Virus blokira internet

[ rime1 @ 01.01.2009. 20:03 ] @

Kada ukljucim google chrom i pokusam da otvorim neku stranicu on mi izbacuje da e moze da otvori stranicu tj. da nisam povezan sa internetom,dok sa mozilom nece da mi otvara stranice koje imaju veze saani virus malware programima i povremeno mi otvara prozora da skeniram mooj kompjuter jer je zarazen virusom,takodze nece da mi otvori malwarebytes ou task mangeru u procesima pise da je pokrenut,nece ni da mi radi update nijednog anti-malware programa,i nece da mo pokrene system restore tj. dodze do kraja i kada trebamda pritisnem next da bi zapoceo on nece,pronasao sam nekoliko virusa sa combofix-om koji su bili u system32 i ocistio ih ali je i problem i dalje ostao,ima li resenja?

[ kristi1 @ 01.01.2009. 20:15 ] @

http://www.elitesecurity.org/t...-Problem-sa-SATA-HDDom-virusom
Imas u drugom postu link da skines malwarebytes sa promenjenim imenom, prethodno deinstaliraj postojeci, probaj ako hoce pa javi sta si uradio.

Ako ne uspes klikni na start\ run pa prekopiraj donji tekst lupi enter i iskopiraj sadrzaj iz notepada na forum.

C:\WINDOWS\NOTEPAD.EXE C:\WINDOWS\SYSTEM32\DRIVERS\etc\HOSTS

[ rime1 @ 01.01.2009. 20:25 ] @

Probao sam i to sve sam pobrisaoi stavio 127.0.0.1 localhost ali nece
Nece ovaj,ali sam uspeo da nadzem portable verziju ali neced da mi uradi update,a tome je baza jos iz juna

[ kristi1 @ 01.01.2009. 20:32 ] @

Skini HijackThis odavde http://rapidshare.com/files/178810771/TG2.exe.exe.html
Stavi ga u folder na desktop i pokreni ga
* Izaberi opciju "Do a system scan and save the logfile"
* Na kraju skeniranja program ce izbaciti tekstualni log.
* taj log kopiraj ovde ( opcije copy / paste)

[ rime1 @ 01.01.2009. 20:36 ] @

hijackthis vec imam promenio sam mu ime, stavio da se vide sistemski programi i sakriveni fajlovi evo loga

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:37:32, on 1.1.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\iolo\common\lib\ioloServiceManager.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Thoosje Vista Sidebar\Thoosje Sidebar.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\PSIService.exe
C:\Program Files\NETGATE\Spy Emergency 2008\SpyEmergencySrv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\SYSTRAY.EXE
C:\Program Files\titca\titca\titca.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.rs/
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - Startup: Thoosje Sidebar.lnk = C:\Program Files\Thoosje Vista Sidebar\Thoosje Sidebar.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iolo FileInfoList Service (ioloFileInfoList) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe
O23 - Service: iolo Product Update Service (ioloProductUpdate) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe
O23 - Service: iolo System Service (ioloSystemService) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Spy Emergency Engine Service (SpyEmrgSrv) - NETGATE Technologies s.r.o. - C:\Program Files\NETGATE\Spy Emergency 2008\SpyEmergencySrv.exe

--
End of file - 6541 bytes

[ Goran Mijailovic @ 01.01.2009. 20:54 ] @

Citat:

kristi1:
Ako ne uspes klikni na start\ run pa prekopiraj donji tekst lupi enter i iskopiraj sadrzaj iz notepada na forum.

C:\WINDOWS\NOTEPAD.EXE C:\WINDOWS\SYSTEM32\DRIVERS\etc\HOSTS

*mozda je bolje ovako:

Code:
%SystemRoot%\NOTEPAD.EXE %SystemRoot%\SYSTEM32\DRIVERS\etc\HOSTS

[ rime1 @ 01.01.2009. 21:03 ] @

127.0.0.1 localhost

[ kristi1 @ 01.01.2009. 21:03 ] @

Ja ne vidim znakove infekcije u logu. Uradicemo jos jednu proveru.

Preuzmi Dr Web ftp://ftp.drweb.com/pub/drweb/cureit/cureit.exe
Restartuj racunar u safe mode i pokreni Dr.WebCureit
Klikni na start pa ok, kad zavrsi expres skeniranje ako nadje malware klikni na Yes to All da izvrsi ciscenje.

Moze da bude i sledece, ako se malware igrao sa Winsock podesavanjima, posto kazes da si pustao ComboFix i da je obrisao neke malware
Skini Winsock Fix http://www.snapfiles.com/download/dlwinsockxpfix.html
Pokreni ga i izaberi opciju Fix
On ce resetovati winsock podesavanja I HOSTS file

[ rime1 @ 01.01.2009. 21:30 ] @

Kako se pokrece ovaj Dr.WebCuriet?

a sto se drugog dela tice odradio sam ovo ali mi je sada iskljucio firewall od eseta i promenio sadrzinu C:\WINDOWS\NOTEPAD.EXE C:\WINDOWS\SYSTEM32\DRIVERS\etc\HOSTS
# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

[ magna86 @ 01.01.2009. 21:37 ] @

evo step by step uputstvo

Citat:

Restartujte kompjuter u Safe Mode.
Dvoklikom se pokrece launch.exe,

nakon čega će se pojaviti uvodni prozor - kliknite Start

Pojaviće se obaveštenje o započinjanju uvodnog skeniranja - kliknite OK

Sačekajte 10 do 15 minuta minuta da Dr.Web CureIt izvrši Express Scan;
ukoliko malware bude pronađen, klikom na taster Yes to All u prozoru koji se pojavi dozvolite programu da izvrši dezinfekciju

Kliknite Options > Change settings; u prozoru koji će se otvoriti, dečekiraj opciju Heuristic Analysis a zatim kliknite OK .

U glavnom prozoru obeležiti opciju Complete scan a zatim kliknuti na dugme u obliku simbola play i Dr.Web CureIt će započeti skeniranje
Ukoliko malware bude pronađen, klikom na taster Yes to All u prozoru koji se pojavi dozvoliti programu da izvrši dezinfekciju .
Kada skeniranje bude završeno, kliknuti Select all taster (ukoliko je dostupan), a zatim kliknite Cure i,

u meniju koji se otvori, kliknite Cure ili Move[ukoliko su incurable]:

odradi ovo sto je Kristi1 predlozio pa javi rezultate

[ rime1 @ 01.01.2009. 21:41 ] @

mene ovo samo vrti u krug sa ove adrese ftp://ftp.drweb.com/pub/drweb/cureit/cureit.exe skinem curiet.exe kada kliknem na njega on trazi neki program preko koga treba da otvori link ja izaberem mozilu i kliknem ok i on opet skine curiet.exe i opet isto,ili mi otvori prozor na kome pise curiet.exe is not valid Win32 aplication,moze li neko na rapidshare da mi postavi ovaj program

_{[Ovu poruku je menjao rime1 dana 01.01.2009. u 22:58 GMT+1]}

[ magna86 @ 01.01.2009. 22:04 ] @

a sto se tice linka...hm
evo sad sam proverio i radi...samo sto mora iz safe moda...
len sam da sad restartujem komp u safe mod...
ako neuspes onda odradi ovo:

hm...kazes da si skenirao sa ComboFix-om?
pokusaj naci log / logove od ComboFix-a
naci ces ga ovde

Code:
C:\ComboFix.txt

[ rime1 @ 01.01.2009. 22:13 ] @

Probao sam iz safe moda otvara isto samo sto ne moze da se poveze na internet evo zadnje loga od ComboFixa iz safe moda

"J" - 2009-01-01 12:50:40 Service Pack 3 [SAFE MODE]
ComboFix 07-05.27.BV - Running from: "C:\Documents and Settings\J\Desktop\"

((((((((((((((((((((((((((((((( Files Created from 2008-12-01 to 2009-01-01 ))))))))))))))))))))))))))))))))))

2008-12-31 17:24 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-12-31 17:24 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-12-31 17:24 40,840 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-12-31 17:24 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-12-31 17:24 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-12-31 17:24 <DIR> d-------- C:\DOCUME~1\J\APPLIC~1\PC Tools
2008-12-31 17:08 38,496 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-12-31 17:08 15,504 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-12-31 17:07 <DIR> d-------- C:\New Folder
2008-12-31 16:45 49,152 --a------ C:\WINDOWS\nircmd.exe
2008-12-31 12:44 208,744 --a------ C:\WINDOWS\system32\muweb.dll
2008-12-30 19:34 <DIR> d-------- C:\Program Files\ChromePortable
2008-12-30 18:51 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater
2008-12-29 19:08 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Applications
2008-12-28 20:04 <DIR> d-------- C:\Program Files\Eidos Interactive
2008-12-26 20:26 <DIR> d-------- C:\Program Files\PhotoZoom Professional
2008-12-25 18:11 <DIR> d-------- C:\Documents and Settings\J\Tracing
2008-12-25 18:11 <DIR> d-------- C:\DOCUME~1\J\Tracing
2008-12-25 17:56 <DIR> d-------- C:\Program Files\Microsoft Office Outlook Connector
2008-12-25 17:51 <DIR> d-------- C:\Program Files\Windows Live SkyDrive
2008-12-25 17:24 <DIR> d-------- C:\Program Files\Common Files\Windows Live
2008-12-24 19:02 <DIR> d-------- C:\Games
2008-12-18 13:13 <DIR> d-------- C:\WINDOWS\ie8updates
2008-12-16 17:37 <DIR> d-------- C:\Program Files\AV Vcs 4.0 DIAMOND
2008-12-16 17:36 <DIR> d-------- C:\Program Files\Voice Changer 4.0 Diamond
2008-12-14 14:34 1,700,352 --a------ C:\WINDOWS\system32\gdiplus.dll
2008-12-11 18:16 16,252,928 --a------ C:\Documents and Settings\J\ntuser.dat
2008-12-11 18:16 16,252,928 --a------ C:\DOCUME~1\J\ntuser.dat
2008-12-08 15:41 <DIR> d-------- C:\Program Files\Microsoft Games for Windows - LIVE
2008-12-08 15:04 <DIR> d-------- C:\Program Files\Rockstar Games
2008-12-07 21:34 <DIR> d-------- C:\Program Files\RapidCheck
2008-12-04 22:55 307,560 --a------ C:\WINDOWS\WLXPGSS.SCR
2008-12-02 22:37 49,480 --a------ C:\WINDOWS\system32\sirenacm.dll
2008-12-02 20:15 <DIR> d-------- C:\Program Files\titca
2008-12-02 17:05 <DIR> d-------- C:\Program Files\Uniblue
2008-12-02 16:49 <DIR> d-------- C:\DOCUME~1\J\APPLIC~1\Uniblue

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2008-12-31 19:06:03 -------- d-----w C:\DOCUME~1\J\APPLIC~1\IDM
2008-12-31 19:06:03 -------- d-----w C:\DOCUME~1\J\APPLIC~1\Hide IP NG
2008-12-31 15:33:05 -------- d-----w C:\Program Files\Skype
2008-12-31 12:00:07 -------- d-----w C:\DOCUME~1\J\APPLIC~1\Spy Emergency
2008-12-30 17:56:12 -------- d-----w C:\DOCUME~1\J\APPLIC~1\Google
2008-12-30 17:51:51 -------- d-----w C:\Program Files\Google
2008-12-30 16:18:27 -------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-12-29 18:19:33 -------- d-----w C:\Program Files\Microsoft Games
2008-12-25 16:54:34 -------- d-----w C:\Program Files\Windows Live
2008-12-24 16:42:07 -------- d-----w C:\Program Files\Illusion
2008-12-24 16:38:36 -------- d-----w C:\Program Files\DNA
2008-12-20 16:29:39 -------- d-----w C:\Program Files\PuppetMaster
2008-12-11 13:39:27 -------- d-----w C:\Program Files\Latinski Recnik 1.1
2008-12-08 14:06:05 -------- d--h--w C:\Program Files\InstallShield Installation Information
2008-12-04 13:56:11 410,984 ----a-w C:\WINDOWS\system32\deploytk.dll
2008-12-01 14:26:37 -------- d-----w C:\Program Files\SystemRequirementsLab
2008-11-28 15:51:09 -------- d-----w C:\Program Files\Siber Systems
2008-11-24 15:22:37 10 ----a-w C:\WINDOWS\popcinfo.dat
2008-11-23 14:18:22 -------- d-----w C:\Program Files\Njegos »Gorski vijenac«
2008-11-22 20:30:24 -------- d-----w C:\Program Files\mIRC
2008-11-22 17:30:16 -------- d-----w C:\DOCUME~1\J\APPLIC~1\SystemRequirementsLab
2008-11-21 19:58:24 -------- d-----w C:\DOCUME~1\J\APPLIC~1\Capcom
2008-11-21 19:56:01 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-11-15 18:20:52 -------- d-----w C:\DOCUME~1\J\APPLIC~1\PC Suite
2008-11-14 13:03:46 -------- d-----w C:\DOCUME~1\J\APPLIC~1\Skype
2008-11-14 13:00:33 -------- d-----w C:\DOCUME~1\J\APPLIC~1\skypePM
2008-11-12 13:20:35 -------- d-----w C:\Program Files\Mafia-WinterEdition
2008-11-12 12:44:54 -------- d-----w C:\Program Files\MSXML 4.0
2008-11-08 14:11:21 -------- d-----w C:\Program Files\Common Files\Skype
2008-11-06 15:57:20 -------- d-----w C:\DOCUME~1\J\APPLIC~1\EyeSpyFX
2008-10-27 09:04:18 514,384 ----a-w C:\WINDOWS\system32\XAudio2_3.dll
2008-10-27 09:04:16 23,376 ----a-w C:\WINDOWS\system32\X3DAudio1_5.dll
2008-10-23 12:36:14 286,720 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-10-22 04:29:02 14,303,392 ----a-w C:\WINDOWS\system32\xlive.dll
2008-10-22 04:29:02 13,643,936 ----a-w C:\WINDOWS\system32\xlivefnt.dll
2008-10-16 13:13:40 202,776 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-10-16 13:13:40 1,809,944 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-10-16 13:12:22 323,608 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-10-16 13:12:20 561,688 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-10-16 13:09:44 92,696 ----a-w C:\WINDOWS\system32\cdm.dll
2008-10-16 13:09:44 51,224 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-10-16 13:09:44 43,544 ----a-w C:\WINDOWS\system32\wups2.dll
2008-10-16 13:08:58 34,328 ----a-w C:\WINDOWS\system32\wups.dll
2008-10-16 13:06:48 268,648 ----a-w C:\WINDOWS\system32\mucltui.dll
2008-10-13 18:05:29 356,352 ----a-w C:\WINDOWS\eSellerateEngine.dll
2008-10-10 03:52:38 452,440 ----a-w C:\WINDOWS\system32\d3dx10_40.dll
2008-10-10 03:52:38 4,379,984 ----a-w C:\WINDOWS\system32\D3DX9_40.dll
2008-10-10 03:52:38 2,036,576 ----a-w C:\WINDOWS\system32\D3DCompiler_40.dll
2008-10-03 10:02:42 247,326 ----a-w C:\WINDOWS\system32\strmdll.dll
2008-08-02 23:14:27 5,852 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{3049C3E9-B461-4BC5-8870-4C09146192CA}=C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2008-08-18 13:30]
{72853161-30C5-4D22-B7F9-0BBC1D38A37E}=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2007-08-24 07:01]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre6\bin\ssv.dll [2008-12-04 14:56]
{9030D464-4C02-4ABF-8ECC-5164760863C6}=C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2008-11-18 13:47]
{AA58ED58-01DD-4d91-8333-CF10577473F7}=C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2008-12-30 18:42]
{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}=C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll [2008-12-30 18:42]
{DBC80044-A445-435b-BC74-9C25C1C588A9}=C:\Program Files\Java\jre6\bin\jp2ssv.dll [2008-12-04 14:56]
{E7E6F031-17CE-4C07-BC86-EABFE594F69C}=C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2008-12-04 14:56]
{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}=C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL [2008-02-25 21:01]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2007-12-21 07:21]
"ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [2008-08-25 12:36]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 01:12]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2008-12-02 22:41]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"LinkResolveIgnoreLinkInfo"=0 (0x0)
"NoResolveSearch"=1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoLowDiskSpaceChecks"=1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"="C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [2007-08-24 07:01]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"="C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 21:19]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
%SystemRoot%\System32\dimsntfy.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages msv1_0 C:\WINDOWS\system32\mlJDtrPg

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\sdauxservice]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\sdcoreservice]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Media Key.lnk]
backup=C:\WINDOWS\pss\Media Key.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk]
backup=C:\WINDOWS\pss\Windows Search.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\^.rnd]
path=\.rnd

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\^default.pls]
path=\default.pls

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\^ntuser.dat]
path=\ntuser.dat

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\^ntuser.dat.LOG]
path=\ntuser.dat.LOG

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\^ntuser.ini]
path=\ntuser.ini

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\90208]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\9c147f9a]
rundll32.exe "C:\WINDOWS\system32\rdftlkap.dll",b

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AntamediaBandwidth]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BigDogPath323Domino]
C:\WINDOWS\Domino.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BigDogPath323VMSnap]
C:\WINDOWS\VMSnap23.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
"C:\Program Files\DNA\btdna.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Caffe-Server]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FreeCall]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
"C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
%systemroot%\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
"C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nokia.PCSync]
"C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe" /NoDialog

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OrderReminder]
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RamBooster]
C:\Program Files\RamBooster 2.0\Rambooster.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RapidCheck]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
"C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RGSC]
C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoftickPPP]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpyEmergency]
"C:\Program Files\NETGATE\Spy Emergency 2008\SpyEmergency.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ThePrivacyGuard]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue RegistryBooster 2]
C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMUAgent.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs BthServ
eapsvcs eaphost
dot3svc dot3svc

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs*
napagent

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{059d64d4-d379-11dd-803b-0018f3ea3f39}]
AutoRun\command- H:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\Rgmen.exe
open\command- H:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\Rgmen.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{08a941f0-6634-11dd-bf14-0018f3ea3f39}]
Auto\command- H:\Start.exe
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Start.exe
explore\Command- H:\gg.exe 0e
open\Command- H:\gg.exe 0o

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{220dba5a-71ea-11dd-bf54-0018f3ea3f39}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe killVBS.vbs

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3a9a04b8-4bea-11dc-9917-0018f3ea3f39}]
Auto\command- G:\RavMonE.exe e
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RavMonE.exe e

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ce3ecb5c-6857-11dc-9995-0018f3ea3f39}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe killVBS.vbs

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e86b5a62-4be3-11dc-9914-0018f3ea3f39}]
Auto\command- RavMonE.exe e
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RavMonE.exe e

*Newly Created Service* - MDMXSDK

Contents of the 'Scheduled Tasks' folder
2009-01-01 11:45:20 C:\WINDOWS\tasks\User_Feed_Synchronization-{132907F2-D634-4C67-9942-44DF435096B5}.job

********************************************************************

catchme 0.3.692 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-01 12:59:19
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

disk error: C:\WINDOWS\

please note that you need administrator rights to perform deep scan

********************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet005\Services\JavaQuickStarterService]
"ImagePath"="\"C:\Program Files\Java\jre6\bin\jqs.exe\" -service -config \"C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf\""

[HKEY_LOCAL_MACHINE\system\ControlSet005\Services\BTHPORT\Parameters\Services\{00001000-0000-1000-8000-00805f9b34fb}]

[HKEY_LOCAL_MACHINE\system\ControlSet005\Services\TDSSserv.sys]
"imagepath"="\systemroot\system32\drivers\TDSSpqlt.sys"

Completion time: 2009-01-01 13:01:20
C:\ComboFix-quarantined-files.txt ... 2009-01-01 13:00
C:\ComboFix2.txt ... 2009-01-01 12:39
C:\ComboFix3.txt ... 2008-12-31 19:55

--- E O F ---

[ magna86 @ 01.01.2009. 22:52 ] @

restartuj kompjuter..pritiskaj F8 i u boot meniju izaberi safe mode

pritisni:
Alt +Ctrl + Delete istovremeno
klikni na tab process
proveri nalazi li se ovaj process
WLXPGSS.SCR

ako ga nadjes selektuj ga i idi na end process

zatvori task manager

moraces da pokazes skrivene fajlove
ako neznas...evo ga tuto
http://www.bleepingcomputer.com/tutorials/tutorial62.html

nadji sledeci File

Code:
C:\WINDOWS\WLXPGSS.SCR

kad ga nadjes brisi ga Shift + Delete pa Enter

************
onda skini ovo
http://www.atribune.org/ccount/click.php?id=1

pokreni ga

*************

i dalje si u safe modu...

onda odradi sledece:
Start / Run kucaj

regedit

pa OK

nadji sledeci kljuc (prati levu stranu)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]

znaci kad kliknes/otvoris Browser Helper Objects
ispod ce ti se pokazati neki brojevi.to su reg. kljucevi

obrisi ovaj kljuc

{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}

zatvori regedit

nadji sledeci File i obrisi ga
C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL

ili ceo folder
C:\Program Files\ZoneAlarmSB

brises ovim komandama
Shift+Delete pa Enter

sad tek restartujes komp i dizes ga u normalni mod
***************

sigurno si imao zone alarm pa si ga obrisao
ovo su repovi od njega koji se pokrecu sa sistemom

javi rezultate

_{[Ovu poruku je menjao magna86 dana 02.01.2009. u 00:34 GMT+1]}

[ Stefan 93 @ 02.01.2009. 00:59 ] @

Nešto drugačije da proverimo, od kada imaš taj ESET SS? Ako si ga skoro instalirao, možda si sa crackom uneo neki virus. I odakle učitavaš definicije sa njim?

[ rime1 @ 02.01.2009. 09:55 ] @

@magna86
nasao sam ovaj fajl WLXPGSS.SCR i izbrisao sam ga ali nije bio medzu procesima,znam kako se otkrivaju skriveni folderi ali nece dam i otvori ovu http://www.atribune.org/ccount/click.php?id=1 stranicu jer je virus blokira, blokira svake koje imaju veze sa anti-virus malware programima.Imao sam zone alarma instaliran ali on nije mogao da radi zajedno sa esetom pa sam ga izbrisao,i koristio sam crack za Eset

[ kristi1 @ 02.01.2009. 10:30 ] @

Ajde da probamo nesto.
Klikni desni klik na ikonicu noda pored sata
izaberi AMON iz Threat Protection opcije
destikliraj File system monitor (AMON) enabled.
Probaj sada da skines neki od gore pomenutih alata cisto provere radi.

[ rime1 @ 02.01.2009. 10:42 ] @

Potpuno sam unistio nod sa Revo Uninstaller ali i dallje nece

[ kristi1 @ 02.01.2009. 10:57 ] @

Ajde pokreni Combofix ali iz normal moda i postavi log da pogledam, znaci iz Normal moda.
Najbolje bi bilo da skines novu verziju ako mozes.

[ rime1 @ 02.01.2009. 15:45 ] @

evo

"J" - 2009-01-02 13:53:27 Service Pack 3
ComboFix 07-05.27.BV - Running from: "C:\Documents and Settings\J\Desktop\"

((((((((((((((((((((((((((((((( Files Created from 2008-12-02 to 2009-01-02 ))))))))))))))))))))))))))))))))))

2009-01-02 12:34 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
2009-01-02 12:34 75,272 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys
2009-01-02 12:34 12,424 --a------ C:\WINDOWS\system32\drivers\avgrkx86.sys
2009-01-02 12:34 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
2009-01-02 12:34 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg
2009-01-02 12:33 45,568 --a------ C:\WINDOWS\system32\avgfwdx.dll
2009-01-02 12:33 22,528 --a------ C:\WINDOWS\system32\drivers\avgfwdx.sys
2009-01-02 12:33 <DIR> d-------- C:\WINDOWS\LastGood
2009-01-02 12:33 <DIR> d-------- C:\Program Files\AVG
2009-01-02 12:33 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\avg8
2009-01-02 11:32 268,648 --a------ C:\WINDOWS\system32\mucltui.dll
2009-01-01 21:25 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2009-01-01 13:57 <DIR> d-------- C:\DOCUME~1\J\APPLIC~1\Thinstall
2008-12-31 17:08 38,496 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-12-31 17:08 15,504 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-12-31 16:45 49,152 --a------ C:\WINDOWS\nircmd.exe
2008-12-31 12:44 208,744 --a------ C:\WINDOWS\system32\muweb.dll
2008-12-30 19:34 <DIR> d-------- C:\Program Files\ChromePortable
2008-12-30 18:51 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater
2008-12-29 19:08 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Applications
2008-12-28 20:04 <DIR> d-------- C:\Program Files\Eidos Interactive
2008-12-25 18:11 <DIR> d-------- C:\Documents and Settings\J\Tracing
2008-12-25 18:11 <DIR> d-------- C:\DOCUME~1\J\Tracing
2008-12-25 17:56 <DIR> d-------- C:\Program Files\Microsoft Office Outlook Connector
2008-12-25 17:51 <DIR> d-------- C:\Program Files\Windows Live SkyDrive
2008-12-25 17:24 <DIR> d-------- C:\Program Files\Common Files\Windows Live
2008-12-24 19:02 <DIR> d-------- C:\Games
2008-12-18 13:13 <DIR> d-------- C:\WINDOWS\ie8updates
2008-12-16 17:36 <DIR> d-------- C:\Program Files\Voice Changer 4.0 Diamond
2008-12-14 14:34 1,700,352 --a------ C:\WINDOWS\system32\gdiplus.dll
2008-12-11 18:16 16,252,928 --a------ C:\Documents and Settings\J\ntuser.dat
2008-12-11 18:16 16,252,928 --a------ C:\DOCUME~1\J\ntuser.dat
2008-12-08 15:41 <DIR> d-------- C:\Program Files\Microsoft Games for Windows - LIVE
2008-12-08 15:04 <DIR> d-------- C:\Program Files\Rockstar Games
2008-12-07 21:34 <DIR> d-------- C:\Program Files\RapidCheck
2008-12-02 22:37 49,480 --a------ C:\WINDOWS\system32\sirenacm.dll
2008-12-02 20:15 <DIR> d-------- C:\Program Files\titca
2008-12-02 17:05 <DIR> d-------- C:\Program Files\Uniblue
2008-12-02 16:49 <DIR> d-------- C:\DOCUME~1\J\APPLIC~1\Uniblue

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2009-01-01 19:09:04 -------- d-----w C:\Program Files\wLite
2009-01-01 19:05:31 -------- d-----w C:\DOCUME~1\J\APPLIC~1\Google
2009-01-01 19:01:26 -------- d-----w C:\DOCUME~1\J\APPLIC~1\BitTorrent
2009-01-01 12:55:27 -------- d-----w C:\DOCUME~1\J\APPLIC~1\Spy Emergency
2008-12-31 15:33:05 -------- d-----w C:\Program Files\Skype
2008-12-30 17:51:51 -------- d-----w C:\Program Files\Google
2008-12-30 16:18:27 -------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-12-29 18:19:33 -------- d-----w C:\Program Files\Microsoft Games
2008-12-25 16:54:34 -------- d-----w C:\Program Files\Windows Live
2008-12-24 16:42:07 -------- d-----w C:\Program Files\Illusion
2008-12-24 16:38:36 -------- d-----w C:\Program Files\DNA
2008-12-20 16:29:39 -------- d-----w C:\Program Files\PuppetMaster
2008-12-11 13:39:27 -------- d-----w C:\Program Files\Latinski Recnik 1.1
2008-12-08 14:06:05 -------- d--h--w C:\Program Files\InstallShield Installation Information
2008-12-04 13:56:11 410,984 ----a-w C:\WINDOWS\system32\deploytk.dll
2008-12-01 14:26:37 -------- d-----w C:\Program Files\SystemRequirementsLab
2008-11-28 15:51:09 -------- d-----w C:\Program Files\Siber Systems
2008-11-24 15:22:37 10 ----a-w C:\WINDOWS\popcinfo.dat
2008-11-23 14:18:22 -------- d-----w C:\Program Files\Njegos »Gorski vijenac«
2008-11-22 20:30:24 -------- d-----w C:\Program Files\mIRC
2008-11-22 17:30:16 -------- d-----w C:\DOCUME~1\J\APPLIC~1\SystemRequirementsLab
2008-11-21 19:58:24 -------- d-----w C:\DOCUME~1\J\APPLIC~1\Capcom
2008-11-21 19:56:01 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-11-15 18:20:52 -------- d-----w C:\DOCUME~1\J\APPLIC~1\PC Suite
2008-11-14 13:03:46 -------- d-----w C:\DOCUME~1\J\APPLIC~1\Skype
2008-11-14 13:00:33 -------- d-----w C:\DOCUME~1\J\APPLIC~1\skypePM
2008-11-12 13:20:35 -------- d-----w C:\Program Files\Mafia-WinterEdition
2008-11-12 12:44:54 -------- d-----w C:\Program Files\MSXML 4.0
2008-11-08 14:11:21 -------- d-----w C:\Program Files\Common Files\Skype
2008-11-06 15:57:20 -------- d-----w C:\DOCUME~1\J\APPLIC~1\EyeSpyFX
2008-10-23 12:36:14 286,720 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-10-22 04:29:02 14,303,392 ----a-w C:\WINDOWS\system32\xlive.dll
2008-10-22 04:29:02 13,643,936 ----a-w C:\WINDOWS\system32\xlivefnt.dll
2008-10-16 13:13:40 202,776 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-10-16 13:13:40 1,809,944 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-10-16 13:12:22 323,608 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-10-16 13:12:20 561,688 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-10-16 13:09:44 92,696 ----a-w C:\WINDOWS\system32\cdm.dll
2008-10-16 13:09:44 51,224 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-10-16 13:09:44 43,544 ----a-w C:\WINDOWS\system32\wups2.dll
2008-10-16 13:08:58 34,328 ----a-w C:\WINDOWS\system32\wups.dll
2008-10-13 18:05:29 356,352 ----a-w C:\WINDOWS\eSellerateEngine.dll
2008-10-10 03:52:38 452,440 ----a-w C:\WINDOWS\system32\d3dx10_40.dll
2008-10-10 03:52:38 4,379,984 ----a-w C:\WINDOWS\system32\D3DX9_40.dll
2008-10-10 03:52:38 2,036,576 ----a-w C:\WINDOWS\system32\D3DCompiler_40.dll
2008-10-03 10:02:42 247,326 ----a-w C:\WINDOWS\system32\strmdll.dll
2008-08-02 23:14:27 5,852 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{3049C3E9-B461-4BC5-8870-4C09146192CA}=C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2008-08-18 13:30]
{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}=C:\Program Files\AVG\AVG8\avgssie.dll [2009-01-02 12:34]
{72853161-30C5-4D22-B7F9-0BBC1D38A37E}=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2007-08-24 07:01]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre6\bin\ssv.dll [2008-12-04 14:56]
{9030D464-4C02-4ABF-8ECC-5164760863C6}=C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2008-11-18 13:47]
{AA58ED58-01DD-4d91-8333-CF10577473F7}=C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2008-12-30 18:42]
{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}=C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll [2008-12-30 18:42]
{DBC80044-A445-435b-BC74-9C25C1C588A9}=C:\Program Files\Java\jre6\bin\jp2ssv.dll [2008-12-04 14:56]
{E7E6F031-17CE-4C07-BC86-EABFE594F69C}=C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2008-12-04 14:56]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2009-01-02 12:34]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 01:12]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2008-12-02 22:41]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"LinkResolveIgnoreLinkInfo"=0 (0x0)
"NoResolveSearch"=1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoLowDiskSpaceChecks"=1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"="C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [2007-08-24 07:01]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"="C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 21:19]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
%SystemRoot%\System32\dimsntfy.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages msv1_0 C:\WINDOWS\system32\mlJDtrPg

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Media Key.lnk]
backup=C:\WINDOWS\pss\Media Key.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk]
backup=C:\WINDOWS\pss\Windows Search.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\^.rnd]
path=\.rnd

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\^default.pls]
path=\default.pls

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\^ntuser.dat]
path=\ntuser.dat

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\^ntuser.dat.LOG]
path=\ntuser.dat.LOG

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\^ntuser.ini]
path=\ntuser.ini

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\90208]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\9c147f9a]
rundll32.exe "C:\WINDOWS\system32\rdftlkap.dll",b

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AntamediaBandwidth]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BigDogPath323Domino]
C:\WINDOWS\Domino.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BigDogPath323VMSnap]
C:\WINDOWS\VMSnap23.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
"C:\Program Files\DNA\btdna.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Caffe-Server]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FreeCall]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
"C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
%systemroot%\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
"C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nokia.PCSync]
"C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe" /NoDialog

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OrderReminder]
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RamBooster]
C:\Program Files\RamBooster 2.0\Rambooster.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RapidCheck]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
"C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RGSC]
C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoftickPPP]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpyEmergency]
"C:\Program Files\NETGATE\Spy Emergency 2008\SpyEmergency.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ThePrivacyGuard]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue RegistryBooster 2]
C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMUAgent.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs BthServ
eapsvcs eaphost
dot3svc dot3svc

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs*
napagent

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{059d64d4-d379-11dd-803b-0018f3ea3f39}]
AutoRun\command- H:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\Rgmen.exe
open\command- H:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\Rgmen.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{08a941f0-6634-11dd-bf14-0018f3ea3f39}]
Auto\command- H:\Start.exe
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Start.exe
explore\Command- H:\gg.exe 0e
open\Command- H:\gg.exe 0o

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{220dba5a-71ea-11dd-bf54-0018f3ea3f39}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe killVBS.vbs

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3a9a04b8-4bea-11dc-9917-0018f3ea3f39}]
Auto\command- G:\RavMonE.exe e
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RavMonE.exe e

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ce3ecb5c-6857-11dc-9995-0018f3ea3f39}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe killVBS.vbs

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e86b5a62-4be3-11dc-9914-0018f3ea3f39}]
Auto\command- RavMonE.exe e
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RavMonE.exe e

*Newly Created Service* - AVG8WD
*Newly Created Service* - AVGFWS8
*Newly Created Service* - AVGLDX86
*Newly Created Service* - AVGMFX86
*Newly Created Service* - AVGRKX86
*Newly Created Service* - AVGTDIX

Contents of the 'Scheduled Tasks' folder
2009-01-02 11:56:10 C:\WINDOWS\tasks\User_Feed_Synchronization-{132907F2-D634-4C67-9942-44DF435096B5}.job

********************************************************************

catchme 0.3.692 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-02 13:55:22
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

disk error: C:\WINDOWS\

please note that you need administrator rights to perform deep scan

********************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet005\Services\JavaQuickStarterService]
"ImagePath"="\"C:\Program Files\Java\jre6\bin\jqs.exe\" -service -config \"C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf\""

[HKEY_LOCAL_MACHINE\system\ControlSet005\Services\BTHPORT\Parameters\Services\{00001000-0000-1000-8000-00805f9b34fb}]

[HKEY_LOCAL_MACHINE\system\ControlSet005\Services\TDSSserv.sys]
"imagepath"="\systemroot\system32\drivers\TDSSpqlt.sys"

Completion time: 2009-01-02 13:57:04
C:\ComboFix-quarantined-files.txt ... 2009-01-02 13:56
C:\ComboFix2.txt ... 2009-01-02 13:48
C:\ComboFix3.txt ... 2009-01-01 13:01

--- E O F ---

Citat:

magna86: restartuj kompjuter..pritiskaj F8 i u boot meniju izaberi safe mode

pritisni:
Alt +Ctrl + Delete istovremeno
klikni na tab process
proveri nalazi li se ovaj process
WLXPGSS.SCR

ako ga nadjes selektuj ga i idi na end process

zatvori task manager

moraces da pokazes skrivene fajlove
ako neznas...evo ga tuto
http://www.bleepingcomputer.com/tutorials/tutorial62.html

nadji sledeci File

Code:
C:\WINDOWS\WLXPGSS.SCR

Imao sam zone alarma ali sam ga izbrisao jer nije mogao zajedno da radi sa nodom i imao sam crack za nod
Nema ovaj kljuc {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} samo ovi
{3049C3E9-B461-4BC5-8870-4C09146192CA}
{72853161-30C5-4D22-B7F9-0BBC1D38A37E}
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
{9030D464-4C02-4ABF-8ECC-5164760863C6}
{AA58ED58-01DD-4d91-8333-CF10577473F7}
{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}
{DBC80044-A445-435b-BC74-9C25C1C588A9}
{E7E6F031-17CE-4C07-BC86-EABFE594F69C}

[ kristi1 @ 02.01.2009. 16:26 ] @

Otvori Notepad i kopiraj tekst koji se nalazi ispod:
Klikni na File\Save as i sacuvaj tekst kao CFScript na desktop

Code:

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e86b5a62-4be3-11dc-9914-0018f3ea3f39}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{059d64d4-d379-11dd-803b-0018f3ea3f39}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{08a941f0-6634-11dd-bf14-0018f3ea3f39}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3a9a04b8-4bea-11dc-9917-0018f3ea3f39}]

Prati uputstvo sa slike i prevuci CFScript.txt preko ikonice ComboFix.exe
To ce startovati ComboFix automatski ,mozda ce doci do restarta sistema (to je normalno)
Kada zavrsi,pojavice se log (C:\ComboFix.txt)
Posalji ComboFix log kao i svez HijackThis log

_{[Ovu poruku je menjao Goran Mijailovic dana 03.01.2009. u 00:11 GMT+1]}

[ Aleksandar Đokić @ 02.01.2009. 16:45 ] @

zasto se maltretirati kad postoje ovakve stvari: http://www.softpedia.com/get/Tweak/Network-Tweak/WinSockFix.shtml

[ kristi1 @ 02.01.2009. 16:51 ] @

Da si citao celu temu video bi da smo vec radili resetovanje sa WinsockFix-om

[ rime1 @ 02.01.2009. 16:54 ] @

On nije hteo da ih izbrise pa sam morao rucno

"J" - 2009-01-02 17:38:38 Service Pack 3
ComboFix 07-05.27.BV - Running from: "C:\Documents and Settings\J\"
Command switches used :: ""C:\Documents and Settings\J\Desktop\CFScript.txt""

((((((((((((((((((((((((((((((( Files Created from 2008-12-02 to 2009-01-02 ))))))))))))))))))))))))))))))))))

2009-01-02 16:21 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Avg8
2009-01-02 12:33 <DIR> d-------- C:\Program Files\AVG
2009-01-02 11:32 268,648 --a------ C:\WINDOWS\system32\mucltui.dll
2009-01-01 21:25 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2009-01-01 13:57 <DIR> d-------- C:\DOCUME~1\J\APPLIC~1\Thinstall
2008-12-31 17:08 38,496 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-12-31 17:08 15,504 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-12-31 16:45 49,152 --a------ C:\WINDOWS\nircmd.exe
2008-12-31 12:44 208,744 --a------ C:\WINDOWS\system32\muweb.dll
2008-12-30 19:34 <DIR> d-------- C:\Program Files\ChromePortable
2008-12-30 18:51 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater
2008-12-29 19:08 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Applications
2008-12-28 20:04 <DIR> d-------- C:\Program Files\Eidos Interactive
2008-12-25 18:11 <DIR> d-------- C:\Documents and Settings\J\Tracing
2008-12-25 18:11 <DIR> d-------- C:\DOCUME~1\J\Tracing
2008-12-25 17:56 <DIR> d-------- C:\Program Files\Microsoft Office Outlook Connector
2008-12-25 17:51 <DIR> d-------- C:\Program Files\Windows Live SkyDrive
2008-12-25 17:24 <DIR> d-------- C:\Program Files\Common Files\Windows Live
2008-12-24 19:02 <DIR> d-------- C:\Games
2008-12-18 13:13 <DIR> d-------- C:\WINDOWS\ie8updates
2008-12-16 17:36 <DIR> d-------- C:\Program Files\Voice Changer 4.0 Diamond
2008-12-14 14:34 1,700,352 --a------ C:\WINDOWS\system32\gdiplus.dll
2008-12-11 18:16 16,252,928 --a------ C:\Documents and Settings\J\ntuser.dat
2008-12-11 18:16 16,252,928 --a------ C:\DOCUME~1\J\ntuser.dat
2008-12-08 15:41 <DIR> d-------- C:\Program Files\Microsoft Games for Windows - LIVE
2008-12-08 15:04 <DIR> d-------- C:\Program Files\Rockstar Games
2008-12-07 21:34 <DIR> d-------- C:\Program Files\RapidCheck
2008-12-02 22:37 49,480 --a------ C:\WINDOWS\system32\sirenacm.dll
2008-12-02 20:15 <DIR> d-------- C:\Program Files\titca
2008-12-02 17:05 <DIR> d-------- C:\Program Files\Uniblue
2008-12-02 16:49 <DIR> d-------- C:\DOCUME~1\J\APPLIC~1\Uniblue

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2009-01-01 19:09:04 -------- d-----w C:\Program Files\wLite
2009-01-01 19:05:31 -------- d-----w C:\DOCUME~1\J\APPLIC~1\Google
2009-01-01 12:55:27 -------- d-----w C:\DOCUME~1\J\APPLIC~1\Spy Emergency
2008-12-31 15:33:05 -------- d-----w C:\Program Files\Skype
2008-12-30 17:51:51 -------- d-----w C:\Program Files\Google
2008-12-30 16:18:27 -------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-12-29 18:19:33 -------- d-----w C:\Program Files\Microsoft Games
2008-12-25 16:54:34 -------- d-----w C:\Program Files\Windows Live
2008-12-24 16:42:07 -------- d-----w C:\Program Files\Illusion
2008-12-24 16:38:36 -------- d-----w C:\Program Files\DNA
2008-12-20 16:29:39 -------- d-----w C:\Program Files\PuppetMaster
2008-12-11 13:39:27 -------- d-----w C:\Program Files\Latinski Recnik 1.1
2008-12-08 14:06:05 -------- d--h--w C:\Program Files\InstallShield Installation Information
2008-12-04 13:56:11 410,984 ----a-w C:\WINDOWS\system32\deploytk.dll
2008-12-01 14:26:37 -------- d-----w C:\Program Files\SystemRequirementsLab
2008-11-28 15:51:09 -------- d-----w C:\Program Files\Siber Systems
2008-11-24 15:22:37 10 ----a-w C:\WINDOWS\popcinfo.dat
2008-11-23 14:18:22 -------- d-----w C:\Program Files\Njegos »Gorski vijenac«
2008-11-22 20:30:24 -------- d-----w C:\Program Files\mIRC
2008-11-22 17:30:16 -------- d-----w C:\DOCUME~1\J\APPLIC~1\SystemRequirementsLab
2008-11-21 19:56:01 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-11-15 18:20:52 -------- d-----w C:\DOCUME~1\J\APPLIC~1\PC Suite
2008-11-14 13:03:46 -------- d-----w C:\DOCUME~1\J\APPLIC~1\Skype
2008-11-14 13:00:33 -------- d-----w C:\DOCUME~1\J\APPLIC~1\skypePM
2008-11-12 13:20:35 -------- d-----w C:\Program Files\Mafia-WinterEdition
2008-11-12 12:44:54 -------- d-----w C:\Program Files\MSXML 4.0
2008-11-08 14:11:21 -------- d-----w C:\Program Files\Common Files\Skype
2008-10-23 12:36:14 286,720 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-10-22 04:29:02 14,303,392 ----a-w C:\WINDOWS\system32\xlive.dll
2008-10-22 04:29:02 13,643,936 ----a-w C:\WINDOWS\system32\xlivefnt.dll
2008-10-16 13:13:40 202,776 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-10-16 13:13:40 1,809,944 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-10-16 13:12:22 323,608 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-10-16 13:12:20 561,688 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-10-16 13:09:44 92,696 ----a-w C:\WINDOWS\system32\cdm.dll
2008-10-16 13:09:44 51,224 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-10-16 13:09:44 43,544 ----a-w C:\WINDOWS\system32\wups2.dll
2008-10-16 13:08:58 34,328 ----a-w C:\WINDOWS\system32\wups.dll
2008-10-13 18:05:29 356,352 ----a-w C:\WINDOWS\eSellerateEngine.dll
2008-10-10 03:52:38 452,440 ----a-w C:\WINDOWS\system32\d3dx10_40.dll
2008-10-10 03:52:38 4,379,984 ----a-w C:\WINDOWS\system32\D3DX9_40.dll
2008-10-10 03:52:38 2,036,576 ----a-w C:\WINDOWS\system32\D3DCompiler_40.dll
2008-10-03 10:02:42 247,326 ----a-w C:\WINDOWS\system32\strmdll.dll
2008-08-02 23:14:27 5,852 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{3049C3E9-B461-4BC5-8870-4C09146192CA}=C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2008-08-18 13:30]
{72853161-30C5-4D22-B7F9-0BBC1D38A37E}=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2007-08-24 07:01]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre6\bin\ssv.dll [2008-12-04 14:56]
{9030D464-4C02-4ABF-8ECC-5164760863C6}=C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2008-11-18 13:47]
{AA58ED58-01DD-4d91-8333-CF10577473F7}=C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2008-12-30 18:42]
{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}=C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll [2008-12-30 18:42]
{DBC80044-A445-435b-BC74-9C25C1C588A9}=C:\Program Files\Java\jre6\bin\jp2ssv.dll [2008-12-04 14:56]
{E7E6F031-17CE-4C07-BC86-EABFE594F69C}=C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2008-12-04 14:56]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 01:12]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2008-12-02 22:41]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"LinkResolveIgnoreLinkInfo"=0 (0x0)
"NoResolveSearch"=1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoLowDiskSpaceChecks"=1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"="C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [2007-08-24 07:01]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"="C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 21:19]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
%SystemRoot%\System32\dimsntfy.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages msv1_0 C:\WINDOWS\system32\mlJDtrPg

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Media Key.lnk]
backup=C:\WINDOWS\pss\Media Key.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk]
backup=C:\WINDOWS\pss\Windows Search.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\^.rnd]
path=\.rnd

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\^default.pls]
path=\default.pls

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\^ntuser.dat]
path=\ntuser.dat

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\^ntuser.dat.LOG]
path=\ntuser.dat.LOG

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\^ntuser.ini]
path=\ntuser.ini

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\90208]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\9c147f9a]
rundll32.exe "C:\WINDOWS\system32\rdftlkap.dll",b

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AntamediaBandwidth]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BigDogPath323Domino]
C:\WINDOWS\Domino.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BigDogPath323VMSnap]
C:\WINDOWS\VMSnap23.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
"C:\Program Files\DNA\btdna.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Caffe-Server]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FreeCall]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
"C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
%systemroot%\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
"C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nokia.PCSync]
"C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe" /NoDialog

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OrderReminder]
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RamBooster]
C:\Program Files\RamBooster 2.0\Rambooster.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RapidCheck]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
"C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RGSC]
C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoftickPPP]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpyEmergency]
"C:\Program Files\NETGATE\Spy Emergency 2008\SpyEmergency.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ThePrivacyGuard]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue RegistryBooster 2]
C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMUAgent.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs BthServ
eapsvcs eaphost
dot3svc dot3svc

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs*
napagent

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{059d64d4-d379-11dd-803b-0018f3ea3f39}]
AutoRun\command- H:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\Rgmen.exe
open\command- H:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\Rgmen.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{08a941f0-6634-11dd-bf14-0018f3ea3f39}]
Auto\command- H:\Start.exe
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Start.exe
explore\Command- H:\gg.exe 0e
open\Command- H:\gg.exe 0o

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{220dba5a-71ea-11dd-bf54-0018f3ea3f39}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe killVBS.vbs

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3a9a04b8-4bea-11dc-9917-0018f3ea3f39}]
Auto\command- G:\RavMonE.exe e
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RavMonE.exe e

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ce3ecb5c-6857-11dc-9995-0018f3ea3f39}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe killVBS.vbs

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e86b5a62-4be3-11dc-9914-0018f3ea3f39}]
Auto\command- RavMonE.exe e
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RavMonE.exe e

Contents of the 'Scheduled Tasks' folder
2009-01-02 15:55:23 C:\WINDOWS\tasks\User_Feed_Synchronization-{132907F2-D634-4C67-9942-44DF435096B5}.job

********************************************************************

catchme 0.3.692 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-02 17:43:50
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

disk error: C:\WINDOWS\

please note that you need administrator rights to perform deep scan

********************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet005\Services\JavaQuickStarterService]
"ImagePath"="\"C:\Program Files\Java\jre6\bin\jqs.exe\" -service -config \"C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf\""

[HKEY_LOCAL_MACHINE\system\ControlSet005\Services\BTHPORT\Parameters\Services\{00001000-0000-1000-8000-00805f9b34fb}]

[HKEY_LOCAL_MACHINE\system\ControlSet005\Services\TDSSserv.sys]
"imagepath"="\systemroot\system32\drivers\TDSSpqlt.sys"

Completion time: 2009-01-02 17:45:28
C:\ComboFix-quarantined-files.txt ... 2009-01-02 17:44
C:\ComboFix2.txt ... 2009-01-02 13:57
C:\ComboFix3.txt ... 2009-01-02 13:48

--- E O F ---

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:54:32, on 2.1.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\iolo\common\lib\ioloServiceManager.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\PSIService.exe
C:\Program Files\Thoosje Vista Sidebar\Thoosje Sidebar.exe
C:\Program Files\NETGATE\Spy Emergency 2008\SpyEmergencySrv.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\titca\titca\titca.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.rs/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - Startup: Thoosje Sidebar.lnk = C:\Program Files\Thoosje Vista Sidebar\Thoosje Sidebar.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: DAGP - Unknown owner - C:\DOCUME~1\J\LOCALS~1\Temp\DAGP.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: GWIZPWKDY - Unknown owner - C:\DOCUME~1\J\LOCALS~1\Temp\GWIZPWKDY.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iolo FileInfoList Service (ioloFileInfoList) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe
O23 - Service: iolo Product Update Service (ioloProductUpdate) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe
O23 - Service: iolo System Service (ioloSystemService) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: KJYXJSM - Unknown owner - C:\DOCUME~1\J\LOCALS~1\Temp\KJYXJSM.exe (file missing)
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Spy Emergency Engine Service (SpyEmrgSrv) - NETGATE Technologies s.r.o. - C:\Program Files\NETGATE\Spy Emergency 2008\SpyEmergencySrv.exe
O23 - Service: TZZ - Unknown owner - C:\DOCUME~1\J\LOCALS~1\Temp\TZZ.exe (file missing)

--
End of file - 6653 bytes

[ kristi1 @ 02.01.2009. 17:16 ] @

Kako si izbrisao rucno, ponovo su tu kao da nista nismo radili. Kazi mi da li si skinuo novi ComboFix ili radis sa starom vezrijom.
Ovaj CF log je potpuno isti kao i onaj prethodni, sto nikako ne moze da bude ako si uradio kako sam ti napisao.
U HJT logu su se pojavili neki servisi kojih nije bilo u prethodnom logu pa cemo probati da ih obrisemo sa HJT-om.

GWIZPWKDY
KJYXJSM
TZZ

Pokreni HijackThis "Do a system scan only" Klikni Config, pa Misc Tools, i onda klikni na Delete an NT service.. dugme.
Kada se otvori unesi ime servisa i kliknite OK. Imena su ti gore iznad.

[ rime1 @ 02.01.2009. 17:24 ] @

Ne znam koja je verzija jer ga nisam skinuo sa njihovog sajta posto mi ne dozvoljava a i morao sam da mu promenim ime da bi radio u Bokabom.exe(i ikonica mije drugacija nacrtan je znak X)

_{[Ovu poruku je menjao rime1 dana 02.01.2009. u 19:09 GMT+1]}

[ rime1 @ 02.01.2009. 18:09 ] @

Ova dva sam izbrisao GWIZPWKDY TZZ
a ovaj KJYXJSM sam disable-ovo preko services.msc jer kaze da ga nema u registru

[ rime1 @ 02.01.2009. 18:31 ] @

Izgleda da za mene nema resenja osim reinstalacije sistema,hvala na trudu svima posebno tebi @kristi1
@magna86 da to sam ja reko mozda oni imaju resenja ali...

[ kristi1 @ 02.01.2009. 19:17 ] @

Ne znam sta da ti kazem, imao sam volju ali problem je sto ne mozemo da pokrenemo ni jedan alat, a pitanje je i taj CF koja je verzija, znaci za svako pokretanje tog alata potrebana je najnovija verzija. Hosts file je ok tako da nije do toga, a ne pada mi trenutno ni jedna ideja na pamet.
Uradi jos ovo Start/ run Combofix/ u pa ok
i sacekaj da se deinstalira Combofix. i pocisti temp fajlove sa Registry disk Cleaner-om

[ rime1 @ 02.01.2009. 19:46 ] @

Start/ run Combofix/ u ,nece da pokrene

[ kristi1 @ 02.01.2009. 19:54 ] @

ako si tako napisao nije dobro moras da ostavis razmak izmedju combofix i /, ovako Combofix /u
Bila je moja greska, nisam primetio

Skini ova dva programa pa malo pocisti komp, skini free verzije http://www.wisecleaner.com/download.html

[ rime1 @ 02.01.2009. 20:11 ] @

Konacno,prcoces svchost.exe kada nje ga iskjucim dobijem pristup internetu na google chromu koji mi je blokiran od kako sam dobio ovaj virus,ali kad njega iskjucim ukjuci se ono odbrojavanje od 1 min do restarta sistema

Note: svchost.exe is a process registered as a backdoor vulnerability which may be installed for malicious purposes by an attacker allowing access to your computer from remote locations, stealing passwords, Internet banking and personal data. If unaccounted for, this process should be removed immediately.

Note: svchost.exe is a process which is registered as a trojan. This Trojan allows attackers to access your computer from remote locations, stealing passwords, Internet banking and personal data. This process is a security risk and should be removed from your system.

Note: svchost.exe is a process belonging to Microsoft Service Host Process. This could also be a stealth monitoring software that sits in the background and tracks all activities such as keyboard input (including websites visited, passwords etc.) This information can be sent to third parties through email or ftp uploads. If you did not intentionally install this program make sure you remove it to protect your privacy.

[ rime1 @ 02.01.2009. 20:31 ] @

evo ih lokacije na kojima se nalaze 6 svchost.exe fajlova

Code:
C:\WINDOWS\$NtServicePackUninstall$\svchost.exe
C:\WINDOWS\Prefetch\SVCHOST.EXE-3530F672.pf
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ServicePackFiles\i386\svchost.exe
C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe.config

[ kristi1 @ 02.01.2009. 20:48 ] @

C:\WINDOWS\Prefetch\SVCHOST.EXE-3530F672.pf

Ovaj mozes da brises, ovo ostalo nemoj.

[ rime1 @ 02.01.2009. 21:06 ] @

izbrisao sam isve ove osim ovaj i system32 ali ga i dalje podize negde kada iskljucim sve svchost.exe u procesima hoce da se poveze na internet ali ostanu dva jedan sa usrname-om networkservice a drugi system ali mi restartuje kompjuter

[ Goran Mijailovic @ 02.01.2009. 23:16 ] @

Citat:

catchme 0.3.692 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-02 17:43:50
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

disk error: C:\WINDOWS\

please note that you need administrator rights to perform deep scan

Hm, rootkit? mozda..

probaj da skeniras sa Blacklightom, zakacicu ga uz ovu poruku.

***
nazalost morao sam da ga rarujem da bih mogao da ga uploadujem, zbog velicine fajla.

_{[Ovu poruku je menjao Goran Mijailovic dana 03.01.2009. u 00:48 GMT+1]}

[ rime1 @ 03.01.2009. 15:27 ] @

Nista nije pronasao

[ magna86 @ 03.01.2009. 15:33 ] @

a jel moze tebi net da radi iz safe moda with network?
aj probaj

[ rime1 @ 03.01.2009. 20:03 ] @

Nece jer se virus pokrece i u safe modu zajedno sa svchostom

[ kristi1 @ 03.01.2009. 20:28 ] @

http://rapidshare.com/files/179470820/E-S.zip.html

Ajde skini Combofix odavde, iskljuci AV i pokreni ga pa postavi log da pogledam jos jednom. Onaj log mi je bio cudan.

[ rime1 @ 03.01.2009. 21:30 ] @

To je to,problem je konacno resen evo log
i moze li savet za neki av,jer ovaj nod ocito ne valja

ComboFix 09-01-02.01 - J 2009-01-03 22:14:54.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1250.1.1033.18.2047.1579 [GMT 1:00]
Running from: c:\documents and settings\J\Local Settings\Temp\wza21f\E-S.exe

[COLOR=RED][B]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/B][/COLOR]
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\J\Application Data\sysFiles00.dll
c:\windows\system32\drivers\TDSSpqlt.sys
c:\windows\system32\gPrtDJlm.ini
c:\windows\system32\gPrtDJlm.ini2
c:\windows\system32\pakltfdr.ini
c:\windows\system32\TDSSbrsr.dll
c:\windows\system32\TDSSlxwp.dll
c:\windows\system32\TDSSnmxh.log
c:\windows\system32\TDSSoiqh.dll
c:\windows\system32\TDSSorvd.dat
c:\windows\system32\TDSSrhym.log
c:\windows\system32\TDSSriqp.dll
c:\windows\system32\TDSSsihc.dll
c:\windows\system32\TDSStkdu.log
c:\windows\system32\TDSSxfum.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_TDSSserv.sys
-------\Legacy_TDSSserv.sys

((((((((((((((((((((((((( Files Created from 2008-12-03 to 2009-01-03 )))))))))))))))))))))))))))))))
.

2009-01-02 21:17 . 2009-01-02 21:23 <DIR> d-------- c:\program files\Wise Disk Cleaner 3 Pro
2009-01-02 21:15 . 2009-01-02 21:17 <DIR> d-------- c:\program files\Wise Registry Cleaner 3 Pro
2009-01-02 11:32 . 2008-10-16 14:06 268,648 --a------ c:\windows\system32\mucltui.dll
2009-01-02 11:32 . 2008-10-16 14:06 27,496 --a------ c:\windows\system32\mucltui.dll.mui
2009-01-01 13:57 . 2009-01-01 13:57 <DIR> d-------- c:\documents and settings\J\Application Data\Thinstall
2008-12-31 12:44 . 2008-10-16 14:06 208,744 --a------ c:\windows\system32\muweb.dll
2008-12-30 19:34 . 2008-12-30 19:34 <DIR> d-------- c:\program files\ChromePortable
2008-12-30 18:51 . 2008-12-30 19:51 <DIR> d-------- c:\documents and settings\All Users\Application Data\Google Updater
2008-12-30 17:47 . 2008-12-30 17:47 54,156 --ah----- c:\windows\QTFont.qfn
2008-12-30 17:47 . 2008-12-30 17:47 1,409 --a------ c:\windows\QTFont.for
2008-12-29 19:08 . 2008-12-29 19:08 <DIR> d-------- c:\documents and settings\All Users\Application Data\Applications
2008-12-28 20:04 . 2008-12-28 20:04 <DIR> d-------- c:\program files\Eidos Interactive
2008-12-26 20:28 . 2008-12-26 20:28 1,315 --a------ c:\windows\jphdw_m16.ini
2008-12-25 18:11 . 2009-01-03 22:22 <DIR> d-------- c:\documents and settings\J\Tracing
2008-12-25 17:56 . 2008-12-25 17:56 <DIR> d-------- c:\program files\Microsoft Office Outlook Connector
2008-12-25 17:51 . 2008-12-25 17:51 <DIR> d-------- c:\program files\Windows Live SkyDrive
2008-12-25 17:51 . 2008-12-25 17:51 <DIR> d-------- c:\program files\Microsoft
2008-12-25 17:24 . 2008-12-25 17:24 <DIR> d-------- c:\program files\Common Files\Windows Live
2008-12-24 19:02 . 2008-12-24 19:02 <DIR> d-------- C:\Games
2008-12-18 13:13 . 2008-12-18 13:13 <DIR> d-------- c:\windows\ie8updates
2008-12-16 17:36 . 2007-05-27 00:50 <DIR> d-------- c:\program files\Voice Changer 4.0 Diamond
2008-12-14 14:34 . 2008-12-14 14:34 1,700,352 --a------ c:\windows\system32\gdiplus.dll
2008-12-08 15:41 . 2008-12-08 15:41 <DIR> d-------- c:\program files\Microsoft Games for Windows - LIVE
2008-12-08 15:04 . 2008-12-08 15:06 <DIR> d-------- c:\program files\Rockstar Games
2008-12-07 21:34 . 2008-12-24 17:39 <DIR> d-------- c:\program files\RapidCheck
2008-12-04 14:56 . 2008-12-04 14:56 <DIR> d-------- c:\program files\Java
2008-12-04 14:56 . 2008-12-04 14:56 73,728 --a------ c:\windows\system32\javacpl.cpl
2008-12-04 14:55 . 2008-12-04 14:55 0 --a------ c:\windows\system32\REN584.tmp
2008-12-04 14:55 . 2008-12-04 14:55 0 --a------ c:\windows\system32\REN583.tmp
2008-12-04 14:55 . 2008-12-04 14:55 0 --a------ c:\windows\system32\REN582.tmp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-01 19:09 --------- d-----w c:\program files\wLite
2009-01-01 19:07 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-01-01 12:55 --------- d-----w c:\documents and settings\J\Application Data\Spy Emergency
2008-12-31 15:33 --------- d-----w c:\program files\Skype
2008-12-30 17:51 --------- d-----w c:\program files\Google
2008-12-30 16:18 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-12-29 18:19 --------- d-----w c:\program files\Microsoft Games
2008-12-25 16:54 --------- d-----w c:\program files\Windows Live
2008-12-24 16:42 --------- d-----w c:\program files\Illusion
2008-12-24 16:38 --------- d-----w c:\program files\DNA
2008-12-20 16:29 --------- d-----w c:\program files\PuppetMaster
2008-12-20 11:49 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2008-12-11 13:39 --------- d-----w c:\program files\Latinski Recnik 1.1
2008-12-08 14:06 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-03 19:31 --------- d-----w c:\program files\titca
2008-12-02 16:05 --------- d-----w c:\program files\Uniblue
2008-12-02 15:49 --------- d-----w c:\documents and settings\J\Application Data\Uniblue
2008-12-01 14:26 --------- d-----w c:\program files\SystemRequirementsLab
2008-11-28 15:52 --------- d-----w c:\documents and settings\All Users\Application Data\RoboForm
2008-11-28 15:51 --------- d-----w c:\program files\Siber Systems
2008-11-23 14:18 --------- d-----w c:\program files\Njegos »Gorski vijenac«
2008-11-22 20:30 --------- d-----w c:\program files\mIRC
2008-11-22 17:30 --------- d-----w c:\documents and settings\J\Application Data\SystemRequirementsLab
2008-11-15 18:20 --------- d-----w c:\documents and settings\J\Application Data\PC Suite
2008-11-14 13:03 --------- d-----w c:\documents and settings\J\Application Data\Skype
2008-11-14 13:00 --------- d-----w c:\documents and settings\J\Application Data\skypePM
2008-11-12 13:20 --------- d-----w c:\program files\Mafia-WinterEdition
2008-11-12 12:44 --------- d-----w c:\program files\MSXML 4.0
2008-11-08 14:11 --------- d-----w c:\program files\Common Files\Skype
2008-11-08 14:11 --------- d-----w c:\documents and settings\All Users\Application Data\Skype
2008-10-13 18:05 356,352 ----a-w c:\windows\eSellerateEngine.dll
2008-02-22 11:37 472 ----a-w c:\program files\setup.reg
2008-02-08 09:03 30,529,024 ----a-w c:\program files\kav.en.msi
2008-02-04 20:36 22,328 ----a-w c:\documents and settings\J\Application Data\PnkBstrK.sys
2007-10-02 05:08 411,248 ----a-w c:\program files\FLV PlayerRCSetup.exe
2004-07-22 08:51 3,432,656 ----a-w c:\program files\ManagedDX.CAB
2004-07-19 20:58 1,156,363 ----a-w c:\program files\BDANT.cab
2004-07-19 20:53 976,020 ----a-w c:\program files\BDAXP.cab
2004-07-09 12:17 13,265,040 ----a-w c:\program files\dxnt.cab
2004-07-09 07:13 703,080 ----a-w c:\program files\BDA.cab
2004-07-09 07:13 15,493,481 ----a-w c:\program files\DirectX.cab
2004-07-09 02:08 472,576 ----a-w c:\program files\dxsetup.exe
2004-07-09 02:08 2,242,560 ----a-w c:\program files\dsetup32.dll
2004-07-09 01:03 62,976 ----a-w c:\program files\DSETUP.dll
2008-08-02 23:14 5,852 --sha-w c:\windows\system32\KGyGaAvL.sys
2008-07-03 13:07 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008070320080704\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2008-12-02 3882312]

c:\documents and settings\J\Start Menu\Programs\u.rar\
Thoosje Sidebar.lnk - c:\program files\Thoosje Vista Sidebar\Thoosje Sidebar.exe [2008-08-18 605696]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.SP54"= SP5X_32.DLL
"VIDC.SP55"= SP5X_32.DLL
"VIDC.SP56"= SP5X_32.DLL
"VIDC.SP57"= SP5X_32.DLL
"VIDC.SP58"= SP5X_32.DLL

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0sremcon.exe\0autocheck smrgdf c:\documents and settings\J\Application Data\iolo\\0lsdelete

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Media Key.lnk]
backup=c:\windows\pss\Media Key.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk]
backup=c:\windows\pss\Windows Search.lnkCommon Startup

[HKLM\~\startupfolder\^.rnd]
path=\.rnd

[HKLM\~\startupfolder\^default.pls]
path=\default.pls

[HKLM\~\startupfolder\^ntuser.dat]
path=\ntuser.dat

[HKLM\~\startupfolder\^ntuser.dat.LOG]
path=\ntuser.dat.LOG

[HKLM\~\startupfolder\^ntuser.ini]
path=\ntuser.ini
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\90208
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AntamediaBandwidth
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BigDogPath323Domino
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Caffe-Server
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FreeCall
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RapidCheck
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoftickPPP
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ThePrivacyGuard
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BigDogPath323VMSnap]
--a------ 2006-09-19 14:26 212992 c:\windows\VMSnap23.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
--a------ 2008-10-05 16:24 289088 c:\program files\DNA\btdna.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
--a------ 2007-08-24 07:00 33648 c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
--a------ 2006-11-13 12:39 1289000 c:\program files\Microsoft ActiveSync\wcescomm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2008-04-14 01:12 1695232 c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
--a------ 2008-12-02 22:41 3882312 c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
--a------ 2008-02-18 15:29 2221352 c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2008-02-28 08:59 570664 c:\program files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nokia.PCSync]
--a------ 2008-06-17 16:00 1249280 c:\program files\Nokia\Nokia PC Suite 7\PcSync2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OrderReminder]
-ra------ 2006-01-30 17:00 98304 c:\program files\Hewlett-Packard\OrderReminder\OrderReminder.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-03-28 22:37 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RamBooster]
--a------ 2005-11-17 07:32 561664 c:\program files\RamBooster 2.0\Rambooster.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--a------ 2004-11-02 20:24 32768 c:\program files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RGSC]
--a------ 2008-12-13 20:15 306088 c:\program files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpyEmergency]
--a------ 2008-05-01 14:14 2071096 c:\program files\NETGATE\Spy Emergency 2008\SpyEmergency.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-08-18 13:29 185896 c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue RegistryBooster 2]
--a------ 2008-05-05 12:22 1923352 c:\program files\Uniblue\RegistryBooster 2\RegistryBooster.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\system32\drivers\sfdrv01a.sys [2006-07-05 63352]
R1 kbfilter;Keyboard Filter Driver;c:\windows\system32\drivers\kbfilter.sys [2007-08-19 12856]
R1 NDISAH;NDISAH;c:\windows\system32\drivers\ndisah.sys [2008-09-27 19584]
R1 SpyEmrg;Spy Emergency Driver;c:\windows\system32\drivers\spyemrg.sys [2008-05-17 12344]
R1 UsbFltr;WayTechUSBFilterDriver;c:\windows\system32\drivers\UsbFltr.sys [2007-08-19 8576]
R3 vmfilter323;323 filter service, Normal;c:\windows\system32\drivers\vmfilter323.sys [2007-08-16 420480]
R3 ZSMC326;Vimicro USB2.0 PC Camera(VC0323);c:\windows\system32\drivers\usbvm323.sys [2008-01-22 260608]
R4 ioloFileInfoList;iolo FileInfoList Service;c:\program files\iolo\Common\Lib\ioloServiceManager.exe [2008-03-14 578408]
R4 ioloSystemService;iolo System Service;c:\program files\iolo\Common\Lib\ioloServiceManager.exe [2008-03-14 578408]
R4 SpyEmrgSrv;Spy Emergency Engine Service;c:\program files\NETGATE\Spy Emergency 2008\SpyEmergencySrv.exe [2008-05-17 694840]
S0 MFX;MFX; [x]
S3 DAGP;DAGP; [x]
S3 fsbl-standalone;F-Secure BlackLight Beta Engine Driver;\??\c:\docume~1\J\LOCALS~1\Temp\F-Secure\BlackLight\fsbldrv.sys --> c:\docume~1\J\LOCALS~1\Temp\F-Secure\BlackLight\fsbldrv.sys [?]
S3 mpr_freader;MPR FileReader Driver;\??\c:\docume~1\J\LOCALS~1\Temp\RarSFX0\mpr_freader.sys --> c:\docume~1\J\LOCALS~1\Temp\RarSFX0\mpr_freader.sys [?]
S3 SpyEmrgGuard;Spy Emergency Real-Time Shield Driver;c:\windows\system32\drivers\spyemrg_guard.sys [2008-05-17 14392]
S3 USBCamera;Icatch(IV) Still Camera Device;c:\windows\system32\drivers\Bulk533.sys [2008-09-28 10986]
S4 Ca533av;Icatch(IV) Video Camera Device;c:\windows\system32\drivers\Ca533av.sys [2008-09-28 515803]
S4 ioloProductUpdate;iolo Product Update Service;c:\program files\iolo\Common\Lib\ioloServiceManager.exe [2008-03-14 578408]
S4 KJYXJSM;KJYXJSM; [x]
S4 Webcam Corp. Service Starter;Webcam Corp. Service Starter;c:\program files\Webcam\Webcam123\dogsvc.exe --> c:\program files\Webcam\Webcam123\dogsvc.exe [?]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{220dba5a-71ea-11dd-bf54-0018f3ea3f39}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe killVBS.vbs

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ce3ecb5c-6857-11dc-9995-0018f3ea3f39}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe killVBS.vbs
.
Contents of the 'Scheduled Tasks' folder

2009-01-03 c:\windows\Tasks\User_Feed_Synchronization-{132907F2-D634-4C67-9942-44DF435096B5}.job
- c:\windows\system32\msfeedssync.exe [2008-08-22 02:05]
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-9c147f9a - c:\windows\system32\rdftlkap.dll
MSConfigStartUp-WMUAgent - (no file)

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.rs/
uSearchMigratedDefaultUrl = hxxp://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZR&fl=0&ptb=FxQDV6NJmNITE9Cif4c9qA&url=http://edits.mywebsearch.com/toolbaredits/barsearch.jhtml&st=sb&searchfor={searchTerms}
mStart Page = about:blank
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: Download ALL with IDA
IE: Download with IDA
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

O16 -: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\J\Application Data\Mozilla\Firefox\Profiles\w92mhjlz.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.startup.homepage - hxxp://www.google.rs
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr=vmn&type=vendio&p=
FF - plugin: c:\program files\Google\Google Updater\2.4.1439.6872\npCIDetect13.dll
FF - plugin: c:\program files\Microsoft Silverlight\2.0.30523.8\npctrl.dll
FF - plugin: c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.1.0.30401.0.dll
FF - plugin: c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
.
.
------- File Associations -------
.
JSEFile=NOTEPAD.EXE %1
VBEFile=NOTEPAD.EXE %1
VBSFile=NOTEPAD.EXE %1
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-03 22:22:03
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-854245398-706699826-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Electronic Arts\H*NULL*a*NULL*r*NULL*r*NULL*y*NULL* *NULL*P*NULL*o*NULL*t*NULL*t*NULL*e*NULL*r*NULL* *NULL*a*NULL*n*NULL*d*NULL* *NULL*t*NULL*h*NULL*e*NULL* *NULL*O*NULL*r*NULL*d*NULL*e*NULL*r*NULL* *NULL*o*NULL*f*NULL* *NULL*t*NULL*h*NULL*e*NULL* *NULL*P*NULL*h*NULL*o*NULL*e*NULL*n*NULL*i*NULL*x*NULL*"!]
"Order"=hex:08,00,00,00,02,00,00,00,ce,03,00,00,01,00,00,00,06,00,00,00,98,00,\
00,00,00,00,00,00,8a,00,00,00,41,75,67,4d,02,00,00,00,01,00,00,00,78,00,32,\
00,32,00,00,00,8c,38,51,8b,20,00,45,4c,45,43,54,52,7e,31,2e,55,52,4c,00,00,\
4e,00,03,00,04,00,ef,be,8c,38,51,8b,08,39,5c,a4,14,00,00,00,45,00,6c,00,65,\
00,63,00,74,00,72,00,6f,00,6e,00,69,00,63,00,20,00,52,00,65,00,67,00,69,00,\
73,00,74,00,72,00,61,00,74,00,69,00,6f,00,6e,00,2e,00,75,00,72,00,6c,00,00,\
00,1c,00,0e,00,00,00,0a,00,ef,be,00,00,00,00,1c,00,00,00,00,00,00,00,00,00,\
be,00,00,00,01,00,00,00,b0,00,00,00,41,75,67,4d,02,00,00,00,01,00,00,00,9e,\
00,32,00,39,08,00,00,8c,38,51,8b,20,00,48,41,52,52,59,50,7e,31,2e,4c,4e,4b,\
00,00,74,00,03,00,04,00,ef,be,8c,38,51,8b,08,39,5c,a4,14,00,00,00,48,00,61,\
00,72,00,72,00,79,00,20,00,50,00,6f,00,74,00,74,00,65,00,72,00,20,00,61,00,\
6e,00,64,00,20,00,74,00,68,00,65,00,20,00,4f,00,72,00,64,00,65,00,72,00,20,\
00,6f,00,66,00,20,00,74,00,68,00,65,00,20,00,50,00,68,00,6f,00,65,00,6e,00,\
69,00,78,00,22,21,2e,00,6c,00,6e,00,6b,00,00,00,1c,00,0e,00,00,00,0a,00,ef,\
be,00,00,00,00,1c,00,00,00,00,00,00,00,00,00,96,00,00,00,02,00,00,00,88,00,\
00,00,41,75,67,4d,02,00,00,00,01,00,00,00,76,00,32,00,37,04,00,00,8c,38,51,\
8b,20,00,4d,49,43,52,4f,53,7e,31,2e,4c,4e,4b,00,00,4c,00,03,00,04,00,ef,be,\
8c,38,51,8b,08,39,5c,a4,14,00,00,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,\
00,66,00,74,00,20,00,44,00,69,00,72,00,65,00,63,00,74,00,58,00,20,00,45,00,\
55,00,4c,00,41,00,2e,00,6c,00,6e,00,6b,00,00,00,1c,00,0e,00,00,00,0a,00,ef,\
be,00,00,00,00,1c,00,00,00,00,00,00,00,00,00,78,00,00,00,03,00,00,00,6a,00,\
00,00,41,75,67,4d,02,00,00,00,01,00,00,00,58,00,32,00,4b,04,00,00,8c,38,51,\
8b,20,00,52,45,41,44,4d,45,7e,31,2e,4c,4e,4b,00,00,2e,00,03,00,04,00,ef,be,\
8c,38,51,8b,08,39,5c,a4,14,00,00,00,52,00,65,00,61,00,64,00,20,00,4d,00,65,\
00,2e,00,6c,00,6e,00,6b,00,00,00,1c,00,0e,00,00,00,0a,00,ef,be,00,00,00,00,\
1c,00,00,00,00,00,00,00,00,00,8c,00,00,00,04,00,00,00,7e,00,00,00,41,75,67,\
4d,02,00,00,00,01,00,00,00,6c,00,32,00,79,05,00,00,8c,38,51,8b,20,00,54,45,\
43,48,4e,49,7e,31,2e,4c,4e,4b,00,00,42,00,03,00,04,00,ef,be,8c,38,51,8b,08,\
39,5c,a4,14,00,00,00,54,00,65,00,63,00,68,00,6e,00,69,00,63,00,61,00,6c,00,\
20,00,53,00,75,00,70,00,70,00,6f,00,72,00,74,00,2e,00,6c,00,6e,00,6b,00,00,\
00,1c,00,0e,00,00,00,0a,00,ef,be,00,00,00,00,1c,00,00,00,00,00,00,00,00,00,\
d2,00,00,00,05,00,00,00,c4,00,00,00,41,75,67,4d,02,00,00,00,01,00,00,00,b2,\
00,32,00,6c,08,00,00,8c,38,51,8b,20,00,55,4e,49,4e,53,54,7e,31,2e,4c,4e,4b,\
00,00,88,00,03,00,04,00,ef,be,8c,38,51,8b,08,39,5c,a4,14,00,00,00,55,00,6e,\
00,69,00,6e,00,73,00,74,00,61,00,6c,00,6c,00,20,00,48,00,61,00,72,00,72,00,\
79,00,20,00,50,00,6f,00,74,00,74,00,65,00,72,00,20,00,61,00,6e,00,64,00,20,\
00,74,00,68,00,65,00,20,00,4f,00,72,00,64,00,65,00,72,00,20,00,6f,00,66,00,\
20,00,74,00,68,00,65,00,20,00,50,00,68,00,6f,00,65,00,6e,00,69,00,78,00,22,\
21,2e,00,6c,00,6e,00,6b,00,00,00,1c,00,0e,00,00,00,0a,00,ef,be,00,00,00,00,\
1c,00,00,00,00,00,00,00,00,00

[HKEY_USERS\S-1-5-21-854245398-706699826-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{33D2BCAC-D8CD-7C15-7D6E-9FACCABFBE7E}*NULL*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"oaigbcmlfjemhihlkjbebonpcfcboo"=hex:6b,61,62,61,67,62,6b,62,65,65,6a,66,70,6c,\
61,64,67,65,68,6e,70,61,00,00
"naoldemhnmfcpobnocieijjpgagg"=hex:6b,61,62,61,6e,61,6c,63,70,62,6e,65,6e,6a,\
65,6e,6f,64,6a,6d,6c,70,00,00

[HKEY_USERS\S-1-5-21-854245398-706699826-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{57C36166-70FE-3C67-1019-08DAF9ABD357}*NULL*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"fajgffiojpod"=hex:66,61,6c,61,69,63,6b,64,67,6b,6c,6f,00,00

[HKEY_USERS\S-1-5-21-854245398-706699826-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{64DD45CF-09EE-7A4E-AEDF-8BF3633D3E5D}*NULL*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"haibciohbojgnffb"=hex:61,61,00,7c
"jaibciohbojgnffbmgoe"=hex:63,61,6a,64,67,65,00,7c
"paacdkghbkbfnjcgfggacgnnegejooni"=hex:64,61,6e,64,6a,70,61,6a,00,00

[HKEY_USERS\S-1-5-21-854245398-706699826-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{74994A84-DEEA-1D66-6253-E678E0142485}*NULL*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"aboccklpfmppekdofhmbaedacickmonjfj"=hex:62,62,61,65,6a,6c,66,6f,61,68,69,65,\
6f,63,66,69,64,64,6b,62,6a,62,62,62,67,6f,69,68,6d,61,6c,6c,6e,67,6d,6c,00,\
1f
"bboccklpfmppekdofhjbfgiabcohoipeddfb"=hex:61,62,66,65,62,6e,6a,65,6b,62,64,6b,\
61,6a,6c,6f,69,61,65,6d,65,6e,68,66,6c,67,6e,61,69,68,62,6a,64,61,00,6c

[HKEY_USERS\S-1-5-21-854245398-706699826-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{9E417608-86B4-BA6E-DF09-0DF38D92EB4D}*NULL*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-854245398-706699826-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{F1C3B509-B662-6634-645E-24E03CCD3F16}*NULL*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"hapmdcbcknilnbag"=hex:6f,61,65,6e,6b,6c,6f,6d,67,6b,6e,6b,61,6d,6f,70,64,68,\
6d,66,64,6b,6f,65,6a,63,6f,67,6f,6b,00,00
"hapmdcbcepcogefg"=hex:63,63,66,6b,69,66,70,68,68,67,6e,6e,67,62,64,64,6c,6a,\
63,67,62,61,6d,6d,6f,67,70,70,6b,70,63,6c,6f,62,61,65,65,62,6b,69,66,61,67,\
62,70,6b,61,6f,66,6f,6e,6e,63,6d,64,61,67,66,61,6f,6e,62,6b,62,67,62,6a,61,\
6d,69,00,00
"iadkcmfjjnbipanbhh"=hex:69,61,64,6a,62,6a,6f,67,67,68,6c,63,67,68,69,6f,62,61,\
00,00
"hanbagijpjiaefmn"=hex:69,61,64,6a,62,6a,6f,67,67,68,6c,63,67,68,69,6f,62,61,\
00,00

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{26ba0792-0985-4d80-8d59-e36016ecec97}]
@Denied: (Full) (Everyone)
"Model"=dword:0000011e
"Therad"=dword:0000001e
"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,\
38,95,44,85,b1,12,f9,90,dd,23,a1,49,8c,bf,1a,9d,fe,41,71,cb,3f,46,a4,7c,ab,\
3f,ce,a2,4b,39,29,d8,6e,56,96,16,73,9f,4f,94,a3,f7,89,46,8f,3c,f2,5c,68,ee,\
21,8c,c2,bc,f9,ea,af,0b,0d,1a,60,fd,e7,c1,34,ef,30,fa,b3,45,7c,c0,ca,18,a6,\
19,9c,8e,91,24,d4,cb,61,47,c6,bd,29,47,f3,bb,33,af,ab,cd,0e,56,2c,76,32,e7,\
38,2e,98,d8,aa,db,af,2e,07,98,4e,76,5f,ea,e7,0e,50,4c,a7,8c,27,9a,ce,f6,9b,\
39,12,86,d9,d9,be,35,22,f8,ac,98,55,74,7d,e3,5d,5f,fc,2c,79,70,66,b9,f0,43,\
56,ff,e4,48,eb,25,4d,90,ab,1b,0c,d4,9f,4c,45,27,90,f4,12,01,58,60,e7,75,b8,\
bd,9a,f1,4d,cb,f5,2e,74,78,3c,f7,95,2c,fd,f1,78,d9,1d,5a,42,49,8c,bf,1a,9d,\
fe,41,71,cb,3f,46,a4,7c,ab,3f,ce,c0,8f,d7,20,9f,15,65,be,a8,d9,c1,c4,0e,a9,\
32,a9,b8,eb,e4,7b,2e,a8,de,00

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):10,e5,1e,c2,35,2e,ad,24,f5,9a,81,4f,e6,b4,a9,dd,cd,b5,31,ac,84,\
f2,55,2f,af,ee,36,76,2f,af,22,a1,de,e3,95,27,fa,1d,9e,57,00,00,00,00,00,00,\
00,00,00,00

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F1C3B509-B662-6634-645E-24E03CCD3F16}\InProcServer32*NULL*]
"jabchlnhlpiejjcjdimp"=hex:69,61,64,6a,62,6a,6f,67,67,68,6c,63,67,68,69,6f,62,\
61,00,00
"iabcblenkjogbhjama"=hex:69,61,64,6a,62,6a,6f,67,67,68,6c,63,67,68,69,6f,62,61,\
00,00
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(612)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\windows\system32\IoctlSvc.exe
c:\windows\system32\PSIService.exe
.
**************************************************************************
.
Completion time: 2009-01-03 22:28:06 - machine was rebooted
ComboFix-quarantined-files.txt 2009-01-03 21:26:48
ComboFix2.txt 2009-01-02 16:45:28

Pre-Run: 56,207,564,800 bytes free
Post-Run: 56,250,466,304 bytes free

399 --- E O F --- 2008-12-18 12:14:07

[ kristi1 @ 03.01.2009. 21:47 ] @

Kazi mi kakva je sad situacija i da li mozes da skines recimo malwarebytes sa neta. I nemoj da ga pokreces samo vidi da li oce da skine.
I postavi mi svez HJT log.

edit:
Onaj CF sto si imao na kompu je bio iz 2007 godine.

[ rime1 @ 03.01.2009. 22:04 ] @

Skinuo sam ga i instalirao jer nisam video sta si napisao ali ga nisam pokrenuo,sada moze da otvara stranice koje ranije nije mogao a i google chrom radi,da skinem novi combofix

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:02:49, on 3.1.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\iolo\common\lib\ioloServiceManager.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\PSIService.exe
C:\Program Files\NETGATE\Spy Emergency 2008\SpyEmergencySrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Thoosje Vista Sidebar\Thoosje Sidebar.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\titca\titca\titca.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.rs/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - Startup: Thoosje Sidebar.lnk = C:\Program Files\Thoosje Vista Sidebar\Thoosje Sidebar.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iolo FileInfoList Service (ioloFileInfoList) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe
O23 - Service: iolo Product Update Service (ioloProductUpdate) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe
O23 - Service: iolo System Service (ioloSystemService) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Spy Emergency Engine Service (SpyEmrgSrv) - NETGATE Technologies s.r.o. - C:\Program Files\NETGATE\Spy Emergency 2008\SpyEmergencySrv.exe

--
End of file - 6700 bytes

[ kristi1 @ 03.01.2009. 22:13 ] @

Evo ovako, HJT log je odlican, samo ces deinstalirati Combofix
Start\Run\ Combofix /u ok. Ovo ce ti obrisati foldere CF i resetovati system restore.
Mozes da pokrenes malwarebytes za svaki slucaj cisto preventive radi.
Sto se tice antivirusa svako ce ti reci nesto drugo, a ja mogu da ti kazem sta ja koristim. Avast i Comodo Firewall.

[ rime1 @ 03.01.2009. 22:16 ] @

Nece da mi deinstalira combofix kucam Combofix /u ali mi kaze da ne moze da ga pronadze
malwarebytes mi je pronasao devet zarazenih kjuceva i ocistio ih

[ kristi1 @ 03.01.2009. 22:18 ] @

Obrisi ovaj folder C:\ComboFix.
Obriši folder C:\qoobox a zatim isključi pa ponovo uključi System Restore:

Ti si ga skinuo na desktop i stavio si ga u folder a folder si nazvao J i zato nece da se deinstalira automatski.

[ rime1 @ 03.01.2009. 22:21 ] @

kod mene se on zove QooBox

[ kristi1 @ 03.01.2009. 22:26 ] @

Pa da to je taj.

[ rime1 @ 05.01.2009. 10:33 ] @

Onaj virus jos uvek pokusava da se pokrene ponekoliko puta na dan ali ga avg detektuje i nedozvoljava mu da se pokrene ali ne moze da se izbrise oznacava ga kao trojanski konj BHO.GGC koji pokusava da se pokrene uz proces svchost.exe
a nalazi se na ovoj adresi C:\System Volume Information\_restore{29D0025D-3378-4AAF-ABB5-2522E76269F0}\RP362\A0239899.dll

[ kristi1 @ 05.01.2009. 15:15 ] @

@rime1 ajde molim te deinstaliraj taj AVG i instaliraj Avast, prilikom instalacije ce te pitati da skenira system pre podizanja, dozvoli mu i restartuj. Javi se posle sa vestima.