Prijatelji,
Vec se danima mucim sa nekim trojancima koji su mi okupirali komp. na poslu,zivce mi pojedose.Uspem da ih nekoliko lociram AVG-om,neke Ad-Aware pronadje,neke Avast (on je default na kompu,AVG po potrebi za scan).I kao sve je u redu.Medjutim posle nekoliko sati Avast izbaci poruku da je locirao neke viruse-trojance ili slicnu gamad.Znaci da ih nije do kraja uklonio nijedan scan.
Ovo je logfile pa molim nekog ko se razume da mi kaze kako i sta da pobrisem.
Logfile of HijackThis v1.99.1
Scan saved at 9:49:59, on 7.2.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\Smartscaps.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SCARDS32.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\SafeSignCertReg.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe
C:\Program Files\SmartTrust\SmartTrust Personal\Csp\SmartCertmover.exe
C:\Program Files\Global Devtech\Network Chat\Network Chat.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\New PFilles\HJT\hijackthis.exe
O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\Program Files\DAP\DAPBHO.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Microsoft Configuration - {40205287-E793-41AC-B95C-D8D064BA33CA} - C:\WINDOWS\system32\mscfg.dll (file missing)
O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\Program Files\DAP\DAPIEBar.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CertificateRegistration] SafeSignCertReg.exe
O4 - HKLM\..\Run: [smss] C:\WINDOWS\System\SMSS.EXE
O4 - HKLM\..\Run: [lssas] C:\WINDOWS\System\lssas.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [lnwin.exe] C:\WINDOWS\system32\lnwin.exe
O4 - HKLM\..\Run: [sysinter] C:\WINDOWS\system32\adirss.exe
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender8\bdmcon.exe"
O4 - HKLM\..\Run: [BDNewsAgent] "C:\Program Files\Softwin\BitDefender8\bdnagent.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AWMON] "C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdS7_0_0 -reboot 1
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Certificate Mover.lnk = ?
O4 - Global Startup: Network Chat AutoStart.lnk = C:\Program Files\Global Devtech\Network Chat\Network Chat.exe
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\PROGRA~1\DAP\DAP.EXE
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9EDFB8A6-E065-489A-8E6B-1548AAC8CDED}: NameServer = 194.106.162.2,194.106.162.10
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: SmartTrust Smart Card Server (Smartscaps) - SmartTrust - C:\WINDOWS\system32\Smartscaps.exe
O23 - Service: CHIPDRIVE SCARD Service (TWKSCARDSRV) - SCM Microsystems - C:\WINDOWS\SCARDS32.EXE
Ovo je AVG-ov report uradjen jutros pa pogledajte sta sam sve uklonio.Ovaj Zhelatin se stalno vraca,onda neki ABC.EXE i jos neki Trojan-Gen.
AVG Anti-Spyware - Scan Report
---------------------------------------------------------
+ Created at: 10:48:14 7.2.2007
+ Scan result:
C:\Program Files\Video ActiveX Object -> Adware.Generic : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{32AE813B-379F-452E-8B2C-5E9C92B1D9DA}\RP358\A0103657.exe -> Proxy.Lager.fa : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{32AE813B-379F-452E-8B2C-5E9C92B1D9DA}\RP357\A0103627.exe -> Worm.Banwarum.f : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{32AE813B-379F-452E-8B2C-5E9C92B1D9DA}\RP358\A0103656.exe -> Worm.Banwarum.f : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{32AE813B-379F-452E-8B2C-5E9C92B1D9DA}\RP359\A0104744.exe -> Worm.Zhelatin.d : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{32AE813B-379F-452E-8B2C-5E9C92B1D9DA}\RP359\A0104739.exe -> Worm.Zhelatin.f : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{32AE813B-379F-452E-8B2C-5E9C92B1D9DA}\RP359\A0104740.exe -> Worm.Zhelatin.f : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{32AE813B-379F-452E-8B2C-5E9C92B1D9DA}\RP359\A0104741.exe -> Worm.Zhelatin.h : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{32AE813B-379F-452E-8B2C-5E9C92B1D9DA}\RP359\A0104742.exe -> Worm.Zhelatin.h : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{32AE813B-379F-452E-8B2C-5E9C92B1D9DA}\RP359\A0104743.exe -> Worm.Zhelatin.i : Cleaned with backup (quarantined).
C:\WINDOWS\system32\GDrrTIs.exe -> Worm.Zhelatin.m : Cleaned with backup (quarantined).
::Report end
Sta da radim?Samo bez komentara tipa Format i slicno.Ova sranja su na bitnom kompu prepunom podataka pa tako nesto nema sanse da uradim osim ako ne budem primoran.
Hvala!
Vec se danima mucim sa nekim trojancima koji su mi okupirali komp. na poslu,zivce mi pojedose.Uspem da ih nekoliko lociram AVG-om,neke Ad-Aware pronadje,neke Avast (on je default na kompu,AVG po potrebi za scan).I kao sve je u redu.Medjutim posle nekoliko sati Avast izbaci poruku da je locirao neke viruse-trojance ili slicnu gamad.Znaci da ih nije do kraja uklonio nijedan scan.
Ovo je logfile pa molim nekog ko se razume da mi kaze kako i sta da pobrisem.
Logfile of HijackThis v1.99.1
Scan saved at 9:49:59, on 7.2.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\Smartscaps.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SCARDS32.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\SafeSignCertReg.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe
C:\Program Files\SmartTrust\SmartTrust Personal\Csp\SmartCertmover.exe
C:\Program Files\Global Devtech\Network Chat\Network Chat.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\New PFilles\HJT\hijackthis.exe
O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\Program Files\DAP\DAPBHO.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Microsoft Configuration - {40205287-E793-41AC-B95C-D8D064BA33CA} - C:\WINDOWS\system32\mscfg.dll (file missing)
O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\Program Files\DAP\DAPIEBar.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CertificateRegistration] SafeSignCertReg.exe
O4 - HKLM\..\Run: [smss] C:\WINDOWS\System\SMSS.EXE
O4 - HKLM\..\Run: [lssas] C:\WINDOWS\System\lssas.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [lnwin.exe] C:\WINDOWS\system32\lnwin.exe
O4 - HKLM\..\Run: [sysinter] C:\WINDOWS\system32\adirss.exe
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender8\bdmcon.exe"
O4 - HKLM\..\Run: [BDNewsAgent] "C:\Program Files\Softwin\BitDefender8\bdnagent.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AWMON] "C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdS7_0_0 -reboot 1
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Certificate Mover.lnk = ?
O4 - Global Startup: Network Chat AutoStart.lnk = C:\Program Files\Global Devtech\Network Chat\Network Chat.exe
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\PROGRA~1\DAP\DAP.EXE
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9EDFB8A6-E065-489A-8E6B-1548AAC8CDED}: NameServer = 194.106.162.2,194.106.162.10
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: SmartTrust Smart Card Server (Smartscaps) - SmartTrust - C:\WINDOWS\system32\Smartscaps.exe
O23 - Service: CHIPDRIVE SCARD Service (TWKSCARDSRV) - SCM Microsystems - C:\WINDOWS\SCARDS32.EXE
Ovo je AVG-ov report uradjen jutros pa pogledajte sta sam sve uklonio.Ovaj Zhelatin se stalno vraca,onda neki ABC.EXE i jos neki Trojan-Gen.
AVG Anti-Spyware - Scan Report
---------------------------------------------------------
+ Created at: 10:48:14 7.2.2007
+ Scan result:
C:\Program Files\Video ActiveX Object -> Adware.Generic : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{32AE813B-379F-452E-8B2C-5E9C92B1D9DA}\RP358\A0103657.exe -> Proxy.Lager.fa : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{32AE813B-379F-452E-8B2C-5E9C92B1D9DA}\RP357\A0103627.exe -> Worm.Banwarum.f : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{32AE813B-379F-452E-8B2C-5E9C92B1D9DA}\RP358\A0103656.exe -> Worm.Banwarum.f : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{32AE813B-379F-452E-8B2C-5E9C92B1D9DA}\RP359\A0104744.exe -> Worm.Zhelatin.d : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{32AE813B-379F-452E-8B2C-5E9C92B1D9DA}\RP359\A0104739.exe -> Worm.Zhelatin.f : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{32AE813B-379F-452E-8B2C-5E9C92B1D9DA}\RP359\A0104740.exe -> Worm.Zhelatin.f : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{32AE813B-379F-452E-8B2C-5E9C92B1D9DA}\RP359\A0104741.exe -> Worm.Zhelatin.h : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{32AE813B-379F-452E-8B2C-5E9C92B1D9DA}\RP359\A0104742.exe -> Worm.Zhelatin.h : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{32AE813B-379F-452E-8B2C-5E9C92B1D9DA}\RP359\A0104743.exe -> Worm.Zhelatin.i : Cleaned with backup (quarantined).
C:\WINDOWS\system32\GDrrTIs.exe -> Worm.Zhelatin.m : Cleaned with backup (quarantined).
::Report end
Sta da radim?Samo bez komentara tipa Format i slicno.Ova sranja su na bitnom kompu prepunom podataka pa tako nesto nema sanse da uradim osim ako ne budem primoran.
Hvala!