[ Banijac @ 07.02.2007. 11:24 ] @
| Prijatelji, Vec se danima mucim sa nekim trojancima koji su mi okupirali komp. na poslu,zivce mi pojedose.Uspem da ih nekoliko lociram AVG-om,neke Ad-Aware pronadje,neke Avast (on je default na kompu,AVG po potrebi za scan).I kao sve je u redu.Medjutim posle nekoliko sati Avast izbaci poruku da je locirao neke viruse-trojance ili slicnu gamad.Znaci da ih nije do kraja uklonio nijedan scan. Ovo je logfile pa molim nekog ko se razume da mi kaze kako i sta da pobrisem. Logfile of HijackThis v1.99.1 Scan saved at 9:49:59, on 7.2.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\Smartscaps.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\SCARDS32.EXE C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\system32\SafeSignCertReg.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe C:\Program Files\SmartTrust\SmartTrust Personal\Csp\SmartCertmover.exe C:\Program Files\Global Devtech\Network Chat\Network Chat.exe C:\Program Files\VIA\RAID\raid_tool.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wscntfy.exe C:\New PFilles\HJT\hijackthis.exe O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\Program Files\DAP\DAPBHO.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Microsoft Configuration - {40205287-E793-41AC-B95C-D8D064BA33CA} - C:\WINDOWS\system32\mscfg.dll (file missing) O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\Program Files\DAP\DAPIEBar.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [CertificateRegistration] SafeSignCertReg.exe O4 - HKLM\..\Run: [smss] C:\WINDOWS\System\SMSS.EXE O4 - HKLM\..\Run: [lssas] C:\WINDOWS\System\lssas.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [lnwin.exe] C:\WINDOWS\system32\lnwin.exe O4 - HKLM\..\Run: [sysinter] C:\WINDOWS\system32\adirss.exe O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender8\bdmcon.exe" O4 - HKLM\..\Run: [BDNewsAgent] "C:\Program Files\Softwin\BitDefender8\bdnagent.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [AWMON] "C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe" O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdS7_0_0 -reboot 1 O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Certificate Mover.lnk = ? O4 - Global Startup: Network Chat AutoStart.lnk = C:\Program Files\Global Devtech\Network Chat\Network Chat.exe O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\PROGRA~1\DAP\DAP.EXE O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{9EDFB8A6-E065-489A-8E6B-1548AAC8CDED}: NameServer = 194.106.162.2,194.106.162.10 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: SmartTrust Smart Card Server (Smartscaps) - SmartTrust - C:\WINDOWS\system32\Smartscaps.exe O23 - Service: CHIPDRIVE SCARD Service (TWKSCARDSRV) - SCM Microsystems - C:\WINDOWS\SCARDS32.EXE Ovo je AVG-ov report uradjen jutros pa pogledajte sta sam sve uklonio.Ovaj Zhelatin se stalno vraca,onda neki ABC.EXE i jos neki Trojan-Gen. AVG Anti-Spyware - Scan Report --------------------------------------------------------- + Created at: 10:48:14 7.2.2007 + Scan result: C:\Program Files\Video ActiveX Object -> Adware.Generic : Cleaned with backup (quarantined). C:\System Volume Information\_restore{32AE813B-379F-452E-8B2C-5E9C92B1D9DA}\RP358\A0103657.exe -> Proxy.Lager.fa : Cleaned with backup (quarantined). C:\System Volume Information\_restore{32AE813B-379F-452E-8B2C-5E9C92B1D9DA}\RP357\A0103627.exe -> Worm.Banwarum.f : Cleaned with backup (quarantined). C:\System Volume Information\_restore{32AE813B-379F-452E-8B2C-5E9C92B1D9DA}\RP358\A0103656.exe -> Worm.Banwarum.f : Cleaned with backup (quarantined). C:\System Volume Information\_restore{32AE813B-379F-452E-8B2C-5E9C92B1D9DA}\RP359\A0104744.exe -> Worm.Zhelatin.d : Cleaned with backup (quarantined). C:\System Volume Information\_restore{32AE813B-379F-452E-8B2C-5E9C92B1D9DA}\RP359\A0104739.exe -> Worm.Zhelatin.f : Cleaned with backup (quarantined). C:\System Volume Information\_restore{32AE813B-379F-452E-8B2C-5E9C92B1D9DA}\RP359\A0104740.exe -> Worm.Zhelatin.f : Cleaned with backup (quarantined). C:\System Volume Information\_restore{32AE813B-379F-452E-8B2C-5E9C92B1D9DA}\RP359\A0104741.exe -> Worm.Zhelatin.h : Cleaned with backup (quarantined). C:\System Volume Information\_restore{32AE813B-379F-452E-8B2C-5E9C92B1D9DA}\RP359\A0104742.exe -> Worm.Zhelatin.h : Cleaned with backup (quarantined). C:\System Volume Information\_restore{32AE813B-379F-452E-8B2C-5E9C92B1D9DA}\RP359\A0104743.exe -> Worm.Zhelatin.i : Cleaned with backup (quarantined). C:\WINDOWS\system32\GDrrTIs.exe -> Worm.Zhelatin.m : Cleaned with backup (quarantined). ::Report end Sta da radim?Samo bez komentara tipa Format i slicno.Ova sranja su na bitnom kompu prepunom podataka pa tako nesto nema sanse da uradim osim ako ne budem primoran. Hvala! |