Skini DDS Program na Desktop
http://download.bleepingcomputer.com/sUBs/dds.scr

Dvoklikom pokreni dds.scr

Kad zavrsi, DDS ce otvoriti dva loga:
1. DDS.txt
2. Attach.txt

Oba izvestaja sacuvaj na Desktop i prikaci ih uz poruku

_{[Ovu poruku je menjao magna86 dana 26.10.2009. u 20:24 GMT+1]}

Ok uradiću to.
U medjuvremenu pokušala sam sa onim što znam da mogu da iskoristim i što sam pročitala na povezanim problemima ovde. Uspela sam da sprečim restart sistema tokom skeniranja sa Malwarebyte's programom i pokazao je sledeće fajlove kao moguću pretnju i/ili zaražene.

Malwarebytes' Anti-Malware 1.41
Database version: 3033
Windows 5.1.2600 Service Pack 3

26.10.2009 17:33:51
mbam-log-2009-10-26 (17-33-44).txt

Scan type: Full Scan (C:\|)
Objects scanned: 278794
Time elapsed: 1 hour(s), 1 minute(s), 34 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 3
Folders Infected: 0
Files Infected: 36

Memory Processes Infected:
C:\Program Files\Registry Easy\RegEasyCleaner.exe (Rogue.RegistryEasy) -> No action taken.

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\seneka (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\seneka (Malware.Trace) -> No action taken.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Program Files\Registry Easy\RegEasyCleaner.exe (Rogue.RegistryEasy) -> No action taken.
C:\Documents and Settings\HelpAssistant.MARIJA.001\xlwohr.exe (Trojan.Dropper) -> No action taken.
C:\Documents and Settings\HelpAssistant.MARIJA.001\Local Settings\Application Data\Google\Chrome\User Data\Default\Cache\f_00003a (Trojan.Downloader) -> No action taken.
C:\Documents and Settings\HelpAssistant.MARIJA.001\Local Settings\Application Data\Google\Chrome\User Data\Default\Cache\f_00003b (Trojan.Downloader) -> No action taken.
C:\Documents and Settings\HelpAssistant.MARIJA.001\Local Settings\Application Data\Google\Chrome\User Data\Default\Cache\f_00003c (Trojan.Downloader) -> No action taken.
C:\Documents and Settings\HelpAssistant.MARIJA.001\Local Settings\Temp\a.exe (Rootkit.Agent) -> No action taken.
C:\Documents and Settings\HelpAssistant.MARIJA.001\Local Settings\Temp\b .exe (Trojan.Downloader) -> No action taken.
C:\Documents and Settings\HelpAssistant.MARIJA.001\Local Settings\Temp\c.exe (Trojan.Downloader) -> No action taken.
C:\Documents and Settings\HelpAssistant.MARIJA.001\Local Settings\Temp\rsyncini.exe (Trojan.Shutdowner) -> No action taken.
C:\Documents and Settings\HelpAssistant.MARIJA.001\Local Settings\Temporary Internet Files\Content.IE5\DCIHWYLH\setup[1].exe (Trojan.Buzus) -> No action taken.
C:\Documents and Settings\HelpAssistant.MARIJA.002\xlwohr.exe (Trojan.Dropper) -> No action taken.
C:\Documents and Settings\HelpAssistant.MARIJA.002\Local Settings\Application Data\Google\Chrome\User Data\Default\Cache\f_00003c (Trojan.Downloader) -> No action taken.
C:\Documents and Settings\HelpAssistant.MARIJA.002\Local Settings\Application Data\Google\Chrome\User Data\Default\Cache\f_00003a (Trojan.Downloader) -> No action taken.
C:\Documents and Settings\HelpAssistant.MARIJA.002\Local Settings\Application Data\Google\Chrome\User Data\Default\Cache\f_00003b (Trojan.Downloader) -> No action taken.
C:\Documents and Settings\HelpAssistant.MARIJA.002\Local Settings\Temp\a.exe (Rootkit.Agent) -> No action taken.
C:\Documents and Settings\HelpAssistant.MARIJA.002\Local Settings\Temp\b .exe (Trojan.Downloader) -> No action taken.
C:\Documents and Settings\HelpAssistant.MARIJA.002\Local Settings\Temp\c.exe (Trojan.Downloader) -> No action taken.
C:\Documents and Settings\HelpAssistant.MARIJA.002\Local Settings\Temp\rsyncini.exe (Trojan.Shutdowner) -> No action taken.
C:\Documents and Settings\marija\xlwohr.exe (Trojan.Dropper) -> No action taken.
C:\Documents and Settings\marija\Local Settings\Temp\a.exe (Rootkit.Agent) -> No action taken.
C:\Documents and Settings\marija\Local Settings\Temp\b .exe (Trojan.Downloader) -> No action taken.
C:\Documents and Settings\marija\Local Settings\Temp\c.exe (Trojan.Downloader) -> No action taken.
C:\Documents and Settings\marija\Local Settings\Temp\rsyncini.exe (Trojan.Shutdowner) -> No action taken.
C:\System Rollback Data\Restore\Archive\00000007\00000009\3\Target\WINDOWS\system32\sdra64.exe (Spyware.Zbot) -> No action taken.
C:\System Rollback Data\Restore\Archive\00000007\00000016\14\Target\WINDOWS\msa.exe (Trojan.Downloader) -> No action taken.
C:\System Rollback Data\Restore\Archive\00000007\00000016\14\Target\WINDOWS\system32\eventlog.dll (Trojan.Sirefef) -> No action taken.
C:\System Rollback Data\Restore\Archive\00000007\00000016\14\Target\WINDOWS\system32\gq0hvdrqvds9.exe (Trojan.Dropper) -> No action taken.
C:\System Rollback Data\Restore\Archive\00000007\00000016\14\Target\WINDOWS\system32\swp.dll (Trojan.Downloader) -> No action taken.
C:\System Rollback Data\Restore\Archive\00000007\00000016\14\Target\WINDOWS\system32\ydrcu.exe (Trojan.Dropper) -> No action taken.
C:\System Rollback Data\Restore\Current\43906\3\Target\DOCUMENTS AND SETTINGS\marija\MY DOCUMENTS\Downloads\noadware.exe (Rogue.NoAdware) -> No action taken.
C:\Documents and Settings\HelpAssistant.MARIJA.001\Local Settings\Temp\ctv1369.exe (Trojan.Dropper) -> No action taken.
C:\Documents and Settings\HelpAssistant.MARIJA.002\Local Settings\Temp\ctv1369.exe (Trojan.Dropper) -> No action taken.
C:\Documents and Settings\marija\Local Settings\Temp\ctv1369.exe (Trojan.Dropper) -> No action taken.
C:\WINDOWS\system32\drivers\seneka.sys (Rootkit.TDSS) -> No action taken.
C:\WINDOWS\system32\drivers\senekasdpphbny.sys (Rootkit.TDSS) -> No action taken.
C:\WINDOWS\system32\drivers\senekatasmrnst.sys (Rootkit.TDSS) -> No action taken.

Obrisala sam ih sve!!!
Posle sam skenirala sa FixBlast - W32.Blaster.Worm has not been found on your computer.
Na kraju sam skenirala i sa Registry Easy programom i problem se desio u tome što kad sam otišla na Recover and/or Delete, obriše mi registry key za bluethoot i ne mogu posle da pokrenem bluethoot da radi normalno (to je jedino što sam primetila da ometa rad)... srećom pre nego što se radi recover ili brisanje pravi se backup file i uspela sam da ga vratim nazad da radi kao pre Registry Easy recover/delete. Opet sam skenirala i pronašao je sve isto rekla bih, ali sad detaljno pregledam i čitam da nadjem da otkažem recovery tog file-a!

Neću ništa da radim za sada, dok ne pogledaš ovo što ti šaljem. Zapravo ovo što si tražio!
Hvala još jednom na pomoći!

Ne znam kako da Attach ovde file, pa ću poslati kao rapidshare file! Izvinjavam se ako otežavam ili pravim neki prob.
http://rapidshare.com/files/298300004/DDS.txt.html
http://rapidshare.com/files/298300191/Attach.txt.html

Ok...nema problema ;)
Ponovo pokreni Malwarebytes AntiMalware.
Izaberi opciju Perform Quick Scan i klikni Scan.
Po završetku procesa klikni OK, Show Results: u listi detektovanog malware-a proveri da li su obelezene sve stavke
i klikni Remove Selected.

Po zavrsetku ciscenja zakaci MBAM log na forum kao i svez DDS log

PS:kad posaljes komentar imas uz poruku opciju Upload uz poruku
tako mi posalji DDS.txt log

Evo uradjeno ono što si tražio.
:)

hm..u redu..idemo sad sa robusnijim alatom...

* Skini Combofix program
Poseti ovu stranicu za download linki Uputstvo za koriscenje Combofix programa:
http://www.elitesecurity.org/t...e-programa-HijackThis-ComboFix

* Privremeno iskljuci svoj AntiVirus program.
Poseti ovu stranicu za uputstvo:
http://www.bleepingcomputer.com/forums/topic114351.html

* Pokreni Combofix!
Kad alat zavrsi skeniranje otvorice notepad sa izvestajem (log).
Kopiraj taj izvestaj ovde. (tipicna lokacija loga: C:\ComboFix.txt)

Ok malo kasnim sa ovim, ali trebalo mi je vremena da sve pripremim da mogu da odradim Combo Fix... imala sam i problem sa "duhom" - ostatkom nekog fajla Norton Security-a koji sam uninstalirala ali je negde u pozadini combo prepoznao da radi.. :S

Nakon uradjenog combo fix-a dobila sam sledeći log...

ComboFix 09-10-26.01 - marija 27.10.2009 1:41.1.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.381.1033.18.1015.665 [GMT 1:00]
Running from: c:\documents and settings\marija\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\WinPCap
c:\program files\WinPCap\daemon_mgm.exe
c:\program files\WinPCap\npf_mgm.exe
c:\program files\WinPCap\rpcapd.exe
c:\recycler\S-1-5-21-1452673195-2193652651-1684103764-1003
c:\windows\system32\drivers\npf.sys
c:\windows\system32\oem1.inf
c:\windows\system32\Packet.dll
c:\windows\system32\pthreadVC.dll
c:\windows\system32\senekakbawvaxy.dat
c:\windows\system32\senekaysawkwff.dat
c:\windows\system32\WanPacket.dll
c:\windows\system32\wpcap.dll

Infected copy of c:\windows\system32\drivers\atapi.sys was found and disinfected
Restored copy from - Kitty ate it :p
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NPF
-------\Service_NPF


((((((((((((((((((((((((( Files Created from 2009-09-27 to 2009-10-27 )))))))))))))))))))))))))))))))
.

2009-10-27 00:37 . 2008-04-14 00:10 96512 ----a-w- c:\windows\system32\drivers\atapi.sys
2009-10-26 15:19 . 2009-10-26 16:47 -------- d-----w- c:\program files\Registry Easy
2009-10-26 00:12 . 2009-10-26 00:12 -------- d-----w- c:\program files\Trend Micro
2009-10-25 22:54 . 2009-10-25 22:54 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-10-25 22:35 . 2008-03-03 17:21 568 ---ha-w- c:\windows\nod32fixtemdono.reg
2009-10-25 22:35 . 2008-03-03 13:25 5702 ---ha-w- c:\windows\nod32restoretemdono.reg
2009-10-25 22:33 . 2009-10-25 22:33 -------- d-----w- c:\program files\ESET
2009-10-25 22:13 . 2009-10-25 22:13 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-10-25 21:46 . 2009-10-25 21:46 -------- d-----w- c:\documents and settings\marija\Application Data\Malwarebytes
2009-10-25 21:46 . 2009-09-10 13:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-25 21:46 . 2009-10-25 21:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-10-25 21:46 . 2009-09-10 13:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-25 21:46 . 2009-10-25 21:46 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-25 21:27 . 2009-10-25 22:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-10-25 20:16 . 2009-10-27 00:58 -------- d-----w- c:\documents and settings\HelpAssistant.MARIJA.002
2009-10-25 18:53 . 2009-10-25 18:44 30208 ----a-w- c:\documents and settings\HelpAssistant.MARIJA.001\sttray.exe
2009-10-25 18:44 . 2009-10-25 18:44 30208 ----a-w- c:\documents and settings\marija\sttray.exe
2009-10-25 18:33 . 2009-10-25 18:33 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-10-25 18:16 . 2009-10-25 18:16 -------- d-----w- c:\documents and settings\marija\Local Settings\Application Data\ESET

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-27 00:37 . 2009-10-09 09:09 -------- d-----w- c:\documents and settings\marija\Application Data\Affinegy
2009-10-26 21:46 . 2009-09-09 19:49 -------- d-----w- c:\documents and settings\marija\Application Data\Skype
2009-10-26 17:57 . 2009-09-09 19:52 -------- d-----w- c:\documents and settings\marija\Application Data\skypePM
2009-10-25 22:54 . 2009-08-26 04:21 -------- d-----w- c:\program files\Java
2009-10-25 20:57 . 2009-08-26 04:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton
2009-10-25 18:44 . 2009-10-25 20:21 30208 ----a-w- c:\documents and settings\HelpAssistant.MARIJA.002\sttray.exe
2009-10-25 01:11 . 2009-10-24 22:58 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET
2009-10-25 00:39 . 2009-10-25 00:39 -------- d-----w- c:\documents and settings\marija\Application Data\ESET
2009-10-24 18:04 . 2009-09-29 11:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec
2009-10-24 15:02 . 2009-10-15 12:56 -------- d-----w- c:\documents and settings\All Users\Application Data\{7B6BA59A-FB0E-4499-8536-A7420338BF3B}
2009-10-23 23:22 . 2009-08-26 04:21 -------- d-----w- c:\program files\Common Files\Adobe
2009-10-23 14:11 . 2009-08-26 04:21 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller
2009-10-21 07:32 . 2009-10-01 11:08 -------- d-----w- c:\documents and settings\marija\Application Data\Paltalk
2009-10-19 16:20 . 2009-08-26 04:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Sonic
2009-10-18 06:13 . 2009-08-25 21:06 -------- d-----w- c:\program files\Microsoft
2009-10-18 06:11 . 2009-08-26 04:21 -------- d-----w- c:\program files\Microsoft Works
2009-10-16 23:12 . 2009-10-01 02:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-10-16 23:12 . 2009-10-06 09:27 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2009-10-15 12:45 . 2009-10-15 12:45 -------- d-----w- c:\documents and settings\All Users\Application Data\PCSettings
2009-10-09 09:07 . 2009-10-09 09:06 -------- d-----w- c:\program files\Virgin Broadband Wireless
2009-10-09 09:06 . 2009-10-09 09:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Affinegy
2009-10-06 10:04 . 2009-08-25 21:43 70448 ----a-w- c:\documents and settings\marija\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-06 09:39 . 2009-08-29 22:28 -------- d-----w- c:\program files\MSBuild
2009-10-06 09:33 . 2009-10-06 09:33 -------- d-----w- c:\program files\Microsoft.NET
2009-10-05 20:17 . 2009-10-05 20:17 -------- d-----w- c:\documents and settings\marija\Application Data\Template
2009-10-05 20:17 . 2009-10-05 20:17 0 ----a-w- c:\documents and settings\marija\Application Data\wklnhst.dat
2009-10-03 19:38 . 2009-09-27 19:04 -------- d-----w- c:\documents and settings\marija\Application Data\Windows Live Writer
2009-10-03 12:33 . 2009-09-09 14:12 -------- d-----w- c:\documents and settings\marija\Application Data\BSplayer
2009-09-30 22:11 . 2009-09-30 22:09 31 ----a-w- c:\windows\system32\drivers\adidsl.cfg
2009-09-30 22:09 . 2009-08-26 04:21 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-09-30 22:09 . 2009-09-30 22:09 -------- d-----w- c:\program files\SAGEM
2009-09-30 22:09 . 2009-08-26 04:21 -------- d-----w- c:\program files\Common Files\InstallShield
2009-09-30 09:27 . 2009-09-30 09:24 -------- d-----w- c:\documents and settings\marija\Application Data\Winamp
2009-09-30 09:26 . 2009-09-07 17:51 -------- d-----w- c:\program files\Winamp
2009-09-09 21:00 . 2009-09-09 20:59 -------- d-----w- c:\program files\Google
2009-09-09 20:58 . 2009-09-09 19:49 -------- d-----r- c:\program files\Skype
2009-09-09 20:58 . 2009-09-09 20:58 -------- d-----w- c:\program files\Common Files\Skype
2009-09-09 20:58 . 2009-09-09 19:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2009-09-09 19:52 . 2009-09-09 19:52 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-09-09 14:14 . 2009-09-09 14:14 -------- d-----w- c:\program files\Codec Pack - All In 1
2009-09-09 14:13 . 2009-09-09 14:14 737280 ----a-w- c:\windows\iun6002.exe
2009-09-09 14:13 . 2009-09-09 14:13 -------- d-----w- c:\program files\BS_Player
2009-09-09 14:13 . 2009-09-09 14:13 -------- d-----w- c:\program files\Conduit
2009-09-09 14:12 . 2009-09-09 14:12 -------- d-----w- c:\documents and settings\marija\Application Data\BSplayer Pro
2009-09-09 14:12 . 2009-09-09 14:12 -------- d-----w- c:\program files\Webteh
2009-09-05 22:05 . 2009-09-05 22:04 -------- d-----w- c:\program files\CCleaner
2009-08-29 22:27 . 2009-08-29 22:27 -------- d-----w- c:\program files\Reference Assemblies
2009-08-25 21:42 . 2009-08-25 21:42 259584 --sha-r- C:\BCDEDIT.EXE
2009-08-25 21:42 . 2009-08-25 21:42 259584 ----a-w- c:\windows\system32\bcdedit.exe
2009-08-25 21:42 . 2009-08-25 21:42 102400 --sha-r- C:\bootsect.exe
2009-08-05 21:48 . 2009-08-25 21:12 54752 ----a-w- c:\windows\system32\drivers\fssfltr_tdi.sys
2009-08-05 09:01 . 2009-08-05 09:01 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-29 04:37 . 2009-07-29 04:37 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-07-29 04:37 . 2009-07-29 04:37 119808 ----a-w- c:\windows\system32\t2embed.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}"= "c:\program files\BS_Player\tbBS_P.dll" [2009-07-02 2215960]

[HKEY_CLASSES_ROOT\clsid\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}]
2009-07-02 09:18 2215960 ----a-w- c:\program files\BS_Player\tbBS_P.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}"= "c:\program files\BS_Player\tbBS_P.dll" [2009-07-02 2215960]

[HKEY_CLASSES_ROOT\clsid\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{FED66DC5-1B74-4A04-8F5C-15C5ACE2B9A5}"= "c:\program files\BS_Player\tbBS_P.dll" [2009-07-02 2215960]

[HKEY_CLASSES_ROOT\clsid\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-09-09 39408]
"Google Update"="c:\documents and settings\marija\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-09-28 133104]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-15 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-15 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-15 159744]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-15 131072]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2008-09-11 446556]
"AESTFltr"="c:\windows\system32\AESTFltr.exe" [2008-12-03 729088]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-12-04 1410344]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-25 149280]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"HP Mobile Broadband"="c:\swsetup\HPQWWAN\HPMobileBroadband.exe" [2008-07-08 439600]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-08-03 36352]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"Wireless Manager"="c:\program files\Virgin Broadband Wireless\Wireless Manager.exe" [2008-05-26 585728]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-02-20 1443072]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"IDTSysTrayApp"="sttray.exe" - c:\windows\sttray.exe [2008-09-11 446556]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-15 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-9-2 604776]
DSLMON.lnk - c:\program files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2009-9-30 839680]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:Remote Desktop

R0 SahdIa32;HDD Filter Driver;c:\windows\system32\drivers\SahdIa32.sys [8.2.2009 3:36 21488]
R0 SaibIa32;Volume Filter Driver;c:\windows\system32\drivers\SaibIa32.sys [8.2.2009 3:36 15856]
R0 SysCow;SysCow;c:\windows\system32\drivers\syscow32x.sys [24.9.2008 23:09 103792]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [20.2.2008 11:11 33800]
R1 SaibVd32;Virtual Disk Driver;c:\windows\system32\drivers\SaibVd32.sys [8.2.2009 3:36 25584]
R2 9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269;Roxio SAIB Service;c:\program files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe [11.12.2008 23:46 125424]
R2 BOTService;BOTService;c:\program files\Roxio\BackOnTrack\Instant Restore\BOTService.exe [25.12.2008 19:28 203248]
R2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [20.2.2008 11:08 472320]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [25.8.2009 22:12 54752]
R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [8.2.2009 3:20 112128]
S2 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\system32\regedt32.exe [15.4.2008 5:00 3584]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\Windows Live\Family Safety\fsssvc.exe [5.8.2009 22:48 704864]

--- Other Services/Drivers In Memory ---

*Deregistered* - mbr
.
Contents of the 'Scheduled Tasks' folder

2009-10-27 c:\windows\Tasks\BackOnTrack Instant Restore Idle.job
- c:\program files\Roxio\BackOnTrack\Instant Restore\RstIdle.exe [2008-12-25 18:28]

2009-10-26 c:\windows\Tasks\GOOGLEUPDATETASKUSERS-1-5-21-1540596067-818211378-770439794-1006CORE.JOB
- c:\documents and settings\marija\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-09-28 15:18]

2009-10-27 c:\windows\Tasks\GOOGLEUPDATETASKUSERS-1-5-21-1540596067-818211378-770439794-1006UA.JOB
- c:\documents and settings\marija\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-09-28 15:18]

2009-10-27 c:\windows\Tasks\USER_FEED_SYNCHRONIZATION-{B1F49AD2-9F9C-4279-A3B5-B260CFC4E382}.JOB
- c:\windows\system32\msfeedssync.exe [2009-03-08 03:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.rs/
uInternet Connection Wizard,ShellNext = hxxp://renewalcenter.symantec.com/storefront/user/home.jsp?NOS=1wyb0bxAeCkXgA9JWACAhDxag0iDLTiujAFD3hluZoCDgYQGSgKCZEEIKDXVkR%2FC2NovGgJOugdC3CX68J2F7K8WV&SASSERVER=lcsitemain.symantec.com&TRANSID=%2F10097711%2FADWBkUD953994757D159B&GUID=DB42C63691BE11DE849500242BCBF864&SSLT=4096&oslang=iso:ENG&oslocale=iso:GBR&vendid=0&vendtag=&epid={db42c636-91be-11de-8495-00242bcbf864}
IE: &AOL Toolbar Search - c:\documents and settings\All Users\Application Data\AOL\ieToolbar\resources\en-GB\local\search.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-27 01:58
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


c:\windows\system32\PerfStringBackup.TMP 527578 bytes

scan completed successfully
hidden files: 1

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2212)
c:\windows\system32\WININET.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
c:\windows\system32\btmmhook.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\idt\wdm\stacsv.exe
c:\program files\Virgin Broadband Wireless\AffinegyService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\windows\system32\wscntfy.exe
c:\combofix\CF3533.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\progra~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
c:\program files\Hewlett-Packard\Shared\HpqToaster.exe
c:\combofix\PEV.cfxxe
.
**************************************************************************
.
Completion time: 2009-10-27 2:06 - machine was rebooted
ComboFix-quarantined-files.txt 2009-10-27 01:05

Pre-Run: 60.586.319.872 bytes free
Post-Run: 60.584.075.264 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - BEF412A4044935635D7191524A9DC539

Opet se nisam snašla sa postavljanjem fajla.. evo pokusacu opet..kapiram da ti je lakse...

opet hvala!

Otvori Notepad i kopiraj tekst koji sam ti oznacio ispod:




Klikni na File\Save as i sacuvaj tekst kao CFScript na Desktop



Kao na slici,prevuci CFScript.txt preko ikonice ComboFix.exe
To ce startovati ComboFix, mozda ce doci do restarta sistema sto je normalno,a kad zavrsi pojavice se log koji trebas da kopiras ovde

i javi mi kakvo je sad stanje.
PS: pisemo se sutra posle 20h...

Ćao ćao.. čini mi se da kompjuter bolje radi sada ali se i dalje desava blokiranje u sred rada..
Npr. danas sam radila u Google Chrome, otvorila Outlook i Word (programe koje inace koristim redovno zajedno) i on je zablokirao i opet ide iritirajuci zvuk bez prestanka, dok ga ne iskljucim manuelno.


Inače napravila sam txt fajl koji si mi rekao i prevukla sam ga u ComboFix.
Pokrenuo se i uradio isto skeniranje kao sinoć... Evo i Log File-a...
Do večeras...
Poz

_{[Ovu poruku je menjao skeri dana 27.10.2009. u 18:32 GMT+1]}

Cao.
Nesto nije kako treba jer si postavila isti log od sinoc.
Jesi li sigurna da si ispravno napravila&uradila CFScript?
Postavi mi log koji se nalazi na C:\ComboFix.txt da proverim

_{[Ovu poruku je menjao magna86 dana 27.10.2009. u 23:39 GMT+1]}

Hmm moguće da sam ti poslala isti log... Bila sam ubedjena da sam ga sačuvala na desktopu ali nisam...
Evo drugog fajla...

Btw. Upravo mi se desilo da sam posle par sati upalila kompjuter i da nisam mogla apsolutno ništa da uradim, samo da šetam miša levo desno.. Pa ja ne znam šta mu je! Evo uz Log file šaljem i slike task manager procesa...

Ovi logovi deluju cisto , no ja bih ipak odradio jos jednu proveru


--> Prijoritet
Skini DDS Program na Desktop
http://download.bleepingcomputer.com/sUBs/dds.scr

Dvoklikom pokreni dds.scr

Kad zavrsi, DDS ce otvoriti dva loga:
1. DDS.txt
2. Attach.txt

Oba izvestaja sacuvaj na Desktop.
Kopiraj mi DDS.txt
..........................................................................


--> Kakava ti je internet konekcija?
Ako imas "brzi" internet i ako si u mogucnoisti odradi ovo: Ako ne..nemoj se muciti.

BitDefender Online scan
http://www.bitdefender.com/scanner/online/free.html

Idi na Start Scan ,stavi kvacicu ispred "I agree with terms and conditions" i idi na Start Here
ukoliko ti bude trazio instalaciju Active X control , dozvoli mu da instalira.
Izbacice ti prozorce,idi na Install pa na Start Scan

BitDefender skida instalaciju,i update ...a za dalje prati uputstva :)

BitDefender ce napraiti log,taj log (izvestaj) prikaci uz poruku

note: Skeniranje je moguce amo preko Internet Explorer-a (Browser-a)
^{ukoliko imas neke crack programe,raruj ih da bi ih BitDefender preskocio.}

@skeri

Imas jednostavniji i pregledniji nacin da okacis spisak procesa od kacenja screenshotova: u command promptu kucas "tasklist", i dobices spisak koji mozes da kopiras. Jos jednostavnija varijanta je da kucas "tasklist > c:\procesi.txt", gde umesto "c:\procesi.txt" upises bilo koju putanju i ime fajla, i na tom mestu ces imati gotov txt fajl koji samo okacis uz poruku...

Ma nešto čudno se dešava...
Evo noćas je radio BitDefender skeniranje, posle toga sam uradila DDS....
Čitala sam šta je BitDefender pronašao, od toga sam samo AdAware ručno izbrisala..ostalo je već viša matematika za mene..

Šaljem Logove...

@Valjan.. Hvala.. znala sam da postoji sigurno lakši način

Ovako stoje stvari...
Tebi su sad svi logovi cisti.
Imas tu dosta "junk" fajlova ali ja ovde vise nevidim tragove malware-a.
Sto znaci da problem nije prouzrokovan infekcijom,vec je uzrok druge "prirode" .


Ono sto je BitDefender nasao i obrisao je su uglavnom crack programi koje on inace uklanja.
to je ono sto je on detektovao kao trojan,virus...bla..bla
Detektovao je i neke file-ove u System Restore,ali nema razloga za brigu,to je obicna heruistika:
Resetovanjem system restora ce te detekcije nestati:

Ovako uninstaliraj Combofix:

Start >> Run
tamo kopiraj ovo:

Ok

ova komanda ce obrisati svaki Combofix-ov file,folder,,becup...
..i resetovace system restore!

I jos nesto...skini program CCleaner
http://www.ccleaner.com/

Odradi Registry kao i Cleaner skeniranje sa njim,a imas i opciju da si poiskljucujes sve te nepotrebne stvari koji ti se pokrecu sa systemom:
Tools >> Sturtup


PS:po logu vidim da MBAM trazi restart...nadam se da si kompjuter restartovala do sad:

Ok, mislim da je konacno cist, poceo je da se ponasa mnogo bolje. Uninstalirala sam neke nepotrebne programe, Sturt up malo preuredila, skenirala sam sa jos jednim online scannerom Windows LiveOneCare koji sam ranije kod kuce na desktop racunaru koristila za ciscenje. I on je pronasao jos neke fajlove kao Trojan i obrisao...
Uradila sam btw. pre tog skeniranja brisanje ComboFix-a, uninstalirao se ali mi je kad startujem Windows i dalje ostao Restore Point za Windows?!?!? :////

To je Restore tacka (system restore) i ne preporucuje se brisanje ali ako bas zelis...
Skini ovaj File i pokreni ga dvoklikom,izaberi opciju 1 ...