molim pomoc

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Ne moze da odradi Combofix do kraja, dodje do
...
complite stage 50

i tu zablokira i ne mrda dalje

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Koliko dugo ga cekas kad dodje dotle? Ostavi ga da odradi treba mu vremena, nemoj da zuris.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

cekam ga sat vremena sigurno!!!

prvi put je odradio to complite stage 50

i jos je javio da je dilete neke dva file

znam da je na jednom p[isalo nesta kao win32 i posle toga je zablokirao i nijedno cvise nije presao complete stage 50

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

@gardinho

Ajde da probamo da pokrenes u Safe Mode CF
uputstvo:

http://www.mycity.rs/Uputstva/Kako-uci-u-Safe-Mode-2.html

Isprati uputstvo i pokreni Combofix

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

ISTO SE DESAVA I U SAFE MODE, ODRADI COMPLETE STAGE 50 I STANE, NIJE DA BLOKIRA JER MU TREPERI ONA MALA CRTICA ALI NE MRDA DALJE...

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Pokreni ponovo DDS i postavi mi svezi DDS.txt log.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Uloguj se preko Facebooka da bi skinuo fajl:

DDS (Ver_10-03-17.01) - NTFSx86
Run by Ceca at 14:57:34,75 on ??? 21.05.2010
Internet Explorer: 7.0.6000.17037
Microsoft® Windows Vista™ Home Basic 6.0.6000.0.1252.2.1033.18.893.467 [GMT -4:00]

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\WLTRYSVC.EXE
C:\Windows\system32\WLANExt.exe
C:\Windows\System32\bcmwltry.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\atashost.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\PVSW\bin\w3dbsmgr.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\svchost.exe -k WindowsMobile
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Windows\system32\WUDFHost.exe
C:\Users\Ceca\AppData\Roaming\U3\0000162443757D22\LaunchPad.exe
C:\Users\Ceca\Desktop\dds.scr
C:\Windows\system32\conime.exe
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uSearch Page = hxxp://www.google.com
uStart Page = hxxp://home.alot.com/?client_id=2B5F573001CA5A810C3501B5&install_time=31-10-2009:19:24&src_id=11031&camp_id=609&tb_version=2.5.4.463
uWindow Title = Internet Explorer provided by Dell
uSearch Bar = hxxp://www.google.com/ie
uDefault_Page_URL = hxxp://www.google.ca/ig/dell?hl=en&client=dell-row&channel=ca&ibd=2080117
mDefault_Page_URL = hxxp://www.google.ca/ig/dell?hl=en&client=dell-row&channel=ca&ibd=2080117
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: ALOT Toolbar Helper: {14ceeaff-96dd-4101-ae37-d5ecdc23c3f6} - c:\program files\alot\bin\alot.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
TB: ALOT Toolbar: {5aa2ba46-9913-4dc7-9620-69ab0fa17ae7} - c:\program files\alot\bin\alot.dll
TB: {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No File
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [MsnMsgr] "c:\program files\windows live\messenger\MsnMsgr.Exe" /background
uRun: [Microsoft Windows Visual V2.0] c:\windows\msiutil.exe
uRun: [Legacy VGA Drivers V1.0] c:\windows\certproc32.exe
uRun: [Sony DVDRam Version 1.8B] c:\windows\uiengine32.exe
uRun: [A00F441FE54.exe] c:\users\ceca\appdata\local\temp\_A00F441FE54.exe
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [Prauge DVDRam Version 2.3A] c:\windows\system32\spfx\hypinit32.exe
uRun: [Microsoft Task Scheduler] c:\windows\system32\dlha\mstask32.com
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [ATICCC] "c:\program files\ati technologies\ati.ace\CLIStart.exe"
mRun: [SigmatelSysTrayApp] sttray.exe
mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [<NO NAME>]
mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\9.0\sharedcom\RoxWatchTray9.exe"
mRun: [PDVDDXSrv] "c:\program files\cyberlink\powerdvd dx\PDVDDXSrv.exe"
mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [Google Desktop Search] "c:\program files\google\google desktop search\GoogleDesktop.exe" /startup
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [sysgif32] c:\users\ceca\appdata\local\temp\~TM4EB8.tmp
mRun: [Microsoft Task Scheduler] c:\windows\system32\dlha\mstask32.com
dRun: [Prauge DVDRam Version 2.3A] c:\windows\system32\spfx\hypinit32.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\pervas~1.lnk - c:\pvsw\bin\w3dbsmgr.exe
mPolicies-system: EnableLUA = 0 (0x0)
IE: Add to Windows &Live Favorites - favorites.live.com/quickadd.aspx
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {8F6E7FB2-E56B-4F66-A4E1-9765D2565280} - hxxp://www.worldwinner.com/games/launcher/ie/v2.22.01.0/iewwload.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: {45FEA75B-C4B8-4189-BB86-319F6B41E479} = 67.55.0.11,67.55.0.13
AppInit_DLLs: c:\progra~1\google\google~2\GOEC62~1.DLL
mASetup: Legacy VGA Drivers V1.0 - c:\windows\certproc32.exe
mASetup: Prauge DVDRam Version 2.3A - c:\windows\system32\spfx\hypinit32.exe
mASetup: Sony DVDRam Version 1.8B - c:\windows\uiengine32.exe

============= SERVICES / DRIVERS ===============

R2 atashost;WebEx Service Host for Support Center;c:\windows\system32\atashost.exe [2009-8-5 20376]
S3 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr.sys [2009-11-10 54632]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2009-8-5 704864]
S3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589;c:\program files\google\google desktop search\GoogleDesktop.exe [2008-10-5 30192]

=============== Created Last 30 ================

2010-05-20 19:50:51 0 d-s---w- C:\ComboFix
2010-05-19 19:27:09 0 d-----w- c:\program files\trend micro
2010-05-18 20:13:37 0 d-----w- c:\programdata\Sun
2010-05-18 20:11:49 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-05-18 16:18:48 98816 ----a-w- c:\windows\sed.exe
2010-05-18 16:18:48 77312 ----a-w- c:\windows\MBR.exe
2010-05-18 16:18:48 256512 ----a-w- c:\windows\PEV.exe
2010-05-18 16:18:48 161792 ----a-w- c:\windows\SWREG.exe
2010-05-18 03:37:22 0 d-sh--w- C:\found.000
2010-05-11 20:50:30 65536 --sha-w- c:\users\ceca\NTUSER.DAT{d8932e6c-6a6f-11db-b6ab-a038f15a5785}.TxR.blf
2010-05-11 20:50:30 1048576 --sha-w- c:\users\ceca\NTUSER.DAT{d8932e6c-6a6f-11db-b6ab-a038f15a5785}.TxR.2.regtrans-ms
2010-05-11 20:50:30 1048576 --sha-w- c:\users\ceca\NTUSER.DAT{d8932e6c-6a6f-11db-b6ab-a038f15a5785}.TxR.1.regtrans-ms
2010-05-11 20:50:30 1048576 --sha-w- c:\users\ceca\NTUSER.DAT{d8932e6c-6a6f-11db-b6ab-a038f15a5785}.TxR.0.regtrans-ms
2010-05-09 13:40:52 121 ----a-w- c:\windows\initiate.inf

==================== Find3M ====================

2010-05-18 13:31:04 51200 ----a-w- c:\windows\inf\infpub.dat
2010-05-18 13:31:03 86016 ----a-w- c:\windows\inf\infstor.dat
2010-05-18 13:31:02 86016 ----a-w- c:\windows\inf\infstrng.dat
2010-05-12 15:21:16 221568 ------w- c:\windows\system32\MpSigStub.exe
2010-03-09 16:54:49 832512 ----a-w- c:\windows\system32\wininet.dll
2010-03-09 16:50:34 56320 ----a-w- c:\windows\system32\iesetup.dll
2010-03-09 16:50:25 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-03-09 16:48:34 72704 ----a-w- c:\windows\system32\admparse.dll
2010-03-09 14:17:48 26624 ----a-w- c:\windows\system32\ieUnatt.exe
2010-03-09 12:43:52 48128 ----a-w- c:\windows\system32\mshtmler.dll
2010-03-04 19:24:26 434176 ----a-w- c:\windows\system32\vbscript.dll
2008-12-12 12:43:05 174 --sha-w- c:\program files\desktop.ini
2008-09-17 01:24:23 190 ----a-w- c:\program files\common files\psasetup.log
2008-06-11 07:11:51 665600 ----a-w- c:\windows\inf\drvindex.dat
2006-11-02 12:39:34 30674 ----a-w- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 12:39:34 30674 ----a-w- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 12:39:34 287440 ----a-w- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 12:39:34 287440 ----a-w- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfc.dat
2008-01-17 21:12:32 8192 --sha-w- c:\windows\users\default\NTUSER.DAT

============= FINISH: 14:59:50,56 ===============


mycity.rs/must-login.png

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Otvoriti Notepad i iskopirati sledeci tekst:

File::
c:\windows\msiutil.exe
c:\windows\certproc32.exe
c:\windows\uiengine32.exe
c:\users\ceca\appdata\local\temp\_A00F441FE54.exe
c:\users\ceca\appdata\local\temp\~TM4EB8.tmp

Folder::
c:\windows\system32\spfx
c:\windows\system32\dlha

Registry::
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"sysgif32"=-
"Microsoft Task Scheduler"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Microsoft Windows Visual V2.0"=-
"Legacy VGA Drivers V1.0"=-
"Sony DVDRam Version 1.8B"=-
"A00F441FE54.exe"=-
"Prauge DVDRam Version 2.3A"=-
"Microsoft Task Scheduler"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\Legacy VGA Drivers V1.0]
[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\Prauge DVDRam Version 2.3A]
[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\Sony DVDRam Version 1.8B]


Snimiti na Desktop fajl iz Notepada kao "CFScript"




Prevuci snimljeni skript/tekst na ComboFix ikonicu kao na slici.
Postaviti u sledecoj poruci log koji bude bio napravljen na kraju ciscenja/skeniranja.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

e ovako kada sam i uraio sto ste rekli, on je odradio ono complite stage 50 i posle toga nastavio sa

Deleting Files
c:windows\system32\dlha\recovery.dat
c:windows\system32\spfx\mstlsap.dll
c:windows\system32\spfx\oleserv32.dll
c:windows\system32\spfx\pfsbase32.dll

Deleting Folders:
c:windows\system32\dlha\
c:windows\system32\spfx\
_

i onda ova donja crtica treperi ali i ne radi dalje nista vise, ja sam ga cekao mozda nekih pola sata nakon toga sam samo ugasio i restartovao comp...

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Korak 1.


Preuzmi AVZ Antiviral Toolkit sa sledećeg linka :

http://devbuilds.kaspersky-labs.com/devbuilds/AVZ/avz4.zip


Raspakuj arhivu u neki folder (uputstvo), a zatim:
pokreni AVZ (dvoklikom na ikonicu);

u meniju izaberi File > Custom Scripts;

u prozor koji se otvori iskopiraj sve što se nalazi unutar Kod polja:

begin
  SearchRootkit(true, true);
  SetAVZGuardStatus(True);
   QuarantineFile('c:\windows\msiutil.exe','');
   QuarantineFile('c:\windows\certproc32.exe','');
   QuarantineFile('c:\windows\uiengine32.exe','');
   QuarantineFile('c:\users\ceca\appdata\local\tem\_A00F441FE54.exe','');
   QuarantineFile('c:\users\ceca\appdata\local\temp\~TM4EB8.tmp','');
   QuarantineFile('c:\windows\system32\dlha\mstask32.com','');
   DeleteFile('c:\windows\msiutil.exe');
   DeleteFile('c:\windows\certproc32.exe');
   DeleteFile('c:\windows\uiengine32.exe');
   DeleteFile('c:\users\ceca\appdata\local\temp\_A00F441FE54.exe');
   DeleteFile('c:\users\ceca\appdata\local\temp\~TM4EB8.tmp');
   DeleteFile('c:\windows\system32\dlha\mstask32.com');
   DeleteDirectory('c:\windows\system32\spfx');
   DeleteDirectory('c:\windows\system32\dlha');
  BC_ImportDeletedList;
  BC_Activate;
  ExecuteSysClean;
  RebootWindows(true);
end.

klikni taster Run i sačekaj da se skripta izvrši.

Korak 2.


Ponovo pokreni AVZ (dvoklikom na ikonicu);

u meniju izaberi File > Standard Scripts;

U prozoru koji se otvori štikliraj opciju 2 i klikni Execute Selected Scripts;

klikni Yes;

po završetku skeniranja dobićeš obaveštenje: Script Executed;

izađi iz programa.

Uploaduj fajl virusinfo_syscheck.zip koji se nalazi u avz\log folderu na forum.

AVZ pokreni opcijom Run As...