imam problem oko podizanja windowsa xp

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Uradio sam sve po uputsvu s tim sto opet nisam na desnom kliku imao opciju Save log (inace na tom prozoru nije bilo nikakvih promjena) pa sam ti iskopirao iz foldera C-pa folder USBNoRisk kao u tvom proslom uputstvu.



USBNoRisk by bobby

Started at 6.2.2009 11:07:31

Scanning for connected USB Mass storage...
----------------------------------------
========================================

Scanning for other storage...
----------------------------------------
C: {dc12bca1-e336-11dd-bffe-806d6172696f}
========================================


Scanning fixed storage for autorun.inf files...
----------------------------------------
Autorun.inf on C: - None
----------------------------------------

Sanitizing Shell Menu...
----------------------------------------
No key found for C:
No key found for dc12bca1-e336-11dd-bffe-806d6172696f
========================================

========================================



New device connected at 6.2.2009 11:08:08

Scanning for connected USB mass storage...
----------------------------------------
I: {7b7caba1-e3b1-11dd-afc9-0019db587bf0}
Added I:
========================================

Scanning USB mass storage for files...
----------------------------------------
Autorun.inf on I: - None
----------------------------------------

Sanitizing Shell Menu...
----------------------------------------
No key found for 7b7caba1-e3b1-11dd-afc9-0019db587bf0
========================================

----------------------------------------

Desktop.ini on I: - None
----------------------------------------

========================================

Processing script
----------------------------------------

Kod:
{7b7caba1-e3b1-11dd-afc9-0019db587bf0}
delete: %DRIVE%nbrbiv.exe
delete_blocked:

----------------------------------------
Drive letter for GUID: I:\
7b7caba1-e3b1-11dd-afc9-0019db587bf0
SectionStart = 1
SectionEnd = 3
Delete: I:\nbrbiv.exe > Error!
----------------------------------------
Deleting blocked files:
----------------------------------------
None
----------------------------------------

========================================

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Ovo je neverovatno...

Pusti ponovo ComboFix i postavi mi log.

Ako te ComboFix upita da uradi update, dozvoli mu to.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Kažu da su rešenja obično jednostavna a u mom slučaju je bilo sledeće:
Ovaj virus ili šta li je već sam uspio obrisati preko avasta sa ovog računara što je na netu. Samo ne znam kako se ranije nesjetih da probam. Evo prikačiću sliku šta je pisalo kad ga je avast pronašao, ja sam išao na briši i više ga nije bilo.

Međutim problem je izgleda sa mojim kućnim računarom, jer sam fleš nakon brisanja virusa ubacivao samo u taj kućni računar i kad sam opet došao na posao, problem isti. Sve sam ponovio 2 puta za svaki slučaj: brisanje sa avastom, priključivanjem fleša na kucni računar i virus je opet bio tu.
Kako da riješim sad ovaj kucni racunar jer je problem očigledno u njemu. Napominjem da na njemu nemam internet.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Dokle god flesh setas levo-desno po racunarima, do tada necemo uspeti nista da uradimo.

Prebaci na taj kucni racunar ComboFix i USBNoRisk, i nakon toga bih te zamolio da taj flesh ne koristis vise ni na jednom drugom racunaru dok ne zavrsimo ciscenje.

Na tom kucnom racunaru proskeniraj ComboFixom i USBNoRiskom prema upustvima koje si vec dobio ranije (bez skriptova, samo pokretanje programa duplim klikom) pa da vidimo sta nam je ciniti.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Sad nisam setao fles osim onog sto je moralo da bi odradio sve po tvom uputstvu. Uz pomoc flesa sam prebacio ComboFix i USBNoRisk na desktop kucno racunara i pokrenuo ih, snimio logove na fles i donio na posao da ti to postavim, ali sam mi se odjednom javio novi problem, kad hocu da otvorim fles dvoklikom on mi otvara sledece na slici. Kako sad da ga otvorim kad nece dvoklikom. Kad idem desni klik na fles prvo mi je Otvori i opet mi otvara istu sliku.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

USBNoRisk i USB_blocker resavaju taj problem automatski.
Ako imas bilo koju verziju na ovom racunaru, pusti ih da ti ovo poprave (flash treba da je prikljucen).

Ako nemas, onda moras rucno:
Idi na Start > Run
U dijalogu koji se bude otvorio kucaj CMD i klikni na OK
Sada treba da se prebacis u konzoli na flesh.
Za to sluzi komanda CD F: (zameni F pravim slovom tvog flesh uredjaja, ovo sam dao kao primer samo).
Kada budes na fleshu u konzoli, kucaj sledece:
DEL autorun.inf

To bi trebalo da resi problem, s tim da moras da uradis i sledece:
- zatvoris konzolu
- otkacis i ponovo prikljucis flesh (uz obavezan Safe Remove iz traya)

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Evo da postavim log od ComboFix-a a zatim i USBNoRisk sa kucnog racunara.
ComboFix 09-02-10.03 - User 2009-02-12 15:49:34.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.495.218 [GMT 1:00]
Running from: c:\documents and settings\User\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Internet Explorer.lnk
c:\windows\IE4 Error Log.txt
c:\windows\system32\amvo.exe
c:\windows\system32\amvo0.dll
c:\windows\system32\AutoRun.inf
c:\windows\system32\csrcs.exe

.
((((((((((((((((((((((((( Files Created from 2009-01-12 to 2009-02-12 )))))))))))))))))))))))))))))))
.

2009-02-09 16:40 . 2009-02-09 16:40 <DIR> d-------- c:\program files\Common Files\Adobe AIR
2009-01-30 15:19 . 2009-02-12 15:41 <DIR> d-------- C:\USBNoRisk
2009-01-26 22:15 . 2009-01-26 22:20 <DIR> d-------- c:\program files\ABBYY FineReader 7.0 Professional Edition
2009-01-26 21:57 . 2009-01-26 21:57 <DIR> d-------- c:\documents and settings\User\Application Data\ABBYY
2009-01-26 21:56 . 2009-01-26 21:56 <DIR> d-------- c:\documents and settings\All Users\Application Data\ABBYY
2009-01-26 19:53 . 2005-02-18 13:02 7,358 --a------ c:\windows\slkuc.ico
2009-01-25 19:15 . 2009-01-25 19:15 <DIR> d-------- c:\documents and settings\User\Application Data\ESET
2009-01-25 19:14 . 2009-01-25 19:14 <DIR> d-------- c:\documents and settings\All Users\Application Data\ESET

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-12 14:47 --------- d-----w c:\documents and settings\User\Application Data\Skype
2009-02-09 15:39 --------- d-----w c:\program files\Common Files\Adobe
2009-01-26 21:55 --------- d-----w c:\program files\TypingMaster
2008-12-28 12:51 --------- d-----w c:\documents and settings\User\Application Data\AVG7
2008-12-28 12:51 --------- d-----w c:\documents and settings\proba\Application Data\AVG7
2008-12-28 12:51 --------- d-----w c:\documents and settings\All Users\Application Data\avg7
2008-11-16 13:50 304,160 ----a-w C:\PA207.DAT
2005-09-15 17:26 41,573 ----a-w c:\program files\mozilla firefox\components\jar50.dll
2005-09-15 17:26 48,223 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll
2005-09-15 17:26 160,871 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2006-12-11 25343016]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-11-02 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-11-02 126976]
"PAC207_Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2006-11-03 319488]
"Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2006-11-03 319488]
"FineReader7NewsReaderPro"="c:\program files\ABBYY FineReader 7.0 Professional Edition\AbbyyNewsReader.exe" [2003-09-12 278528]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"Run StartupMonitor"="StartupMonitor.exe" [2000-05-20 c:\windows\StartupMonitor.exe]
"SoundMan"="SOUNDMAN.EXE" [2005-12-14 c:\windows\soundman.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-03 c:\windows\system32\narrator.exe]

c:\documents and settings\User\Start Menu\Programs\Startup\
PowerReg Scheduler V3.exe [2006-11-23 225280]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-07-27 113664]
AutoCAD Startup Accelerator.lnk - c:\program files\Common Files\Autodesk Shared\acstart16.exe [2004-02-25 10872]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm
"vidc.XVID"= xvid.dll
"vidc.DIV3"= DivXc32.dll
"vidc.DIV4"= DivXc32f.dll
"vidc.3ivx"= 3ivxVfWCodec.dll
"msacm.divxa32"= divxa32.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

S3 PAC207;Eye 110;c:\windows\system32\drivers\PFC027.SYS [2008-11-10 616064]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{41dd480a-5a6e-11dd-9d10-001617904eea}]
\Shell\AutoRun\command - G:\nbrbiv.exe
\Shell\explore\Command - G:\nbrbiv.exe
\Shell\open\Command - G:\nbrbiv.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a081c829-46db-11dd-9cef-001617904eea}]
\Shell\AutoRun\command - F:\ntde1ect.com
\Shell\explore\Command - F:\ntde1ect.com
\Shell\open\Command - F:\ntde1ect.com
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-kav - c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
HKLM-Explorer_Run-csrcs - c:\windows\system32\csrcs.exe


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath -

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("backups.number_of_prefs_copies", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.link.open_newwindow.ui", 3); // prefs UI version
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.default.Window.closed", "allAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.default.Window.document", "allAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.default.Window.frames", "allAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.default.Window.history", "allAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.default.Window.length", "allAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.default.Window.opener", "allAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.default.Window.parent", "allAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.default.Window.self", "allAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.default.Window.top", "allAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.default.Window.window", "allAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.DOMParser,parseFromString", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.DOMParser,parseFromStream", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.disable_window_open_feature.status", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("advanced.always_load_images", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.protocol-handler.external.help", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.connect.timeout", 30); // in seconds
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.request.timeout", 120); // in seconds
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN_show_punycode", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.image.imageBehavior", 0); // 0-Accept, 1-dontAcceptForeign, 2-dontUse
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.cookie.cookieBehavior", 3); // 0-Accept, 1-dontAcceptForeign, 2-dontUse, 3-p3p
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.cookie.p3plevel", 1); // 0=low, 1=medium, 2=high, 3=custom
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.enablePad", false); // Allow client to do proxy autodiscovery
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("app.id", "{ec8030f7-c20a-464f-9b0e-13a3a9e97384}");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("app.version",
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("app.extensions.version", "1.0");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("app.build_id",
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("app.update.autoUpdateEnabled", true); // Whether or not background app updates
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("app.update.url", "chrome://mozapps/locale/update/update.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("app.update.updatesAvailable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("app.update.lastUpdateDate", 0); // UTC offset when last App update was
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("app.update.performed", false); // Whether or not an update has been
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.update.autoUpdateEnabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.update.autoUpdate", false); // Automatically download and install
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.update.interval", 604800000); // Check for updates to Extensions and
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.update.lastUpdateDate", 0); // UTC offset when last Extension/Theme
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.update.severity.threshold", 5);// The number of pending Extension/Theme
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.update.count", 0); // The number of extension/theme/etc
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("update.interval", 3600000); // Check each of the above intervals
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("update.showSlidingNotification", true); // Windows-only slide-up taskbar
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("update.severity", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("general.useragent.vendor", "Firefox");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("general.useragent.vendorSub",
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.update.resetHomepage", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.startup.homepage_override.1", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.turbo.enabled", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.default", "chrome://browser/content/searchconfig.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.custom", "chrome://browser/content/searchconfig.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("update_notifications.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("update_notifications.provider.0.frequency", 7); // number of days
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.xul.error_pages.enabled", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("pfs.datasource.url", "chrome://mozapps/locale/plugins/plugins.properties");
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-12 15:50:52
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-02-12 15:51:59
ComboFix-quarantined-files.txt 2009-02-12 14:51:56

Pre-Run: 14.481.698.816 bytes free
Post-Run: 14,980,272,128 bytes free

171



USBNoRisk by bobby

Started at 12.2.2009 15:40:10

Scanning for connected USB Mass storage...
----------------------------------------
========================================

Scanning for other storage...
----------------------------------------
C: {77898a32-5a01-11db-96e6-806d6172696f}
D: {77898a33-5a01-11db-96e6-806d6172696f}
========================================


Scanning fixed storage for autorun.inf files...
----------------------------------------
Autorun.inf on C: - None
----------------------------------------

Sanitizing Shell Menu...
----------------------------------------
No key found for C:
No key found for 77898a32-5a01-11db-96e6-806d6172696f
========================================

Autorun.inf on D: - None
----------------------------------------

Sanitizing Shell Menu...
----------------------------------------
No key found for D:
No key found for 77898a33-5a01-11db-96e6-806d6172696f
========================================

========================================



New device connected at 12.2.2009 15:40:32

Scanning for connected USB mass storage...
----------------------------------------
F: {f2f2cb80-b7c5-11db-9849-001617904eea}
Added F:
========================================

Scanning USB mass storage for files...
----------------------------------------
Autorun.inf on F: - None
----------------------------------------

Sanitizing Shell Menu...
----------------------------------------
Sanitized f2f2cb80-b7c5-11db-9849-001617904eea
========================================

----------------------------------------

Desktop.ini on F: - None
----------------------------------------

========================================

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Prijatelju, ubi me ovaj tvoj slucaj u pojam.
Ja sam se pogubio sada po logovima jer mi nije jasno koji je vise sa kog kompjutera i na sta se zalis za koji kompjuter.
Ovaj zadnji log je sada sa nekog treceg racunara?

Ovaj racunar je bio isto inficiran.
Imao si prikljucene inficirane uredjaje koji su ti bili oznaceni kao F: i G:, a ni jedan od njih nije ovaj sto si sada skenirao USBNoRiskom.

Ako jos uvek na nekom od ovih kompjutera imas konkretan problem, moracemo da smislimo nacina da to resimo, ali ne vise u ovoj temi. U ovoj temi ne moze vise da se snadje ni bog otac.

Javi mi kakvo je stanje na kojem kompu sada, pa da vidimo za dalje.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

OK. upravu si da je komplikovano i izvinjavam se. Postavicu novu temu. Dakle u novoj temi cu postaviti log od ComboFix-a i USBNoRisk-a (sa kucnog racunara) jer je izgleda problem u njemu i onda preko flesa zarazim i ova dva racunara na poslu.