Toolbar
Pravilnik foruma
Burek marketing
Najčešća pitanja
Posetite Burek Prodavnicu
Prijava na forum:
Ime:
Lozinka:
Prijavi me trajno:
Trajanje:
Registruj nalog:
zaboravili ste šifru?
Ime:
Lozinka:
Ponovi Lozinku:
E-mail:

Zatvori
ConQUIZtador
banner
BUREK marketing
*
linktree Burek :: Forumi ::  >  Tehnicki deo foruma  >  Pc Klinika ~ Doktori za vas kompjuter
linktree Tema: Worm, pomoć (Moderatori: enaB, chelavi1)
Trenutno vreme je: 20. Jul 2025, 15:02:56
 nazadnapred
Korisnici koji su trenutno na forumu 0 članova i 0 gostiju pregledaju ovu temu.

 Napomena: Za sva pitanja u vezi kupovine novog hardware-a ili procene vrednosti i preporuke koristite - ovu temu! 

Spyware,sta je,kako radi,kako se zastititi? :: Kako rade mreze :: Burek Anti-virus software review :: Index tema koje ne treba propustiti

Idi dole
Stranice:
1
2  Sve
Počni novu temu Nova anketa Odgovor Štampaj Dodaj temu u favorite Pogledajte svoje poruke u temi
Tema: Worm, pomoć  (Pročitano 3963 puta)
Tema opcije Oceni temu
NennadS
13. Dec 2010, 12:42:37
Jet set burekdzija


Question everything.

Zodijak Gemini
Pol Muškarac
Poruke 5329
Zastava Beograd
OS
Windows XP
Browser
Mozilla Firefox 3.6.12
Ovako...
radi se o računaru koji nema antivirus i nije na internetu i u koji se ubacuju samo fleške koje se prethodno provere na drugim računarima, ali potkrala se greška i u računar je uleteo neki worm koji se sada prenosi na svaku flešku koja se ubaci.

Kako da izvedem čišćenje? Mislio sam prvo da ga priključim na net i pustim antivirus i malwarebytes da odrade čišćenje, pa onda nešto za dublje čišćenje procesa, ukoliko ih bude bilo.

Računar sadrži važne podatke i reinstalacija dolazi u obzir samo u krajnjem slučaju.
IP sačuvana
social share
Deus ex machina.
Pogledaj profil
 
Prijava na forum:
Ime:
Lozinka:
Zelim biti prijavljen:
Trajanje:
Registruj nalog:
zaboravili ste šifru?
Ime:
Lozinka:
Ponovi Lozinku:
E-mail:
Zatvori
cvrle_bg
Poruka #1 13. Dec 2010, 13:23:21
Zvezda u usponu

Zodijak Capricorn
Pol Muškarac
Poruke 1662
Zastava Zemun
OS
Windows XP
Browser
Opera 10.63
mob
HTC Desire
Pa uradi to sto si planirao sa Malwarebytes-om.
IP sačuvana
social share
Ko uci znace, ko se snadje imace.
Pogledaj profil WWW
 
Prijava na forum:
Ime:
Lozinka:
Zelim biti prijavljen:
Trajanje:
Registruj nalog:
zaboravili ste šifru?
Ime:
Lozinka:
Ponovi Lozinku:
E-mail:
Zatvori
ivicaspas
Poruka #2 13. Dec 2010, 13:36:26
Prijatelj foruma
Poznata licnost

MC- argus

Zodijak
Pol Muškarac
Poruke 4467
Zastava
OS
Windows 7
Browser
Mozilla Firefox 3.6.13
mob
HTC 
Citat: NennadS 13. Dec 2010, 12:42:37
Ovako...
radi se o računaru koji nema antivirus i nije na internetu i u koji se ubacuju samo fleške koje se prethodno provere na drugim računarima, ali potkrala se greška i u računar je uleteo neki worm koji se sada prenosi na svaku flešku koja se ubaci.

Kako da izvedem čišćenje? Mislio sam prvo da ga priključim na net i pustim antivirus i malwarebytes da odrade čišćenje, pa onda nešto za dublje čišćenje procesa, ukoliko ih bude bilo.

Računar sadrži važne podatke i reinstalacija dolazi u obzir samo u krajnjem slučaju.


Skini OTL na desktop http://oldtimer.geekstogo.com/OTL.exe

Pokreni OTL i klikni na Run Scan

Kad se zavrsi skeniranje izvestaj ce biti prikazan u Notepadu.

Snimi izvestaj na desktop i prikaci ga uz poruku.
IP sačuvana
social share
Pogledaj profil
 
Prijava na forum:
Ime:
Lozinka:
Zelim biti prijavljen:
Trajanje:
Registruj nalog:
zaboravili ste šifru?
Ime:
Lozinka:
Ponovi Lozinku:
E-mail:
Zatvori
NennadS
Poruka #3 13. Dec 2010, 14:11:10
Jet set burekdzija


Question everything.

Zodijak Gemini
Pol Muškarac
Poruke 5329
Zastava Beograd
OS
Windows XP
Browser
Mozilla Firefox 3.6.12
ESET SS je našao C:\WINOWS\livemessenger.com.
Kačim log čim završi scan.
Ivice, hvala na interesovanju. Smiley


Ne dobijam nikakav log sa OTL, odn. završi scan i prikaže prazan notepad fajl, javi da log ne postoji i pita da li hoću da ga kreiram.. Smile


Evo log-a od malwarebytes-a, da li mogu ovo sve da obrišem?

Citat
Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org

Verzija baze: 5306

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

13.12.2010 14:16:54
mbam-log-2010-12-13 (14-16-50).txt

Način skeniranja: Kompletno skeniranje (C:\|)
Skeniranih objekata 158080
Proteklo vreme 18 minuta(e), 7 sekundi

Inficirani procesi u memoriji: 0
Inficirani moduli u memoriji: 0
Inficirani ključevi u registru: 3
Inficirane vrednosti u registru: 1
Inficirani podaci u registru: 0
Inficirane fascikle: 3
Inficirane datoteke: 1

Inficirani procesi u memoriji:
(Maliciozne stavke nisu pronađene)

Inficirani moduli u memoriji:
(Maliciozne stavke nisu pronađene)

Inficirani ključevi u registru:
HKEY_CLASSES_ROOT\CLSID\{4D25F926-B9FE-4682-BF72-8AB8210D6D75} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\MyWaySearchAssistantDE.Auxiliary (Adware.MyWaySearch) -> No action taken.
HKEY_CLASSES_ROOT\MyWaySearchAssistantDE.Auxiliary.1 (Adware.MyWaySearch) -> No action taken.

Inficirane vrednosti u registru:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Video Drivers (Trojan.Agent) -> Value: Windows Video Drivers -> No action taken.

Inficirani podaci u registru:
(Maliciozne stavke nisu pronađene)

Inficirane fascikle:
c:\program files\microsoft common (Trojan.Agent) -> No action taken.
c:\program files\MyWaySA (Adware.MyWebSearch) -> No action taken.
c:\program files\MyWaySA\SrchAsDe (Adware.MyWebSearch) -> No action taken.

Inficirane datoteke:
c:\system volume information\_restore{46de8921-1d39-44d2-a9e9-64119261f211}\RP521\A0037634.com (Trojan.Buzus) -> No action taken.
« Poslednja izmena: 13. Dec 2010, 14:24:08 od NennadS »
IP sačuvana
social share
Deus ex machina.
Pogledaj profil
 
Prijava na forum:
Ime:
Lozinka:
Zelim biti prijavljen:
Trajanje:
Registruj nalog:
zaboravili ste šifru?
Ime:
Lozinka:
Ponovi Lozinku:
E-mail:
Zatvori
ivicaspas
Poruka #4 13. Dec 2010, 14:17:27
Prijatelj foruma
Poznata licnost

MC- argus

Zodijak
Pol Muškarac
Poruke 4467
Zastava
OS
Windows 7
Browser
Mozilla Firefox 3.6.13
mob
HTC 
U medjuvremenu skini MCShield

Ako kazes da nemas AV na tom kompu i da je opasnost samo od fleski, instaliraj ovaj program na taj racunar, ustvari instaliraj ga na sve racunare koje imas. Tako ces se zastititi od crva koji se sire preko fleski.
IP sačuvana
social share
Pogledaj profil
 
Prijava na forum:
Ime:
Lozinka:
Zelim biti prijavljen:
Trajanje:
Registruj nalog:
zaboravili ste šifru?
Ime:
Lozinka:
Ponovi Lozinku:
E-mail:
Zatvori
3maj001
Poruka #5 13. Dec 2010, 14:18:41
Prijatelj foruma
Legenda foruma

You'll never see me fall from grace

Zodijak
Pol Muškarac
Poruke 48490
OS
Windows XP
Browser
Mozilla Firefox 3.6.12
Иначе за компове који нису на нету можеш инсталирати Авиру и ручно је апдејтовати са времена на време

http://www.softpedia.com/get/Others/Signatures-Updates/Avira-Antivir-Virus-Definition-File-Update.shtml


IP sačuvana
social share

It's all a fucking joke anyway


       Tim: You never say please. You never say thank you.
Frank: Please don't be an idiot. Thank you.
Pogledaj profil
 
Prijava na forum:
Ime:
Lozinka:
Zelim biti prijavljen:
Trajanje:
Registruj nalog:
zaboravili ste šifru?
Ime:
Lozinka:
Ponovi Lozinku:
E-mail:
Zatvori
NennadS
Poruka #6 13. Dec 2010, 14:32:31
Jet set burekdzija


Question everything.

Zodijak Gemini
Pol Muškarac
Poruke 5329
Zastava Beograd
OS
Windows XP
Browser
Mozilla Firefox 3.6.12
Instalirao sam već ESET SS i McShield. Inače, šef zamolio (naredio) da ga očistim, misli da se ja kao nešto puno razumem. Smile Neka stoji ovaj SS, pa neka se on je*ava sa njim posle. Smile

Buni me zašto OTL ne daje log...
IP sačuvana
social share
Deus ex machina.
Pogledaj profil
 
Prijava na forum:
Ime:
Lozinka:
Zelim biti prijavljen:
Trajanje:
Registruj nalog:
zaboravili ste šifru?
Ime:
Lozinka:
Ponovi Lozinku:
E-mail:
Zatvori
ivicaspas
Poruka #7 13. Dec 2010, 14:40:33
Prijatelj foruma
Poznata licnost

MC- argus

Zodijak
Pol Muškarac
Poruke 4467
Zastava
OS
Windows 7
Browser
Mozilla Firefox 3.6.13
mob
HTC 
Brisi to sve gore. Iskljuci SRestore, restartuj pa ikljuci ponovo. Ponovo pokreni OTL
IP sačuvana
social share
Pogledaj profil
 
Prijava na forum:
Ime:
Lozinka:
Zelim biti prijavljen:
Trajanje:
Registruj nalog:
zaboravili ste šifru?
Ime:
Lozinka:
Ponovi Lozinku:
E-mail:
Zatvori
NennadS
Poruka #8 13. Dec 2010, 14:44:04
Jet set burekdzija


Question everything.

Zodijak Gemini
Pol Muškarac
Poruke 5329
Zastava Beograd
OS
Windows XP
Browser
Mozilla Firefox 3.6.12
Citat: ivicaspas 13. Dec 2010, 14:40:33
Brisi to sve gore. Iskljuci SRestore, restartuj pa ikljuci ponovo. Ponovo pokreni OTL

Obrisao sve što je mb našao.

Inače, nije davao log zato što sam pokrenuo OTL sa CD-a. Smile

Evo loga:

Citat
                                                                     
                                                                     
                                                                     
                                             
OTL logfile created on: 13.12.2010 14:39:28 - Run 4
OTL by OldTimer - Version 3.2.17.3     Folder = C:\Documents and Settings\Admin\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 0000081A | Country: Serbia and Montenegro | Language: SRL | Date Format: d.M.yyyy
 
1.014,00 Mb Total Physical Memory | 583,00 Mb Available Physical Memory | 57,00% Memory free
2,00 Gb Paging File | 2,00 Gb Available in Paging File | 86,00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74,41 Gb Total Space | 55,22 Gb Free Space | 74,20% Space Free | Partition Type: NTFS
Drive D: | 1,17 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: D3SLW72J | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2010.12.13 14:00:31 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Admin\Desktop\OTL.exe
PRC - [2010.11.04 21:06:14 | 000,261,120 | ---- | M] () -- C:\Program Files\MCShield\MCShieldRTM.exe
PRC - [2010.11.04 18:46:45 | 000,073,728 | ---- | M] () -- C:\Program Files\MCShield\MCShieldTray.exe
PRC - [2009.05.14 15:47:54 | 000,731,840 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET Smart Security\ekrn.exe
PRC - [2009.05.14 15:47:08 | 002,029,640 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET Smart Security\egui.exe
PRC - [2005.05.11 23:33:52 | 000,479,232 | ---- | M] (Hewlett-Packard Co.) -- C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
PRC - [2004.12.14 03:44:06 | 000,029,696 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
PRC - [2004.10.14 19:42:54 | 001,404,928 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\Core\smax4pnp.exe
PRC - [2004.08.04 05:00:00 | 001,032,192 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
 
 
========== Modules (SafeList) ==========
 
MOD - [2010.12.13 14:00:31 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Admin\Desktop\OTL.exe
MOD - [2004.08.04 05:00:00 | 001,050,624 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2009.05.14 15:54:22 | 000,020,680 | ---- | M] (ESET) [On_Demand | Stopped] -- C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe -- (EhttpSrv)
SRV - [2009.05.14 15:47:54 | 000,731,840 | ---- | M] (ESET) [Auto | Running] -- C:\Program Files\ESET\ESET Smart Security\ekrn.exe -- (ekrn)
SRV - [2006.07.10 16:32:46 | 000,495,616 | ---- | M] ( ) [On_Demand | Stopped] -- C:\WINDOWS\System32\lxdbcoms.exe -- (lxdb_device)
SRV - [2004.09.29 11:14:36 | 000,069,632 | ---- | M] (HP) [Auto | Stopped] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2009.05.14 15:49:26 | 000,055,768 | ---- | M] (ESET) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\epfwtdi.sys -- (epfwtdi)
DRV - [2009.05.14 15:49:26 | 000,033,096 | ---- | M] (ESET) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\epfwndis.sys -- (Epfwndis)
DRV - [2009.05.14 15:49:22 | 000,133,000 | ---- | M] (ESET) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\epfw.sys -- (epfw)
DRV - [2009.05.14 15:47:14 | 000,107,256 | ---- | M] (ESET) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ehdrv.sys -- (ehdrv)
DRV - [2009.05.14 15:41:10 | 000,114,472 | ---- | M] (ESET) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\eamon.sys -- (eamon)
DRV - [2006.11.22 09:01:48 | 000,693,760 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\hardlock.sys -- (Hardlock)
DRV - [2006.11.22 09:01:48 | 000,100,096 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\aksusb.sys -- (aksusb)
DRV - [2006.11.22 09:01:46 | 000,327,168 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\akshasp.sys -- (akshasp)
DRV - [2005.04.01 16:52:46 | 000,132,608 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k)
DRV - [2004.09.17 14:02:54 | 000,732,928 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\senfilt.sys -- (senfilt)
DRV - [2004.08.03 23:07:44 | 000,043,008 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\amdagp.sys -- (amdagp)
DRV - [2004.08.03 23:07:44 | 000,041,088 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sisagp.sys -- (sisagp)
DRV - [2004.08.03 22:29:56 | 001,897,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2001.08.17 14:07:44 | 000,019,072 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sparrow.sys -- (Sparrow)
DRV - [2001.08.17 14:07:42 | 000,030,688 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys -- (sym_u3)
DRV - [2001.08.17 14:07:40 | 000,028,384 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys -- (sym_hi)
DRV - [2001.08.17 14:07:36 | 000,032,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys -- (symc8xx)
DRV - [2001.08.17 14:07:34 | 000,016,256 | ---- | M] (Symbios Logic Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\symc810.sys -- (symc810)
DRV - [2001.08.17 13:52:22 | 000,036,736 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ultra.sys -- (ultra)
DRV - [2001.08.17 13:52:20 | 000,045,312 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql12160.sys -- (ql12160)
DRV - [2001.08.17 13:52:20 | 000,040,320 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql1080.sys -- (ql1080)
DRV - [2001.08.17 13:52:18 | 000,049,024 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql1280.sys -- (ql1280)
DRV - [2001.08.17 13:52:16 | 000,179,584 | ---- | M] (Mylex Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys -- (dac2w2k)
DRV - [2001.08.17 13:52:12 | 000,017,280 | ---- | M] (American Megatrends Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys -- (mraid35x)
DRV - [2001.08.17 13:52:00 | 000,026,496 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\asc.sys -- (asc)
DRV - [2001.08.17 13:51:58 | 000,014,848 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\asc3550.sys -- (asc3550)
DRV - [2001.08.17 13:51:56 | 000,005,248 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\aliide.sys -- (AliIde)
DRV - [2001.08.17 13:51:54 | 000,006,656 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\cmdide.sys -- (CmdIde)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www1.euro.dell.com/content/default.aspx?c=de&l=de&s=gen
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www1.euro.dell.com/content/default.aspx?c=de&l=de&s=gen
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 192.168.11*;<local>
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 147.91.1.45:8080
 
FF - HKLM\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2010.12.13 13:34:44 | 000,000,000 | ---D | M]
 
 
O1 HOSTS File: ([2004.08.04 05:00:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET Smart Security\egui.exe (ESET)
O4 - HKLM..\Run: [LXDBCATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXDBtime.DLL ()
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.)
O4 - HKCU..\Run: [MCShield] C:\Program Files\MCShield\MCShieldRTM.exe ()
O4 - HKCU..\Run: [MCShieldTray] C:\Program Files\MCShield\MCShieldTray.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\NPJPI150_06.dll (Sun Microsystems, Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab (Java Plug-in 1.4.2_03)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Java Plug-in 1.5.0_06)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004.08.11 17:15:00 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{1213df47-01b4-11df-8cf9-000e0cb0a039}\Shell\AutoRun\command - "" = E:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\usb.exe -- File not found
O33 - MountPoints2\{1213df47-01b4-11df-8cf9-000e0cb0a039}\Shell\open\command - "" = E:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\usb.exe -- File not found
O33 - MountPoints2\{1213df48-01b4-11df-8cf9-000e0cb0a039}\Shell\AutoRun\command - "" = E:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\usb.exe -- File not found
O33 - MountPoints2\{1213df48-01b4-11df-8cf9-000e0cb0a039}\Shell\open\command - "" = E:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\usb.exe -- File not found
O33 - MountPoints2\{5350ebd6-3c8c-11de-8cd8-000e0cb0a039}\Shell\AutoRun\command - "" = E:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\usb.exe -- File not found
O33 - MountPoints2\{5350ebd6-3c8c-11de-8cd8-000e0cb0a039}\Shell\open\command - "" = E:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\usb.exe -- File not found
O33 - MountPoints2\{9881709e-ea27-11de-8cf7-000e0cb0a039}\Shell\AutoRun\command - "" = E:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\usb.exe -- File not found
O33 - MountPoints2\{9881709e-ea27-11de-8cf7-000e0cb0a039}\Shell\open\command - "" = E:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\usb.exe -- File not found
O33 - MountPoints2\{a6d94f44-d5a5-11dd-8c95-000e0cb0a039}\Shell - "" = AutoRun
O33 - MountPoints2\{a6d94f44-d5a5-11dd-8c95-000e0cb0a039}\Shell\Auto\command - "" = E:\UFO.exe -- File not found
O33 - MountPoints2\{a6d94f44-d5a5-11dd-8c95-000e0cb0a039}\Shell\AutoRun - "" = Auto&Play
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.12.13 14:39:16 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Admin\Desktop\OTL.exe
[2010.12.13 13:38:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Admin\Application Data\MCShield
[2010.12.13 13:38:02 | 000,000,000 | ---D | C] -- C:\Program Files\MCShield
[2010.12.13 13:37:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Admin\Application Data\Malwarebytes
[2010.12.13 13:37:39 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.12.13 13:37:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010.12.13 13:37:34 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.12.13 13:37:34 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010.12.13 13:36:58 | 000,000,000 | ---D | C] -- C:\Program Files\TNod User & Password Finder
[2010.12.13 13:36:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Admin\Application Data\ESET
[2010.12.13 13:32:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Admin\Application Data\WinRAR
[2010.12.13 13:31:56 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR
[2010.12.08 12:33:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Admin\Desktop\Miroslav Nikolic Data
[2010.12.08 12:18:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Admin\Desktop\DATA
[2009.02.23 12:07:15 | 000,393,216 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdbiesc.dll
[2009.02.23 12:07:14 | 000,409,600 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdbinpa.dll
[2009.02.23 12:07:13 | 000,536,576 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdblmpm.dll
[2009.02.23 12:07:13 | 000,421,888 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdbcomm.dll
[2009.02.23 12:07:13 | 000,114,688 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdbpplc.dll
[2009.02.23 12:07:12 | 001,183,744 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdbserv.dll
[2009.02.23 12:07:12 | 000,995,328 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdbusb1.dll
[2009.02.23 12:07:12 | 000,696,320 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdbhbn3.dll
[2009.02.23 12:07:12 | 000,610,304 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdbcomc.dll
[2009.02.23 12:07:12 | 000,163,840 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdbprox.dll
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.12.13 14:35:01 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.12.13 14:34:37 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.12.13 14:34:35 | 1063,399,424 | -HS- | M] () -- C:\hiberfil.sys
[2010.12.13 14:34:35 | 000,119,744 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010.12.13 14:00:31 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Admin\Desktop\OTL.exe
[2010.12.13 13:37:40 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.12.13 13:36:58 | 000,001,583 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Update NOD32 license.lnk
[2010.12.10 15:18:29 | 000,002,529 | ---- | M] () -- C:\Documents and Settings\Admin\Desktop\Microsoft Excel.lnk
[2010.12.10 12:00:00 | 000,000,366 | ---- | M] () -- C:\WINDOWS\tasks\HPpromotions journeysoftware.job
[2010.11.29 17:42:18 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.11.29 17:42:06 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.12.13 13:37:40 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.12.13 13:36:58 | 000,001,583 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Update NOD32 license.lnk
[2009.02.23 12:07:26 | 000,001,504 | R--- | C] () -- C:\WINDOWS\System32\lxdbprod.ini
[2009.02.23 12:07:13 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxdbvs.dll
[2008.04.17 11:29:02 | 000,001,380 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2007.10.11 15:00:19 | 000,006,836 | ---- | C] () -- C:\WINDOWS\System32\UNWISE.INI
[2007.09.14 13:03:52 | 000,000,403 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2007.08.20 07:51:00 | 000,208,896 | ---- | C] () -- C:\WINDOWS\System32\NetCdf.dll
[2007.01.11 12:39:28 | 000,000,260 | ---- | C] () -- C:\WINDOWS\OPLV.INI
[2006.11.27 07:13:31 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2006.08.12 08:33:19 | 000,003,584 | ---- | C] () -- C:\Documents and Settings\Admin\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006.06.24 10:31:03 | 000,000,128 | ---- | C] () -- C:\Documents and Settings\Admin\Local Settings\Application Data\fusioncache.dat
[2006.04.30 09:48:55 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006.04.30 09:33:32 | 000,000,474 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2005.04.27 21:38:00 | 000,372,736 | ---- | C] () -- C:\WINDOWS\System32\hpzidi01.dll
[2005.04.27 21:37:49 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\hpzids01.dll
[2004.08.11 17:24:19 | 000,000,791 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2004.08.11 17:11:31 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2004.08.11 17:07:24 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2004.08.11 17:00:30 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys
[2004.08.11 17:00:16 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll
[1999.01.22 19:46:58 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\MSRTEDIT.DLL

< End of report >
IP sačuvana
social share
Deus ex machina.
Pogledaj profil
 
Prijava na forum:
Ime:
Lozinka:
Zelim biti prijavljen:
Trajanje:
Registruj nalog:
zaboravili ste šifru?
Ime:
Lozinka:
Ponovi Lozinku:
E-mail:
Zatvori
ivicaspas
Poruka #9 13. Dec 2010, 15:03:53
Prijatelj foruma
Poznata licnost

MC- argus

Zodijak
Pol Muškarac
Poruke 4467
Zastava
OS
Windows 7
Browser
Mozilla Firefox 3.6.13
mob
HTC 
Pokreni OTL

U beli okvir prozora gde piše Custom Scans/Fixes kopiraj sledece:

Kod:
:OTL
O33 - MountPoints2\{1213df47-01b4-11df-8cf9-000e0cb0a039}\Shell\AutoRun\command - "" = E:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\usb.exe -- File not found
O33 - MountPoints2\{1213df47-01b4-11df-8cf9-000e0cb0a039}\Shell\open\command - "" = E:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\usb.exe -- File not found
O33 - MountPoints2\{1213df48-01b4-11df-8cf9-000e0cb0a039}\Shell\AutoRun\command - "" = E:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\usb.exe -- File not found
O33 - MountPoints2\{1213df48-01b4-11df-8cf9-000e0cb0a039}\Shell\open\command - "" = E:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\usb.exe -- File not found
O33 - MountPoints2\{5350ebd6-3c8c-11de-8cd8-000e0cb0a039}\Shell\AutoRun\command - "" = E:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\usb.exe -- File not found
O33 - MountPoints2\{5350ebd6-3c8c-11de-8cd8-000e0cb0a039}\Shell\open\command - "" = E:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\usb.exe -- File not found
O33 - MountPoints2\{9881709e-ea27-11de-8cf7-000e0cb0a039}\Shell\AutoRun\command - "" = E:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\usb.exe -- File not found
O33 - MountPoints2\{9881709e-ea27-11de-8cf7-000e0cb0a039}\Shell\open\command - "" = E:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\usb.exe -- File not found
O33 - MountPoints2\{a6d94f44-d5a5-11dd-8c95-000e0cb0a039}\Shell - "" = AutoRun
O33 - MountPoints2\{a6d94f44-d5a5-11dd-8c95-000e0cb0a039}\Shell\Auto\command - "" = E:\UFO.exe -- File not found
O33 - MountPoints2\{a6d94f44-d5a5-11dd-8c95-000e0cb0a039}\Shell\AutoRun - "" = Auto&Play
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

:commands
[purity]
[emptytemp]
[Reboot]

Klikni taster Run Fix;


Log koji dobiješ iskopiraj ovde

IP sačuvana
social share
Pogledaj profil
 
Prijava na forum:
Ime:
Lozinka:
Zelim biti prijavljen:
Trajanje:
Registruj nalog:
zaboravili ste šifru?
Ime:
Lozinka:
Ponovi Lozinku:
E-mail:
Zatvori
Idi gore
Stranice:
1
2  Sve
Počni novu temu Nova anketa Odgovor Štampaj Dodaj temu u favorite Pogledajte svoje poruke u temi
linktree Burek :: Forumi ::  >  Tehnicki deo foruma  >  Pc Klinika ~ Doktori za vas kompjuter
linktree Tema: Worm, pomoć (Moderatori: enaB, chelavi1)
Trenutno vreme je: 20. Jul 2025, 15:02:56
 nazadnapred
Prebaci se na:  

Poslednji odgovor u temi napisan je pre više od 6 meseci.  

Temu ne bi trebalo "iskopavati" osim u slučaju da imate nešto važno da dodate. Ako ipak želite napisati komentar, kliknite na dugme "Odgovori" u meniju iznad ove poruke. Postoje teme kod kojih su odgovori dobrodošli bez obzira na to koliko je vremena od prošlog prošlo. Npr. teme o određenom piscu, knjizi, muzičaru, glumcu i sl. Nemojte da vas ovaj spisak ograničava, ali nemojte ni pisati na teme koje su završena priča.
web design

Forum Info: Banneri Foruma :: Burek Toolbar :: Burek Prodavnica :: Burek Quiz :: Najcesca pitanja :: Tim Foruma :: Prijava zloupotrebe

Izvori vesti: Blic :: Wikipedia :: Mondo :: Press :: Naša mreža :: Sportska Centrala :: Glas Javnosti :: Kurir :: Mikro :: B92 Sport :: RTS :: Danas

Prijatelji foruma: Triviador :: Nova godina Beograd :: nova godina restorani :: FTW.rs :: MojaPijaca :: Pojacalo :: 011info :: Burgos :: Sudski tumač Novi Beograd

Pravne Informacije: Pravilnik Foruma :: Politika privatnosti :: Uslovi koriscenja :: O nama :: Marketing :: Kontakt :: Sitemap

All content on this website is property of "Burek.com" and, as such, they may not be used on other websites without written permission.

Copyright © 2002- "Burek.com", all rights reserved. Performance: 0.062 sec za 14 q. Powered by: SMF. © 2005, Simple Machines LLC.