|
| |||||||
| Registracija | Mapa Spy | Member List | Donacije | Pretraživanje | Today's Posts | Označi Sve Forume Kao Pročitane | Forum Rules |
 |
 |
| | Thread Tools |
|
#1
21. studenog 2008, 10:34
| |||
| |||
| Sinoć kad sam booted moje računalo u sustavu Windows XP, tri prozora pojavila greška kazivanje: "Error loading C: \ WINDOWS \ system32 \ lwmela.dll" "Error loading C: \ WINDOWS \ system32 \ logibeja.dll" "Error loading C: \ WINDOWS \ system32 \ nebazifi.dll" Sam primijetio da su sve tri ove pogreške povezane s rundll32.exe. Gledao sam na Google-u, te predložili da ne bih obrisati ovu datoteku. Ja sam zadivljen, ako bilo tko može pomoć mene riješiti moj problem. I've posted hijackThis moj dnevnik. Nadam se da ovo pomaže. Code: |
|
#2
21. studenog 2008, 13:05
| |||
| |||
| Preuzimanje Malwarebytes' Anti-zaštita od zlonamjernih programa (MBAM)
Extra Napomena: Ako MBAM susrete datoteku koja je teško ukloniti, bit će predstavljen sa 1 of 2 upitom, kliknite U redu da biste bilo i nek MBAM nastaviti s procesom dezinfekcije, ako je zatraženo da ponovo pokrenete računalo, učinite to odmah. ---------- Molimo Vas da instalirate novu verziju HijackThis i post novi zapisnik. Preuzimanje TrendMicro HijackThis.exe (HJT) na radnoj površini.
__________________  |
|
#3
21. studenog 2008, 20:25
| |||
| |||
| Hvala vam Evilfantasy. Nakon pokrenut postupak ponovne inicijalizacije operacijskog sust MBAM a, pop-up prozore kao da su se prestali pojavljivati. Evo moje logove. MBAM: Malwarebytes' Anti-zaštita od zlonamjernih programa 1,30 Database version: 1415 5/1/2600 Windows Service Pack 3 21/11/2008 7:17:41 PM mbam-log-2008-11-21 (19-17-41). txt Scan type: Quick Scan Objekti skenirane: 53708 Proteklo vrijeme: 3 minute (s), 24 Drugi (a / e) Memory Processes zaraženih: 0 Memorijske module zaraženih: 0 Ključevi registra zaraženih: 3 Registry Values zaraženih: 5 Registry Data Items zaraženih: 2 Mape zaraženih: 0 Zaraženih datoteka: 0 Memory Processes zaraženih: (Nema stavki otkrivenih zlonamjernih) Memorijske module zaraženih: (Nema stavki otkrivenih zlonamjernih) Ključevi registra zaraženih: HKEY_CLASSES_ROOT \ CLSID \ (ec43e3fd-46a6-5c60-97d7-e0b85dbdd6c4) (Trojan.BHO) -> karanteni i uspješno izbrisan. HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ contim (Trojan.Vundo) -> karanteni i uspješno izbrisan. HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ rdfa (Trojan.Vundo) -> karanteni i uspješno izbrisan. Registry Values zaraženih: HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entVersion \ Explorer \ SharedTaskScheduler \ (ec43e3fd-46a6-5c60-97d7-e0b85dbdd6c4) (Trojan.BHO) -> karanteni i uspješno izbrisan. HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entVersion \ ShellServiceObjectDelayLoad \ ssodl (Trojan.BHO) -> karanteni i uspješno izbrisan. HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entVersion \ Run \ cpm13d13c71 (Trojan.Agent) -> karanteni i uspješno izbrisan. HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entVersion \ Run \ vuzeparume (Trojan.Agent) -> karanteni i uspješno izbrisan. HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entVersion \ Run \ 10e20fed (Trojan.Vundo) -> karanteni i uspješno izbrisan. Registry Data Items zaraženih: HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ Curre ntVersion \ Explorer \ Advanced \ Start_ShowSearch (Hijack.StartMenu) -> Bad: (0) Good: (1) -> karanteni i uspješno izbrisan. HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ Curre ntVersion \ Explorer \ Advanced \ Start_ShowHelp (Hijack.StartMenu) -> Bad: (0) Good: (1) -> karanteni i uspješno izbrisan. Mape zaraženih: (Nema stavki otkrivenih zlonamjernih) Zaražene datoteke: (Nema stavki otkrivenih zlonamjernih) HijackThis: Logfile of Trend Micro HijackThis v2.0.2 Scan spremljena u 7:23:04, na 21/11/2008 Platforma: Windows XP SP3 (Winnt 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Pokretanje procesa: C: \ WINDOWS \ System32 \ smss.exe C: \ WINDOWS \ system32 \ Winlogon.exe C: \ WINDOWS \ system32 \ services.exe C: \ WINDOWS \ system32 \ lsass.exe C: \ WINDOWS \ system32 \ Svchost.exe C: \ WINDOWS \ System32 \ Svchost.exe C: \ WINDOWS \ system32 \ spoolsv.exe C: \ WINDOWS \ explorer.exe C: \ Program Files \ Java \ jre1.6.0_07 \ bin \ jusched.exe C: \ Program Files \ LogMeIn \ x86 \ LogMeInSystray.exe C: \ Program Files \ UltraMon \ UltraMon.exe C: \ Program Files \ Adobe \ Acrobat 8,0 \ Acrobat \ Acrotray.exe C: \ Program Files \ LogMeIn \ x86 \ LMIGuardian.exe C: \ programa ~ 1 \ AVG \ AVG8 \ avgtray.exe C: \ WINDOWS \ system32 \ RUNDLL32.EXE C: \ Program Files \ UltraMon \ UltraMonTaskbar.exe C: \ WINDOWS \ RTHDCPL.EXE C: \ WINDOWS \ SOUNDMAN.EXE C: \ WINDOWS \ system32 \ Ctfmon.exe C: \ Documents and Settings \ mi \ Local Settings \ Application Data \ Google \ Update \ GoogleUpdate.exe C: \ Program Files \ Yahoo! \ Sprave \ YahooWidgets.exe C: \ Program Files \ Yahoo! \ Sprave \ YahooWidgets.exe C: \ Program Files \ Yahoo! \ Sprave \ YahooWidgets.exe C: \ programa ~ 1 \ AVG \ AVG8 \ avgwdsvc.exe C: \ Program Files \ Bonjour \ mDNSResponder.exe C: \ Program Files \ gigabajt \ EnergySaver \ GSvr.exe C: \ Program Files \ Google \ Common \ Google Updater \ GoogleUpdaterService.exe C: \ Program Files \ Common Files \ Microsoft Shared \ VS7DEBUG \ MDM.EXE C: \ programa ~ 1 \ AVG \ AVG8 \ avgrsx.exe C: \ Program Files \ Nero \ Nero8 \ Nero BackItUp \ NBService.exe C: \ Program Files \ NVIDIA Corporation \ nTune \ nTuneService.exe C: \ WINDOWS \ system32 \ nvsvc32.exe C: \ WINDOWS \ system32 \ PnkBstrA.exe C: \ Program Files \ Alcohol Soft \ Alcohol 120 \ StarWind \ StarWindServiceAE.exe C: \ programa ~ 1 \ AVG \ AVG8 \ avgemc.exe C: \ Program Files \ Common Files \ Macrovision Shared \ FLEXnet Izdavač \ FNPLicensingService.exe C: \ WINDOWS \ System32 \ Svchost.exe C: \ Program Files \ Mozilla Firefox \ firefox.exe C: \ Program Files \ Trend Micro \ HijackThis \ HijackThis.exe R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Int ernet Postavke, ProxyOverride = *. lokalne O2 - BHO: Adobe PDF Reader Link Helper - (06849E9F-C8D7-4D59-B87D-784B7D6BE0B3) - C: \ Program Files \ Common Files \ Adobe \ Acrobat \ ActiveX \ AcroIEHelper.dll O2 - BHO: ContributeBHO Class - (074C1DC5-9320-4A9A-947D-C042949C6216) - C: \ Program Files \ Adobe \ / Adobe pridonijeti CS3/contributeieplugin.dll O2 - BHO: (no name) - (24e9d28a-8ed5-4d92-9642-2fba5c8cacd9) - C: \ WINDOWS \ system32 \ jabupogu.dll (file missing) O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - (3CA2F312-6F6E-4B53-A66E-4E65E497C8C0) - C: \ Program Files \ AVG \ AVG8 \ avgssie.dll O2 - BHO: SSVHelper Class - (761497BB-D6F0-462C-B6EB-D4DAF1D92D43) - C: \ Program Files \ Java \ jre1.6.0_07 \ bin \ ssv.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - (AE7CD045-E861-484f-8273-0445EE161910) - C: \ Program Files \ Adobe \ Acrobat 8,0 \ Acrobat \ AcroIEFavClient.dll O2 - BHO: Google Toolbar Notifier BHO - (AF69DE43-7D58-4638-B6FA-CE66B5AD205D) - C: \ Program Files \ Google \ GoogleToolbarNotifier \ 4.1.805.4472 \ sw g.dll O2 - BHO: PDF-XChange Viewer IE Plugin - (C5D07EB6-BBCE-4DAE-ACBB-D13A8D28CB1F) - C: \ Program Files \ Tracker Software \ PDF-XChange 4 Pro \ PDF-XChange Viewer PDF \ PDF viewer \ PDFXCviewIEPlugin . dll O3 - Toolbar: Adobe PDF - (47833539-D0C5-4125-9FA8-0819E2EAAC93) - C: \ Program Files \ Adobe \ Acrobat 8,0 \ Acrobat \ AcroIEFavClient.dll O3 - Toolbar: pridonošenju Toolbar - (517BDDE4-E3A7-4570-B21E-2B52B6139FC7) - C: \ Program Files \ Adobe \ / Adobe pridonijeti CS3/contributeieplugin.dll O4 - HKLM \ .. \ Run: [GEST] m '| \ ü O4 - HKLM \ .. \ Run: [NvCplDaemon] RUNDLL32.EXE C: \ WINDOWS \ system32 \ NvCpl.dll, NvStartup O4 - HKLM \ .. \ Run: [nwiz] nwiz.exe / install O4 - HKLM \ .. \ Run: [SunJavaUpdateSched] "C: \ Program Files \ Java \ jre1.6.0_07 \ bin \ jusched.exe" O4 - HKLM \ .. \ Run: [LogMeIn GUI] "C: \ Program Files \ LogMeIn \ x86 \ LogMeInSystray.exe" O4 - HKLM \ .. \ Run: [UltraMon] "C: \ Program Files \ UltraMon \ UltraMon.exe" / auto O4 - HKLM \ .. \ Run: [Acrobat Assistant 8,0] "C: \ Program Files \ Adobe \ Acrobat 8,0 \ Acrobat \ Acrotray.exe" O4 - HKLM \ .. \ Run: [Adobe_ID0EYTHM] C: \ programa ~ 1 \ UOBIČAJENA ~ 1 \ Adobe \ ADOBEV ~ 1 \ Server \ bin \ Ver SiO ~ 2.EXE O4 - HKLM \ .. \ Run: [NeroFilterCheck] C: \ Program Files \ Common Files \ Nero \ Lib \ NeroCheck.exe O4 - HKLM \ .. \ Run: [NBKeyScan] "C: \ Program Files \ Nero \ Nero8 \ Nero BackItUp \ NBKeyScan.exe" O4 - HKLM \ .. \ Run: [AVG8_TRAY] C: \ programa ~ 1 \ AVG \ AVG8 \ avgtray.exe O4 - HKLM \ .. \ Run: [NvMediaCenter] RUNDLL32.EXE C: \ WINDOWS \ system32 \ NvMcTray.dll, NvTaskbarInit O4 - HKLM \ .. \ Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM \ .. \ Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM \ .. \ Run: [AlcWzrd] ALCWZRD.EXE O4 - HKLM \ .. \ Run: [Alcmtr] ALCMTR.EXE O4 - HKCU \ .. \ Run: [NVIDIA nTune] "C: \ Program Files \ NVIDIA Corporation \ nTune \ nTuneCmd.exe" jasno O4 - HKCU \ .. \ Run: [Ctfmon.exe] C: \ WINDOWS \ system32 \ Ctfmon.exe O4 - HKCU \ .. \ Run: [AlcoholAutomount] "C: \ Program Files \ Alcohol Soft \ Alcohol 120 \ axcmd.exe" / automount O4 - HKCU \ .. \ Run: [Google Update] "C: \ Documents and Settings \ mi \ Local Settings \ Application Data \ Google \ Update \ GoogleUpdate.exe" / c O4 - HKUS \ S-1-5-19 \ .. \ Run: [Ctfmon.exe] C: \ WINDOWS \ system32 \ Ctfmon.exe (User 'LOCAL SERVICE') O4 - HKUS \ S-1-5-19 \ .. \ Run: [vuzeparume] Rundll32.exe "C: \ WINDOWS \ system32 \ lowumela.dll", s (User 'LOCAL SERVICE') O4 - HKUS \ S-1-5-20 \ .. \ Run: [Ctfmon.exe] C: \ WINDOWS \ system32 \ Ctfmon.exe (User 'NETWORK SERVICE') O4 - HKUS \ S-1-5-18 \ .. \ Run: [Ctfmon.exe] C: \ WINDOWS \ system32 \ Ctfmon.exe (User 'SYSTEM') O4 - HKUS \. DEFAULT \ .. \ Run: [Ctfmon.exe] C: \ WINDOWS \ system32 \ Ctfmon.exe (User 'Default user') O4 - Startup: Yahoo! Widgets.lnk = C: \ Program Files \ Yahoo! \ Sprave \ YahooWidgets.exe O8 - Extra kontekst meni stavka: Priložena postojećim PDF - res: / / C: \ Program Files \ Adobe \ Acrobat 8,0 \ Acrobat \ AcroIEFavClient.dll / AcroIEAppend.html O8 - Extra kontekst meni stavka: Convert link target to Adobe PDF - res: / / C: \ Program Files \ Adobe \ Acrobat 8,0 \ Acrobat \ AcroIEFavClient.dll / AcroIECapture.html O8 - Extra kontekst meni stavka: Convert link target postojećim PDF - res: / / C: \ Program Files \ Adobe \ Acrobat 8,0 \ Acrobat \ AcroIEFavClient.dll / AcroIEAppend.html O8 - Extra kontekst meni stavka: Pretvorite odabrani linkovi na Adobe PDF - res: / / C: \ Program Files \ Adobe \ Acrobat 8,0 \ Acrobat \ AcroIEFavClient.dll / AcroIECaptureSelLinks.html O8 - Extra kontekst meni stavka: Pretvorite odabrani linkovi na postojeće PDF - res: / / C: \ Program Files \ Adobe \ Acrobat 8,0 \ Acrobat \ AcroIEFavClient.dll / AcroIEAppendSelLinks.html O8 - Extra kontekst meni stavka: Convert selection to Adobe PDF - res: / / C: \ Program Files \ Adobe \ Acrobat 8,0 \ Acrobat \ AcroIEFavClient.dll / AcroIECapture.html O8 - Extra kontekst meni stavka: Convert selection postojećim PDF - res: / / C: \ Program Files \ Adobe \ Acrobat 8,0 \ Acrobat \ AcroIEFavClient.dll / AcroIEAppend.html O8 - Extra kontekst meni stavka: Convert to Adobe PDF - res: / / C: \ Program Files \ Adobe \ Acrobat 8,0 \ Acrobat \ AcroIEFavClient.dll / AcroIECapture.html O8 - Extra kontekst meni stavka: E & zvezi u Microsoft Excel - res: / / C: \ programa ~ 1 \ MICROS ~ 2 \ OFFICE11 \ EXCEL.EXE/3000 O9 - Extra button: (no name) - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C: \ Program Files \ Java \ jre1.6.0_07 \ bin \ ssv.dll O9 - Extra 'Tools' MENUITEM: Sun Java Console - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C: \ Program Files \ Java \ jre1.6.0_07 \ bin \ ssv.dll O9 - Extra button: Research - (92780B25-18CC-41C8-B9BE-3C9C571A8263) - C: \ programa ~ 1 \ MICROS ~ 2 \ OFFICE11 \ REFIEBAR.DLL O9 - Extra button: (no name) - (e2e2dd38-d088-4134-82b7-f2ba38496583) - C: \ WINDOWS \ Network Diagnostic \ xpnetdiag.exe O9 - Extra 'Tools' MENUITEM: @ xpsp3res.dll, -20001 - (e2e2dd38-d088-4134-82b7-f2ba38496583) - C: \ WINDOWS \ Network Diagnostic \ xpnetdiag.exe O9 - Extra button: Messenger - (FB5F1910-F110-11D2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ msmsgs.exe O9 - Extra 'Tools' MENUITEM: Windows Messenger - (FB5F1910-F110-11D2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ msmsgs.exe O16 - DPF: (30528230-99f7-4bb4-88d8-fa1d4f56a2ab) (Installation Support) - C: \ Program Files \ Yahoo! \ Common \ Yinsthelper.dll O16 - DPF: (77E32299-43C6-629F-AB77-6A1E6D7663F6) (Groove Control) -- http://atv.disney.go.com/global/down.../OTOYAX29b.cab O18 - Protocol: linkscanner - (F274614C-63F8-47D5-A4D1-FBDDE494F8D1) - C: \ Program Files \ AVG \ AVG8 \ avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll C: \ WINDOWS \ system32 \ gevabovo.dll c: \ windows \ system32 \ logibeja.dll O23 - Service: Adobe CS3 šlagvort Version - Adobe Systems Incorporated - C: \ Program Files \ Common Files \ Adobe \ Adobe CS3 Version šlagvort \ Server \ bin \ VersionCueCS3.exe O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, sro - C: \ programa ~ 1 \ AVG \ AVG8 \ avgemc.exe O23 - Service: AVG Free8 upozoravanje (avg8wd) - AVG Technologies CZ, sro - C: \ programa ~ 1 \ AVG \ AVG8 \ avgwdsvc.exe O23 - Service: Id_String1.6844F930_1628_4223_B5CC_5BB94B879762 # # # # (Bonjour Service) - Apple Computer, Inc - C: \ Program Files \ Bonjour \ mDNSResponder.exe O23 - Service: FAH @ F: + + Preuzimanja daleko poklič 2 ispucati 2 + [RAZOR1911] [WEB SEED] FAR Cry 2 ispucati - REAL 100% POTPUNO DJELATNO + FAH.exe - Unknown vlasnika - C: \ WINDOWS \ O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd - C: \ Program Files \ Common Files \ Macrovision Shared \ FLEXnet Izdavač \ FNPLicensingService.exe O23 - Service: GEST Servis za program upravljanja. (GEST Service) - Unknown vlasnika - C: \ Program Files \ gigabajt \ EnergySaver \ GSvr.exe O23 - Service: Google Updater Service (gusvc) - Google - C: \ Program Files \ Google \ Common \ Google Updater \ GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C: \ Program Files \ Common Files \ InstallShield \ Driver \ 11 \ Intel 32 \ IDriverT.exe O23 - Service: Nero BackItUp Planer 3 - Nero AG - C: \ Program Files \ Nero \ Nero8 \ Nero BackItUp \ NBService.exe O23 - Service: NMIndexingService - Nero AG - C: \ Program Files \ Common Files \ Nero \ Lib \ NMIndexingService.exe O23 - Service: nTune Service (nTuneService) - NVIDIA - C: \ Program Files \ NVIDIA Corporation \ nTune \ nTuneService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C: \ WINDOWS \ system32 \ nvsvc32.exe O23 - Service: PnkBstrA - Unknown vlasnika - C: \ WINDOWS \ system32 \ PnkBstrA.exe O23 - Service: PnkBstrB - Unknown vlasnika - C: \ WINDOWS \ system32 \ PnkBstrB.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C: \ Program Files \ Alcohol Soft \ Alcohol 120 \ StarWind \ StarWindServiceAE.exe -- End of file - 10749 bytes |
|
#4
21. studeni 2008, 21:44
| |||
| |||
| Izgleda bolje, ali još uvijek ima neke štetne sadržaje left to čist. Deinstalirajte bilo koji pukotine / warez sada molim. To je dobro ne čiste štetni sadržaj kad je gotovo 100% vjerojatnost da će zlonamjerni softver došao jedan od njih. Otvori HijackThis i odaberite Da li je sustav skenirati samo zatim staviti kvačica pored: - O2 - BHO: (no name) - (24e9d28a-8ed5-4d92-9642-2fba5c8cacd9) - C: \ WINDOWS \ system32 \ jabupogu.dll (file missing) - O4 - HKLM \ .. \ Run: [GEST] m '| \ ü - O4 - HKLM \ .. \ Run: [Alcmtr] ALCMTR.EXE - O4 - HKUS \ S-1-5-19 \ .. \ Run: [vuzeparume] Rundll32.exe \ "c: \ windows \ system32 \ lowumela.dll \", S (Korisnik \ 'LOCAL SERVICE \') - O20 - AppInit_DLLs: avgrsstx.dll C: \ WINDOWS \ system32 \ gevabovo.dll c: \ windows \ system32 \ logibeja.dll - O23 - Service: FAH @ F: + + Preuzimanja daleko poklič 2 ispucati 2 + [RAZOR1911] [WEB SEED] FAR Cry 2 ispucati - REAL 100% POTPUNO DJELATNO + FAH.exe - Unknown vlasnika - C: \ WINDOWS \ Zatvori sve prozore osim HijackThis i kliknite Fix checked. ---------- Napomena: se upute u nastavku su izrađene specijalno za ovog korisnika. Ukoliko niste u ovom, NE slijedite ove smjerove, jer bi mogao oštetiti djelovanju vašeg sustava Idi na Start> Run i tip notepad.exe zatim pritisnite U redu Kopirajte i zalijepite niže u Notepad i spremite kao fixme.reg da svoju Desktop Code: REGEDIT4 [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run] "GEST" =- "Alcmtr" =- Pobrinite se da ćete mi reći ako primite poruku o uspjehu dodavši gore u registar. Ako ne dobijete poruku uspjeh, on nije 'funkcionirati. Brisanje fixme.reg iz Desktop. ---------- Preuzimanje ATF čistiju by Atribune i spremite je na svoj Desktop. Alternate Download link Windows Vista korisnike: ATF-čistiju mora biti Pokreni kao administrator Dvaput kliknite na ATF-Cleaner.exe za pokretanje programa. Potvrdite okvire na lijevoj strani:
Sada kliknite na Prazan Izdvojeno Kada dobijete Gotovo Čišćenje poruku, kliknite U redu Firefox korisnici kliknu Firefox Na traci izbornika Kliknite na Odaberi Sve, A zatim kliknite Prazno Napomena: Ako želite zadržati svoje spremljene lozinke kliknite Ne na redak. Opera korisnici kliknu Opera Na traci izbornika Kliknite na Odaberi Sve, A zatim kliknite Prazno Napomena: Ako želite zadržati svoje spremljene lozinke kliknite Ne na upit Važno: Ponovo pokrenite računalo prije nego što nastavite. Imajte na umu da vaš sustav će se pokrenuti sporiji za pokretanje ili dva nakon što koristiti ovaj alat kako ne panici ---------- Download ComboFix © by sUBs jedan od linkova ispod. Budite sigurni da ste na vrhu u Desktop. Link # 1 Link # 2 ** Napomena: Važno je da se sprema izravno na svoj Desktop Zatvori otvoriti bilo koju web preglednicima. (Firefox, Internet Explorer, etc) prije početka ComboFix. Privremeno onemogućiti tvoj AntiVirus, A svaka protušpijunskih Zaštita u stvarnom vremenu prije obavlja scan. Kliknite ovaj link da biste vidjeli popis sigurnosne programe, koji bi trebao biti onemogućen i kako onemogućiti ih. Dvaput kliknite combofix.exe i slijedite upute. Za instalaciju sustava Windows XP Recovery Console: - Ako koristite sustav Windows XP i već nemate instaliranu konzolu za oporavak, provjerite Vašu internetsku vezu je aktivna (ako je moguće) i kliknite na Da. - Ako za neki razlog Internet nije rad klik Ne. -- Ako ne koristite Windows XP, nećete biti upozoreni. - Kada se od vas zatraži da prihvatite LUKK-klikni U redu. - Prihvatiti Microsoft EULA (Klikni Da). - Kada su rekli da RC je ispravno instaliran kliknite DA da nastavi skeniranje za štetne sadržaje. Kada završite ComboFix će proizvesti prijava za vas. Objaviti ComboFix log i novu HijackThis log u sljedećem odgovoru. Važno: Ne mouseclick ComboFix's prozor dok je pokrenut. Svibanj uzrokovati da ga zatajiti. Ne zaboravite ponovo uključili vaš protuvirusni i protušpijunski ComboFix zaštita kada je završeno.
__________________ |
|
#5
22. studenog 2008, 10:02
| |||
| |||
| I uspješno dodan koda u moje registra. JA isto tako pravedan aktivira moj AVG i ona je rekao da je otkrivena je trojanski konj 'SHeur2.CWU' na otvorenom. Ovo se nalazi na C: \ System Volume Information \ _restore (437C89B8-7BDE-4F8B-A154-0070B533E200) \ RP137 \ A009106.dll. Ive 'isto tako uklonili neki od moj napuknut programi koje sam ne koristite. Jedan od njih, koji nisam bio ukloniti Far Cry 2. Ja sam primjetio da je u zapisnicima, ova igra pojavi prilično često. Bi li ova igra biti doprinose problem? Konačno, za HijackThis logove, kako ti znaš što to maknuti? Da li samo ukloniti stavke koje ne izgledaju ispraviti, ili postoji više sustavan pristup to? ________________________________ ComboFix 08-11-21.05 - 2008-11-22 8:12:31.1 me - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2252 [GMT -8:00] Running from: C: \ Documents and Settings \ mi \ Desktop \ ComboFix.exe . Ostali ((((((((((((((((((((((((((((((((((((((( brisanja ))))))))) )))))))))))))))))))))))))))))))))))))))) . c: \ windows \ system32 \ aporanuz.ini c: \ windows \ system32 \ ifizaben.ini . ((((((((((((((((((((((((( Files Created from 2008/10/22 da 2008/11/22 ))))))))))) )))))))))))))))))))) . 2008-11-21 19:21. 2008-11-21 19:21 <DIR> d -------- C: \ Program Files \ Trend Micro 2008-11-21 19:03. 2008-11-21 19:03 <DIR> d -------- C: \ Program Files \ Malwarebytes' Anti-zaštita od zlonamjernih programa 2008-11-21 19:03. 2008-11-21 19:03 <DIR> d -------- C: \ Documents and Settings \ mi \ Application Data \ Malwarebytes 2008-11-21 19:03. 2008-11-21 19:03 <DIR> d -------- C: \ Documents and Settings \ All Users \ Application Data \ Malwarebytes 2008-11-21 19:03. 2008-10-22 16:10 38.496 - a ------ C: \ Windows \ System32 \ Drivers \ mbamswissarmy.sys 2008-11-21 19:03. 2008-10-22 16:10 15.504 - a ------ C: \ Windows \ System32 \ Drivers \ mbam.sys 2008-11-21 08:25. 2008-11-21 08:25 69 - a ------ C: \ Windows \ NeroDigital.ini 2008-11-21 08:24. 2008-11-21 08:25 3.532 - a ------ C: \ drmHeader.bin 2008-11-20 06:34. 2008-11-20 06:34 <DIR> d -------- C: \ Documents and Settings \ mi \ Application Data \ Leadertech 2008-11-17 22:31. 2008-11-17 22:31 <DIR> d -------- C: \ Program Files \ MSECache 2008-11-13 20:26. 2008-08-07 11:38 9.728 - a ------ C: \ Windows \ system32 \ RtNicProp32.dll 2008-11-13 07:17. 2008-09-04 09:15 1.106.944 ----- --- c c: \ windows \ system32 \ dllcache \ msxml3.dll 2008-11-13 07:17. 2008-10-24 03:21 455.296 ----- --- c c: \ windows \ system32 \ dllcache \ mrxsmb.sys 2008-11-11 07:22. 2008-11-11 07:22 <DIR> d -------- C: \ Program Files \ Belarc 2008-11-11 07:22. 2008-02-27 13:49 3.840 - a ------ C: \ Windows \ System32 \ Drivers \ BANTExt.sys 2008-11-09 08:13. 2008-11-09 08:13 <DIR> d -------- C: \ Program Files \ Virtools 2008-11-06 22:31. 2007-12-03 02:10 644.400 - a ------ C: \ Windows \ system32 \ MSCOMCT2.OCX 2008-11-06 20:58. 2008-11-06 20:58 <DIR> d -------- C: \ Documents and Settings \ All Users \ Application Data \ Fallout3 2008-11-06 20:57. 2008-11-06 20:57 <DIR> d -------- C: \ Program Files \ MSBuild 2008-11-06 20:55. 2008-11-06 20:55 <DIR> d -------- C: \ Windows \ system32 \ XPSViewer 2008-11-06 20:55. 2008-11-06 20:55 <DIR> d -------- C: \ Program Files \ Reference Skupštinama 2008-11-06 20:54. 2008-11-06 20:54 <DIR> d -------- C: \ Windows \ system32 \ xlive 2008-11-06 20:54. 2006-06-29 13:07 14.048 --------- C: \ Windows \ system32 \ spmsg2.dll 2008-11-05 07:49. 2008-11-22 07:51 <DIR> d -------- C: \ Windows \ System32 \ Drivers \ Pros 2008-11-05 07:49. 2008-11-05 07:49 <DIR> d -------- C: \ Program Files \ AVG 2008-11-05 07:49. 2008-11-05 07:49 97.928 - a ------ C: \ Windows \ System32 \ Drivers \ avgldx86.sys 2008-11-05 07:49. 2008-11-05 07:49 76.040 - a ------ C: \ Windows \ System32 \ Drivers \ avgtdix.sys 2008-11-05 07:49. 2008-11-05 07:49 10.520 - a ------ C: \ Windows \ system32 \ avgrsstx.dll 2008-11-03 09:40. 2008-11-05 07:44 <DIR> d -------- C: \ Documents and Settings \ LogMeInRemoteUser 2008-10-29 07:59. 2008-10-29 07:59 <DIR> d -------- C: \ Program Files \ Microsoft Silverlight 2008-10-23 21:08. 2008-10-15 08:34 337.408 ----- --- c c: \ windows \ system32 \ dllcache \ netapi32.dll 2008-10-22 10:07. 2008-10-22 10:07 <DIR> d -------- C: \ Windows \. Jagex_cache_32 2008-10-22 10:07. 2008-10-22 10:08 30 - a ------ C: \ Documents and Settings \ mi \ jagex_runescape_preferences.dat . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))) )))))))))))))))))))))))))))))))))))))))))))) . 2008-11-22 16:15 16.608 AW ---- C: \ Windows \ gdrv.sys 2008-11-22 04:36 183.112 AW ---- c: \ windows \ system32 \ PnkBstrB.exe 2008-11-22 04:36 138.184 AW ---- C: \ Windows \ System32 \ Drivers \ PnkBstrK.sys 2008-11-21 23:39 --------- d ----- wc: \ Documents and Settings \ mi \ Application Data \ uTorrent 2008-11-21 18:44 66.872 ---- AW c: \ windows \ system32 \ PnkBstrA.exe 2008-11-21 16:12 --------- d ----- wc: \ Documents and Settings \ All Users \ Application Data \ Google Updater 2008-11-16 08:35 --------- d ----- wc: \ Program Files \ LogMeIn 2008-11-14 04:25 319.488 AW ---- C: \ Windows \ HideWin.exe 2008-11-07 06:31 --------- d - h - wc: \ Program Files \ InstallShield Installation Information 2008-11-07 06:30 --------- d ----- wc: \ Program Files \ Google 2008-11-05 15:49 --------- d ----- wc: \ Documents and Settings \ All Users \ Application Data \ avg8 2008-11-03 15:05 87.352 ---- AW c: \ windows \ system32 \ LMIinit.dll 2008-11-03 15:05 83.288 ---- AW c: \ windows \ system32 \ LMIRfsClientNP.dll 2008-11-03 15:05 47.640 AW ---- C: \ Windows \ System32 \ Drivers \ LMIRfsDriver.sys 2008-11-03 15:05 28.984 ---- AW c: \ windows \ system32 \ LMIport.dll 2008-11-03 15:05 23.736 ---- AW c: \ windows \ system32 \ lmimirr.dll 2008-11-03 15:05 10.040 ---- AW c: \ windows \ system32 \ lmimirr2.dll 2008-10-29 10:02 --------- d ----- wc: \ Program Files \ Microsoft Works 2008-10-25 06:17 --------- d --- AW c: \ Documents and Settings \ All Users \ Application Data \ Temp 2008-10-24 11:21 455.296 AW ---- C: \ Windows \ System32 \ Drivers \ mrxsmb.sys 2008-10-20 05:28 --------- d ----- wc: \ Documents and Settings \ All Users \ Application Data \ FLEXnet 2008-10-19 22:44 --------- d ----- wc: \ Documents and Settings \ All Users \ Application Data \ Ubisoft 2008-10-18 01:48 5.554 ---- AW c: \ windows \ system32 \ ealregsnapshot1.reg 2008-10-18 01:48 --------- d ----- wc: \ Program Files \ Electronic Arts 2008-10-17 09:16 --------- d ----- wc: \ Program Files \ Windows Live 2008-10-17 08:58 --------- d ----- wc: \ Documents and Settings \ All Users \ Application Data \ WLInstaller 2008-10-17 08:57 --------- dcsh - WC: \ Program Files \ Common Files \ WindowsLiveInstaller 2008-10-16 22:13 202.776 AW ---- c: \ windows \ system32 \ wuweb.dll 2008-10-16 22:13 1.809.944 ---- AW c: \ windows \ system32 \ Wuaueng.dll 2008-10-16 22:12 561.688 AW ---- c: \ windows \ system32 \ wuapi.dll 2008-10-16 22:12 323.608 AW ---- c: \ windows \ system32 \ wucltui.dll 2008-10-16 22:09 92.696 ---- AW c: \ windows \ system32 \ cdm.dll 2008-10-16 22:09 51.224 ---- AW c: \ windows \ system32 \ wuauclt.exe 2008-10-16 22:09 43.544 ---- AW c: \ windows \ system32 \ wups2.dll 2008-10-16 22:08 34.328 ---- AW c: \ windows \ system32 \ wups.dll 2008-10-16 22:06 268.648 AW ---- c: \ windows \ system32 \ mucltui.dll 2008-10-16 22:06 208.744 AW ---- c: \ windows \ system32 \ muweb.dll 2008-10-14 02:05 --------- d ----- wc: \ Documents and Settings \ All Users \ Application Data \ nView_Profiles 2008-10-14 02:03 --------- d ----- wc: \ Program Files \ Common Files \ Wise Installation Wizard 2008-10-14 02:03 --------- d ----- wc: \ Program Files \ AGEIA Technologies 2008-10-13 16:13 --------- d ----- wc: \ Program Files \ SystemRequirementsLab 2008-10-13 16:13 --------- d ----- wc: \ Documents and Settings \ mi \ Application Data \ SystemRequirementsLab 2008-10-09 05:12 --------- d ----- wc: \ Documents and Settings \ mi \ Application Data \ Nero 2008-10-09 05:11 --------- d ----- wc: \ Program Files \ Common Files \ Nero 2008-10-09 05:10 --------- d ----- wc: \ Program Files \ Nero 2008-10-09 05:10 --------- d ----- wc: \ Documents and Settings \ All Users \ Application Data \ Nero 2008-10-09 04:34 --------- d ----- wc: \ Program Files \ Common Files \ Autodesk Shared 2008-10-09 04:34 --------- d ----- wc: \ Program Files \ Common Files \ alias Dijeljeno 2008-10-09 04:33 6.656 ---- AW c: \ windows \ system32 \ haspvdd.dll 2008-10-09 04:33 47.616 AW ---- C: \ Windows \ System32 \ Drivers \ Haspnt.sys 2008-10-09 04:32 --------- d ----- wc: \ Program Files \ Autodesk 2008-10-05 06:52 94.208 AW ---- C: \ Windows \ ScUnin.exe 2008-10-01 00:43 1.286.152 ---- AW c: \ windows \ system32 \ msxml4.dll 2008-09-27 06:16 --------- d ----- wc: \ Program Files \ 3DGroove 2008-09-22 05:57 --------- d ----- wc: \ Program Files \ Keyclone 2008-09-19 00:32 4 - sh - r C: \ WINOS.SYS 2008-09-17 16:55 453.152 AW ---- c: \ windows \ system32 \ nvudisp.exe 2008-09-17 04:27 453.152 AW ---- c: \ windows \ system32 \ NVUNINST.EXE 2008-09-16 04:35 107.888 AW ---- c: \ windows \ system32 \ CmdLineExt.dll 2008-09-15 12:12 1.846.400 ---- AW c: \ windows \ system32 \ Win32k.sys 2008-09-10 01:14 1.307.648 ------ wc: \ windows \ system32 \ msxml6.dll 2008-09-04 17:15 1.106.944 ---- AW c: \ windows \ system32 \ msxml3.dll 2008-09-04 16:31 288.024 AW ---- c: \ windows \ system32 \ PhysXCplUI.exe 2008-08-29 15:57 70.936 ---- AW c: \ windows \ system32 \ PhysXLoader.dll 2008-08-26 07:24 826.368 AW ---- c: \ windows \ system32 \ Wininet.dll 2008-08-21 04:00 22.328 AW ---- C: \ Documents and Settings \ mi \ Application Data \ PnkBstrK.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))) )))))))))))))))))))))))))))))))))))))))) . . * Note * empty entries & čitljiv default unose se ne prikazuju REGEDIT4 [HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ Curre ntVersion \ Run] "NVIDIA nTune" = "C: \ Program Files \ NVIDIA Corporation \ nTune \ nTuneCmd.exe" [2007-09-04 81920] "Ctfmon.exe" = "c: \ windows \ system32 \ Ctfmon.exe" [2008-04-14 15360] "AlcoholAutomount" = "C: \ Program Files \ Alcohol Soft \ Alcohol 120 \ axcmd.exe" [2007-07-02 220544] "Google Update" = "C: \ Documents and Settings \ mi \ Local Settings \ Application Data \ Google \ Update \ GoogleUpdate.exe" [2008-10-11 133104] [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entVersion \ Run] "NvCplDaemon" = "c: \ windows \ system32 \ NvCpl.dll" [2008-10-07 13574144] "SunJavaUpdateSched" = "C: \ Program Files \ Java \ jre1.6.0_07 \ bin \ jusched.exe" [2008-06-10 144784] "LogMeIn GUI" = "C: \ Program Files \ LogMeIn \ x86 \ LogMeInSystray.exe" [2008-02-28 63048] "UltraMon" = "C: \ Program Files \ UltraMon \ UltraMon.exe" [2007-12-16 693536] "Acrobat Assistant 8,0" = "C: \ Program Files \ Adobe \ Acrobat 8,0 \ Acrobat \ Acrotray.exe" [2008-01-11 623992] "Adobe_ID0EYTHM" = "c: \ programa ~ 1 \ UOBIČAJENA ~ 1 \ Adobe \ Adobe V ~ 1 \ Server \ bin \ VERSIO ~ 2.EXE" [2007-03-20 1884160] "NeroFilterCheck" = "C: \ Program Files \ Common Files \ Nero \ Lib \ NeroCheck.exe" [2007-03-01 153136] "NBKeyScan" = "C: \ Program Files \ Nero \ Nero8 \ Nero BackItUp \ NBKeyScan.exe" [2007-12-03 2213160] "AVG8_TRAY" = "c: \ programa ~ 1 \ AVG \ AVG8 \ avgtray.exe" [2008-11-05 1234712] "NvMediaCenter" = "c: \ windows \ system32 \ NvMcTray. Dll" [2008-10-07 86016] "nwiz" = "nwiz.exe" [2008/10/07 c: \ windows \ system32 \ nwiz.exe] "RTHDCPL" = "RTHDCPL.EXE" [2008/07/23 c: \ windows \ RTHDCPL.exe] "SoundMan" = "SOUNDMAN.EXE" [2008/06/18 c: \ windows \ SoundMan.exe] "AlcWzrd" = "ALCWZRD.EXE" [2008/06/19 c: \ windows \ alcwzrd.exe] [HKEY_USERS \. DEFAULT \ Software \ Microsoft \ Windows \ Cur rentVersion \ Run] "Ctfmon.exe" = "c: \ windows \ system32 \ Ctfmon.exe" [2008-04-14 15360] C: \ Documents and Settings \ mi \ Start Menu \ Programs \ Startup \ Yahoo! Widgets.lnk - C: \ Program Files \ Yahoo! \ Sprave \ YahooWidgets.exe [2008-03-18 4742184] [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ winlogon \ obavijestiti \ LMIinit] 2008-11-03 07:05 87352 C: \ Windows \ system32 \ LMIinit.dll [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ drivers32] "msacm.ac3filter" = ac3filter.acm "Sentinel" = snti386.dll [HKLM \ ~ \ startupfolder \ C: ^ Documents and Settings me ^ ^ Start Menu ^ Programs ^ Startup ^ Adobe Media Player.lnk] path = C: \ Documents and Settings \ mi \ Start Menu \ Programs \ Startup \ Adobe Media Player.lnk backup = C: \ Windows \ PSS \ Adobe Media Player.lnkStartup [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ shared tools \ msconfig \ startupreg \ IndxStoreSvr_ (79662E04-7C6C-4d9f-84C7-88D8A56B10AA)] - a ------ 2007-12-13 18:10 1688872 C: \ Program Files \ Common Files \ Nero \ Lib \ NMIndexStoreSvr.exe [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ sigurnosni centar] "UpdatesDisableNotify" = dword: 00000001 [HKLM \ ~ \ Services \ sharedaccess \ Parameters \ firewallpo licy \ standardprofile \ AuthorizedApplications \ List] "% windir% \ \ system32 \ \ sessmgr.exe" = "% windir% \ \ Network Diagnostic \ \ xpnetdiag.exe" = "c: \ \ Program Files \ \ uTorrent \ \ uTorrent.exe" = "G: \ \ Games \ \ Sierra \ \ FEARCombat \ \ fpupdate.exe" = "G: \ \ Games \ \ Sierra \ \ FEARCombat \ \ FEARMP.exe" = "c: \ \ WINDOWS \ \ system32 \ \ PnkBstrA.exe" = "c: \ \ WINDOWS \ \ system32 \ \ PnkBstrB.exe" = "c: \ \ Program Files \ \ Opera \ \ opera.exe" = "c: \ \ Program Files \ \ Bonjour \ \ mDNSResponder.exe" = "c: \ \ Program Files \ \ Common Files \ \ Adobe \ \ Adobe CS3 Version šlagvort \ \ Server \ \ bin \ \ VersionCueCS3.exe" = "c: \ \ Program Files \ \ gigabajt \ \ EnergySaver \ \ run.exe" = "c: \ \ Program Files \ \ Sony \ \ kolodvor \ \ LaunchPad \ \ LaunchPad.exe" = "c: \ \ Program Files \ \ Keyclone \ \ keyclone.exe" = "c: \ \ Program Files \ \ Autodesk \ \ Maya8.5 \ \ bin \ \ maya.exe" = "G: \ \ Games \ \ Battlefield2 \ \ BF2.exe" = "c: \ \ Program Files \ \ Windows Live \ \ Messenger \ \ msnmsgr.exe" = "c: \ \ Program Files \ \ Windows Live \ \ Messenger \ \ livecall.exe" = "c: \ \ Program Files \ \ Electronic Arts \ \ EADM \ \ Core.exe" = "G: \ \ Games \ \ FarCry2 \ \ Far Cry 2 \ \ bin \ \ FarCry2.exe" = "G: \ \ Games \ \ FarCry2 \ \ Far Cry 2 \ \ bin \ \ FC2Launcher.exe" = "G: \ \ Games \ \ FarCry2 \ \ Far Cry 2 \ \ bin \ \ FC2Editor.exe" = "c: \ \ Program Files \ \ AVG \ \ AVG8 \ \ avgemc.exe" = "c: \ \ Program Files \ \ AVG \ \ AVG8 \ \ avgupd.exe" = [HKLM \ ~ \ Services \ sharedaccess \ Parameters \ firewallpo licy \ standardprofile \ GloballyOpenPorts \ List] "3703: TCP" = 3703: TCP: Adobe CS3 Version šlagvort Server "3704: TCP" = 3704: TCP: Adobe CS3 Version šlagvort Server "50900: TCP" = 50900: TCP: Adobe CS3 Version šlagvort Server "50901: TCP" = 50901: TCP: Adobe CS3 Version šlagvort Server R1 AvgLdx86; AVG Free AVI Loader Driver x86, c: \ Windows \ System32 \ Drivers \ avgldx86.sys [2008-11-05 97928] R2 avg8emc; Free8 AVG E-mail Scanner, c: \ programa ~ 1 \ AVG \ AVG8 \ avgemc.exe [2008-11-05 875288] R2 avg8wd; AVG Free8 Watchdog, c: \ programa ~ 1 \ AVG \ AVG8 \ avgwdsvc.exe [2008-11-05 231704] R2 AvgTdiX; AVG Network Free8 preusmjerivač; c: \ Windows \ System32 \ Drivers \ avgtdix.sys [2008-11-05 76040] R2 GEST Service; GEST Servis za program upravljanja.; "C: \ program files \ gigabajt \ EnergySaver \ GSvr.exe" [2008-08-16 80392] R2 LMIInfo; LogMeIn Kernel Information Provider; \? \ C: \ Program Files \ LogMeIn \ x86 \ RaInfo.sys [2008-02-28 12856] R2 LMIRfsDriver; LogMeIn Remote File System Driver; \? \ C: \ Windows \ System32 \ Drivers \ LMIRfsDrive r.sys [2008-08-17 47640] R2 UltraMonUtility; UltraMon Utility Driver; \? \ C: \ Program Files \ Common Files \ stvarnom Soft \ UltraMonMirrorDrv \ x32 \ UltraMonUtility.sys [2006-09-24 11776] R3 UltraMonMirror; UltraMonMirror; c: \ Windows \ System32 \ Drivers \ UltraMonMirror.sys [2006-09-24 3584] S4 LMIRfsClientNP; LMIRfsClientNP; [] . Sadržaj je 'Scheduled Tasks' folder 2008/11/22 C: \ Windows \ Tasks \ GoogleUpdateTaskUser.job - C: \ Documents and Settings \ mi \ Local Settings \ Application Data \ Google \ Update \ GoogleUpdate.exe [2008-10-11 09:30] . . ------- Supplementary Scan ------- . FireFox -: Profil - C: \ Documents and Settings \ mi \ Application Data \ Mozilla \ Firefox \ Profiles \ c4mu9u23.default \ FF -: plugin - C: \ Documents and Settings \ mi \ Local Settings \ Application Data \ Google \ Update \ 1.2.131.27 \ npGoogleOneClick6.dl l FF -: plugin - C: \ Program Files \ Adobe \ Acrobat 8,0 \ Acrobat \ preglednik \ nppdf32.dll FF -: plugin - C: \ Program Files \ DivX \ DivX Sadržaj Uploader \ npUpload.dll FF -: plugin - C: \ Program Files \ Google \ Google Updater \ 2.4.1368.5602 \ npCIDetect13.dll FF -: plugin - C: \ Program Files \ Microsoft Silverlight \ 2.0.31005.0 \ npctrl.dll FF -: plugin - C: \ Program Files \ Mozilla Firefox \ plugins \ npyaxmpb.dll FF -: plugin - C: \ Program Files \ Virtools \ 3D Život Player \ npvirtools.dll . ************************************************** ************************ catchme 0.3.1367 W2K/XP/Vista - rootkit / potaja detector by Gmer zlonamjernih programa, http://www.gmer.net Rootkit scan 2008-11-22 08:15:19 5/1/2600 Windows Service Pack 3 NTFS skeniranja skrivenih procesa ... skeniranja skrivenih autostart entries ... skeniranja skrivenih datoteka ... C: \ Windows \ Temp \ 828cd72f-2f04-46ff-bcad-0e3d727a9909.tmp 0 bytes scan uspješno završena skrivenih datoteka: 1 ************************************************** ************************ "ServiceDll" = "c: \ windows \ system32 \ es.dll" [HKEY_LOCAL_MACHINE \ System \ ControlSet001 \ Services \ AH F @ F: + + Preuzimanja daleko poklič 2 ispucati 2 + [RAZOR1911] [WEB SEED] FAR Cry 2 ispucati - REAL 100% POTPUNO DJELATNO + FAH.exe] "ImagePath" = "f: \ downloads \ daleko poklič 2 ispucati 2 \ [RAZOR1911] [WEB SEED] FAR Cry 2 ispucati - REAL 100% POTPUNO DJELATNO \ FAH.exe-svcstart " [HKEY_LOCAL_MACHINE \ System \ ControlSet001 \ Services \ AH F @ F: + + Preuzimanja daleko poklič 2 ispucati 2 + [RAZOR1911] [WEB SEED] FAR Cry 2 ispucati - REAL 100% POTPUNO DJELATNO + FAH.exe] "ImagePath" = "f: \ downloads \ daleko poklič 2 ispucati 2 \ . ------------------------ Other Running Processes ----------------------- -- . C: \ Program Files \ LogMeIn \ x86 \ LMIGuardian.exe c: \ windows \ system32 \ rundll32.exe C: \ Program Files \ Bonjour \ mDNSResponder.exe C: \ Program Files \ Google \ Common \ Google Updater \ GoogleUpdaterService.exe C: \ Program Files \ UltraMon \ UltraMonTaskbar.exe C: \ Program Files \ Common Files \ Microsoft Shared \ VS7DEBUG \ MDM.EXE C: \ Program Files \ Nero \ Nero8 \ Nero BackItUp \ NBService.exe c: \ programa ~ 1 \ AVG \ AVG8 \ avgrsx.exe C: \ Program Files \ NVIDIA Corporation \ nTune \ nTuneService.exe c: \ windows \ system32 \ nvsvc32.exe c: \ windows \ system32 \ PnkBstrA.exe C: \ Program Files \ Alcohol Soft \ Alcohol 120 \ StarWind \ StarWindServiceAE.exe c: \ windows \ system32 \ wdfmgr.exe C: \ Program Files \ Common Files \ Macrovision Shared \ FLEXnet Izdavač \ FNPLicensingService.exe . ************************************************** ************************ . Completion time: 2008-11-22 8:18:54 - stroj je ponovno podizanje sustava [me] ComboFix-u karanteni-files.txt 2008-11-22 16:18:50 Pre-Run: 75917185024 bytes free Post-Run: 76165115904 bytes free 252 --- EOF --- 2008-11-19 11:01:01 _______________________________________________ Logfile of Trend Micro HijackThis v2.0.2 Scan spremljena u 8:51:17, na 22/11/2008 Platforma: Windows XP SP3 (Winnt 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Pokretanje procesa: C: \ WINDOWS \ System32 \ smss.exe C: \ WINDOWS \ system32 \ Winlogon.exe C: \ WINDOWS \ system32 \ services.exe C: \ WINDOWS \ system32 \ lsass.exe C: \ WINDOWS \ system32 \ Svchost.exe C: \ WINDOWS \ System32 \ Svchost.exe C: \ WINDOWS \ system32 \ spoolsv.exe C: \ Program Files \ Java \ jre1.6.0_07 \ bin \ jusched.exe C: \ Program Files \ LogMeIn \ x86 \ LogMeInSystray.exe C: \ Program Files \ UltraMon \ UltraMon.exe C: \ Program Files \ Adobe \ Acrobat 8,0 \ Acrobat \ Acrotray.exe C: \ Program Files \ LogMeIn \ x86 \ LMIGuardian.exe C: \ programa ~ 1 \ AVG \ AVG8 \ avgtray.exe C: \ WINDOWS \ system32 \ RUNDLL32.EXE C: \ WINDOWS \ RTHDCPL.EXE C: \ WINDOWS \ SOUNDMAN.EXE C: \ WINDOWS \ system32 \ Ctfmon.exe C: \ programa ~ 1 \ AVG \ AVG8 \ avgwdsvc.exe C: \ Documents and Settings \ mi \ Local Settings \ Application Data \ Google \ Update \ GoogleUpdate.exe C: \ Program Files \ Yahoo! \ Sprave \ YahooWidgets.exe C: \ Program Files \ Bonjour \ mDNSResponder.exe C: \ Program Files \ gigabajt \ EnergySaver \ GSvr.exe C: \ Program Files \ Google \ Common \ Google Updater \ GoogleUpdaterService.exe C: \ Program Files \ UltraMon \ UltraMonTaskbar.exe C: \ Program Files \ Common Files \ Microsoft Shared \ VS7DEBUG \ MDM.EXE C: \ Program Files \ Nero \ Nero8 \ Nero BackItUp \ NBService.exe C: \ programa ~ 1 \ AVG \ AVG8 \ avgrsx.exe C: \ Program Files \ NVIDIA Corporation \ nTune \ nTuneService.exe C: \ WINDOWS \ system32 \ nvsvc32.exe C: \ WINDOWS \ system32 \ PnkBstrA.exe C: \ Program Files \ Alcohol Soft \ Alcohol 120 \ StarWind \ StarWindServiceAE.exe C: \ Program Files \ Yahoo! \ Sprave \ YahooWidgets.exe C: \ programa ~ 1 \ AVG \ AVG8 \ avgemc.exe C: \ Program Files \ Common Files \ Macrovision Shared \ FLEXnet Izdavač \ FNPLicensingService.exe C: \ WINDOWS \ System32 \ Svchost.exe C: \ WINDOWS \ system32 \ wuauclt.exe C: \ WINDOWS \ explorer.exe C: \ Program Files \ Yahoo! \ Sprave \ YahooWidgets.exe C: \ Program Files \ Mozilla Firefox \ firefox.exe C: \ Program Files \ Trend Micro \ HijackThis \ HijackThis.exe R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Int ernet Postavke, ProxyOverride = *. lokalne O2 - BHO: Adobe PDF Reader Link Helper - (06849E9F-C8D7-4D59-B87D-784B7D6BE0B3) - C: \ Program Files \ Common Files \ Adobe \ Acrobat \ ActiveX \ AcroIEHelper.dll O2 - BHO: ContributeBHO Class - (074C1DC5-9320-4A9A-947D-C042949C6216) - C: \ Program Files \ Adobe \ / Adobe pridonijeti CS3/contributeieplugin.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - (3CA2F312-6F6E-4B53-A66E-4E65E497C8C0) - C: \ Program Files \ AVG \ AVG8 \ avgssie.dll O2 - BHO: SSVHelper Class - (761497BB-D6F0-462C-B6EB-D4DAF1D92D43) - C: \ Program Files \ Java \ jre1.6.0_07 \ bin \ ssv.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - (AE7CD045-E861-484f-8273-0445EE161910) - C: \ Program Files \ Adobe \ Acrobat 8,0 \ Acrobat \ AcroIEFavClient.dll O2 - BHO: Google Toolbar Notifier BHO - (AF69DE43-7D58-4638-B6FA-CE66B5AD205D) - C: \ Program Files \ Google \ GoogleToolbarNotifier \ 4.1.805.4472 \ sw g.dll O2 - BHO: PDF-XChange Viewer IE Plugin - (C5D07EB6-BBCE-4DAE-ACBB-D13A8D28CB1F) - C: \ Program Files \ Tracker Software \ PDF-XChange 4 Pro \ PDF-XChange Viewer PDF \ PDF viewer \ PDFXCviewIEPlugin . dll O3 - Toolbar: Adobe PDF - (47833539-D0C5-4125-9FA8-0819E2EAAC93) - C: \ Program Files \ Adobe \ Acrobat 8,0 \ Acrobat \ AcroIEFavClient.dll O3 - Toolbar: pridonošenju Toolbar - (517BDDE4-E3A7-4570-B21E-2B52B6139FC7) - C: \ Program Files \ Adobe \ / Adobe pridonijeti CS3/contributeieplugin.dll O4 - HKLM \ .. \ Run: [NvCplDaemon] RUNDLL32.EXE C: \ WINDOWS \ system32 \ NvCpl.dll, NvStartup O4 - HKLM \ .. \ Run: [nwiz] nwiz.exe / install O4 - HKLM \ .. \ Run: [SunJavaUpdateSched] "C: \ Program Files \ Java \ jre1.6.0_07 \ bin \ jusched.exe" O4 - HKLM \ .. \ Run: [LogMeIn GUI] "C: \ Program Files \ LogMeIn \ x86 \ LogMeInSystray.exe" O4 - HKLM \ .. \ Run: [UltraMon] "C: \ Program Files \ UltraMon \ UltraMon.exe" / auto O4 - HKLM \ .. \ Run: [Acrobat Assistant 8,0] "C: \ Program Files \ Adobe \ Acrobat 8,0 \ Acrobat \ Acrotray.exe" O4 - HKLM \ .. \ Run: [Adobe_ID0EYTHM] C: \ programa ~ 1 \ UOBIČAJENA ~ 1 \ Adobe \ ADOBEV ~ 1 \ Server \ bin \ Ver SiO ~ 2.EXE O4 - HKLM \ .. \ Run: [NeroFilterCheck] C: \ Program Files \ Common Files \ Nero \ Lib \ NeroCheck.exe O4 - HKLM \ .. \ Run: [NBKeyScan] "C: \ Program Files \ Nero \ Nero8 \ Nero BackItUp \ NBKeyScan.exe" O4 - HKLM \ .. \ Run: [AVG8_TRAY] C: \ programa ~ 1 \ AVG \ AVG8 \ avgtray.exe O4 - HKLM \ .. \ Run: [NvMediaCenter] RUNDLL32.EXE C: \ WINDOWS \ system32 \ NvMcTray.dll, NvTaskbarInit O4 - HKLM \ .. \ Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM \ .. \ Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM \ .. \ Run: [AlcWzrd] ALCWZRD.EXE O4 - HKCU \ .. \ Run: [NVIDIA nTune] "C: \ Program Files \ NVIDIA Corporation \ nTune \ nTuneCmd.exe" jasno O4 - HKCU \ .. \ Run: [Ctfmon.exe] C: \ WINDOWS \ system32 \ Ctfmon.exe O4 - HKCU \ .. \ Run: [AlcoholAutomount] "C: \ Program Files \ Alcohol Soft \ Alcohol 120 \ axcmd.exe" / automount O4 - HKCU \ .. \ Run: [Google Update] "C: \ Documents and Settings \ mi \ Local Settings \ Application Data \ Google \ Update \ GoogleUpdate.exe" / c O4 - HKUS \ S-1-5-18 \ .. \ Run: [Ctfmon.exe] C: \ WINDOWS \ system32 \ Ctfmon.exe (User 'SYSTEM') O4 - HKUS \. DEFAULT \ .. \ Run: [Ctfmon.exe] C: \ WINDOWS \ system32 \ Ctfmon.exe (User 'Default user') O4 - Startup: Yahoo! Widgets.lnk = C: \ Program Files \ Yahoo! \ Sprave \ YahooWidgets.exe O8 - Extra kontekst meni stavka: Priložena postojećim PDF - res: / / C: \ Program Files \ Adobe \ Acrobat 8,0 \ Acrobat \ AcroIEFavClient.dll / AcroIEAppend.html O8 - Extra kontekst meni stavka: Convert link target to Adobe PDF - res: / / C: \ Program Files \ Adobe \ Acrobat 8,0 \ Acrobat \ AcroIEFavClient.dll / AcroIECapture.html O8 - Extra kontekst meni stavka: Convert link target postojećim PDF - res: / / C: \ Program Files \ Adobe \ Acrobat 8,0 \ Acrobat \ AcroIEFavClient.dll / AcroIEAppend.html O8 - Extra kontekst meni stavka: Pretvorite odabrani linkovi na Adobe PDF - res: / / C: \ Program Files \ Adobe \ Acrobat 8,0 \ Acrobat \ AcroIEFavClient.dll / AcroIECaptureSelLinks.html O8 - Extra kontekst meni stavka: Pretvorite odabrani linkovi na postojeće PDF - res: / / C: \ Program Files \ Adobe \ Acrobat 8,0 \ Acrobat \ AcroIEFavClient.dll / AcroIEAppendSelLinks.html O8 - Extra kontekst meni stavka: Convert selection to Adobe PDF - res: / / C: \ Program Files \ Adobe \ Acrobat 8,0 \ Acrobat \ AcroIEFavClient.dll / AcroIECapture.html O8 - Extra kontekst meni stavka: Convert selection postojećim PDF - res: / / C: \ Program Files \ Adobe \ Acrobat 8,0 \ Acrobat \ AcroIEFavClient.dll / AcroIEAppend.html O8 - Extra kontekst meni stavka: Convert to Adobe PDF - res: / / C: \ Program Files \ Adobe \ Acrobat 8,0 \ Acrobat \ AcroIEFavClient.dll / AcroIECapture.html O8 - Extra kontekst meni stavka: E & zvezi u Microsoft Excel - res: / / C: \ programa ~ 1 \ MICROS ~ 2 \ OFFICE11 \ EXCEL.EXE/3000 O9 - Extra button: (no name) - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C: \ Program Files \ Java \ jre1.6.0_07 \ bin \ ssv.dll O9 - Extra 'Tools' MENUITEM: Sun Java Console - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C: \ Program Files \ Java \ jre1.6.0_07 \ bin \ ssv.dll O9 - Extra button: Research - (92780B25-18CC-41C8-B9BE-3C9C571A8263) - C: \ programa ~ 1 \ MICROS ~ 2 \ OFFICE11 \ REFIEBAR.DLL O9 - Extra button: (no name) - (e2e2dd38-d088-4134-82b7-f2ba38496583) - C: \ WINDOWS \ Network Diagnostic \ xpnetdiag.exe O9 - Extra 'Tools' MENUITEM: @ xpsp3res.dll, -20001 - (e2e2dd38-d088-4134-82b7-f2ba38496583) - C: \ WINDOWS \ Network Diagnostic \ xpnetdiag.exe O9 - Extra button: Messenger - (FB5F1910-F110-11D2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ msmsgs.exe O9 - Extra 'Tools' MENUITEM: Windows Messenger - (FB5F1910-F110-11D2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ msmsgs.exe O16 - DPF: (30528230-99f7-4bb4-88d8-fa1d4f56a2ab) (Installation Support) - C: \ Program Files \ Yahoo! \ Common \ Yinsthelper.dll O16 - DPF: (77E32299-43C6-629F-AB77-6A1E6D7663F6) (Groove Control) -- http://atv.disney.go.com/global/down.../OTOYAX29b.cab O18 - Protocol: linkscanner - (F274614C-63F8-47D5-A4D1-FBDDE494F8D1) - C: \ Program Files \ AVG \ AVG8 \ avgpp.dll O23 - Service: Adobe CS3 šlagvort Version - Adobe Systems Incorporated - C: \ Program Files \ Common Files \ Adobe \ Adobe CS3 Version šlagvort \ Server \ bin \ VersionCueCS3.exe O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, sro - C: \ programa ~ 1 \ AVG \ AVG8 \ avgemc.exe O23 - Service: AVG Free8 upozoravanje (avg8wd) - AVG Technologies CZ, sro - C: \ programa ~ 1 \ AVG \ AVG8 \ avgwdsvc.exe O23 - Service: Id_String1.6844F930_1628_4223_B5CC_5BB94B879762 # # # # (Bonjour Service) - Apple Computer, Inc - C: \ Program Files \ Bonjour \ mDNSResponder.exe O23 - Service: FAH @ F: + + Preuzimanja daleko poklič 2 ispucati 2 + [RAZOR1911] [WEB SEED] FAR Cry 2 ispucati - REAL 100% POTPUNO DJELATNO + FAH.exe - Unknown vlasnika - C: \ WINDOWS \ O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd - C: \ Program Files \ Common Files \ Macrovision Shared \ FLEXnet Izdavač \ FNPLicensingService.exe O23 - Service: GEST Servis za program upravljanja. (GEST Service) - Unknown vlasnika - C: \ Program Files \ gigabajt \ EnergySaver \ GSvr.exe O23 - Service: Google Updater Service (gusvc) - Google - C: \ Program Files \ Google \ Common \ Google Updater \ GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C: \ Program Files \ Common Files \ InstallShield \ Driver \ 11 \ Intel 32 \ IDriverT.exe O23 - Service: Nero BackItUp Planer 3 - Nero AG - C: \ Program Files \ Nero \ Nero8 \ Nero BackItUp \ NBService.exe O23 - Service: NMIndexingService - Nero AG - C: \ Program Files \ Common Files \ Nero \ Lib \ NMIndexingService.exe O23 - Service: nTune Service (nTuneService) - NVIDIA - C: \ Program Files \ NVIDIA Corporation \ nTune \ nTuneService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C: \ WINDOWS \ system32 \ nvsvc32.exe O23 - Service: PnkBstrA - Unknown vlasnika - C: \ WINDOWS \ system32 \ PnkBstrA.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C: \ Program Files \ Alcohol Soft \ Alcohol 120 \ StarWind \ StarWindServiceAE.exe -- End of file - 10115 bytes |
|
#6
22. studenog 2008, 12:33
| |||
| |||
| Quote:
Quote:
Quote:
Pustiti mene znati što se odlučite na uklanjanju pukotine. Im 'ne idući u otpad moje vrijeme zalivši nad zapisnicima i dolazi s ispravci ako ne uklonite ih.
__________________ |
|
#7
22. studenog 2008, 13:15
| |||
| |||
| Ne mogu ukloniti sve moje napuknut igre, ali ne mogu ukloniti napuknut softver kao što je CS3/Maya kao što sam im potrebna za moj rad. JA isto tako ne može ukloniti svoj napuknut Windows: ( Nažalost o troši vaše vrijeme evilfantasy. Nisam bio svjestan ove politike. Ja sam još uvijek jako zahvalni i duboko cijenimo Vašu pomoć. |
|
#8
22. studenog 2008, 13:29
| |||
| |||
| Sve dok to radite pravno kopiju Windows to ne čini mnogo dobra pokušati ukloniti štetne sadržaje. Mislim da je teško vjerovati da će bilo koji poslodavac ili klijent će potaknuti ili oprostiti korištenje piratskog softvera sa svojim podacima. Ukoliko imate informacije o klijentima PC ste stavljajući ih u ozbiljnom riziku. Čak i ako se vlastite informacije koje ste stavili sebe i nikome li poslati e-poštu ili instant poruke na ozbiljan rizik kao dobro. Nedostatak sigurnosti je veoma opasno. To je vrlo istinita izjava. Quote:
__________________ |
|
#9
22. studenog 2008, 13:40
| |||
| |||
| Oh, ja sam redovni student. Ja radim sa puno softvera kao što su CS3, Maya ... i drugih stvarno skupih softvera. Nažalost sam provesti većinu svog novca na nastavi i knjige, pa mi nemamo dovoljno za kupovinu softvera. |
|
#10
22. studenog 2008, 13:50
| |||
| |||
| Čak i ako smo bili u većini i dalje od alata koje koristimo bi zavrssiti uklanjanja pukotine anyway. Microsoft, kao i mnogi softver i hardver prodavač ramping su se napori širom svijeta kako bi je nemoguće ili barem jako teško pokrenuti Windows i druge programe bez čitljiv Windows tipku. Treba razmotriti uzimajući barem pravni sustav Windows prije nego što su se iznenada zaglavi sa nijedan OS da radi sa svim. Pogledajte OVDJE. Piratstvo = krađe bez obzira koliko je opravdano. To je najbolje da uklonite ComboFix. To nije sigurno imati samo sredstvo za laganje okolo.
__________________ |
