MyCity » Ambulanta -> Arhiva Ambulante » virus sa usba

virus sa usba

Napisano na dan: 19.2.2009
1

virus sa usba
Sledeća strana Pagination

Idi na vrh

Poslao: 19 Feb 2009 00:36
Idi na vrh
offline
  • Pridružio: 19 Feb 2009
  • Poruke: 9

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 0:20:40, on 19.2.2009
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16386)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\IDT\WDM\sttray.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\DellTPad\Apoint.exe
C:\Win\lsass.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\nikola\Downloads\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = [Link mogu videti samo ulogovani korisnici]
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [Link mogu videti samo ulogovani korisnici]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [Link mogu videti samo ulogovani korisnici]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [Link mogu videti samo ulogovani korisnici]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [Link mogu videti samo ulogovani korisnici]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [Link mogu videti samo ulogovani korisnici]
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: Live TV Toolbar - {b69a9db4-d0a1-4722-b56b-f20757a29cdf} - C:\Program Files\Live_TV\tbLiv0.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Live TV Toolbar - {b69a9db4-d0a1-4722-b56b-f20757a29cdf} - C:\Program Files\Live_TV\tbLiv0.dll
O3 - Toolbar: Live TV Toolbar - {b69a9db4-d0a1-4722-b56b-f20757a29cdf} - C:\Program Files\Live_TV\tbLiv0.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [run32] C:\Win\lsass.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - [Link mogu videti samo ulogovani korisnici]\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O13 - Gopher Prefix:
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_c204e27d\aestsrv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_c204e27d\STacSV.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE

--
End of file - 7338 bytes


kopirao sam nesto sa usba i racunar je poceo cudno da se ponasa. ne rade mi shift ni caps, a kada kucam, slova se pojavljuju veoma sporo. ponekad se ponasa kao da je taster shift zaglavljen. kada skeniram nod av javlja da je sve cisto. moze pomoc?



Poslao: 19 Feb 2009 16:57
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Pozdrav...



Pokreni ESET Smart Security/ESET NOD32 na sledeci nacin :
Start>All Programs>ESET>ESET Smart Security ili pak ESET NOD32 Antivirus(ukoliko koristis samo Antivirus resenje).

* Kada ti se otvori glavni prozor programa, klikni na Setup opciju sa leve strane prozora;
* Izaberi Antivirus and antispyware opciju i klikni na Temporarily disable Antivirus and antispyware protection.
* Na sledece pitanje klikni Yes.

Napomena: Ne zaboravi da ukljuciš ovu opciju po završetku cišcenja.



-------------------------------------------------------------------------------------



Arrow Skini ComboFix sa jedne od sledecih adresa na Desktop:
[Link mogu videti samo ulogovani korisnici]
[Link mogu videti samo ulogovani korisnici]
[Link mogu videti samo ulogovani korisnici]

Startuj ga i ne diraj prozor programa dok skenira.
Sledi uputstva na ekranu. Kada zavrsi pojavice se log (C:\ComboFix.txt) koji ces nam ovde iskopirati.



Poslao: 19 Feb 2009 17:25
Idi na vrh
offline
  • Pridružio: 19 Feb 2009
  • Poruke: 9

evo ga:

ComboFix 09-02-18.01 - nikola 2009-02-19 17:12:56.1 - NTFSx86
Microsoft® Windows Vista™ Ultimate 6.0.6000.0.1252.1.1033.18.2037.1101 [GMT 1:00]
Running from: c:\users\nikola\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated)
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\recycler\S-1-5-21-1482476501-1644491937-682003330-1013
c:\recycler\S-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini

.
((((((((((((((((((((((((( Files Created from 2009-01-19 to 2009-02-19 )))))))))))))))))))))))))))))))
.

2009-02-19 13:54 . 2009-02-19 13:54 <DIR> d-------- c:\users\nikola\AppData\Roaming\Malwarebytes
2009-02-19 13:54 . 2009-02-19 13:54 <DIR> d-------- c:\programdata\Malwarebytes
2009-02-19 13:54 . 2009-02-19 13:54 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-02-19 13:54 . 2009-02-11 10:19 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys
2009-02-19 13:54 . 2009-02-11 10:19 15,504 --a------ c:\windows\System32\drivers\mbam.sys
2009-02-18 23:26 . 2009-02-18 23:26 <DIR> d-------- c:\programdata\Yahoo! Companion
2009-02-18 16:50 . 2008-04-18 22:43 170,032 --a------ c:\windows\System32\drivers\Apfiltr.sys
2009-02-18 16:50 . 2008-01-19 16:53 100,546 --a------ c:\windows\System32\Vxdif.dll
2009-02-18 16:40 . 2009-02-18 16:40 2,560 --a------ c:\windows\_MSRSTRT.EXE
2009-02-17 20:36 . 2009-02-17 20:37 <DIR> dr-hs---- C:\Win
2009-02-16 12:07 . 2009-02-16 12:07 <DIR> d-------- c:\program files\URUSoft
2009-02-15 22:30 . 2009-02-19 04:03 <DIR> d-------- c:\users\nikola\AppData\Roaming\skypePM
2009-02-15 22:30 . 2009-02-15 22:30 56 --ah----- c:\windows\System32\ezsidmv.dat
2009-02-15 22:28 . 2009-02-19 04:04 <DIR> d-------- c:\users\nikola\AppData\Roaming\Skype
2009-02-15 22:28 . 2009-02-15 22:28 <DIR> d-------- c:\programdata\Skype
2009-02-15 22:28 . 2009-02-15 22:28 <DIR> dr------- c:\program files\Skype
2009-02-15 22:28 . 2009-02-15 22:28 <DIR> d-------- c:\program files\Common Files\Skype
2009-02-12 01:00 . 2009-02-12 01:01 <DIR> d-------- c:\programdata\Yahoo!
2009-02-10 19:47 . 2009-02-10 19:48 <DIR> d-------- C:\Total_Training
2009-02-10 03:25 . 2009-02-10 03:25 <DIR> d-------- c:\programdata\Adobe Systems
2009-02-10 03:19 . 2009-02-10 03:19 <DIR> d-------- c:\program files\Common Files\Adobe Systems Shared
2009-02-09 12:31 . 2009-02-10 15:06 <DIR> d-------- c:\program files\Macromedia
2009-02-09 12:31 . 2009-02-09 12:35 <DIR> d-------- c:\program files\Common Files\Macromedia
2009-01-30 18:52 . 2009-01-30 18:52 <DIR> d-------- c:\users\nikola\AppData\Roaming\vlc
2009-01-30 18:51 . 2009-01-30 18:51 <DIR> d-------- c:\program files\VideoLAN
2009-01-26 01:22 . 2009-01-26 01:41 <DIR> d-------- c:\program files\GRETECH
2009-01-24 23:47 . 2009-01-24 23:47 224,768 --a------ c:\windows\System32\drivers\usbport.sys
2009-01-24 23:47 . 2009-01-24 23:47 192,000 --a------ c:\windows\System32\drivers\usbhub.sys
2009-01-24 23:47 . 2009-01-24 23:47 73,216 --a------ c:\windows\System32\drivers\usbccgp.sys
2009-01-24 23:47 . 2009-01-24 23:47 38,912 --a------ c:\windows\System32\drivers\hidclass.sys
2009-01-24 23:47 . 2009-01-24 23:47 38,400 --a------ c:\windows\System32\drivers\usbehci.sys
2009-01-24 23:47 . 2009-01-24 23:47 25,472 --a------ c:\windows\System32\drivers\hidparse.sys
2009-01-24 23:47 . 2009-01-24 23:47 23,040 --a------ c:\windows\System32\drivers\usbuhci.sys
2009-01-24 23:47 . 2009-01-24 23:47 12,288 --a------ c:\windows\System32\drivers\hidusb.sys
2009-01-24 23:47 . 2009-01-24 23:47 8,704 --a------ c:\windows\System32\hccoin.dll
2009-01-24 23:47 . 2009-01-24 23:47 5,888 --a------ c:\windows\System32\drivers\usbd.sys
2009-01-24 23:46 . 2009-01-24 23:46 414,208 --a------ c:\windows\System32\msdri.dll
2009-01-24 23:46 . 2009-01-24 23:46 292,352 --a------ c:\windows\System32\psisdecd.dll
2009-01-24 23:46 . 2009-01-24 23:46 218,624 --a------ c:\windows\System32\psisrndr.ax
2009-01-24 23:46 . 2009-01-24 23:46 110,264 --a------ c:\windows\System32\drivers\ataport.sys
2009-01-24 23:46 . 2009-01-24 23:46 80,384 --a------ c:\windows\System32\MSNP.ax
2009-01-24 23:46 . 2009-01-24 23:46 68,608 --a------ c:\windows\System32\Mpeg2Data.ax
2009-01-24 23:46 . 2009-01-24 23:46 57,856 --a------ c:\windows\System32\MSDvbNP.ax
2009-01-24 23:46 . 2009-01-24 23:46 53,760 --a------ c:\windows\System32\drivers\hdaudbus.sys
2009-01-24 23:46 . 2009-01-24 23:46 45,240 --a------ c:\windows\System32\drivers\pciidex.sys
2009-01-24 23:46 . 2009-01-24 23:46 21,688 --a------ c:\windows\System32\drivers\atapi.sys
2009-01-24 23:46 . 2009-01-24 23:46 17,592 --a------ c:\windows\System32\drivers\intelide.sys
2009-01-24 23:45 . 2009-01-24 23:45 242,688 --a------ c:\windows\System32\drivers\rdpdr.sys
2009-01-24 23:45 . 2009-01-24 23:45 220,160 --a------ c:\windows\System32\drivers\bthport.sys
2009-01-24 23:45 . 2009-01-24 23:45 181,760 --a------ c:\windows\System32\fsquirt.exe
2009-01-24 23:45 . 2009-01-24 23:45 140,392 --a------ c:\windows\System32\drivers\pci.sys
2009-01-24 23:45 . 2009-01-24 23:45 50,792 --a------ c:\windows\System32\drivers\termdd.sys
2009-01-24 23:45 . 2009-01-24 23:45 50,280 --a------ c:\windows\System32\drivers\volmgr.sys
2009-01-24 23:45 . 2009-01-24 23:45 29,184 --a------ c:\windows\System32\drivers\BTHUSB.SYS
2009-01-24 23:45 . 2009-01-24 23:45 28,776 --a------ c:\windows\System32\drivers\mssmbios.sys
2009-01-24 23:45 . 2009-01-24 23:45 22,632 --a------ c:\windows\System32\streamci.dll
2009-01-24 23:45 . 2009-01-24 23:45 19,456 --a------ c:\windows\System32\drivers\bthenum.sys
2009-01-24 23:45 . 2009-01-24 23:45 13,928 --a------ c:\windows\System32\drivers\msisadrv.sys
2009-01-24 23:45 . 2009-01-24 23:45 12,776 --a------ c:\windows\System32\drivers\swenum.sys
2009-01-24 20:02 . 2006-11-02 11:23 <DIR> dr------- c:\users\RA Media Server\Videos
2009-01-24 20:02 . 2006-11-02 11:23 <DIR> d-------- c:\users\RA Media Server\Saved Games
2009-01-24 20:02 . 2006-11-02 11:23 <DIR> dr------- c:\users\RA Media Server\Pictures
2009-01-24 20:02 . 2006-11-02 11:23 <DIR> dr------- c:\users\RA Media Server\Music
2009-01-24 20:02 . 2006-11-02 11:23 <DIR> dr------- c:\users\RA Media Server\Links
2009-01-24 20:02 . 2006-11-02 11:23 <DIR> dr------- c:\users\RA Media Server\Downloads
2009-01-24 20:02 . 2009-01-24 20:03 <DIR> dr------- c:\users\RA Media Server\Documents
2009-01-24 20:02 . 2006-11-02 12:18 <DIR> d--h----- c:\users\RA Media Server\AppData
2009-01-24 20:02 . 2009-01-24 20:03 <DIR> d-------- c:\users\RA Media Server
2009-01-24 20:01 . 2009-01-24 23:33 <DIR> d-a------ c:\programdata\TEMP
2009-01-23 18:50 . 2009-02-05 00:08 <DIR> d-------- c:\users\Public\T.B.01.08
2009-01-20 15:45 . 2009-01-20 15:45 <DIR> d-------- c:\program files\MySQL
2009-01-20 15:01 . 2009-01-20 15:01 <DIR> d-------- c:\programdata\Apple Computer
2009-01-20 15:01 . 2009-01-20 15:01 <DIR> d-------- c:\programdata\Apple
2009-01-20 15:01 . 2009-01-20 15:02 <DIR> d-------- c:\program files\QuickTime
2009-01-20 15:01 . 2009-01-20 15:01 <DIR> d-------- c:\program files\Common Files\Apple
2009-01-20 15:01 . 2009-01-20 15:01 <DIR> d-------- c:\program files\Apple Software Update

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-19 13:57 --------- d-----w c:\program files\Live_TV
2009-02-19 03:03 --------- d-----w c:\users\nikola\AppData\Roaming\mIRC
2009-02-19 03:03 --------- d-----w c:\program files\mIRC
2009-02-19 02:15 --------- d-----w c:\users\nikola\AppData\Roaming\BitTorrent
2009-02-18 22:18 --------- d-----w c:\program files\Yahoo!
2009-02-18 15:51 --------- d-----w c:\program files\DellTPad
2009-02-18 15:41 --------- d-----w c:\program files\RADIO_USA
2009-02-18 14:15 --------- d-----w c:\programdata\Microsoft Help
2009-02-18 12:51 --------- d-----w c:\users\nikola\AppData\Roaming\DNA
2009-02-18 12:49 --------- d-----w c:\program files\DNA
2009-02-10 16:09 --------- d-----w c:\program files\Opera
2009-02-10 02:21 --------- d-----w c:\program files\Common Files\Adobe
2009-02-07 23:14 --------- d-----w c:\program files\Common Files\InstallShield
2009-02-04 01:28 197 ----a-w c:\windows\system32\drivers\stwrte.log
2009-01-24 22:44 --------- d-----w c:\program files\Dell
2009-01-24 22:34 --------- d-----w c:\programdata\Dell
2009-01-15 22:53 --------- d-----w c:\users\nikola\AppData\Roaming\Winamp
2009-01-15 13:45 --------- d-----w c:\program files\Winamp
2008-12-27 15:20 --------- d-----w c:\program files\BitTorrent
2006-11-02 12:49 174 --sha-w c:\program files\desktop.ini
2008-10-30 21:49 74 --sh--r c:\windows\CT4CET.bin
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2006-11-02 1196032]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2008-02-28 442433]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2008-03-12 3563520]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-08-18 1447168]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2008-04-30 196608]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"run32"="c:\win\lsass.exe" [2002-01-01 551669]

c:\users\nikola\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-02-08 752168]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MsnMsgr"="c:\program files\MSN Messenger\msnmsgr.exe" /background
"CollaborationHost"=c:\windows\system32\p2phost.exe -s
"BitTorrent DNA"="c:\program files\DNA\btdna.exe"
"Skype"="c:\program files\Skype\Phone\Skype.exe" /nosplash /minimized

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"Dell Webcam Central"="c:\program files\Dell Webcam\Dell Webcam Central\WebcamDell.exe" /mode2
"HotKeysCmds"=c:\windows\system32\hkcmd.exe
"IgfxTray"=c:\windows\system32\igfxtray.exe
"Persistence"=c:\windows\system32\igfxpers.exe
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0\bin\jusched.exe"
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe"
"Windows Defender"=%ProgramFiles%\Windows Defender\MSASCui.exe -hide
"ioCentre"=c:\genius\ioCentre\gTaskBar.exe
"NeroFilterCheck"=c:\windows\system32\NeroCheck.exe
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
"WinampAgent"="c:\program files\Winamp\winampa.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1329787070-2645521928-1567272476-1000]
"EnableNotificationsRef"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{BE7511EF-99F9-4434-9010-85435EBCBB13}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{94CB31F3-FCB9-4AD6-9492-0A4D8193736B}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{54F5AC86-A4AF-43CC-AB4D-B307FC2965E0}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{EBAA2C8F-4CF3-49EA-BCF0-BC45A3AB99C5}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{68855544-459D-4E3D-9F3D-FE8E26E62AD8}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{685F0990-1CF3-4318-B42C-26FCA2C75077}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{E9314084-DAA7-4C20-A870-5A83909EA717}"= UDP:c:\program files\DNA\btdna.exe:DNA (TCP-In)
"{03CB32F6-74D3-4C91-94FA-0FDCA7568B91}"= TCP:c:\program files\DNA\btdna.exe:DNA (UDP-In)
"{902CD350-777D-4CEB-A59A-B65F37223EEE}"= UDP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent (TCP-In)
"{AAEB9DAA-69C0-4CE2-81FC-D4EA6C5B31BA}"= TCP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent (UDP-In)
"{D706900C-1F42-4463-A6D9-5C805014BF27}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{0B8C2FCC-7512-4D6C-9BA6-BA21F1AB983F}"= c:\program files\Skype\Phone\Skype.exe:Skype

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\BitTorrent\\bittorrent.exe"= c:\program files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent
"c:\\Users\\nikola\\AppData\\Local\\Temp\\RarSFX8\\Yahoo!\\Messenger\\YahooMessenger.exe"= c:\users\nikola\AppData\Local\Temp\RarSFX8\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger
"c:\\Users\\nikola\\AppData\\Local\\Temp\\RarSFX8\\Yahoo!\\Messenger\\YServer.exe"= c:\users\nikola\AppData\Local\Temp\RarSFX8\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server
"c:\\Users\\nikola\\AppData\\Local\\Temp\\RarSFX13\\Yahoo!\\Messenger\\YahooMessenger.exe"= c:\users\nikola\AppData\Local\Temp\RarSFX13\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger
"c:\\Users\\nikola\\AppData\\Local\\Temp\\RarSFX13\\Yahoo!\\Messenger\\YServer.exe"= c:\users\nikola\AppData\Local\Temp\RarSFX13\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server
"c:\\Users\\nikola\\AppData\\Local\\Temp\\RarSFX17\\Yahoo!\\Messenger\\YahooMessenger.exe"= c:\users\nikola\AppData\Local\Temp\RarSFX17\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger
"c:\\Users\\nikola\\AppData\\Local\\Temp\\RarSFX17\\Yahoo!\\Messenger\\YServer.exe"= c:\users\nikola\AppData\Local\Temp\RarSFX17\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server
"c:\\Users\\nikola\\AppData\\Local\\Temp\\RarSFX18\\Yahoo!\\Messenger\\YahooMessenger.exe"= c:\users\nikola\AppData\Local\Temp\RarSFX18\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger
"c:\\Users\\nikola\\AppData\\Local\\Temp\\RarSFX18\\Yahoo!\\Messenger\\YServer.exe"= c:\users\nikola\AppData\Local\Temp\RarSFX18\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server
"c:\\Users\\nikola\\AppData\\Local\\Temp\\RarSFX21\\Yahoo!\\Messenger\\YahooMessenger.exe"= c:\users\nikola\AppData\Local\Temp\RarSFX21\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger
"c:\\Users\\nikola\\AppData\\Local\\Temp\\RarSFX21\\Yahoo!\\Messenger\\YServer.exe"= c:\users\nikola\AppData\Local\Temp\RarSFX21\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server
"c:\\Users\\nikola\\AppData\\Local\\Temp\\RarSFX24\\Yahoo!\\Messenger\\YahooMessenger.exe"= c:\users\nikola\AppData\Local\Temp\RarSFX24\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger
"c:\\Users\\nikola\\AppData\\Local\\Temp\\RarSFX24\\Yahoo!\\Messenger\\YServer.exe"= c:\users\nikola\AppData\Local\Temp\RarSFX24\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server
"c:\\Users\\nikola\\AppData\\Local\\Temp\\RarSFX26\\Yahoo!\\Messenger\\YahooMessenger.exe"= c:\users\nikola\AppData\Local\Temp\RarSFX26\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger
"c:\\Users\\nikola\\AppData\\Local\\Temp\\RarSFX26\\Yahoo!\\Messenger\\YServer.exe"= c:\users\nikola\AppData\Local\Temp\RarSFX26\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server
"c:\\Users\\nikola\\AppData\\Local\\Temp\\RarSFX27\\Yahoo!\\Messenger\\YahooMessenger.exe"= c:\users\nikola\AppData\Local\Temp\RarSFX27\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger
"c:\\Users\\nikola\\AppData\\Local\\Temp\\RarSFX27\\Yahoo!\\Messenger\\YServer.exe"= c:\users\nikola\AppData\Local\Temp\RarSFX27\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server
"c:\\Users\\nikola\\AppData\\Local\\Temp\\RarSFX29\\Yahoo!\\Messenger\\YahooMessenger.exe"= c:\users\nikola\AppData\Local\Temp\RarSFX29\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger
"c:\\Users\\nikola\\AppData\\Local\\Temp\\RarSFX29\\Yahoo!\\Messenger\\YServer.exe"= c:\users\nikola\AppData\Local\Temp\RarSFX29\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server
"c:\\Users\\nikola\\AppData\\Local\\Temp\\RarSFX31\\Yahoo!\\Messenger\\YahooMessenger.exe"= c:\users\nikola\AppData\Local\Temp\RarSFX31\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger
"c:\\Users\\nikola\\AppData\\Local\\Temp\\RarSFX31\\Yahoo!\\Messenger\\YServer.exe"= c:\users\nikola\AppData\Local\Temp\RarSFX31\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server

R1 epfwtdir;epfwtdir;c:\windows\System32\drivers\epfwtdir.sys [2008-08-18 34312]
R2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_c204e27d\AEstSrv.exe [2008-10-30 73728]
R2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2008-08-18 468224]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\System32\drivers\btwl2cap.sys [2008-10-30 29736]
R3 gHidPnp;USB Device Enhanced Function Driver;c:\windows\System32\drivers\gHidPnp.sys [2008-11-17 16384]
R3 gMouUsb;USB Mouse Device Drv;c:\windows\System32\drivers\gMouUsb.sys [2008-11-17 9856]
R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI Service;c:\windows\System32\drivers\IntcHdmi.sys [2008-10-30 111616]
R3 k57nd60x;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\System32\drivers\k57nd60x.sys [2008-01-29 203264]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\System32\drivers\mbamswissarmy.sys [2009-02-19 38496]
R3 OA001Ufd;Creative Camera OA001 Upper Filter Driver;c:\windows\System32\drivers\OA001Ufd.sys [2008-10-30 149208]
R3 OA001Vid;Creative Camera OA001 Function Driver;c:\windows\System32\drivers\OA001Vid.sys [2008-10-30 277624]
R3 usnjsvc;Messenger Sharing Folders USN Journal Reader service;c:\program files\MSN Messenger\usnsvc.exe [2007-01-19 97136]
S3 gMouPS2;PS2 Scroll Mouse Device;c:\windows\System32\drivers\gMouPS2.sys [2008-11-17 17408]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder

2009-02-13 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2008\OneClick.exe [2007-12-21 15:17]
.
.
------- Supplementary Scan -------
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
FF - ProfilePath - c:\users\nikola\AppData\Roaming\Mozilla\Firefox\Profiles\5z9t70qh.default\
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava11.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava12.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava13.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava14.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava32.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjpi160.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npoji610.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2009-02-19 17:15:23
Windows 6.0.6000 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(2248-)
c:\windows\system32\btmmhook.dll
c:\windows\system32\btncopy.dll
.
Completion time: 2009-02-19 17:17:19
ComboFix-quarantined-files.txt 2009-02-19 16:17:17

Pre-Run: 88.395.337.728 bytes free
Post-Run: 88,372,191,232 bytes free

259

Poslao: 19 Feb 2009 18:03
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Otvoriti Notepad i iskopirati sledeci tekst:

Folder::
c:\win

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"run32"=-


Snimiti na Desktop fajl iz Notepada kao "CFScript"




Prevuci snimljeni skript/tekst na ComboFix ikonicu kao na slici.
Postaviti u sledecoj poruci log koji bude bio napravljen na kraju ciscenja/skeniranja.

Poslao: 19 Feb 2009 18:14
Idi na vrh
offline
  • Pridružio: 19 Feb 2009
  • Poruke: 9

evo ga:

ComboFix 09-02-18.01 - nikola 2009-02-19 18:03:56.2 - NTFSx86
Microsoft® Windows Vista™ Ultimate 6.0.6000.0.1252.1.1033.18.2037.1015 [GMT 1:00]
Running from: c:\users\nikola\Desktop\ComboFix.exe
Command switches used :: c:\users\nikola\Desktop\CFScript.txt
AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated)
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\win
c:\win\1.exe
c:\win\lsass.exe
c:\win\names.txt

.
((((((((((((((((((((((((( Files Created from 2009-01-19 to 2009-02-19 )))))))))))))))))))))))))))))))
.

2009-02-19 13:54 . 2009-02-19 13:54 <DIR> d-------- c:\users\nikola\AppData\Roaming\Malwarebytes
2009-02-19 13:54 . 2009-02-19 13:54 <DIR> d-------- c:\programdata\Malwarebytes
2009-02-19 13:54 . 2009-02-19 13:54 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-02-19 13:54 . 2009-02-11 10:19 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys
2009-02-19 13:54 . 2009-02-11 10:19 15,504 --a------ c:\windows\System32\drivers\mbam.sys
2009-02-18 23:26 . 2009-02-18 23:26 <DIR> d-------- c:\programdata\Yahoo! Companion
2009-02-18 16:50 . 2008-04-18 22:43 170,032 --a------ c:\windows\System32\drivers\Apfiltr.sys
2009-02-18 16:50 . 2008-01-19 16:53 100,546 --a------ c:\windows\System32\Vxdif.dll
2009-02-18 16:40 . 2009-02-18 16:40 2,560 --a------ c:\windows\_MSRSTRT.EXE
2009-02-16 12:07 . 2009-02-16 12:07 <DIR> d-------- c:\program files\URUSoft
2009-02-15 22:30 . 2009-02-19 04:03 <DIR> d-------- c:\users\nikola\AppData\Roaming\skypePM
2009-02-15 22:30 . 2009-02-15 22:30 56 --ah----- c:\windows\System32\ezsidmv.dat
2009-02-15 22:28 . 2009-02-19 04:04 <DIR> d-------- c:\users\nikola\AppData\Roaming\Skype
2009-02-15 22:28 . 2009-02-15 22:28 <DIR> d-------- c:\programdata\Skype
2009-02-15 22:28 . 2009-02-15 22:28 <DIR> dr------- c:\program files\Skype
2009-02-15 22:28 . 2009-02-15 22:28 <DIR> d-------- c:\program files\Common Files\Skype
2009-02-12 01:00 . 2009-02-12 01:01 <DIR> d-------- c:\programdata\Yahoo!
2009-02-10 19:47 . 2009-02-10 19:48 <DIR> d-------- C:\Total_Training
2009-02-10 03:25 . 2009-02-10 03:25 <DIR> d-------- c:\programdata\Adobe Systems
2009-02-10 03:19 . 2009-02-10 03:19 <DIR> d-------- c:\program files\Common Files\Adobe Systems Shared
2009-02-09 12:31 . 2009-02-10 15:06 <DIR> d-------- c:\program files\Macromedia
2009-02-09 12:31 . 2009-02-09 12:35 <DIR> d-------- c:\program files\Common Files\Macromedia
2009-01-30 18:52 . 2009-01-30 18:52 <DIR> d-------- c:\users\nikola\AppData\Roaming\vlc
2009-01-30 18:51 . 2009-01-30 18:51 <DIR> d-------- c:\program files\VideoLAN
2009-01-26 01:22 . 2009-01-26 01:41 <DIR> d-------- c:\program files\GRETECH
2009-01-24 23:47 . 2009-01-24 23:47 224,768 --a------ c:\windows\System32\drivers\usbport.sys
2009-01-24 23:47 . 2009-01-24 23:47 192,000 --a------ c:\windows\System32\drivers\usbhub.sys
2009-01-24 23:47 . 2009-01-24 23:47 73,216 --a------ c:\windows\System32\drivers\usbccgp.sys
2009-01-24 23:47 . 2009-01-24 23:47 38,912 --a------ c:\windows\System32\drivers\hidclass.sys
2009-01-24 23:47 . 2009-01-24 23:47 38,400 --a------ c:\windows\System32\drivers\usbehci.sys
2009-01-24 23:47 . 2009-01-24 23:47 25,472 --a------ c:\windows\System32\drivers\hidparse.sys
2009-01-24 23:47 . 2009-01-24 23:47 23,040 --a------ c:\windows\System32\drivers\usbuhci.sys
2009-01-24 23:47 . 2009-01-24 23:47 12,288 --a------ c:\windows\System32\drivers\hidusb.sys
2009-01-24 23:47 . 2009-01-24 23:47 8,704 --a------ c:\windows\System32\hccoin.dll
2009-01-24 23:47 . 2009-01-24 23:47 5,888 --a------ c:\windows\System32\drivers\usbd.sys
2009-01-24 23:46 . 2009-01-24 23:46 414,208 --a------ c:\windows\System32\msdri.dll
2009-01-24 23:46 . 2009-01-24 23:46 292,352 --a------ c:\windows\System32\psisdecd.dll
2009-01-24 23:46 . 2009-01-24 23:46 218,624 --a------ c:\windows\System32\psisrndr.ax
2009-01-24 23:46 . 2009-01-24 23:46 110,264 --a------ c:\windows\System32\drivers\ataport.sys
2009-01-24 23:46 . 2009-01-24 23:46 80,384 --a------ c:\windows\System32\MSNP.ax
2009-01-24 23:46 . 2009-01-24 23:46 68,608 --a------ c:\windows\System32\Mpeg2Data.ax
2009-01-24 23:46 . 2009-01-24 23:46 57,856 --a------ c:\windows\System32\MSDvbNP.ax
2009-01-24 23:46 . 2009-01-24 23:46 53,760 --a------ c:\windows\System32\drivers\hdaudbus.sys
2009-01-24 23:46 . 2009-01-24 23:46 45,240 --a------ c:\windows\System32\drivers\pciidex.sys
2009-01-24 23:46 . 2009-01-24 23:46 21,688 --a------ c:\windows\System32\drivers\atapi.sys
2009-01-24 23:46 . 2009-01-24 23:46 17,592 --a------ c:\windows\System32\drivers\intelide.sys
2009-01-24 23:45 . 2009-01-24 23:45 242,688 --a------ c:\windows\System32\drivers\rdpdr.sys
2009-01-24 23:45 . 2009-01-24 23:45 220,160 --a------ c:\windows\System32\drivers\bthport.sys
2009-01-24 23:45 . 2009-01-24 23:45 181,760 --a------ c:\windows\System32\fsquirt.exe
2009-01-24 23:45 . 2009-01-24 23:45 140,392 --a------ c:\windows\System32\drivers\pci.sys
2009-01-24 23:45 . 2009-01-24 23:45 50,792 --a------ c:\windows\System32\drivers\termdd.sys
2009-01-24 23:45 . 2009-01-24 23:45 50,280 --a------ c:\windows\System32\drivers\volmgr.sys
2009-01-24 23:45 . 2009-01-24 23:45 29,184 --a------ c:\windows\System32\drivers\BTHUSB.SYS
2009-01-24 23:45 . 2009-01-24 23:45 28,776 --a------ c:\windows\System32\drivers\mssmbios.sys
2009-01-24 23:45 . 2009-01-24 23:45 22,632 --a------ c:\windows\System32\streamci.dll
2009-01-24 23:45 . 2009-01-24 23:45 19,456 --a------ c:\windows\System32\drivers\bthenum.sys
2009-01-24 23:45 . 2009-01-24 23:45 13,928 --a------ c:\windows\System32\drivers\msisadrv.sys
2009-01-24 23:45 . 2009-01-24 23:45 12,776 --a------ c:\windows\System32\drivers\swenum.sys
2009-01-24 20:02 . 2006-11-02 11:23 <DIR> dr------- c:\users\RA Media Server\Videos
2009-01-24 20:02 . 2006-11-02 11:23 <DIR> d-------- c:\users\RA Media Server\Saved Games
2009-01-24 20:02 . 2006-11-02 11:23 <DIR> dr------- c:\users\RA Media Server\Pictures
2009-01-24 20:02 . 2006-11-02 11:23 <DIR> dr------- c:\users\RA Media Server\Music
2009-01-24 20:02 . 2006-11-02 11:23 <DIR> dr------- c:\users\RA Media Server\Links
2009-01-24 20:02 . 2006-11-02 11:23 <DIR> dr------- c:\users\RA Media Server\Downloads
2009-01-24 20:02 . 2009-01-24 20:03 <DIR> dr------- c:\users\RA Media Server\Documents
2009-01-24 20:02 . 2006-11-02 12:18 <DIR> d--h----- c:\users\RA Media Server\AppData
2009-01-24 20:02 . 2009-01-24 20:03 <DIR> d-------- c:\users\RA Media Server
2009-01-24 20:01 . 2009-01-24 23:33 <DIR> d-a------ c:\programdata\TEMP
2009-01-23 18:50 . 2009-02-05 00:08 <DIR> d-------- c:\users\Public\T.B.01.08
2009-01-20 15:45 . 2009-01-20 15:45 <DIR> d-------- c:\program files\MySQL
2009-01-20 15:01 . 2009-01-20 15:01 <DIR> d-------- c:\programdata\Apple Computer
2009-01-20 15:01 . 2009-01-20 15:01 <DIR> d-------- c:\programdata\Apple
2009-01-20 15:01 . 2009-01-20 15:02 <DIR> d-------- c:\program files\QuickTime
2009-01-20 15:01 . 2009-01-20 15:01 <DIR> d-------- c:\program files\Common Files\Apple
2009-01-20 15:01 . 2009-01-20 15:01 <DIR> d-------- c:\program files\Apple Software Update

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-19 13:57 --------- d-----w c:\program files\Live_TV
2009-02-19 03:03 --------- d-----w c:\users\nikola\AppData\Roaming\mIRC
2009-02-19 03:03 --------- d-----w c:\program files\mIRC
2009-02-19 02:15 --------- d-----w c:\users\nikola\AppData\Roaming\BitTorrent
2009-02-18 22:18 --------- d-----w c:\program files\Yahoo!
2009-02-18 15:51 --------- d-----w c:\program files\DellTPad
2009-02-18 15:41 --------- d-----w c:\program files\RADIO_USA
2009-02-18 14:15 --------- d-----w c:\programdata\Microsoft Help
2009-02-18 12:51 --------- d-----w c:\users\nikola\AppData\Roaming\DNA
2009-02-18 12:49 --------- d-----w c:\program files\DNA
2009-02-10 16:09 --------- d-----w c:\program files\Opera
2009-02-10 02:21 --------- d-----w c:\program files\Common Files\Adobe
2009-02-07 23:14 --------- d-----w c:\program files\Common Files\InstallShield
2009-02-04 01:28 197 ----a-w c:\windows\system32\drivers\stwrte.log
2009-01-24 22:44 --------- d-----w c:\program files\Dell
2009-01-24 22:34 --------- d-----w c:\programdata\Dell
2009-01-15 22:53 --------- d-----w c:\users\nikola\AppData\Roaming\Winamp
2009-01-15 13:45 --------- d-----w c:\program files\Winamp
2008-12-27 15:20 --------- d-----w c:\program files\BitTorrent
2006-11-02 12:49 174 --sha-w c:\program files\desktop.ini
2008-10-30 21:49 74 --sh--r c:\windows\CT4CET.bin
.

((((((((((((((((((((((((((((( [Link mogu videti samo ulogovani korisnici],32 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-02-19 15:09:10 262,144 ----a-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2009-02-19 16:15:29 262,144 ----a-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2006-11-02 1196032]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2008-02-28 442433]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2008-03-12 3563520]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-08-18 1447168]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2008-04-30 196608]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]

c:\users\nikola\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-02-08 752168]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MsnMsgr"="c:\program files\MSN Messenger\msnmsgr.exe" /background
"CollaborationHost"=c:\windows\system32\p2phost.exe -s
"BitTorrent DNA"="c:\program files\DNA\btdna.exe"
"Skype"="c:\program files\Skype\Phone\Skype.exe" /nosplash /minimized

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"Dell Webcam Central"="c:\program files\Dell Webcam\Dell Webcam Central\WebcamDell.exe" /mode2
"HotKeysCmds"=c:\windows\system32\hkcmd.exe
"IgfxTray"=c:\windows\system32\igfxtray.exe
"Persistence"=c:\windows\system32\igfxpers.exe
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0\bin\jusched.exe"
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe"
"Windows Defender"=%ProgramFiles%\Windows Defender\MSASCui.exe -hide
"ioCentre"=c:\genius\ioCentre\gTaskBar.exe
"NeroFilterCheck"=c:\windows\system32\NeroCheck.exe
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
"WinampAgent"="c:\program files\Winamp\winampa.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1329787070-2645521928-1567272476-1000]
"EnableNotificationsRef"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{BE7511EF-99F9-4434-9010-85435EBCBB13}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{94CB31F3-FCB9-4AD6-9492-0A4D8193736B}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{54F5AC86-A4AF-43CC-AB4D-B307FC2965E0}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{EBAA2C8F-4CF3-49EA-BCF0-BC45A3AB99C5}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{68855544-459D-4E3D-9F3D-FE8E26E62AD8}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{685F0990-1CF3-4318-B42C-26FCA2C75077}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{E9314084-DAA7-4C20-A870-5A83909EA717}"= UDP:c:\program files\DNA\btdna.exe:DNA (TCP-In)
"{03CB32F6-74D3-4C91-94FA-0FDCA7568B91}"= TCP:c:\program files\DNA\btdna.exe:DNA (UDP-In)
"{902CD350-777D-4CEB-A59A-B65F37223EEE}"= UDP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent (TCP-In)
"{AAEB9DAA-69C0-4CE2-81FC-D4EA6C5B31BA}"= TCP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent (UDP-In)
"{D706900C-1F42-4463-A6D9-5C805014BF27}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{0B8C2FCC-7512-4D6C-9BA6-BA21F1AB983F}"= c:\program files\Skype\Phone\Skype.exe:Skype

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\BitTorrent\\bittorrent.exe"= c:\program files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent
"c:\\Users\\nikola\\AppData\\Local\\Temp\\RarSFX8\\Yahoo!\\Messenger\\YahooMessenger.exe"= c:\users\nikola\AppData\Local\Temp\RarSFX8\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger
"c:\\Users\\nikola\\AppData\\Local\\Temp\\RarSFX8\\Yahoo!\\Messenger\\YServer.exe"= c:\users\nikola\AppData\Local\Temp\RarSFX8\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server
"c:\\Users\\nikola\\AppData\\Local\\Temp\\RarSFX13\\Yahoo!\\Messenger\\YahooMessenger.exe"= c:\users\nikola\AppData\Local\Temp\RarSFX13\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger
"c:\\Users\\nikola\\AppData\\Local\\Temp\\RarSFX13\\Yahoo!\\Messenger\\YServer.exe"= c:\users\nikola\AppData\Local\Temp\RarSFX13\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server
"c:\\Users\\nikola\\AppData\\Local\\Temp\\RarSFX17\\Yahoo!\\Messenger\\YahooMessenger.exe"= c:\users\nikola\AppData\Local\Temp\RarSFX17\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger
"c:\\Users\\nikola\\AppData\\Local\\Temp\\RarSFX17\\Yahoo!\\Messenger\\YServer.exe"= c:\users\nikola\AppData\Local\Temp\RarSFX17\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server
"c:\\Users\\nikola\\AppData\\Local\\Temp\\RarSFX18\\Yahoo!\\Messenger\\YahooMessenger.exe"= c:\users\nikola\AppData\Local\Temp\RarSFX18\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger
"c:\\Users\\nikola\\AppData\\Local\\Temp\\RarSFX18\\Yahoo!\\Messenger\\YServer.exe"= c:\users\nikola\AppData\Local\Temp\RarSFX18\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server
"c:\\Users\\nikola\\AppData\\Local\\Temp\\RarSFX21\\Yahoo!\\Messenger\\YahooMessenger.exe"= c:\users\nikola\AppData\Local\Temp\RarSFX21\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger
"c:\\Users\\nikola\\AppData\\Local\\Temp\\RarSFX21\\Yahoo!\\Messenger\\YServer.exe"= c:\users\nikola\AppData\Local\Temp\RarSFX21\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server
"c:\\Users\\nikola\\AppData\\Local\\Temp\\RarSFX24\\Yahoo!\\Messenger\\YahooMessenger.exe"= c:\users\nikola\AppData\Local\Temp\RarSFX24\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger
"c:\\Users\\nikola\\AppData\\Local\\Temp\\RarSFX24\\Yahoo!\\Messenger\\YServer.exe"= c:\users\nikola\AppData\Local\Temp\RarSFX24\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server
"c:\\Users\\nikola\\AppData\\Local\\Temp\\RarSFX26\\Yahoo!\\Messenger\\YahooMessenger.exe"= c:\users\nikola\AppData\Local\Temp\RarSFX26\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger
"c:\\Users\\nikola\\AppData\\Local\\Temp\\RarSFX26\\Yahoo!\\Messenger\\YServer.exe"= c:\users\nikola\AppData\Local\Temp\RarSFX26\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server
"c:\\Users\\nikola\\AppData\\Local\\Temp\\RarSFX27\\Yahoo!\\Messenger\\YahooMessenger.exe"= c:\users\nikola\AppData\Local\Temp\RarSFX27\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger
"c:\\Users\\nikola\\AppData\\Local\\Temp\\RarSFX27\\Yahoo!\\Messenger\\YServer.exe"= c:\users\nikola\AppData\Local\Temp\RarSFX27\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server
"c:\\Users\\nikola\\AppData\\Local\\Temp\\RarSFX29\\Yahoo!\\Messenger\\YahooMessenger.exe"= c:\users\nikola\AppData\Local\Temp\RarSFX29\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger
"c:\\Users\\nikola\\AppData\\Local\\Temp\\RarSFX29\\Yahoo!\\Messenger\\YServer.exe"= c:\users\nikola\AppData\Local\Temp\RarSFX29\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server
"c:\\Users\\nikola\\AppData\\Local\\Temp\\RarSFX31\\Yahoo!\\Messenger\\YahooMessenger.exe"= c:\users\nikola\AppData\Local\Temp\RarSFX31\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger
"c:\\Users\\nikola\\AppData\\Local\\Temp\\RarSFX31\\Yahoo!\\Messenger\\YServer.exe"= c:\users\nikola\AppData\Local\Temp\RarSFX31\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server

R1 epfwtdir;epfwtdir;c:\windows\System32\drivers\epfwtdir.sys [2008-08-18 34312]
R2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_c204e27d\AEstSrv.exe [2008-10-30 73728]
R2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2008-08-18 468224]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\System32\drivers\btwl2cap.sys [2008-10-30 29736]
R3 gHidPnp;USB Device Enhanced Function Driver;c:\windows\System32\drivers\gHidPnp.sys [2008-11-17 16384]
R3 gMouUsb;USB Mouse Device Drv;c:\windows\System32\drivers\gMouUsb.sys [2008-11-17 9856]
R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI Service;c:\windows\System32\drivers\IntcHdmi.sys [2008-10-30 111616]
R3 k57nd60x;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\System32\drivers\k57nd60x.sys [2008-01-29 203264]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\System32\drivers\mbamswissarmy.sys [2009-02-19 38496]
R3 OA001Ufd;Creative Camera OA001 Upper Filter Driver;c:\windows\System32\drivers\OA001Ufd.sys [2008-10-30 149208]
R3 OA001Vid;Creative Camera OA001 Function Driver;c:\windows\System32\drivers\OA001Vid.sys [2008-10-30 277624]
R3 usnjsvc;Messenger Sharing Folders USN Journal Reader service;c:\program files\MSN Messenger\usnsvc.exe [2007-01-19 97136]
S3 gMouPS2;PS2 Scroll Mouse Device;c:\windows\System32\drivers\gMouPS2.sys [2008-11-17 17408]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder

2009-02-13 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2008\OneClick.exe [2007-12-21 15:17]
.
.
------- Supplementary Scan -------
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
FF - ProfilePath - c:\users\nikola\AppData\Roaming\Mozilla\Firefox\Profiles\5z9t70qh.default\
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava11.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava12.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava13.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava14.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava32.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjpi160.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npoji610.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2009-02-19 18:05:40
Windows 6.0.6000 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-02-19 18:07:35
ComboFix-quarantined-files.txt 2009-02-19 17:07:33
ComboFix2.txt 2009-02-19 16:17:20

Pre-Run: 87.887.003.648 bytes free
Post-Run: 87,858,851,840 bytes free

261

Poslao: 19 Feb 2009 18:49
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Arrow Upakuj u zip/rar kompletan folder: C:\qoobox\quarantine

i upload-uj tu arhivu preko ovog linka: [Link mogu videti samo ulogovani korisnici]



-------------------------------------------------------------------------------------



Preuzmi USBNoRisk na Desktop i pokreni ga duplim klikom na ikonicu programa.
- Sacekaj koji sekund dok program izvrsi inicijalno skeniranje.
- Ubacuj sve USB memorijske uredjaje redom u USB slot i svaki zadrzi u slotu po 10 sekundi.
- Ukoliko imas vise uredjaja za proveru, onda na parcetu papira zapisi kojim redom su ubacivani jer ce nam kasnije trebati taj podatak
- Kada zavrsis sa svim uredjajima, klikni desno dugme misa na sred prozora programa i odaberi opciju Save log. To ce automatski otvoriti log u Notepadu. Iskopiraj nam taj log iz Notepada na forum.

Objasnjenje: U USB memorijske uredjaje spadaju svi oni uredjaji koji po prikljucivanju na kompjuter dobijaju svoju oznaku particije. Tu spadaju USB flash drajvovi, eksterni hard-diskovi, memorijske kartice, MP3 i MP4 plejeri, neki mobilni telefoni, neki GPS (navigacioni) uredjaji itd.

Poslao: 19 Feb 2009 18:56
Idi na vrh
offline
  • Pridružio: 19 Feb 2009
  • Poruke: 9

upload-ovao.


nemam taj usb kod sebe, a takodje ne posedujem ni licni usb, tako da ne znam da li treba da skidam ovaj USBNoRisk?

Poslao: 19 Feb 2009 19:18
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Nema potrebe...

Kakvo je trenutno stanje?

Poslao: 19 Feb 2009 19:20
Idi na vrh
offline
  • Pridružio: 19 Feb 2009
  • Poruke: 9

radi bez problema, cini mi se...obicno se problem javljao posle prijavljivanja na FB, ali sad sam prijavljen, i sve funkcionise ok. jel to sad gotovo?Smile

Poslao: 19 Feb 2009 19:23
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Imao si jednog crva - to je obrisano.

Sudeći po logovima, PC je sada čist. Preostaje da uradiš sledeće:

Klikni START a zatim RUN
U liniju za unos teksta ukucaj Combofix /u i klikni OK





Sačekaj da se proces deinstalacije završi
Gornja procedura će:
Obrisati sledeće:
ComboFix i njegove file-ove i foldere
VundoFix Backups folder, ako postoji
C:\Deckard folder, ako postoji
C:\OtMoveIt folder, ako postoji
Resetovati podešavanja sata na kompjuteru
Sakriti ekstenzije file-ova, ako je potrebno
Sakriti sistemske/skrivene file-ove/foldere, ako je potrebno
Resetovati System Restore



To je sve.

MyCity » Ambulanta -> Arhiva Ambulante » virus sa usba

Ko je trenutno na forumu
 

Ukupno su 1271 korisnika na forumu :: 152 registrovanih, 12 sakrivenih i 1107 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: 100ka, 357magnum, 4thFlavian, amadeus, Apok, Aristotle2002, armor, Asteker, Avalon015, Azzo, banebeograd, bankulen, Bivan, bladesu, Bob.Rock, bobomicek, Bobrock1, Bojan198527, bojank, bojankrstc, bojcistv, bokisha253, Boris90, Borski1977, Brana01, branko7, Brankojle, Ca6otep, casual03, cemix, Cian, Cicumile, cinoeye, coaaco, Crazzer, crnogorac, darcaud, dejanbenkovic, Denaya, Dioniss, djboj, Djota1, doom83, Dorcolac, draganl, dragon_hv, Duh sa sekirom, esko_hz, famoso, feanor, Feller, FOX, GAGI, gobrad, gomago, goran.vvv, h8propaganda, Haris, HrcAk47, Incognito, Iskander, Istman, Jezekijel, jon istvan, kojotuzamku, Kolimator, koom0001, Kriglord, kybonacci, Lelemood, Lester Freamon, ljubo70, LostInSpaceandTime, Manjane, Marko1238, maxim_von_burdengate, mercedesamg, MGBRBG, Mi lao shu, Mig 29, milanpb, mile.ilic75, miljannis, Miloš Popović, mir, mir juzni, MiroslavD, MK10, N.e.m.a.nj.a., Ne doznajem se u oružje, nebidrag, nebkv, nebojsag, neko iz mase, nemkea71, nenad81, nenooo, oldtimer, Orc, Paklenica, Panter, panzerwaffe, Penzula, peradetlić, Pilence, Pilipenda, Polemarchoi, Polifon, prikolica, Primus17, PrincipL, RAKITNICA, RD84, Romibrat, S94, samo opusteno, sap, sasovsky, savaskytec, sedan, sekretar, Shadow soldier, shlauf, Simulink11000, Sir Budimir, Sky diver 29, SlaKoj, sony771, SOVO515, Sr.Stat., srle45, stegonosa, strelac07, suton, tanakadzo, TBoy, varda, vargas, vidra1, Vrač, Wrangler, XBMC, zdrebac, zhuki8, ZlatniRez, zmajognjeniivan, Zoca, zodiac94, Zorge, Zrcalo, zziko, šumar bk2