Šta je novo?
Od:
Filteri

asdsdsd.exe

  • Začetnik teme Začetnik teme Cranky
  • Datum pokretanja Datum pokretanja
probao sam to ali nema ga u tom spisku tj nema za njega checksum

naime stalno mi prijavljuje greshku sa odredjenim procesima koji se konstantno pojavljuju iz odredjenog foldera tj temporary internet fajla
ja ga nadjem preko cmd/a i izbrisem
nadjem sve sdsdhad i kjobse i izbrisem ali
taj ****ni folder u temporary se konstantno pojavljuje tj njih nekoliko i koliko god puta da ih izbrisem o5 se pojave
 
Moras onda najpre da ga pronadjes u listi procesa i da ga ubijes, osim ako nije onaj sto radi code injection u neki sistemski exe.

Jesi li probavao u safe mode da udjes i odatle da brises iste te fajlove sto si rekao?
 
nema ga u listi procesa 😀
evo sad sam zavrsio rad u safe modu, pa cemo da vidimo dejstvo
valjalo je proci kroz nekoliko naloga i skrivenih fajlova ali sve sam pregledao
nasao sam zanimljivost u prefetch folderu i recycle folderu
neki izvrsni fajl
fix.exe ne znam od cega je ali nisam ga dirao u recycle
posto kada ulazim na ovaj nalog u levom desnom cosku kao da se odradi autorun i procita se iz recycle

imam jedno pitanje nasao sam i folder recycler za sta on sluzi? posto sam nalazio i virusa sa takvim imenom.
pooz

edit: sad sam malo gledao po netu izgleda da je to neki virus/malware
 
Poslednja izmena:
Folder recycler nije virus ali recycler.exe sa slicicom foldera jeste 🙂

Taj fix.exe je neki malware 100%.
 
pff
dzaba sto sam bauljao 2sata po safe modu i brisao sve
kad nisam nasao glavnog
odnekle me **** a ja ne mogu da ga nadjem odakle
 
Uzmi ti lepo Process Explorer pa sve sumnjive exe koje nadjes sa njim desni klik pa Suspend. Tako ces ih onemoguciti da se vracaju kad negde nesto obrises. Drugo, dok cistis iskljuci internet. Trece, uzmi HijackThis pa uradi system scan i sve sto je sumnjivo obelezi pa klikni fix (narocito obrati paznju na BHO). Cetvrto, poteraj i LSPFix da vidis da nema nesto sumnjivo i tamo.

Ako se ne snalazis sa HijackThis okaci log fajl od njega ovde. Javi sta si uradio.
 
Ne pojavljuju se u listi procesa jer avira konstantno izbacuje kako je nasla sumnjive viruse u tom i tom fajlu i derivate i ja to konstantno brisem
kad je bio avast uopste nije prijavljivao ali nije se mogao ni tada naci u procesima
jer ionako samo izbaci da sdsdsdhd.exe ima problem i mora da se zatvori
jednom mi se samo desilo da sam imao 200 procesa i to je bio exxredr.exe koji se isto pojavljivao iz tih foldera odakle prijavljuje avira i ja sam to izbrisao i otad se nije pojavljivao u procesima ali ga je avira ovako prijavljivala

sinoc sam u safe modu trazio redom sve po cmd/u i presao naloge i izbrisao te fajlove ali ocigledno ima neki kao pomocni kojeg ne mogu da nadjem koji ih konstantno vraca
zaboravio sam reci da dok god je internet iskljucen uopste avira ne prijavljuje niti se oni pojavljuju

evo screen shota odakle dolaze


a evo i HT log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:53:53, on 29.1.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\TP-LINK\TWCU\TWCU.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Opera\opera.exe
C:\Documents and Settings\Administrator\Desktop\Portable\PortableApps\PortableAppsMenu\PortableAppsMenu.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [TWCU] "C:\Program Files\TP-LINK\TWCU\TWCU.exe" -nogui
O4 - HKLM\..\Run: [SoundMax] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{20289E75-291D-4615-8A43-12F434C92DE7}: NameServer = 79.143.173.161 79.143.172.2
O17 - HKLM\System\CCS\Services\Tcpip\..\{630EAD48-B813-49BE-84CA-438219256428}: NameServer = 212.200.13.13
O17 - HKLM\System\CCS\Services\Tcpip\..\{E064EEA7-82EF-4689-801B-AB95BF2B0AD0}: NameServer = 212.200.13.13
O23 - Service: TP-LINK Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PsExec (PSEXESVC) - Unknown owner - C:\WINDOWS\PSEXESVC.EXE (file missing)
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 5707 bytes
 
Poslednja izmena:
Ako se ne pojavljuju dok je net iskljucen i ako je ovaj C:\WINDOWS\PSEXESVC.EXE remote telnet programcic onda bi on bio krivac.


Probaj ovo:
Also to prevent a further reoccurrence of psexesvc.exe remove the file and put a folder with the same name in it's place.
While this doesn't deal with the problem of infected machines it should at least prevent the malware from carrying out its dirty work.

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers]
"C:\\WINDOWS\\psexesvc.exe"="WIN95"
Kliknite za proširenje...
http://forum.sysinternals.com/forum_posts.asp?TID=15204&PID=73419#73419
 
@Cranky jel ti poznata ova adresa, posto u logu imas i Telekom Srbija.

Kod: 
inetnum:        79.143.172.0 - 79.143.175.255 
 netname:         TERRANET-NET 
 descr:          Terranet Bijeljina 
 country:        BA

Iskopiraj ovaj tekst u notepad pa klikni na File\ save as i animi ga na desktopk kao cranky.bat

Kod: 
sc stop "PsExec"
sc delete "PsExec"
del "C:\WINDOWS\PSEXESVC.EXE"

I pokreni ga. Ovim batch fajlom ces da se resis tog servisa i fajla, koji ti najverovatnije pravi problem.
 
jeste poznata mi je to je moj provajder terra net

uradio sam ali mi se upozorenja jos uvek pojavljuju

i u ht logu ga josh ima

edit: cini mi se da infekcija postaje gora pojavljuju se novi exei koji nisu do sada i na novim mjestima
 
Poslednja izmena:
Ajde postavi novi HijackThis log, stavi ga u folder i promeni mu ime u cranky.exe, znaci ne sme da asocira na HijackThis.
 
U svakom slucaju ja sam napravio previd, ovako mora da izgleda batch fajl, znaci snimi ga isto kao Bat i pokreni ga, mora da ga obrise.

Kod: 
sc stop "PSEXESVC"
sc delete "PSEXESVC"
del "C:\WINDOWS\PSEXESVC.EXE"
 
Poslednja izmena:
pokrenuo sam i izgleda da ga je obrisao pokrenuo sam ht i nema ga u logu
sacekao sam malo i o5 se pojavljuju ovi sdsdsdhd.exe, sxdxdsd.exe, sad se pojvaljuju i neki 500.exe i 382.exe
i provjerio sam o5 sa ht nema tog psexesvc.exe
ovi novi procesi se pojavljuju u temp folderu
 
Poslednja izmena:
Hmmm... Sto ne dignes neki Live XP, pa sa njega da radis scan?
 
Poslednja izmena:
ovo vec postaje ozbiljnije pocinje da mi internet konekciju iskljucuje nekad ne mogu uopste da se konektujem kaze da je wlles kartica vec u upotrebi ccc

edit: nasao sam 2 fajla u kojem nesta pise a spominje se jedan od problematicnih exea sto je bio
<?xml version="1.0" encoding="UTF-16"?>
<DATABASE>
<EXE NAME="Exredr.exe" FILTER="GRABMI_FILTER_PRIVACY">
<MATCHING_FILE NAME="Exredr.exe" SIZE="49196" CHECKSUM="0xF064A72C" MODULE_TYPE="WIN32" PE_CHECKSUM="0x10773" LINKER_VERSION="0x10000" LINK_DATE="01/15/2009 23:44:43" UPTO_LINK_DATE="01/15/2009 23:44:43" />

imaju josh 2 fajla sa slicnim kodom sta ovo znaci
 
Poslednja izmena:
Ja sam ti lepo rekao da ugasis internet dok sve ne ocistis i ne osposobis firewall.

Vidi sta je ovo:
C:\WINDOWS\system32\acs.exe
C:\WINDOWS\system32\PnkBstrA.exe

A obrisi ovo:
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

Proveri da li su ovo tvoji DNS serveri:
O17 - HKLM\System\CCS\Services\Tcpip\..\{20289E75-291D-4615-8A43-12F434C92DE7}: NameServer = 79.143.173.161 79.143.172.2

Mozes i ovo da obrises (ako PnkBstrA nije pravi Punk Buster za igre koje igras):
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PsExec (PSEXESVC) - Unknown owner - C:\WINDOWS\PSEXESVC.EXE (file missing)
 
acs.exe / configuration tool za wireless karticu tacnije TP LINK
pnkbstra.exe kad sam instalirao krizu i to se instaliralo ne znam ni za sta je

za ovaj imjpmig.exe belongs to the Microsoft Input Method Editor. It is used to simplify the input of Asian characters in the Microsoft Office suite.
psexescvc izbrisan zahvaljujuci spocku
inace nisam taj ni vidio preko cmd niti ga je ijedan antispyware i antimalware vidio kao ni avast niti avira

Provericu sa gazdom ali mislim da jesu

uglavnom da javim sta je bilo od juce
avira je konstantno javljala ****** i procese na net nisam mogao ici jer pise citiram
"Cannot connect because your device is allready busy"
a nisam uopste prikljucen na net


tada sam otisao i gledao ssta se sve pojavljuje prilikom restarta
naime windows explorer prijavi gresku i mora da se resetuje pri cemu je se pokretao neki root.exe

pogledam pokrene se neki 042.exe odem u temp folder kad imam sta i da vidim
neki perflibblabla.dat i bruka exea koji pocinju brojevima
restart safe mod pobrisem sve system restore, sve iz recycle, recycler foldera
pokrenem cc cleaner kojim sam morao nekoliko puta analizirati i reg bazu i sve ostale foldere
izbrisao sve sta je nasao
ukucao u search sve sa .dat ekstenzijom gledao koji su se menjali u skorije vreme i pobrisao
jedino nisam smio da diram bootstat.dat
nije mi se svidjelo sto pise boot 😀
pokrenuo sam ponovo normalno windows i da kucnem od drvo nema problema

p.s da napomenem da sam i prije radio sve iz safe moda ali su se konstantno pojavljivali, firewall nikad nisam ni gasio bio je celo vreme upaljen
vidjecu da skinem neki drugi firewall ako moze preporuka
 
Poslednja izmena:
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
Windows live messenger legitiman fajl

O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
Takodje nije maliciozan, ali nepotreban u startupu

O17 - HKLM\System\CCS\Services\Tcpip\..\{20289E75-291D-4615-8A43-12F434C92DE7}: NameServer = 79.143.173.161 79.143.172.2
O tome smo vec pricali to je tvoj provajder

O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
Ovo si verovatno instalirao da bi imao admin privilegije za radi igranja na poslu. Nije maliciozan.

O23 - Service: PsExec (PSEXESVC) - Unknown owner - C:\WINDOWS\PSEXESVC.EXE (file missing)
Ovaj servis smo obrisali, nije legitiman.

Gore sam ti napisao da promenis ime HJT-a u nesto drugo i da postavis novi log.
 
Poslednja izmena:
evo novi log, prebacio sam exe fajl u drugi folder i promenio mu ime
izvini na cekanju totalno sam zaboravio na to


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:10:07, on 31.1.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\TP-LINK\TWCU\TWCU.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Documents and Settings\Administrator\Desktop\Portable\PortableApps\PortableAppsMenu\PortableAppsMenu.exe
C:\Documents and Settings\Administrator\Desktop\Portable\PortableApps\ProcessExplorer\procexp.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Opera\opera.exe
C:\Documents and Settings\Administrator\Desktop\md5deep-3.2\Crank2.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [TWCU] "C:\Program Files\TP-LINK\TWCU\TWCU.exe" -nogui
O4 - HKLM\..\Run: [SoundMax] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{20289E75-291D-4615-8A43-12F434C92DE7}: NameServer = 79.143.173.161 79.143.172.2
O17 - HKLM\System\CCS\Services\Tcpip\..\{630EAD48-B813-49BE-84CA-438219256428}: NameServer = 212.200.13.13
O17 - HKLM\System\CCS\Services\Tcpip\..\{E064EEA7-82EF-4689-801B-AB95BF2B0AD0}: NameServer = 212.200.13.13
O23 - Service: TP-LINK Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 5732 bytes
 
@Cranky nista se sporno ne vidi u logu. Probaj da odradis ovo

Idi na ovaj link http://www.bitdefender.com/scan8/ie.html Bitdefender Online Scan.
Moras iskljucivo preko IExplorera
klikni na I Agree pa na Start Scan.
Zatim sacekaj da skine definicije i klikni na More details.
Zatim klikni na tab Detected problems.
Onda klikni na link Click here to export the scan report da bi snimio izvestaj
 
Odradio sam skeniranje evo izvjestaja
da napomenem da kad je dosao do temporary internet fajlova
avira je izbacila popup da se 2 .exe javljaju i da su virusi obrisao sam ali mislim da su ostali bitdefender nije nista prijavio
evo izvoda iz event viewera

The description for Event ID ( 4113 ) in Source ( Avira AntiVir ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: TR/Agent.scr.19; C:\Documents and Settings\Vera\Local Settings\Temporary Internet Files\Content.IE5\CL2ROT6J\ROOT[1].exe; ; .

The description for Event ID ( 4113 ) in Source ( Avira AntiVir ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: TR/VB.jid; C:\Documents and Settings\Vera\Local Settings\Temporary Internet Files\Content.IE5\WPMNOLMV\f2[1].exe; ; .

I jos root.exe sam vec bio jednom obrisao tj nadam se

p.s pff sad tek vidim da su na drugom nalogu




Scan report generated at: Sat, Jan 31, 2009 - 17:23:27
Scan path: C:\;D:\;E:\;F:\;G:\;
Statistics
Time
01:28:26
Files
577969
Folders
8424
Boot Sectors
0
Archives
5918
Packed Files
13433
Results
Identified Viruses
2
Infected Files
2
Suspect Files
0
Warnings
0
Disinfected
0
Deleted Files
2
Engines Info
Virus Definitions
2635989
Engine build
AVCORE v1.7 (build 8314.19) (i386) (Sep 29 2008 17:19:14)
Scan plugins
17
Archive plugins
45
Unpack plugins
7
E-mail plugins
6
System plugins
4
Scan Settings
First Action
Disinfect
Second Action
Delete
Heuristics
Yes
Enable Warnings
Yes
Scanned Extensions
*;
Exclude Extensions
Scan Emails
Yes
Scan Archives
Yes
Scan Packed
Yes
Scan Files
Yes
Scan Boot
Yes

Scanned File
Status

C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
Infected with: Trojan.Generic.1368891

C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
Deleted

E:\tft\The_Frozen_Throne\The Frozen Throne.iso=>crack/dev-ft-keygen.exe
Infected with: Trojan.Dropper.PT

E:\tft\The_Frozen_Throne\The Frozen Throne.iso=>crack/dev-ft-keygen.exe
Deleted

E:\tft\The_Frozen_Throne\The Frozen Throne.iso
Update failed
 
Nemojte nikada preporucivati drugima da koriste Combo Fix,jer to nije obicni program nego veoma mocna alatka.Potrebno je dosta iskustva da bi se sa njim rukovalo.Pre skidanja sa neta se iskljuci antivirus i tek onda se pokrene.
 
Hvala vam momci svima na pomoci
uspio sam resiti dio problema sam a dio u ambulanti u "mom gradu" 😀

Combo fix mozes koristiti kao pocetnik uz dodatne predostroznosti
ali pisanje skripti za istog je druga stvar.
 
Da,da u "mom gradu" je sigurno najbolja pomoc za ove probleme na nasim prostorima,a i sire.
Garantovano nemas vise problema.Pozdrav za Ambulantu i malware fightere.
 
Morate se prijaviti ili registrovati da odgovorite ovde.
Nazad
Vrh Dno