
2008-09-10 15:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-09-09 07:52 --------- d-----w C:\Documents and Settings\Aca\Application Data\uTorrent
2008-08-25 05:23 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-24 17:05 --------- d-----w C:\Program Files\Opera
2008-08-17 18:44 --------- d-----w C:\Documents and Settings\Aca\Application Data\Sony
2008-08-09 09:39 --------- d-----w C:\Program Files\Winamp
2008-08-08 06:35 --------- d-----w C:\Program Files\RegCleaner
2008-08-07 18:45 --------- d-----w C:\Program Files\Mv2Player
2008-08-05 02:52 --------- d-----w C:\Program Files\Innovative Solutions
2008-08-04 22:12 --------- d-----w C:\Program Files\Sun
2008-08-04 22:11 --------- d-----w C:\Program Files\Java
2008-08-04 19:47 --------- d-----w C:\Program Files\Common Files\Adobe
2008-08-01 12:26 --------- d-----w C:\Program Files\Common Files\ACD Systems
2008-08-01 03:59 --------- d-----w C:\Documents and Settings\Aca\Application Data\Publish Providers
2008-08-01 03:57 --------- d-----w C:\Program Files\Vstplugins
2008-08-01 03:57 --------- d-----w C:\Program Files\Sony
2008-08-01 03:56 --------- d-----w C:\Program Files\Sony Setup
2008-07-31 16:33 --------- d-----w C:\Program Files\Easy CD-DA Extractor 10
2008-07-31 12:42 --------- d-----w C:\Documents and Settings\Aca\Application Data\Canon
2008-07-25 21:24 --------- d-----w C:\Program Files\Microsoft Visual Studio 8
2008-07-25 21:13 --------- d-----w C:\Program Files\MSBuild
2008-07-25 21:13 --------- d-----w C:\Program Files\Microsoft Works
2008-07-25 21:11 --------- d-----w C:\Program Files\Microsoft.NET
2008-07-25 20:05 --------- d-----w C:\Program Files\MSECache
2008-07-24 13:26 --------- d-----w C:\Program Files\AAA Photo Album
2008-07-24 10:28 --------- d-----w C:\Program Files\Microsoft
2008-07-23 00:06 --------- d-----w C:\Program Files\Flickr Uploadr
2008-07-23 00:06 --------- d-----w C:\Documents and Settings\Aca\Application Data\Flickr
2008-07-22 20:06 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-07-22 19:57 --------- d-----w C:\Program Files\Skype
2008-07-22 19:57 --------- d-----w C:\Program Files\Common Files\Skype
2008-07-22 19:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype
2008-07-21 13:37 --------- d-----w C:\Program Files\ESET
2008-07-19 05:04 --------- d-----w C:\Program Files\Netscape
2008-07-17 08:39 --------- d-----w C:\Documents and Settings\Aca\Application Data\CD-LabelPrint
2008-07-16 23:37 --------- d-----w C:\Program Files\Common Files\Borland Shared
2008-07-16 23:37 --------- d-----w C:\Program Files\b&b
2008-07-14 13:37 --------- d-----w C:\Program Files\Common Files\Adobe AIR
2008-07-14 13:37 --------- d-----w C:\Program Files\Adobe Media Player
2008-07-13 22:41 --------- d-----w C:\Documents and Settings\Aca\Application Data\Mikrotik
2008-07-11 19:26 --------- d-----w C:\Program Files\TC UP
2008-07-11 17:36 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-07-11 10:43 --------- d-----w C:\Program Files\ABBYY FineReader 4.0 Sprint
2008-07-11 10:32 --------- d-----w C:\Program Files\ABBYY FineReader 7.0 Professional Edition
2008-07-11 10:25 --------- d-----w C:\Documents and Settings\Aca\Application Data\ABBYY
2008-07-11 10:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\ABBYY
2008-07-11 10:02 --------- d-----w C:\Documents and Settings\Aca\Application Data\Corel
2008-07-11 10:01 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-07-11 10:01 --------- d-----w C:\Program Files\Common Files\Corel
2008-07-11 10:00 --------- d-----w C:\Program Files\Corel
2008-07-11 09:51 --------- d-----w C:\Program Files\Alcohol Soft
2008-07-11 08:51 --------- d-----w C:\Program Files\BearPaw 1200CU Plus
2008-07-11 08:49 --------- d-----w C:\Program Files\Temp
2008-07-11 08:45 --------- d-----w C:\Program Files\Canon
2008-07-11 08:41 --------- d--h--w C:\Documents and Settings\All Users\Application Data\CanonBJ
2008-07-11 08:36 --------- d-----w C:\Program Files\Common Files\Canon
2008-07-11 08:31 --------- d-----w C:\Documents and Settings\Aca\Application Data\Winamp
2008-07-11 08:10 --------- d-----w C:\Documents and Settings\Aca\Application Data\ACD Systems
2008-07-10 10:33 298,104 ----a-w C:\WINDOWS\system32\imon.dll
2008-07-07 20:26 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-06-24 16:43 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-24 16:12 295,936 ----a-w C:\WINDOWS\system32\wmpeffects.dll
2008-06-23 16:57 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:46 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-05-14 10:29 16,384 --sha-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
2008-05-14 10:29 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
2008-05-14 10:29 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008051420080515\index.dat
2008-05-14 10:29 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.

((((((((((((((((((((((((((((( snapshot_2008-09-10_22.21.05.48 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-12-07 03:01:07 124,928 ------w C:\WINDOWS\system32\advpack.dll
+ 2008-06-23 16:57:27 124,928 ----a-w C:\WINDOWS\system32\advpack.dll
- 2008-07-26 12:32:06 264,616 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
+ 2008-09-11 12:42:38 272,576 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
- 2007-12-07 03:01:07 63,488 ------w C:\WINDOWS\system32\icardie.dll
+ 2008-06-23 16:57:28 63,488 ----a-w C:\WINDOWS\system32\icardie.dll
- 2007-12-07 03:01:10 6,067,200 ------w C:\WINDOWS\system32\ieframe.dll
+ 2008-06-23 16:57:33 6,066,176 ----a-w C:\WINDOWS\system32\ieframe.dll
- 2007-12-07 03:01:11 267,776 ------w C:\WINDOWS\system32\iertutil.dll
+ 2008-06-23 16:57:34 267,776 ----a-w C:\WINDOWS\system32\iertutil.dll
- 2007-12-07 03:01:11 459,264 ------w C:\WINDOWS\system32\msfeeds.dll
+ 2008-06-23 16:57:36 459,264 ----a-w C:\WINDOWS\system32\msfeeds.dll
- 2007-12-07 02:01:12 52,224 ------w C:\WINDOWS\system32\msfeedsbs.dll
+ 2008-06-23 16:57:36 52,224 ----a-w C:\WINDOWS\system32\msfeedsbs.dll
- 2008-01-16 15:20:50 3,593,728 ------w C:\WINDOWS\system32\mshtml.dll
+ 2008-06-24 08:57:40 3,592,192 ----a-w C:\WINDOWS\system32\mshtml.dll
- 2007-12-07 03:01:13 105,984 ------w C:\WINDOWS\system32\url.dll
+ 2008-06-23 16:57:40 105,984 ----a-w C:\WINDOWS\system32\url.dll
- 2007-12-07 03:01:13 1,162,752 ------w C:\WINDOWS\system32\urlmon.dll
+ 2008-06-23 16:57:40 1,159,680 ----a-w C:\WINDOWS\system32\urlmon.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{73676140-CB2D-40B5-BCF0-9FB4AE97798E}]
2008-09-09 09:59 237056 --a------ C:\WINDOWS\system32\ljJBQJby.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{77D7E795-33C5-4323-974D-A2A49AB75517}]
2008-08-30 02:16 133616 --a----t- C:\Program Files\Google\Update\1.2.131.11\GoopdateBho.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-02-28 1828136]
"AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-07-02 220544]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-02-06 21898024]
"DriverMax"="C:\Program Files\Innovative Solutions\DriverMax\devices.exe" [2008-07-25 5057368]
"Google Update"="C:\Documents and Settings\Aca\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-08-30 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-07-10 949376]
"NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2008-02-28 570664]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 2221352]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-08-04 36352]
"FineReader7NewsReaderPro"="C:\Program Files\ABBYY FineReader 7.0 Professional Edition\AbbyyNewsReader.exe" [2003-08-05 278528]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2008-07-07 167936]
"40d40cc9"="C:\WINDOWS\system32\nfjlukrx.dll" [BU]
"BM43e73f55"="C:\WINDOWS\system32\jiyaheee.dll" [BU]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ShowDeskFix"="shell32" [X]

C:\Documents and Settings\Aca\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3fhg"= mp3fhg.acm
"VIDC.YV12"= yv12vfw.dll
"VIDC.ACDV"= ACDV.dll
"MSACM.NSPAC"= NSPAC32.ACM
"MSACM.VOXACM118"= vdk32118.acm
"MSACM.NSX83"= nsx83p32.acm
"MSACM.NSX723"= sx5363s.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 VD_FileDisk;VD_FileDisk;C:\WINDOWS\system32\drivers\VD_FileDisk.sys [2006-01-13 15872]
S2 gupdate1c8edd8d6ff3fe;Google Update Service (gupdate1c8edd8d6ff3fe);C:\Program Files\Google\Update\GoogleUpdate.exe [2008-08-30 133104]
.
Contents of the 'Scheduled Tasks' folder
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Aca\Application Data\Mozilla\Firefox\Profiles\zh89co81.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.jasatomic.org.rs
FF -: plugin - C:\Documents and Settings\Aca\Local Settings\Application Data\Google\Update\1.2.131.11\npGoogleOneClick5.dll
FF -: plugin - C:\Program Files\Google\Google Earth Plugin\npgeplugin.dll
FF -: plugin - C:\Program Files\Google\Picasa3\npPicasa3.dll
FF -: plugin - C:\Program Files\Google\Update\1.2.131.11\npGoogleOneClick5.dll
FF -: plugin - C:\Program Files\Netscape\Communicator\Program\Plugins\npaudio.dll
FF -: plugin - C:\Program Files\Netscape\Communicator\Program\Plugins\npavi32.dll
FF -: plugin - C:\Program Files\Netscape\Communicator\Program\Plugins\nplau32.dll
FF -: plugin - C:\Program Files\Netscape\Communicator\Program\Plugins\npnul32.dll
FF -: plugin - C:\Program Files\Netscape\Communicator\Program\Plugins\NPOFF12.DLL
FF -: plugin - C:\Program Files\Netscape\Communicator\Program\Plugins\NPQTW32.DLL
FF -: plugin - C:\Program Files\Netscape\Communicator\Program\Plugins\NPVCAL32.DLL
FF -: plugin - C:\Program Files\Opera\program\plugins\NPOFF12.DLL
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, gmer.net
Rootkit scan 2008-09-11 17:03:21
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\ESET\nod32krn.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Completion time: 2008-09-11 17:08:01 - machine was rebooted [Aca]
ComboFix-quarantined-files.txt 2008-09-11 15:07:55
ComboFix2.txt 2008-09-11 12:49:03
ComboFix3.txt 2008-09-10 20:21:57
ComboFix4.txt 2008-09-09 23:12:06
ComboFix5.txt 2008-09-11 13:23:53

Pre-Run: 3,271,245,824 bytes free
Post-Run: 3,263,516,672 bytes free

262 --- E O F --- 2008-09-10 20:35:27

Poslao: 11 Sep 2008 17:27
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Pozdrav...


Postavi HijackThis logfile:

http://www.mycity.rs/Ambulanta/Kako-otvoriti-temu-u-Ambulanti.html

Poslao: 11 Sep 2008 18:36
Idi na vrh
offline
  • Pridružio: 07 Jun 2008
  • Poruke: 46

Zahvaljujem se na pomoći. Upustvo i kritike su na mestu i više nego ozbiljne.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:26:49, on 11.9.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Innovative Solutions\DriverMax\devices.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Winamp\winamp.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Aca\Desktop\FERKO\TR3.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = jasatomic.org.rs/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: (no name) - {05C92845-C1D7-41F6-B760-8A35415FABDa} - C:\WINDOWS\system32\nmjurddv.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: (no name) - {740611B0-F8F3-4C30-BA98-F17C6164A83B} - C:\WINDOWS\system32\ljJBQJby.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Update Helper - {77D7E795-33C5-4323-974D-A2A49AB75517} - C:\Program Files\Google\Update\1.2.131.11\GoopdateBho.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [FineReader7NewsReaderPro] C:\Program Files\ABBYY FineReader 7.0 Professional Edition\AbbyyNewsReader.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [40d40cc9] rundll32.exe "C:\WINDOWS\system32\weqsmhsc.dll",b
O4 - HKLM\..\Run: [BM43e73f55] Rundll32.exe "C:\WINDOWS\system32\ychdbafg.dll",s
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [DriverMax] "C:\Program Files\Innovative Solutions\DriverMax\devices.exe" -agent
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU)
O16 - DPF: {304171C0-65EA-4B51-B5D9-93A311E26EB1} (MxPEG_ActiveX Control) - developer.mobotix.com/mobotix_sdk_1.0.1/paks/MxPEG_ActiveX.cab
O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Viewer Control) - baza.ds.org.rs/viewer/activeXViewer/activexviewer.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{250DE528-24E5-45D4-BECA-BC2FB4B45D9D}: NameServer = 212.200.56.13,212.200.56.11
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Google Update Service (gupdate1c8edd8d6ff3fe) (gupdate1c8edd8d6ff3fe) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

--
End of file - 9443 bytes

Poslao: 11 Sep 2008 18:52
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Aktiviraj prikaz skrivenih file-ova: http://www.mycity.rs/Uputstva-sa-ex-SuperSajta/Kako-videti-skrivene-fajlove.html



Uploaduj sledeće file-ove na proveru:

C:\WINDOWS\system32\mlfcache.dat
C:\Program Files\Google\Update\1.2.131.11\GoopdateBho.dll


Upload link: http://www.mycity.rs/ambulanta-upload.php

Poslao: 11 Sep 2008 19:33
Idi na vrh
offline
  • Pridružio: 07 Jun 2008
  • Poruke: 46

Uradio sam sve sto ste od mene trazili.

Poslao: 11 Sep 2008 20:02
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Otvoriti Notepad i iskopirati sledeci tekst:

File::
C:\WINDOWS\system32\ljJBQJby.dll
C:\WINDOWS\system32\nmjurddv.dll

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{73676140-CB2D-40B5-BCF0-9FB4AE97798E}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{05C92845-C1D7-41F6-B760-8A35415FABDa}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"40d40cc9"=-
"BM43e73f55"=-


Snimiti na Desktop fajl iz Notepada kao "CFScript"




Prevuci snimljeni skript/tekst na ComboFix ikonicu kao na slici.
Postaviti u sledecoj poruci log koji bude bio napravljen na kraju ciscenja/skeniranja.

Poslao: 11 Sep 2008 20:28
Idi na vrh
offline
  • Pridružio: 07 Jun 2008
  • Poruke: 46

ComboFix 08-09-10.04 - Aca 2008-09-11 20:19:47.9 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1250.1.1033.18.595 [GMT 2:00]
Running from: F:\Programi\ComboFix.exe
Command switches used :: C:\Documents and Settings\Aca\Desktop\CFScript.txt
* Created a new restore point
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\ljJBQJby.dll

.
((((((((((((((((((((((((( Files Created from 2008-08-11 to 2008-09-11 )))))))))))))))))))))))))))))))
.

2008-09-10 17:34 . 2008-09-10 17:34 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-09-10 17:31 . 2008-09-10 17:31 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-09-10 09:56 . 2008-06-23 18:57 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-09-10 09:56 . 2008-06-23 11:20 625,664 -----c--- C:\WINDOWS\system32\dllcache\iexplore.exe
2008-09-10 09:04 . 2008-06-13 13:05 272,128 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-09-10 09:04 . 2008-06-13 13:05 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-09-10 07:49 . 2008-09-10 17:36 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-09-10 07:49 . 2005-02-25 05:35 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-09-10 06:09 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-09-10 06:09 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-09-09 09:55 . 2008-09-09 09:55 <DIR> d-------- C:\Documents and Settings\Aca\Application Data\ArcSoft
2008-09-09 09:54 . 2008-09-09 09:54 135,299 --a------ C:\Setup_ver1.1662.0.exe
2008-09-08 15:48 . 2008-09-08 15:55 <DIR> d-------- C:\Program Files\CD Autorun Creator
2008-09-07 12:31 . 2008-09-07 12:31 <DIR> d-------- C:\WINDOWS\system32\IOSUBSYS
2008-09-05 20:02 . 2008-09-05 20:02 56,492 --ah----- C:\WINDOWS\system32\mlfcache.dat
2008-09-03 00:10 . 2008-09-03 00:11 <DIR> d-------- C:\Documents and Settings\Aca\Application Data\HateML
2008-08-29 19:18 . 2008-08-29 19:18 2,302,017 --a------ C:\WINDOWS\system32\GPhotos.scr
2008-08-25 07:31 . 2008-08-25 07:31 <DIR> d-------- C:\Program Files\PowerISO
2008-08-13 21:55 . 2008-08-13 21:55 <DIR> d-------- C:\Documents and Settings\Aca\Application Data\Nvu
2008-08-13 21:54 . 2008-08-13 21:54 <DIR> d-------- C:\Program Files\Nvu
2008-08-13 09:58 . 2008-08-13 09:58 <DIR> d-------- C:\My Media Files
2008-08-13 09:58 . 2008-08-13 09:58 43 --a------ C:\WINDOWS\Aurora Media Workshop.INI
2008-08-13 09:57 . 2002-05-06 11:01 45,056 --a------ C:\WINDOWS\system32\WNASPI32.DLL
2008-08-13 09:57 . 1999-09-10 12:06 45,056 --a------ C:\WINDOWS\system32\WNASPI2K.BAK
2008-08-13 09:57 . 1999-09-10 12:06 25,244 --a------ C:\WINDOWS\system32\drivers\ASPI2K.BAK
2008-08-13 09:57 . 2002-05-06 11:01 17,005 --a------ C:\WINDOWS\system32\drivers\ASPI32.SYS
2008-08-13 09:57 . 2001-04-19 17:34 5,600 --a------ C:\WINDOWS\system\WINASPI.DLL
2008-08-13 09:57 . 1999-09-10 12:06 5,600 --a------ C:\WINDOWS\system\WINASPI.BAK
2008-08-13 09:57 . 2001-04-19 17:34 4,672 --a------ C:\WINDOWS\system\WOWPOST.EXE
2008-08-13 09:57 . 1999-09-10 12:06 4,672 --a------ C:\WINDOWS\system\WOWPOST.BAK
2008-08-13 09:56 . 2008-08-13 09:57 <DIR> d-------- C:\Program Files\Aurora Media Workshop
2008-08-11 06:50 . 2008-08-11 06:50 <DIR> d-------- C:\Documents and Settings\Aca\Application Data\FastStone
2008-08-11 06:49 . 2008-08-11 06:49 <DIR> d-------- C:\Program Files\FastStone Capture

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-11 17:47 --------- d-----w C:\Documents and Settings\Aca\Application Data\Skype
2008-09-11 15:05 --------- d-----w C:\Documents and Settings\Aca\Application Data\skypePM
2008-09-11 13:35 --------- d-----w C:\Program Files\ACD Systems
2008-09-11 13:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\ACD Systems
2008-09-11 13:33 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-10 18:42 --------- d-----w C:\Program Files\Google
2008-09-10 15:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-09-09 07:52 --------- d-----w C:\Documents and Settings\Aca\Application Data\uTorrent
2008-08-25 05:23 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-24 17:05 --------- d-----w C:\Program Files\Opera
2008-08-17 18:44 --------- d-----w C:\Documents and Settings\Aca\Application Data\Sony
2008-08-09 09:39 --------- d-----w C:\Program Files\Winamp
2008-08-08 06:35 --------- d-----w C:\Program Files\RegCleaner
2008-08-07 18:45 --------- d-----w C:\Program Files\Mv2Player
2008-08-05 02:52 --------- d-----w C:\Program Files\Innovative Solutions
2008-08-04 22:12 --------- d-----w C:\Program Files\Sun
2008-08-04 22:11 --------- d-----w C:\Program Files\Java
2008-08-04 19:47 --------- d-----w C:\Program Files\Common Files\Adobe
2008-08-01 12:26 --------- d-----w C:\Program Files\Common Files\ACD Systems
2008-08-01 03:59 --------- d-----w C:\Documents and Settings\Aca\Application Data\Publish Providers
2008-08-01 03:57 --------- d-----w C:\Program Files\Vstplugins
2008-08-01 03:57 --------- d-----w C:\Program Files\Sony
2008-08-01 03:56 --------- d-----w C:\Program Files\Sony Setup
2008-07-31 16:33 --------- d-----w C:\Program Files\Easy CD-DA Extractor 10
2008-07-31 12:42 --------- d-----w C:\Documents and Settings\Aca\Application Data\Canon
2008-07-25 21:24 --------- d-----w C:\Program Files\Microsoft Visual Studio 8
2008-07-25 21:13 --------- d-----w C:\Program Files\MSBuild
2008-07-25 21:13 --------- d-----w C:\Program Files\Microsoft Works
2008-07-25 21:11 --------- d-----w C:\Program Files\Microsoft.NET
2008-07-25 20:05 --------- d-----w C:\Program Files\MSECache
2008-07-24 13:26 --------- d-----w C:\Program Files\AAA Photo Album
2008-07-24 10:28 --------- d-----w C:\Program Files\Microsoft
2008-07-23 00:06 --------- d-----w C:\Program Files\Flickr Uploadr
2008-07-23 00:06 --------- d-----w C:\Documents and Settings\Aca\Application Data\Flickr
2008-07-22 20:06 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-07-22 19:57 --------- d-----w C:\Program Files\Skype
2008-07-22 19:57 --------- d-----w C:\Program Files\Common Files\Skype
2008-07-22 19:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype
2008-07-21 13:37 --------- d-----w C:\Program Files\ESET
2008-07-19 05:04 --------- d-----w C:\Program Files\Netscape
2008-07-17 08:39 --------- d-----w C:\Documents and Settings\Aca\Application Data\CD-LabelPrint
2008-07-16 23:37 --------- d-----w C:\Program Files\Common Files\Borland Shared
2008-07-16 23:37 --------- d-----w C:\Program Files\b&b
2008-07-14 13:37 --------- d-----w C:\Program Files\Common Files\Adobe AIR
2008-07-14 13:37 --------- d-----w C:\Program Files\Adobe Media Player
2008-07-13 22:41 --------- d-----w C:\Documents and Settings\Aca\Application Data\Mikrotik
2008-07-11 19:26 --------- d-----w C:\Program Files\TC UP
2008-07-11 17:36 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-07-11 10:43 --------- d-----w C:\Program Files\ABBYY FineReader 4.0 Sprint
2008-07-11 10:32 --------- d-----w C:\Program Files\ABBYY FineReader 7.0 Professional Edition
2008-07-11 10:25 --------- d-----w C:\Documents and Settings\Aca\Application Data\ABBYY
2008-07-11 10:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\ABBYY
2008-07-11 10:02 --------- d-----w C:\Documents and Settings\Aca\Application Data\Corel
2008-07-11 10:01 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-07-11 10:01 --------- d-----w C:\Program Files\Common Files\Corel
2008-07-11 10:00 --------- d-----w C:\Program Files\Corel
2008-07-11 09:51 --------- d-----w C:\Program Files\Alcohol Soft
2008-07-11 08:51 --------- d-----w C:\Program Files\BearPaw 1200CU Plus
2008-07-11 08:49 --------- d-----w C:\Program Files\Temp
2008-07-11 08:45 --------- d-----w C:\Program Files\Canon
2008-07-11 08:41 --------- d--h--w C:\Documents and Settings\All Users\Application Data\CanonBJ
2008-07-11 08:36 --------- d-----w C:\Program Files\Common Files\Canon
2008-07-11 08:31 --------- d-----w C:\Documents and Settings\Aca\Application Data\Winamp
2008-07-11 08:10 --------- d-----w C:\Documents and Settings\Aca\Application Data\ACD Systems
2008-07-10 10:33 298,104 ----a-w C:\WINDOWS\system32\imon.dll
2008-07-07 20:26 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-06-24 16:43 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-24 16:12 295,936 ----a-w C:\WINDOWS\system32\wmpeffects.dll
2008-06-23 16:57 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:46 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-05-14 10:29 16,384 --sha-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
2008-05-14 10:29 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
2008-05-14 10:29 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008051420080515\index.dat
2008-05-14 10:29 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.

((((((((((((((((((((((((((((( snapshot_2008-09-10_22.21.05.48 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-12-07 03:01:07 124,928 ------w C:\WINDOWS\system32\advpack.dll
+ 2008-06-23 16:57:27 124,928 ----a-w C:\WINDOWS\system32\advpack.dll
- 2008-07-26 12:32:06 264,616 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
+ 2008-09-11 18:10:52 287,704 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
- 2007-12-07 03:01:07 63,488 ------w C:\WINDOWS\system32\icardie.dll
+ 2008-06-23 16:57:28 63,488 ----a-w C:\WINDOWS\system32\icardie.dll
- 2007-12-07 03:01:10 6,067,200 ------w C:\WINDOWS\system32\ieframe.dll
+ 2008-06-23 16:57:33 6,066,176 ----a-w C:\WINDOWS\system32\ieframe.dll
- 2007-12-07 03:01:11 267,776 ------w C:\WINDOWS\system32\iertutil.dll
+ 2008-06-23 16:57:34 267,776 ----a-w C:\WINDOWS\system32\iertutil.dll
- 2007-12-07 03:01:11 459,264 ------w C:\WINDOWS\system32\msfeeds.dll
+ 2008-06-23 16:57:36 459,264 ----a-w C:\WINDOWS\system32\msfeeds.dll
- 2007-12-07 02:01:12 52,224 ------w C:\WINDOWS\system32\msfeedsbs.dll
+ 2008-06-23 16:57:36 52,224 ----a-w C:\WINDOWS\system32\msfeedsbs.dll
- 2008-01-16 15:20:50 3,593,728 ------w C:\WINDOWS\system32\mshtml.dll
+ 2008-06-24 08:57:40 3,592,192 ----a-w C:\WINDOWS\system32\mshtml.dll
- 2007-12-07 03:01:13 105,984 ------w C:\WINDOWS\system32\url.dll
+ 2008-06-23 16:57:40 105,984 ----a-w C:\WINDOWS\system32\url.dll
- 2007-12-07 03:01:13 1,162,752 ------w C:\WINDOWS\system32\urlmon.dll
+ 2008-06-23 16:57:40 1,159,680 ----a-w C:\WINDOWS\system32\urlmon.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{77D7E795-33C5-4323-974D-A2A49AB75517}]
2008-08-30 02:16 133616 --a----t- C:\Program Files\Google\Update\1.2.131.11\GoopdateBho.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-02-28 1828136]
"AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-07-02 220544]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-02-06 21898024]
"DriverMax"="C:\Program Files\Innovative Solutions\DriverMax\devices.exe" [2008-07-25 5057368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-07-10 949376]
"NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2008-02-28 570664]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 2221352]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-08-04 36352]
"FineReader7NewsReaderPro"="C:\Program Files\ABBYY FineReader 7.0 Professional Edition\AbbyyNewsReader.exe" [2003-08-05 278528]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2008-07-07 167936]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ShowDeskFix"="shell32" [X]

C:\Documents and Settings\Aca\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3fhg"= mp3fhg.acm
"VIDC.YV12"= yv12vfw.dll
"VIDC.ACDV"= ACDV.dll
"MSACM.NSPAC"= NSPAC32.ACM
"MSACM.VOXACM118"= vdk32118.acm
"MSACM.NSX83"= nsx83p32.acm
"MSACM.NSX723"= sx5363s.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 VD_FileDisk;VD_FileDisk;C:\WINDOWS\system32\drivers\VD_FileDisk.sys [2006-01-13 15872]
S2 gupdate1c8edd8d6ff3fe;Google Update Service (gupdate1c8edd8d6ff3fe);C:\Program Files\Google\Update\GoogleUpdate.exe [2008-08-30 133104]
.
Contents of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -

BHO-{88A0ACE6-C469-4E2C-B66D-792B1C9CD9B0} - C:\WINDOWS\system32\ljJBQJby.dll



**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, gmer.net
Rootkit scan 2008-09-11 20:21:38
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-09-11 20:22:40
ComboFix-quarantined-files.txt 2008-09-11 18:22:32
ComboFix2.txt 2008-09-11 18:17:27
ComboFix3.txt 2008-09-11 17:28:29
ComboFix4.txt 2008-09-11 17:01:29
ComboFix5.txt 2008-09-11 18:19:10

Pre-Run: 3,362,181,120 bytes free
Post-Run: 3,352,862,720 bytes free

224 --- E O F --- 2008-09-10 20:35:27

Poslao: 11 Sep 2008 20:39
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Kakvo je sada stanje?

Poslao: 11 Sep 2008 22:03
Idi na vrh
offline
  • Pridružio: 07 Jun 2008
  • Poruke: 46

Namerno se javljam tek sad, jer sam prvo proverio kako radi računar i da li još postoji virus.

Računar radi kao nov čak imam utisak i bolje nego pre. Sve u svemu prezadovoljan sam.

Hvala Vam na pomoći a ovo je još jedan dokaz koliko je Mycity jak i koliko je dobro biti član tako velike i jake porodice.

HVALA!!!

Poslao: 11 Sep 2008 22:17
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Ok. Uradi još i sledeće:

Klikni START a zatim RUN
U liniju za unos teksta ukucaj Combofix /u i klikni OK





Sačekaj da se proces deinstalacije završi
Gornja procedura će:
Obrisati sledeće:
ComboFix i njegove file-ove i foldere
VundoFix Backups folder, ako postoji
C:\Deckard folder, ako postoji
C:\OtMoveIt folder, ako postoji
Resetovati podešavanja sata na kompjuteru
Sakriti ekstenzije file-ova, ako je potrebno
Sakriti sistemske/skrivene file-ove/foldere, ako je potrebno
Resetovati System Restore


To je sve.

poz

MyCity » Ambulanta -> Arhiva Ambulante » da li sam dobro proverio racunar?

Ko je trenutno na forumu
 

Ukupno su 1014 korisnika na forumu :: 32 registrovanih, 4 sakrivenih i 978 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: A.R.Chafee.Jr., acatomic, Apok, bestguarder, Brana01, Centauro, dankisha, darkangel, Doca, dragoljub11987, GandorCC, Goran 0000, Kubovac, Marko Marković, Mcdado, mercedesamg, Mihajlo, Milan A. Nikolic, Milos ZA, moldway, nebkv, nenad81, novator, procesor, raptorsi, sabros, Sirius, Stoilkovic, suton, TangoSix, Valter071, vathra