|
| |||||||
| Registracija | Mapa Spy | Member List | Donacije | Pretraživanje | Today's Posts | Označi Sve Forume Kao Pročitane | Forum Rules |
 |
 |
| | Thread Tools |
|
#1
5. srpnja 2008, 08:54
| |||
| |||
| Hit by Antivirus XP 2008 Hi momački .. nisam otvorena e-mail i dobio udarac sa XP Antivirus 2008 virus. Cant dobili osloboditi od njega. Bilo kakva pomoć mnogo poštovati .. |
|
#3
5. srpnja 2008, 09:34
| |||
| |||
| Hit by Antivirus XP 2008 Sorry mate I dont shvatiti .. Što želiš učiniti sa mnom je sve? |
|
#4
5. srpnja 2008, 09:44
| ||||||||||||
| ||||||||||||
| Hit by Antivirus XP 2008 Uzmi vremena za čitanje, a zatim pokrenite softver i poslati log datoteka tako da možete vidjeti što se događa s vašim računalom.
__________________
My System: Hybr! D
|
|
#5
5. srpnja 2008, 11:59
| |||
| |||
| Hit by Antivirus XP 2008 Heresu se prijavljuje: SUPERAntiSpyware Scan Prijava http://www.superantispyware.com Generirano 07/05/2008 at 05:20 Application Version: 4/15/1000 Core Pravila Database Version: 3497 Trace Pravila Database Version: 1488 Scan type: Quick Scan Ukupno Scan Vrijeme: 00:10:14 Memorija predmeta skenirane: 268 Memorija prijetnje otkrivena: 1 Registry stavke skenirane: 407 Matični prijetnje otkrivena: 26 File predmeta skenirane: 6977 File prijetnje otkrivena: 175 Rogue.AntiVirus XP 2008 C: \ Program Files \ RHCPV6J0EREL \ RHCPV6J0EREL.EXE C: \ Program Files \ RHCPV6J0EREL \ RHCPV6J0EREL.EXE C: \ Documents and Settings \ All Users \ Start Menu \ Programs \ Antivirus XP 2008 \ Antivirus XP 2008.lnk C: \ Documents and Settings \ All Users \ Start Menu \ Programs \ Antivirus XP 2008 \ Kako Registracija Antivirus XP 2008.lnk C: \ Documents and Settings \ All Users \ Start Menu \ Programs \ Antivirus XP 2008 \ License Agreement.lnk C: \ Documents and Settings \ All Users \ Start Menu \ Programs \ Antivirus XP 2008 \ Antivirus XP 2008.lnk Registracija C: \ Documents and Settings \ All Users \ Start Menu \ Programs \ Antivirus XP 2008 \ Uninstall.lnk C: \ Documents and Settings \ All Users \ Start Menu \ Programs \ Antivirus XP 2008 C: \ AA \ RHCPV6J0EREL \ RHCPV6J0EREL.EXE Rogue.Dropper / general [lphctv6j0erel] C: \ Windows \ System32 \ LPHCTV6J0EREL.EXE C: \ Windows \ System32 \ LPHCTV6J0EREL.EXE Adware.Tracking Cookie C: \ Documents and Settings \ Danny \ Cookies \ @ danny posluživanje-sys [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny burstnet [2]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@media.adrevolver [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny clickbank [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny advertpro [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@e-2dj6wjnywnc5eeo.stats.esomniture [2]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny tribalfusion [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@adserver.mediarun [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny 192 [2]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny adviva [2]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@ehg-mgnlimited.hitbox [2]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny sex video [2]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny mediaplex [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@stat.onestat [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny adrevenue [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@ads.videhost [2]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@ads.pugetsoundsoftwar e [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny oglašavanja [2]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny doubleclick [2]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@www.burstnet [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@tracking.summitmedia. co [1]. txt C: \ Documents and Settings \ Danny \ Cookies \ danny@bs.serving-sys [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny tacoda [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny @ S [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny kontera [2]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@data.coremetrics [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny questionmarket [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny roiservice [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny adbrite [2]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@counter.hitslink [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@adserving.muppetism [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny @ cgi-bin [4]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@vhost.oddcast [2]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@rotator.adjuggler [2]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@s1.trafficmaxx [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@www.stilemedia [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@ads.ookla [2]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny neocounter2 [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@ad1.doublepimp [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@te.kontera [2]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny 9167811 [2]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny adrevolver [3]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny indextools [2]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny sexyandshocking [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny yadro [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@w00tpublishers.wootme DIA [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@dynamic.media.adrevol ver [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@e-2dj6wfkokkcjcao.stats.esomniture [2]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny atwola [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny zedo [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny adecn [2]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@mobilefun.112.2o7 [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@m1.webstats.motigo [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny adrevolver [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny 1068755026 [2]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny specificclick [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny firstchoice [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny @ 2o7 [2]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny tradedoubler [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@ads.techguy [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny adultadworld [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@ehg-bestbuy.hitbox [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny firstchoice [2]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@ehg-twi.hitbox [2]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@ad.yieldmanager [2]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny revsci [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@statse.webtrendslive [2]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@exchange.ggmedia [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny adlegend [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny @ cgi-bin [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@shopping.112.2o7 [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@ehg-iwantoneofthose.hitbox [2]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@ads.digitalrock.co [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny 63701567 [2]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny uvertira [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@ad1.clickhype [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny @ a [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny bluestreak [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny statcounter [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny atdmt [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@ads.pubmatic [2]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny 247realmedia [2]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@avgtechnologies.112.2 o7 [2]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny bravenet [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@heavycom.122.2o7 [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@stat.dealtime [2]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@adopt.euroclick [2]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@server.iad.liveperson [2]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny fastclick [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny tronožni [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny adtech [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny povećati [2]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@ehg-systemax.hitbox [2]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny stilemedia [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny gostats [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@network-ca.247realmedia [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny hitbox [2]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny AdRotator [2]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny 1048893890 [2]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny @ cgi-bin [3]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@www.clash-media [2]. Txt C: \ Documents and Settings \ Danny \ Cookies \ @ danny indexstats [2]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@test.coremetrics [1]. Txt C: \ Documents and Settings \ Danny \ Cookies \ danny@eas.apm.emediate [1]. Txt C: \ Documents and Settings \ Danny \ Local Settings \ Temp \ Cookies \ @ danny adtech [2]. Txt C: \ Documents and Settings \ Danny \ Local Settings \ Temp \ Cookies \ danny@ehg-iwantoneofthose.hitbox [1]. Txt C: \ Documents and Settings \ Danny \ Local Settings \ Temp \ Cookies \ @ danny sextracker [1]. Txt C: \ Documents and Settings \ Danny \ Local Settings \ Temp \ Cookies \ danny@ad.yieldmanager [1]. Txt C: \ Documents and Settings \ Danny \ Local Settings \ Temp \ Cookies \ danny@metacafe.122.2o7 [1]. Txt C: \ Documents and Settings \ Danny \ Local Settings \ Temp \ Cookies \ danny@stat.onestat [2]. Txt C: \ Documents and Settings \ Danny \ Local Settings \ Temp \ Cookies \ danny@counter4.sextracker [1]. Txt C: \ Documents and Settings \ Danny \ Local Settings \ Temp \ Cookies \ @ danny doubleclick [1]. Txt C: \ Documents and Settings \ Danny \ Local Settings \ Temp \ Cookies \ @ danny atdmt [2]. Txt C: \ Documents and Settings \ Danny \ Local Settings \ Temp \ Cookies \ danny@as1.falkag [1]. Txt C: \ Documents and Settings \ Danny \ Local Settings \ Temp \ Cookies \ danny@hg1.hitbox [1]. Txt C: \ Documents and Settings \ Danny \ Local Settings \ Temp \ Cookies \ danny@c1.zedo [1]. Txt C: \ Documents and Settings \ Danny \ Local Settings \ Temp \ Cookies \ danny@counter13.sextracker [1]. Txt C: \ Documents and Settings \ Danny \ Local Settings \ Temp \ Cookies \ danny@counter15.sextracker [1]. Txt C: \ Documents and Settings \ Danny \ Local Settings \ Temp \ Cookies \ @ danny hitbox [2]. Txt C: \ Documents and Settings \ Danny \ Local Settings \ Temp \ Cookies \ @ danny adrevolver [2]. Txt C: \ Documents and Settings \ Danny \ Local Settings \ Temp \ Cookies \ @ danny adrevolver [1]. Txt C: \ Documents and Settings \ Danny \ Local Settings \ Temp \ Cookies \ @ danny zedo [2]. Txt C: \ Documents and Settings \ Danny \ Local Settings \ Temp \ Cookies \ @ danny targetnet [1]. Txt C: \ Documents and Settings \ Danny \ Local Settings \ Temp \ Cookies \ danny@adopt.hbmediapro [2]. Txt C: \ Documents and Settings \ Danny \ Local Settings \ Temp \ Cookies \ danny @ 2o7 [1]. Txt C: \ Documents and Settings \ Danny \ Local Settings \ Temp \ Cookies \ @ danny atwola [1]. Txt C: \ Documents and Settings \ Rozzie \ Cookies \ rozzie@stats.searchtrack [2]. Txt C: \ Documents and Settings \ Rozzie \ Cookies \ rozzie @ atdmt [2]. Txt C: \ Documents and Settings \ Rozzie \ Cookies \ rozzie @ petnaest [1]. Txt C: \ Documents and Settings \ Rozzie \ Cookies \ rozzie@www.fifteen [1]. Txt C: \ Documents and Settings \ Rozzie \ Cookies \ rozzie@e-2dj6wflisidjkko.stats.esomniture [2]. Txt C: \ Documents and Settings \ Rozzie \ Cookies \ rozzie @ adtech [2]. Txt C: \ Documents and Settings \ Rozzie \ Cookies \ rozzie@marksandspencer.122 ,2 o7 [1]. Txt C: \ Documents and Settings \ Rozzie \ Cookies \ rozzie @ adrevolver [1]. Txt C: \ Documents and Settings \ Rozzie \ Cookies \ rozzie@perf.overture [1]. Txt C: \ Documents and Settings \ Rozzie \ Cookies \ rozzie @ windowsmedia [1]. Txt C: \ Documents and Settings \ Rozzie \ Cookies \ rozzie @ statcounter [1]. Txt C: \ Documents and Settings \ Rozzie \ Cookies \ rozzie@msnportal.112.2o7 [1]. Txt C: \ Documents and Settings \ Rozzie \ Cookies \ rozzie @ račune [1]. Txt C: \ Documents and Settings \ Rozzie \ Cookies \ rozzie@e-2dj6wflyckcjabo.stats.esomniture [2]. Txt C: \ Documents and Settings \ Rozzie \ Cookies \ rozzie@ehg-debenhams.hitbox [2]. Txt C: \ Documents and Settings \ Rozzie \ Cookies \ rozzie@paypal.112.2o7 [1]. Txt C: \ Documents and Settings \ Rozzie \ Cookies \ rozzie@tracker.roitesting [1]. Txt C: \ Documents and Settings \ Rozzie \ Cookies \ rozzie @ bravenet [2]. Txt C: \ Documents and Settings \ Rozzie \ Cookies \ rozzie@adopt.euroclick [2]. Txt C: \ Documents and Settings \ Rozzie \ Cookies \ rozzie @ indexstats [1]. Txt C: \ Documents and Settings \ Rozzie \ Cookies \ rozzie@data4.perf.overture [2]. Txt C: \ Documents and Settings \ Rozzie \ Cookies \ rozzie@bs.serving-sys [1]. Txt C: \ Documents and Settings \ Rozzie \ Cookies \ rozzie @ revsci [1]. Txt C: \ Documents and Settings \ Rozzie \ Cookies \ rozzie @ mediaplex [1]. Txt C: \ Documents and Settings \ Rozzie \ Cookies \ rozzie@etype.adbureau [2]. Txt C: \ Documents and Settings \ Rozzie \ Cookies \ rozzie@112.2o7 [2]. Txt C: \ Documents and Settings \ Rozzie \ Cookies \ rozzie @ hitbox [2]. Txt C: \ Documents and Settings \ Rozzie \ Cookies \ rozzie@ehg-bskyb.hitbox [2]. Txt C: \ Documents and Settings \ Rozzie \ Cookies \ rozzie@ads.telegraph.co [1]. Txt C: \ Documents and Settings \ Rozzie \ Cookies \ rozzie@statse.webtrendsliv e [1]. Txt C: \ Documents and Settings \ Rozzie \ Cookies \ rozzie @ questionmarket [2]. Txt C: \ Documents and Settings \ Rozzie \ Cookies \ rozzie @ posluživanje-sys [1]. Txt C: \ Documents and Settings \ Rozzie \ Cookies \ rozzie @ tradedoubler [2]. Txt C: \ Documents and Settings \ Rozzie \ Cookies \ rozzie @ indextools [2]. Txt C: \ Documents and Settings \ Rozzie \ Cookies \ rozzie @ 2o7 [2]. Txt C: \ Documents and Settings \ Rozzie \ Cookies \ rozzie @ oglašavanja [2]. Txt Rogue.AntiSpywareExpert HKLM \ SYSTEM \ CurrentControlSet \ Enum \ root \ LEGACY_CBE VTSVC HKLM \ SYSTEM \ CurrentControlSet \ Enum \ root \ LEGACY_CBE VTSVC # NextInstance HKLM \ SYSTEM \ CurrentControlSet \ Enum \ root \ LEGACY_CBE VTSVC \ 0000 HKLM \ SYSTEM \ CurrentControlSet \ Enum \ root \ LEGACY_CBE VTSVC \ # 0000 Service HKLM \ SYSTEM \ CurrentControlSet \ Enum \ root \ LEGACY_CBE VTSVC \ # 0000 Legacy HKLM \ SYSTEM \ CurrentControlSet \ Enum \ root \ LEGACY_CBE VTSVC \ 0000 # ConfigFlags HKLM \ SYSTEM \ CurrentControlSet \ Enum \ root \ LEGACY_CBE VTSVC \ Class 0000 # HKLM \ SYSTEM \ CurrentControlSet \ Enum \ root \ LEGACY_CBE VTSVC \ 0000 # ClassGUID HKLM \ SYSTEM \ CurrentControlSet \ Enum \ root \ LEGACY_CBE VTSVC \ 0000 # DeviceDesc HKLM \ SYSTEM \ CurrentControlSet \ Enum \ root \ LEGACY_CBE VTSVC \ 0000 \ Control HKLM \ SYSTEM \ CurrentControlSet \ Enum \ root \ LEGACY_CBE VTSVC \ 0000 \ Control # ActiveService HKLM \ SYSTEM \ CurrentControlSet \ Services \ CbEvtSvc HKLM \ SYSTEM \ CurrentControlSet \ Services \ CbEvtSvc # tima PE HKLM \ SYSTEM \ CurrentControlSet \ Services \ CbEvtSvc # St umjetnosti HKLM \ SYSTEM \ CurrentControlSet \ Services \ CbEvtSvc # Er rorControl HKLM \ SYSTEM \ CurrentControlSet \ Services \ CbEvtSvc # Im agePath HKLM \ SYSTEM \ CurrentControlSet \ Services \ CbEvtSvc # Di splayName HKLM \ SYSTEM \ CurrentControlSet \ Services \ CbEvtSvc # Ob jectName HKLM \ SYSTEM \ CurrentControlSet \ Services \ CbEvtSvc # Op t HKLM \ SYSTEM \ CurrentControlSet \ Services \ CbEvtSvc \ Se curity HKLM \ SYSTEM \ CurrentControlSet \ Services \ CbEvtSvc \ Se curity # Sigurnost HKLM \ SYSTEM \ CurrentControlSet \ Services \ CbEvtSvc \ En um HKLM \ SYSTEM \ CurrentControlSet \ Services \ CbEvtSvc \ En um # 0 HKLM \ SYSTEM \ CurrentControlSet \ Services \ CbEvtSvc \ En um # Count HKLM \ SYSTEM \ CurrentControlSet \ Services \ CbEvtSvc \ En um # NextInstance NotHarmful.Sysinternals Bluescreen Screen Saver C: \ Windows \ System32 \ BLPHCTV6J0EREL.SCR Trojan.Unclassified / CBEvtSvc C: \ Windows \ System32 \ CBEVTSVC.EXE C: \ WINDOWS \ prefekt \ CBEVTSVC.EXE-2F4C36CD.pf Trojan.Unknown Origin C: \ Windows \ System32 \ PHCTV6J0EREL.BMP Malwarebytes' Anti-zaštita od zlonamjernih programa 1,19 Database version: 924 5/1/2600 Windows Service Pack 3 19:22:42 05/07/2008 mbam-log-7-5-2008 (19-22-42). txt Scan type: Full Scan (C: \ | D: \ | E: \ |) Objekti skenirane: 113635 Proteklo vrijeme: 42 minuta (e), 4 Drugi (a / e) Memory Processes zaraženih: 0 Memorijske module zaraženih: 0 Ključevi registra zaraženih: 1 Registry Values zaraženih: 0 Registry Data Items zaraženih: 2 Mape zaraženih: 0 Zaraženih datoteka: 4 Memory Processes zaraženih: (Nema stavki otkrivenih zlonamjernih) Memorijske module zaraženih: (Nema stavki otkrivenih zlonamjernih) Ključevi registra zaraženih: HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Software Notifier (Rogue.Multiple) -> karanteni i uspješno izbrisan. Registry Values zaraženih: (Nema stavki otkrivenih zlonamjernih) Registry Data Items zaraženih: HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ Curre ntVersion \ Policies \ System \ NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> karanteni i uspješno izbrisan. HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ Curre ntVersion \ Policies \ System \ NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> karanteni i uspješno izbrisan. Mape zaraženih: (Nema stavki otkrivenih zlonamjernih) Zaražene datoteke: C: \ System Volume Information \ _restore (CB12E2D1-8CFA-4FCC-A08D-7A3A985B54E4) \ RP2 \ A0000029.exe (Trojan.Downloader) -> karanteni i uspješno izbrisan. C: \ System Volume Information \ _restore (CB12E2D1-8CFA-4FCC-A08D-7A3A985B54E4) \ RP2 \ A0000047.dll (Rogue.AntivirusXP2008) -> karanteni i uspješno izbrisan. C: \ System Volume Information \ _restore (CB12E2D1-8CFA-4FCC-A08D-7A3A985B54E4) \ RP4 \ A0000262.exe (Trojan.Downloader) -> karanteni i uspješno izbrisan. C: \ System Volume Information \ _restore (CB12E2D1-8CFA-4FCC-A08D-7A3A985B54E4) \ RP4 \ A0000485.dll (Rogue.AntivirusXP2008) -> karanteni i uspješno izbrisan. JavaRa 1,08 Uklanjanje Log.Report slijedi nakon .------------------------------------ line The JavaRa proces uklanjanja je započeo subota srp 05 19:49:54 2008 Pronađeno i uklonjeno: C: \ Program Files \ Java \ jre1.6.0_05Found i uklonili: SOFTWARE \ JavaSoft \ Java Runtime Environment \ 1.4Found i uklonili: SOFTWARE \ Classes \ JavaWebStart.isInstalled.1.5.0.0F ound i uklonili: Software \ JavaSoft \ Java2D \ 1.5.0_02Found i povuklo: Software \ JavaSoft \ Java2D \ 1.5.0_04Found i povuklo: Software \ JavaSoft \ Java2D \ 1.5.0_06Found i povuklo: Software \ JavaSoft \ Java2D \ 1.5.0_09Found i povuklo: Software \ JavaSoft \ Java2D \ 1.5.0_10Found i povuklo: Software \ JavaSoft \ Java2D \ 1.5.0_11Found i uklonili: SOFTWARE \ Classes \ JavaPlugin.150_02Found i uklonili: SOFTWARE \ Classes \ JavaPlugin.150_04Found i uklonili: SOFTWARE \ Classes \ JavaPlugin.150_06Found i ukloniti: SOFTWARE \ Classes \ JavaPlugin.150_09Found i uklonili: SOFTWARE \ Classes \ JavaPlugin.150_10--------------------------------- --- Gotov izvješćivanje. Hvala momci |
|
#6
5. srpnja 2008, 12:01
| |||
| |||
| Hit by Antivirus XP 2008 Potrebna Hijackthis log sada.
__________________  |
|
#7
5. srpnja 2008, 12:25
| |||
| |||
| Hit by Antivirus XP 2008 Joj žao. Evo ga: Logfile of Trend Micro HijackThis v2.0.2 Scan spremljena u 20:24:21, dana 05/07/2008 Platforma: Windows XP SP3 (Winnt 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Pokretanje procesa: C: \ WINDOWS \ System32 \ smss.exe C: \ WINDOWS \ system32 \ Winlogon.exe C: \ WINDOWS \ system32 \ services.exe C: \ WINDOWS \ system32 \ lsass.exe C: \ WINDOWS \ system32 \ Svchost.exe C: \ WINDOWS \ System32 \ Svchost.exe C: \ WINDOWS \ system32 \ spoolsv.exe C: \ WINDOWS \ System32 \ Svchost.exe C: \ Program Files \ CA \ eTrust Antivirus \ InoRpc.exe C: \ Program Files \ CA \ eTrust Antivirus \ InoRT.exe C: \ Program Files \ CA \ eTrust Antivirus \ InoTask.exe C: \ Program Files \ SPAMfighter \ sfus.exe C: \ WINDOWS \ explorer.exe C: \ WINDOWS \ AGRSMMSG.exe C: \ WINDOWS \ System32 \ OSD.EXE C: \ WINDOWS \ system32 \ SB.exe C: \ Program Files \ Synaptics \ SynTP \ SynTPLpr.exe C: \ Program Files \ Synaptics \ SynTP \ SynTPEnh.exe C: \ programa ~ 1 \ CA \ ETRUST ~ 1 \ realmon.exe C: \ Program Files \ QuickTime \ qttask.exe C: \ Program Files \ iTunes \ iTunesHelper.exe C: \ Program Files \ MUSICMATCH \ MUSICMATCH džu-boks \ mmtask.exe C: \ Program Files \ iPod \ bin \ iPodService.exe C: \ Program Files \ SPAMfighter \ SFAgent.exe C: \ Program Files \ Common Files \ Real \ Update_OB \ realsched.exe C: \ WINDOWS \ system32 \ rundll32.exe C: \ Program Files \ Java \ jre1.6.0_06 \ bin \ jusched.exe C: \ Program Files \ Messenger \ msmsgs.exe C: \ Program Files \ United Alerts \ UnitedAlerts.exe C: \ Program Files \ Google \ GoogleToolbarNotifier \ GoogleToolbarNo tifier.exe C: \ Program Files \ DNA \ btdna.exe C: \ Program Files \ Windows Media Player \ WMPNSCFG.exe C: \ Program Files \ SUPERAntiSpyware \ SUPERAntiSpyware.exe C: \ WINDOWS \ system32 \ sistray.exe C: \ Program Files \ MSN Toolbar Suite \ DS \ 02.05.0001.1119 \ en-gb \ bin \ WindowsSearch.exe C: \ Program Files \ MSN Toolbar Suite \ DS \ 02.05.0001.1119 \ en-gb \ bin \ WindowsSearchIndexer.exe C: \ Program Files \ Internet Explorer \ iexplore.exe C: \ Program Files \ WinZip \ WZQKPICK.EXE C: \ WINDOWS \ system32 \ wuauclt.exe C: \ Program Files \ Internet Explorer \ iexplore.exe C: \ Program Files \ MSN Toolbar Suite \ DS \ 02.05.0001.1119 \ en-gb \ bin \ WindowsSearchFilter.exe C: \ Program Files \ Trend Micro \ HijackThis \ sniper.exe R0 - HKCU \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://news.bbc.co.uk/sport1/hi/football/default.stm R0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://www.toysrus.co.uk/ R1 - HKCU \ Software \ Microsoft \ Internet Connection Wizard, ShellNext = http://www.toysrus.co.uk/ R3 - URLSearchHook: ICQ Toolbar - (855F3B16-6D32-4fe6-8A56-BBB695989046) - C: \ Program Files \ ICQToolbar \ toolbaru.dll (file missing) O2 - BHO: AcroIEHlprObj Class - (06849E9F-C8D7-4D59-B87D-784B7D6BE0B3) - C: \ Program Files \ Adobe \ Acrobat 6,0 \ Reader \ ActiveX \ AcroIEHelper.dll O2 - BHO: RealPlayer Download i Record Plugin za Internet Explorer - (3049C3E9-B461-4BC5-8870-4C09146192CA) - C: \ Program Files \ Real \ RealPlayer \ rpbrowserrecordplugin.dll O2 - BHO: SSVHelper Class - (761497BB-D6F0-462C-B6EB-D4DAF1D92D43) - C: \ Program Files \ Java \ jre1.6.0_06 \ bin \ ssv.dll O2 - BHO: Google Toolbar Helper - (AA58ED58-01DD-4d91-8333-CF10577473F7) - c: \ program files \ google \ googletoolbar3.dll O2 - BHO: Google Toolbar Notifier BHO - (AF69DE43-7D58-4638-B6FA-CE66B5AD205D) - C: \ Program Files \ Google \ GoogleToolbarNotifier \ 3.0.1225.9868 \ s wg.dll O2 - BHO: MSN Search Toolbar Helper - (BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0) - C: \ Program Files \ MSN Toolbar Suite \ TB \ 02.05.0000.1082 \ en-gb \ msntb.dll O3 - Toolbar: ICQ Toolbar - (855F3B16-6D32-4fe6-8A56-BBB695989046) - C: \ Program Files \ ICQToolbar \ toolbaru.dll (file missing) O3 - Toolbar: MSN Search Toolbar - (BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0) - C: \ Program Files \ MSN Toolbar Suite \ TB \ 02.05.0000.1082 \ en-gb \ msntb.dll O3 - Toolbar: & Google - (2318C2B1-4965-11d4-9B18-009027A5CD4F) - c: \ program files \ google \ googletoolbar3.dll O4 - HKLM \ .. \ Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM \ .. \ Run: [OSD]% SystemRoot% \ System32 \ OSD.EXE O4 - HKLM \ .. \ Run: [SB] C: \ WINDOWS \ system32 \ SB.exe O4 - HKLM \ .. \ Run: [SynTPLpr] C: \ Program Files \ Synaptics \ SynTP \ SynTPLpr.exe O4 - HKLM \ .. \ Run: [SynTPEnh] C: \ Program Files \ Synaptics \ SynTP \ SynTPEnh.exe O4 - HKLM \ .. \ Run: [SiSUSBRG] C: \ WINDOWS \ SiSUSBrg.exe O4 - HKLM \ .. \ Run: [NeroFilterCheck] C: \ WINDOWS \ system32 \ NeroCheck.exe O4 - HKLM \ .. \ Run: [stvarnom Monitor] C: \ programa ~ 1 \ CA \ ETRUST ~ 1 \ realmon.exe-s O4 - HKLM \ .. \ Run: [UserFaultCheck]% systemroot% \ system32 \ dumprep 0-u O4 - HKLM \ .. \ Run: [QuickTime Task] "C: \ Program Files \ QuickTime \ qttask.exe"-atboottime O4 - HKLM \ .. \ Run: [iTunesHelper] "C: \ Program Files \ iTunes \ iTunesHelper.exe" O4 - HKLM \ .. \ Run: [SiSPower] Rundll32.exe SiSPower.dll, ModeAgent O4 - HKLM \ .. \ Run: [mmtask] "C: \ Program Files \ MUSICMATCH \ MUSICMATCH džu-boks \ mmtask.exe" O4 - HKLM \ .. \ Run: [SPAMfighter agentu] "C: \ Program Files \ SPAMfighter \ SFAgent.exe" update odgađanja 60 O4 - HKLM \ .. \ Run: [TkBellExe] "C: \ Program Files \ Common Files \ Real \ Update_OB \ realsched.exe"-osboot O4 - HKLM \ .. \ Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl, BluetoothAuthenticationAgent O4 - HKLM \ .. \ Run: [SMrhcpv6j0erel] C: \ Program Files \ rhcpv6j0erel \ rhcpv6j0erel.exe O4 - HKLM \ .. \ Run: [SunJavaUpdateSched] "C: \ Program Files \ Java \ jre1.6.0_06 \ bin \ jusched.exe" O4 - HKCU \ .. \ Run: [MSMSGS] "C: \ Program Files \ Messenger \ msmsgs.exe" / background O4 - HKCU \ .. \ Run: [United Alerts] C: \ Program Files \ United Alerts \ UnitedAlerts.exe O4 - HKCU \ .. \ Run: [swg] C: \ Program Files \ Google \ GoogleToolbarNotifier \ GoogleToolbarNo tifier.exe O4 - HKCU \ .. \ Run: [BitTorrent DNA] "C: \ Program Files \ DNA \ btdna.exe" O4 - HKCU \ .. \ Run: [WMPNSCFG] C: \ Program Files \ Windows Media Player \ WMPNSCFG.exe O4 - HKCU \ .. \ Run: [SUPERAntiSpyware] C: \ Program Files \ SUPERAntiSpyware \ SUPERAntiSpyware.exe O4 - HKUS \ S-1-5-18 \ .. \ Run: [Ctfmon.exe] C: \ WINDOWS \ system32 \ Ctfmon.exe (User 'SYSTEM') O4 - HKUS \. DEFAULT \ .. \ Run: [Ctfmon.exe] C: \ WINDOWS \ system32 \ Ctfmon.exe (User 'Default user') O4 - Global Startup: Microsoft Office.lnk = C: \ Program Files \ Microsoft Office \ Office10 \ OSA.EXE O4 - Global Startup: Utility Tray.lnk = C: \ WINDOWS \ system32 \ sistray.exe O4 - Global Startup: Windows Desktop Search.lnk = C: \ Program Files \ MSN Toolbar Suite \ DS \ 02.05.0001.1119 \ en-gb \ bin \ WindowsSearch.exe O4 - Global Startup: WinZip Quick Pick.lnk = C: \ Program Files \ WinZip \ WZQKPICK.EXE O8 - Extra kontekst meni stavka: & Google Search - res: / / C: \ Program Files \ Google \ GoogleToolbar1.dll/cmsearch.html O8 - Extra kontekst meni stavka: & ICQ Toolbar Search - res: / / C: \ Program Files \ ICQToolbar \ toolbaru.dll / SEARCH.HTML O8 - Extra kontekst meni stavka: & MSN Search - res: / / C: \ Program Files \ MSN Toolbar Suite \ TB \ 02.05.0000.1082 \ en-gb \ msntb.dll / search.htm O8 - Extra kontekst meni stavka: Povratni Links - res: / / C: \ Program Files \ Google \ GoogleToolbar1.dll/cmbacklinks.html O8 - Extra kontekst meni stavka: Predmemorirano snimka Page - res: / / C: \ Program Files \ Google \ GoogleToolbar1.dll/cmcache.html O8 - Extra kontekst meni stavka: E & zvezi u Microsoft Excel - res: / / C: \ programa ~ 1 \ MICROS ~ 3 \ Office10 \ EXCEL.EXE/3000 O8 - Extra kontekst meni stavka: Open in new background tab - res: / / C: \ Program Files \ MSN Toolbar Suite \ TAB \ 02.05.0001.1119 \ en-gb \ msntabres.dll/229? 4f61d6b2c8414b81896dc6b3a393b615 O8 - Extra kontekst meni stavka: Otvori u novom planu tab - res: / / C: \ Program Files \ MSN Toolbar Suite \ TAB \ 02.05.0001.1119 \ en-gb \ msntabres.dll/230? 4f61d6b2c8414b81896dc6b3a393b615 O8 - Extra kontekst meni stavka: Similar Pages - res: / / C: \ Program Files \ Google \ GoogleToolbar1.dll/cmsimilar.html O8 - Extra kontekst meni stavka: Prevedi na engleski - res: / / C: \ Program Files \ Google \ GoogleToolbar1.dll/cmtrans.html O9 - Extra button: (no name) - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C: \ Program Files \ Java \ jre1.6.0_06 \ bin \ ssv.dll O9 - Extra 'Tools' MENUITEM: Sun Java Console - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C: \ Program Files \ Java \ jre1.6.0_06 \ bin \ ssv.dll O9 - Extra button: (no name) - (e2e2dd38-d088-4134-82b7-f2ba38496583) - C: \ WINDOWS \ Network Diagnostic \ xpnetdiag.exe O9 - Extra 'Tools' MENUITEM: @ xpsp3res.dll, -20001 - (e2e2dd38-d088-4134-82b7-f2ba38496583) - C: \ WINDOWS \ Network Diagnostic \ xpnetdiag.exe O9 - Extra button: Messenger - (FB5F1910-F110-11D2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ msmsgs.exe O9 - Extra 'Tools' MENUITEM: Windows Messenger - (FB5F1910-F110-11D2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ msmsgs.exe O9 - Extra button: Medion-UK - (CE67CBC2-5CCB-4FC4-BA83-51AE4878170C) -- http://www.medion.co.uk (file missing) (HKCU) O16 - DPF: RaptisoftGameLoader -- http://www.miniclip.com/hamsterball/...gameloader.cab O16 - DPF: (17492023-C23A-453E-A040-C7C580BBF700) (Windows Genuine Advantage Validation Tool) -- http://go.microsoft.com/fwlink/?Link...04&clcid=0x409 O16 - DPF: (1803B9EF-9905-4F34-AFC4-05D1BAB28801) (RegUserCfgUI Class) -- http://us.dl1.yimg.com/download.yaho...1/yregucfg.cab O16 - DPF: (6414512B-B978-451D-A0D8-FCFDF33E833C) (WUWebControl Class) -- http://v5.windowsupdate.microsoft.co...?1106745510172 O16 - DPF: (6E32070A-766D-4EE6-879C-DC1FA91D2FC3) (MUWebControl Class) -- http://www.update.microsoft.com/micr...?1215253028000 O16 - DPF: (B38870E4-7ECB-40DA-8C6A-595F0A5519FF) (MsnMessengerSetupDownloadControl Class) -- http://messenger.msn.com/download/Ms...Downloader.cab O16 - DPF: (BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B) (Zylom Igre Player) -- http://game07.zylom.com/activex/zylomgamesplayer.cab O16 - DPF: (E8F628B5-259A-4734-97EE-BA914D7BE941) (Driver Agent ActiveX Control) -- http://driveragent.com/files/driveragent.cab O20 - Winlogon Obavijesti:! SASWinLogon - C: \ Program Files \ SUPERAntiSpyware \ SASWINLO.dll O23 - Service: Google Updater Service (gusvc) - Google - C: \ Program Files \ Google \ Common \ Google Updater \ GoogleUpdaterService.exe O23 - Service: eTrust Antivirus RPC server (InoRPC) - Computer Associates International, Inc - C: \ Program Files \ CA \ eTrust Antivirus \ InoRpc.exe O23 - Service: eTrust Antivirus stvarnom Server (InoRT) - Computer Associates International, Inc - C: \ Program Files \ CA \ eTrust Antivirus \ InoRT.exe O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc - C: \ Program Files \ CA \ eTrust Antivirus \ InoTask.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc - C: \ Program Files \ iPod \ bin \ iPodService.exe O23 - Service: SPAMfighter Update Service - SPAMfighter APS - C: \ Program Files \ SPAMfighter \ sfus.exe -- End of file - 10438 bytes |
|
#8
5. srpnja 2008, 12:32
| |||
| |||
| Hit by Antivirus XP 2008 Ipak neki posao. Preuzimanje SDFix.exe i spremite je na svoj Desktop. Dvaput kliknite na SDFix.exe i ona će ekstrakt datoteke u% systemdrive% (Pogon koji sadrži Windows Directory, obično C: \ SDFix) Odmah zatim ponovo pokrenuti računalo u Safe Mode tako da učinite sljedeće:
---------- Next post dodaj SDFix log NOVO Hijackthis log
__________________ |
|
#9
5. srpnja 2008, 13:34
| |||
| |||
| Hit by Antivirus XP 2008 OK Sljedeća logove SDFix: 1,201 Version Run by Danny na 05/07/2008 at 21:08 Microsoft Windows XP [Version 5/1/2600] Running From: C: \ pjesme \ SDFix Provjera Usluge : Vraćanjem Default Security Vrijednosti Vraćanjem Default Hosts File Postupak ponovne inicijalizacije operacijskog sust Provjera Files : Ne Trojan Found Files Uklanjanje Temp Files Provjerite REKLAME : Završna Provjeri : catchme 0.3.1361.2 W2K/XP/Vista - rootkit / potaja detector by Gmer zlonamjernih programa, http://www.gmer.net Rootkit scan 2008-07-05 21:21:39 5/1/2600 Windows Service Pack 3 NTFS skeniranja skrivenih procesa ... skeniranja skrivenih i usluge Grozd sustava ... [HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Servic es \ BTHPORT \ Parameters \ Keys \ 000c55050b1d] [HKEY_LOCAL_MACHINE \ SYSTEM \ ControlSet003 \ Services \ B THPORT \ Parameters \ Keys \ 000c55050b1d] skeniranja skrivenih stavki registra ... [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Prefetcher] "TracesProcessed" = dword: 000000aa "TracesSuccessful" = dword: 00000005 skeniranja skrivenih datoteka ... scan uspješno završena skriveni procesi: 0 skriven usluge: 0 skrivenih datoteka: 0 Preostali Usluge : Ovlašteni Aplikacija Ključ Izvoz: [HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ servic ES \ sharedaccess \ Parameters \ firewallpolicy \ standardnih profila \ authorizedapplications \ list] "% windir% \ \ system32 \ \ sessmgr.exe" = "% windir% \ \ syste m32 \ \ sessmgr.exe: *: enabled: @ xpsp2res.dll, -22019" "C: \ \ Program Files \ \ CA \ \ eTrust Antivirus \ \ InoRpc.exe" = "C: \ \ Program Files \ \ CA \ \ eTrust Antivirus \ \ InoRpc.exe: *: Omogućen: eTrust Antivirus - RPC server " "C: \ \ Program Files \ \ CA \ \ eTrust Antivirus \ \ InocIT.exe" = "C: \ \ Program Files \ \ CA \ \ eTrust Antivirus \ \ InocIT.exe: *: Omogućen: eTrust Antivirus - Lokalna Scanner " "C: \ \ Program Files \ \ CA \ \ eTrust Antivirus \ \ Realmon.exe" = "C: \ \ Program Files \ \ CA \ \ eTrust Antivirus \ \ Realmon.exe: *: Omogućen: eTrust Antivirus - realno nadzirati " "C: \ \ Program Files \ \ Messenger \ \ msmsgs.exe" = "C: \ \ Program Files \ \ Messenger \ \ msmsgs.exe: *: Omogućen: Windows Messenger" "C: \ \ Program Files \ \ United Alerts \ \ UnitedAlerts.exe" = "C: \ \ Program Files \ \ United Alerts \ \ UnitedAlerts.exe" "C: \ \ Program Files \ \ ICQ \ \ Icq.exe" = "C: \ \ Program Files \ \ ICQ \ \ Icq.exe: *: Omogućen: ICQ" "C: \ \ Program Files \ \ CA \ \ eTrust Antivirus \ \ Shellscn.exe" = "C: \ \ Program Files \ \ CA \ \ eTrust Antivirus \ \ Shellscn.exe: *: Omogućen: Shellscn" "C: \ \ Program Files \ \ iTunes \ \ iTunes.exe" = "C: \ \ Program Files \ \ iTunes \ \ iTunes.exe: *: Omogućen: iTunes" "C: \ \ StubInstaller.exe" = "C: \ \ StubInstaller.exe: *: E nabled: LimeWire swarmed Installer" "C: \ \ Program Files \ \ LimeWire \ \ LimeWire.exe" = "C: \ \ Program Files \ \ LimeWire \ \ LimeWire.exe: *: Omogućen: LimeWire» "C: \ \ Program Files \ \ Messenger \ \ msnmsgr.exe" = "C: \ \ Program Files \ \ Messenger \ \ msnmsgr.exe: *: Omogućen: MSN Messenger 7,5" "C: \ \ Program Files \ \ BitTorrent_DNA \ \ dna.exe" = "C: \ \ Program Files \ \ BitTorrent_DNA \ \ dna.exe: *: Omogućen: BitTorren t DNA" "C: \ \ Program Files \ \ DNA \ \ btdna.exe" = "C: \ \ Program Files \ \ DNA \ \ btdna.exe: *: Omogućen: DNA" "% windir% \ \ Network Diagnostic \ \ xpnetdiag.exe" = "% windir% \ \ Network Diagnostic \ \ xpnetdiag.exe: *: Omogućen: @ xpsp3res.dll, -20000" [HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ servic ES \ sharedaccess \ Parameters \ firewallpolicy \ domainpr ofile \ authorizedapplications \ list] "% windir% \ \ system32 \ \ sessmgr.exe" = "% windir% \ \ syste m32 \ \ sessmgr.exe: *: enabled: @ xpsp2res.dll, -22019" "C: \ \ Program Files \ \ United Alerts \ \ UnitedAlerts.exe" = "C: \ \ Program Files \ \ United Alerts \ \ UnitedAlerts.exe" "C: \ \ Program Files \ \ Messenger \ \ msnmsgr.exe" = "C: \ \ Program Files \ \ Messenger \ \ msnmsgr.exe: *: Omogućen: MSN Messenger 7,5" "% windir% \ \ Network Diagnostic \ \ xpnetdiag.exe" = "% windir% \ \ Network Diagnostic \ \ xpnetdiag.exe: *: Omogućen: @ xpsp3res.dll, -20000" Preostali Files : Skrivene datoteke s Svojstva : Srijeda 26. siječanj 2005 4704 A.SH. --- "C: \ WINDOWS \ system32 \ KGyGaAvL.sys" Srijeda 13. srpnja 2005 .. 4348 SH. --- "C: \ Documents and Settings \ All Users \ DRM \ DRMv1.bak" Subota 5. srpnja 2008 0 A.SH. --- "C: \ Documents and Settings \ All Users \ DRM \ Cache \ Indiv01.tmp" Ponedjeljak 13. lipnja 2005 7420 A.. H. --- "C: \ Documents and Settings \ Rozzie \ Local Settings \ Temp \ Mar15.tmp" Ponedjeljak 13. lipnja 2005 7420 A.. H. --- "C: \ Documents and Settings \ Rozzie \ Local Settings \ Temp \ Mar9.tmp" Ponedjeljak 13. lipnja 2005 7420 A.. H. --- "C: \ Documents and Settings \ Rozzie \ Local Settings \ Temp \ MarA.tmp" Subota 5 srp 2008 96 A.. H. --- "C: \ Documents and Settings \ All Users \ Application Data \ avg8 (2) \ scanlogs \ srmcheck.tmp" Srijeda 13. srpnja 2005 4348 H. ... --- "C: \ Documents and Settings \ Danny \ My Documents \ My Music \ License Backup \ drmv1key.bak" Srijeda 25 siječanj 2006 20 A.. H. --- "C: \ Documents and Settings \ Danny \ My Documents \ My Music \ License Backup \ drmv1lic.bak" Srijeda 13. srpnja 2005 312 A.SH. --- "C: \ Documents and Settings \ Danny \ My Documents \ My Music \ License Backup \ drmv2key.bak" Završeno! i Logfile of Trend Micro HijackThis v2.0.2 Scan spremljena u 21:33:52, dana 05/07/2008 Platforma: Windows XP SP3 (Winnt 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Pokretanje procesa: C: \ WINDOWS \ System32 \ smss.exe C: \ WINDOWS \ system32 \ Winlogon.exe C: \ WINDOWS \ system32 \ services.exe C: \ WINDOWS \ system32 \ lsass.exe C: \ WINDOWS \ system32 \ Svchost.exe C: \ WINDOWS \ System32 \ Svchost.exe C: \ WINDOWS \ system32 \ spoolsv.exe C: \ WINDOWS \ System32 \ Svchost.exe C: \ Program Files \ CA \ eTrust Antivirus \ InoRpc.exe C: \ Program Files \ CA \ eTrust Antivirus \ InoRT.exe C: \ Program Files \ CA \ eTrust Antivirus \ InoTask.exe C: \ Program Files \ SPAMfighter \ sfus.exe C: \ WINDOWS \ explorer.exe C: \ WINDOWS \ AGRSMMSG.exe C: \ WINDOWS \ System32 \ OSD.EXE C: \ WINDOWS \ system32 \ SB.exe C: \ Program Files \ Synaptics \ SynTP \ SynTPLpr.exe C: \ Program Files \ Synaptics \ SynTP \ SynTPEnh.exe C: \ programa ~ 1 \ CA \ ETRUST ~ 1 \ realmon.exe C: \ Program Files \ QuickTime \ qttask.exe C: \ Program Files \ iTunes \ iTunesHelper.exe C: \ Program Files \ MUSICMATCH \ MUSICMATCH džu-boks \ mmtask.exe C: \ Program Files \ iPod \ bin \ iPodService.exe C: \ Program Files \ SPAMfighter \ SFAgent.exe C: \ Program Files \ Common Files \ Real \ Update_OB \ realsched.exe C: \ WINDOWS \ system32 \ rundll32.exe C: \ Program Files \ Java \ jre1.6.0_06 \ bin \ jusched.exe C: \ Program Files \ Messenger \ msmsgs.exe C: \ Program Files \ United Alerts \ UnitedAlerts.exe C: \ Program Files \ Google \ GoogleToolbarNotifier \ GoogleToolbarNo tifier.exe C: \ Program Files \ DNA \ btdna.exe C: \ WINDOWS \ system32 \ wuauclt.exe C: \ Program Files \ Windows Media Player \ WMPNSCFG.exe C: \ Program Files \ SUPERAntiSpyware \ SUPERAntiSpyware.exe C: \ WINDOWS \ system32 \ sistray.exe C: \ Windows \ System32 \ Msiexec.exe C: \ Program Files \ MSN Toolbar Suite \ DS \ 02.05.0001.1119 \ en-gb \ bin \ WindowsSearch.exe C: \ Program Files \ WinZip \ WZQKPICK.EXE C: \ Program Files \ MSN Toolbar Suite \ DS \ 02.05.0001.1119 \ en-gb \ bin \ WindowsSearchIndexer.exe C: \ Program Files \ MSN Toolbar Suite \ DS \ 02.05.0001.1119 \ en-gb \ bin \ WindowsSearchFilter.exe C: \ Program Files \ Internet Explorer \ iexplore.exe C: \ Program Files \ Trend Micro \ HijackThis \ sniper.exe R0 - HKCU \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://news.bbc.co.uk/sport1/hi/football/default.stm R0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://www.toysrus.co.uk/ R1 - HKCU \ Software \ Microsoft \ Internet Connection Wizard, ShellNext = http://www.toysrus.co.uk/ R3 - URLSearchHook: ICQ Toolbar - (855F3B16-6D32-4fe6-8A56-BBB695989046) - C: \ Program Files \ ICQToolbar \ toolbaru.dll (file missing) O2 - BHO: AcroIEHlprObj Class - (06849E9F-C8D7-4D59-B87D-784B7D6BE0B3) - C: \ Program Files \ Adobe \ Acrobat 6,0 \ Reader \ ActiveX \ AcroIEHelper.dll O2 - BHO: RealPlayer Download i Record Plugin za Internet Explorer - (3049C3E9-B461-4BC5-8870-4C09146192CA) - C: \ Program Files \ Real \ RealPlayer \ rpbrowserrecordplugin.dll O2 - BHO: SSVHelper Class - (761497BB-D6F0-462C-B6EB-D4DAF1D92D43) - C: \ Program Files \ Java \ jre1.6.0_06 \ bin \ ssv.dll O2 - BHO: Google Toolbar Helper - (AA58ED58-01DD-4d91-8333-CF10577473F7) - c: \ program files \ google \ googletoolbar3.dll O2 - BHO: Google Toolbar Notifier BHO - (AF69DE43-7D58-4638-B6FA-CE66B5AD205D) - C: \ Program Files \ Google \ GoogleToolbarNotifier \ 3.0.1225.9868 \ s wg.dll O2 - BHO: MSN Search Toolbar Helper - (BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0) - C: \ Program Files \ MSN Toolbar Suite \ TB \ 02.05.0000.1082 \ en-gb \ msntb.dll O3 - Toolbar: ICQ Toolbar - (855F3B16-6D32-4fe6-8A56-BBB695989046) - C: \ Program Files \ ICQToolbar \ toolbaru.dll (file missing) O3 - Toolbar: MSN Search Toolbar - (BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0) - C: \ Program Files \ MSN Toolbar Suite \ TB \ 02.05.0000.1082 \ en-gb \ msntb.dll O3 - Toolbar: & Google - (2318C2B1-4965-11d4-9B18-009027A5CD4F) - c: \ program files \ google \ googletoolbar3.dll O4 - HKLM \ .. \ Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM \ .. \ Run: [OSD]% SystemRoot% \ System32 \ OSD.EXE O4 - HKLM \ .. \ Run: [SB] C: \ WINDOWS \ system32 \ SB.exe O4 - HKLM \ .. \ Run: [SynTPLpr] C: \ Program Files \ Synaptics \ SynTP \ SynTPLpr.exe O4 - HKLM \ .. \ Run: [SynTPEnh] C: \ Program Files \ Synaptics \ SynTP \ SynTPEnh.exe O4 - HKLM \ .. \ Run: [SiSUSBRG] C: \ WINDOWS \ SiSUSBrg.exe O4 - HKLM \ .. \ Run: [NeroFilterCheck] C: \ WINDOWS \ system32 \ NeroCheck.exe O4 - HKLM \ .. \ Run: [stvarnom Monitor] C: \ programa ~ 1 \ CA \ ETRUST ~ 1 \ realmon.exe-s O4 - HKLM \ .. \ Run: [UserFaultCheck]% systemroot% \ system32 \ dumprep 0-u O4 - HKLM \ .. \ Run: [QuickTime Task] "C: \ Program Files \ QuickTime \ qttask.exe"-atboottime O4 - HKLM \ .. \ Run: [iTunesHelper] "C: \ Program Files \ iTunes \ iTunesHelper.exe" O4 - HKLM \ .. \ Run: [SiSPower] Rundll32.exe SiSPower.dll, ModeAgent O4 - HKLM \ .. \ Run: [mmtask] "C: \ Program Files \ MUSICMATCH \ MUSICMATCH džu-boks \ mmtask.exe" O4 - HKLM \ .. \ Run: [SPAMfighter agentu] "C: \ Program Files \ SPAMfighter \ SFAgent.exe" update odgađanja 60 O4 - HKLM \ .. \ Run: [TkBellExe] "C: \ Program Files \ Common Files \ Real \ Update_OB \ realsched.exe"-osboot O4 - HKLM \ .. \ Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl, BluetoothAuthenticationAgent O4 - HKLM \ .. \ Run: [SMrhcpv6j0erel] C: \ Program Files \ rhcpv6j0erel \ rhcpv6j0erel.exe O4 - HKLM \ .. \ Run: [SunJavaUpdateSched] "C: \ Program Files \ Java \ jre1.6.0_06 \ bin \ jusched.exe" O4 - HKCU \ .. \ Run: [MSMSGS] "C: \ Program Files \ Messenger \ msmsgs.exe" / background O4 - HKCU \ .. \ Run: [United Alerts] C: \ Program Files \ United Alerts \ UnitedAlerts.exe O4 - HKCU \ .. \ Run: [swg] C: \ Program Files \ Google \ GoogleToolbarNotifier \ GoogleToolbarNo tifier.exe O4 - HKCU \ .. \ Run: [BitTorrent DNA] "C: \ Program Files \ DNA \ btdna.exe" O4 - HKCU \ .. \ Run: [WMPNSCFG] C: \ Program Files \ Windows Media Player \ WMPNSCFG.exe O4 - HKCU \ .. \ Run: [SUPERAntiSpyware] C: \ Program Files \ SUPERAntiSpyware \ SUPERAntiSpyware.exe O4 - HKUS \ S-1-5-18 \ .. \ Run: [Ctfmon.exe] C: \ WINDOWS \ system32 \ Ctfmon.exe (User 'SYSTEM') O4 - HKUS \. DEFAULT \ .. \ Run: [Ctfmon.exe] C: \ WINDOWS \ system32 \ Ctfmon.exe (User 'Default user') O4 - Global Startup: Microsoft Office.lnk = C: \ Program Files \ Microsoft Office \ Office10 \ OSA.EXE O4 - Global Startup: Utility Tray.lnk = C: \ WINDOWS \ system32 \ sistray.exe O4 - Global Startup: Windows Desktop Search.lnk = C: \ Program Files \ MSN Toolbar Suite \ DS \ 02.05.0001.1119 \ en-gb \ bin \ WindowsSearch.exe O4 - Global Startup: WinZip Quick Pick.lnk = C: \ Program Files \ WinZip \ WZQKPICK.EXE O8 - Extra kontekst meni stavka: & Google Search - res: / / C: \ Program Files \ Google \ GoogleToolbar1.dll/cmsearch.html O8 - Extra kontekst meni stavka: & ICQ Toolbar Search - res: / / C: \ Program Files \ ICQToolbar \ toolbaru.dll / SEARCH.HTML O8 - Extra kontekst meni stavka: & MSN Search - res: / / C: \ Program Files \ MSN Toolbar Suite \ TB \ 02.05.0000.1082 \ en-gb \ msntb.dll / search.htm O8 - Extra kontekst meni stavka: Povratni Links - res: / / C: \ Program Files \ Google \ GoogleToolbar1.dll/cmbacklinks.html O8 - Extra kontekst meni stavka: Predmemorirano snimka Page - res: / / C: \ Program Files \ Google \ GoogleToolbar1.dll/cmcache.html O8 - Extra kontekst meni stavka: E & zvezi u Microsoft Excel - res: / / C: \ programa ~ 1 \ MICROS ~ 3 \ Office10 \ EXCEL.EXE/3000 O8 - Extra kontekst meni stavka: Open in new background tab - res: / / C: \ Program Files \ MSN Toolbar Suite \ TAB \ 02.05.0001.1119 \ en-gb \ msntabres.dll/229? 4f61d6b2c8414b81896dc6b3a393b615 O8 - Extra kontekst meni stavka: Otvori u novom planu tab - res: / / C: \ Program Files \ MSN Toolbar Suite \ TAB \ 02.05.0001.1119 \ en-gb \ msntabres.dll/230? 4f61d6b2c8414b81896dc6b3a393b615 O8 - Extra kontekst meni stavka: Similar Pages - res: / / C: \ Program Files \ Google \ GoogleToolbar1.dll/cmsimilar.html O8 - Extra kontekst meni stavka: Prevedi na engleski - res: / / C: \ Program Files \ Google \ GoogleToolbar1.dll/cmtrans.html O9 - Extra button: (no name) - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C: \ Program Files \ Java \ jre1.6.0_06 \ bin \ ssv.dll O9 - Extra 'Tools' MENUITEM: Sun Java Console - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C: \ Program Files \ Java \ jre1.6.0_06 \ bin \ ssv.dll O9 - Extra button: (no name) - (e2e2dd38-d088-4134-82b7-f2ba38496583) - C: \ WINDOWS \ Network Diagnostic \ xpnetdiag.exe O9 - Extra 'Tools' MENUITEM: @ xpsp3res.dll, -20001 - (e2e2dd38-d088-4134-82b7-f2ba38496583) - C: \ WINDOWS \ Network Diagnostic \ xpnetdiag.exe O9 - Extra button: Messenger - (FB5F1910-F110-11D2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ msmsgs.exe O9 - Extra 'Tools' MENUITEM: Windows Messenger - (FB5F1910-F110-11D2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ msmsgs.exe O9 - Extra button: Medion-UK - (CE67CBC2-5CCB-4FC4-BA83-51AE4878170C) -- http://www.medion.co.uk (file missing) (HKCU) O16 - DPF: RaptisoftGameLoader -- http://www.miniclip.com/hamsterball/...gameloader.cab O16 - DPF: (17492023-C23A-453E-A040-C7C580BBF700) (Windows Genuine Advantage Validation Tool) -- http://go.microsoft.com/fwlink/?Link...04&clcid=0x409 O16 - DPF: (1803B9EF-9905-4F34-AFC4-05D1BAB28801) (RegUserCfgUI Class) -- http://us.dl1.yimg.com/download.yaho...1/yregucfg.cab O16 - DPF: (6414512B-B978-451D-A0D8-FCFDF33E833C) (WUWebControl Class) -- http://v5.windowsupdate.microsoft.co...?1106745510172 O16 - DPF: (6E32070A-766D-4EE6-879C-DC1FA91D2FC3) (MUWebControl Class) -- http://www.update.microsoft.com/micr...?1215253028000 O16 - DPF: (B38870E4-7ECB-40DA-8C6A-595F0A5519FF) (MsnMessengerSetupDownloadControl Class) -- http://messenger.msn.com/download/Ms...Downloader.cab O16 - DPF: (BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B) (Zylom Igre Player) -- http://game07.zylom.com/activex/zylomgamesplayer.cab O16 - DPF: (E8F628B5-259A-4734-97EE-BA914D7BE941) (Driver Agent ActiveX Control) -- http://driveragent.com/files/driveragent.cab O20 - Winlogon Obavijesti:! SASWinLogon - C: \ Program Files \ SUPERAntiSpyware \ SASWINLO.dll O23 - Service: Google Updater Service (gusvc) - Google - C: \ Program Files \ Google \ Common \ Google Updater \ GoogleUpdaterService.exe O23 - Service: eTrust Antivirus RPC server (InoRPC) - Computer Associates International, Inc - C: \ Program Files \ CA \ eTrust Antivirus \ InoRpc.exe O23 - Service: eTrust Antivirus stvarnom Server (InoRT) - Computer Associates International, Inc - C: \ Program Files \ CA \ eTrust Antivirus \ InoRT.exe O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc - C: \ Program Files \ CA \ eTrust Antivirus \ InoTask.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc - C: \ Program Files \ iPod \ bin \ iPodService.exe O23 - Service: SPAMfighter Update Service - SPAMfighter APS - C: \ Program Files \ SPAMfighter \ sfus.exe -- End of file - 10422 bytes |
|
#10
5. srpnja 2008, 13:38
| |||
| |||
| Hit by Antivirus XP 2008 Ja trebaju imati neki više informacija o par datoteka. Post linkove ovdje na rezultate kada završi. Scan Sumnjičavu File (s) Posjetite Virustotal (Ako više od jedne datoteke treba skenirati moraju biti gotovi i odvojeno za svaku logove posted jedan)
Code: C: \ Program Files \ rhcpv6j0erel \ rhcpv6j0erel.exe
Code: C: \ Program Files \ United Alerts \ UnitedAlerts.exe
__________________ |
