Problem sa C:\Win\lsass.exe

Molim vas moze li mi neko pomoći?!
Pojavio mi se isass.exe,googlao sam i procitao da je nije "zdrav" :) za moj komp.
Unaprijed hvala!!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:08:19, on 7/30/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\PC\Desktop\123\123.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar.dll
O4 - HKLM\..\Run: [Device Detector] DevDetect.exe -autorun
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [run32] C:\Win\lsass.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\googletoolbar.dll/cmsearch.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 6447 bytes

Preuzmi ovaj program: OTM
http://oldtimer.geekstogo.com/OTM.exe

Pokreni program i u levi prozor ispod " Paste Instructions for Items to be Moved "
iskopiraj sve dole sto sam ti oznacio:




Idi na MoveIt!

restartuj komp....

Onda Skini DDS sa ovog linka:
http://download.bleepingcomputer.com/sUBs/dds.scr

Pokreni ga i sacekaj par minuta da program zavrsi skeniranje. Kad zavrsi napravice dva loga.
Prvi se zove Attach.txt i on nam netreba vec onaj drugi ( veci ) koji se zove DDS.txt

Tj log DDS.txt odmah kopiraj u drugi notepad ( File > Save As ) i taj notepad prikaci uz poruku
[/quote]

Potpis

http://www.itfix.biz/images/Malware.JPG

Interesantna stvar ali skoro sam ubio kod drugara taj virus, crv ili sta vec bese. Uradio ovako skini AV ESET SMART SECURITY 3.0.672. prvo obrisi taj fajl na lokaciji c\win\ i tu obrisi sve sto ima pa onda otvori Registry i obrisi svude gde nadjes c:\win pa onda idi start pa Run i tu kucaj "msconfig"(naravno ako imas XP) i tu ides na stavku startup i tu obrises tamo gde pise c:\win\isass.exe posle samo restart i instaliras AV nek ti skenira lepo komp kad nadje sve obrises viruse pa restart i onda ce da ga izbrise iz kompa

Potpis

Ako te snadje muka pozovi hajduka
Pazi se hajduka ako ga snjadje muka

Hvala na javljanju!Cekam dalje upute, pozz


DDS (Ver_09-07-30.01) - NTFSx86
Run by PC at 16:34:09.85 on Thu 07/30/2009
Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_06
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2046.1376 [GMT 2:00]

AV: ESET Smart Security 3.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET Personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\PC\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.yahoo.com/
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_06\bin\ssv.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar.dll
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
mRun: [Device Detector] DevDetect.exe -autorun
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [egui] "c:\program files\eset\eset smart security\egui.exe" /hide /waitservice
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [run32] c:\win\lsass.exe
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
dRunOnce: [RunNarrator] Narrator.exe
IE: &Google Search - c:\program files\google\googletoolbar.dll/cmsearch.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_06\bin\ssv.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~2\office12\GR99D3~1.DLL
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
SEH: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - No File
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL
SecurityProviders: msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,
LSA: Authentication Packages = msv1_0 c:\windows\system32\yayaYpMF

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\pc\applic~1\mozilla\firefox\profiles\1nptc0nz.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.startup.homepage - hxxp://www.vijesti.cg.yu/
FF - component: c:\program files\nokia\nokia pc suite 7\bkmrksync\components\BkMrkExt.dll
FF - component: c:\program files\real\realplayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll
FF - plugin: c:\documents and settings\all users\application data\zylom\zylomgamesplayer\npzylomgamesplayer.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npyaxmpb.dll

---- FIREFOX POLICIES ----

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-5-13 64160]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2008-2-1 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2008-2-1 51440]
R2 {B154377D-700F-42cc-9474-23858FBDF4BD};Power Control [2009/05/13 08:40:42];c:\program files\cyberlink\powerdvd9\000.fcl [2009-2-28 87536]
R2 aawservice;Ad-Aware 2007 Service;c:\program files\lavasoft\ad-aware 2007\aawservice.exe [2008-1-4 587096]
R2 ekrn;Eset Service;c:\program files\eset\eset smart security\ekrn.exe [2007-12-21 468224]
R3 camvid20;Philips ToUcam Camera; Video;c:\windows\system32\drivers\camdrv21.sys [2008-5-14 223232]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-3-9 1029456]
S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2006-2-16 4096]
S3 WFIOCTL;WFIOCTL;c:\program files\winfast\wfdtv\WFIOCTL.sys [2008-5-14 9446]

============== File Associations ===============

regfile=regedit.exe "%1" %*

=============== Created Last 30 ================

2009-07-30 16:31 <DIR> --d----- C:\_OTM
2009-07-21 00:52 352 a---h--- c:\windows\nod32fixtemdono.reg
2009-07-21 00:51 <DIR> --d----- c:\program files\ESET
2009-07-21 00:47 360,192 a------- c:\windows\system32\TuneUpDefragService.exe
2009-07-18 23:41 54,156 a---h--- c:\windows\QTFont.qfn
2009-07-18 23:41 1,409 a------- c:\windows\QTFont.for
2009-07-11 21:31 <DIR> --d----- C:\VundoFix Backups
2009-07-11 17:58 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Jes-Soft
2009-07-09 18:34 25 a------- c:\windows\cdplayer.ini
2009-07-09 18:34 <DIR> --d----- c:\program files\common files\xing shared

==================== Find3M ====================

2009-07-13 13:36 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-13 13:36 19,096 a------- c:\windows\system32\drivers\mbam.sys
2009-07-09 18:34 499,712 a------- c:\windows\system32\msvcp71.dll
2009-07-09 18:34 348,160 a------- c:\windows\system32\msvcr71.dll
2009-06-26 18:18 659,456 a------- c:\windows\system32\wininet.dll
2009-06-26 18:18 81,920 a------- c:\windows\system32\ieencode.dll
2009-06-16 16:55 119,808 a------- c:\windows\system32\t2embed.dll
2009-06-16 16:55 82,432 a------- c:\windows\system32\fontsub.dll
2009-06-03 21:27 1,290,752 a------- c:\windows\system32\quartz.dll
2009-06-01 16:18 15,688 a------- c:\windows\system32\lsdelete.exe
2009-05-13 08:38 29,480 a------- c:\windows\system32\msxml3a.dll
2009-05-12 22:42 87,608 a------- c:\docume~1\pc\applic~1\inst.exe
2009-05-12 22:42 47,360 a------- c:\docume~1\pc\applic~1\pcouffin.sys
2009-05-07 17:44 344,064 a------- c:\windows\system32\localspl.dll
2008-05-15 16:32 32 a------- c:\docume~1\alluse~1\applic~1\ezsid.dat

============= FINISH: 16:34:36.07 ===============

To je to. Kompjuter je cist. Sad mozes obrisati sve te dijagnosticke alate koje smo koristili.

Potpis

http://www.itfix.biz/images/Malware.JPG

Jeli ovo ok, treba li da postoji ovo i kako da se ukloni?Pozz

izvini moja startiva...preskocio sam jedan mali deo loga...mali ali dovoljan...

Skini ovaj program:
Avenger
http://swandog46.geekstogo.com/avenger2/download.php

Znaci raspakuj Program u neki Folder na Desktop pa ga pokreni:

Iskopiraj ovaj tekst:



Idi na Execute ...pa Yes...Yes ... doci ce do restarta kompjutera

posle toga mi molim te postavi novi DDS log i HJT log


Ako ga sila od Avengera ne ukloni idemo na drasticnije mere

Potpis

http://www.itfix.biz/images/Malware.JPG

"Naredjenje izvrsenje" :)
ono isass i dalje postoji

DDS (Ver_09-07-30.01) - NTFSx86
Run by PC at 17:32:06.65 on Thu 07/30/2009
Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_06
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2046.1452 [GMT 2:00]

AV: ESET Smart Security 3.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET Personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\PC\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.yahoo.com/
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_06\bin\ssv.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar.dll
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
mRun: [Device Detector] DevDetect.exe -autorun
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [egui] "c:\program files\eset\eset smart security\egui.exe" /hide /waitservice
mRun: [run32] c:\_otm\movedfiles\07302009_163103\win\lsass.exe
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
dRunOnce: [RunNarrator] Narrator.exe
IE: &Google Search - c:\program files\google\googletoolbar.dll/cmsearch.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_06\bin\ssv.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~2\office12\GR99D3~1.DLL
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
SEH: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - No File
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL
SecurityProviders: msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,
LSA: Authentication Packages = msv1_0 c:\windows\system32\yayaYpMF

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\pc\applic~1\mozilla\firefox\profiles\1nptc0nz.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.startup.homepage - hxxp://www.vijesti.cg.yu/
FF - component: c:\program files\nokia\nokia pc suite 7\bkmrksync\components\BkMrkExt.dll
FF - component: c:\program files\real\realplayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll
FF - plugin: c:\documents and settings\all users\application data\zylom\zylomgamesplayer\npzylomgamesplayer.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npyaxmpb.dll

---- FIREFOX POLICIES ----

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-5-13 64160]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2008-2-1 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2008-2-1 51440]
R2 {B154377D-700F-42cc-9474-23858FBDF4BD};Power Control [2009/05/13 08:40:42];c:\program files\cyberlink\powerdvd9\000.fcl [2009-2-28 87536]
R2 aawservice;Ad-Aware 2007 Service;c:\program files\lavasoft\ad-aware 2007\aawservice.exe [2008-1-4 587096]
R2 ekrn;Eset Service;c:\program files\eset\eset smart security\ekrn.exe [2007-12-21 468224]
R3 camvid20;Philips ToUcam Camera; Video;c:\windows\system32\drivers\camdrv21.sys [2008-5-14 223232]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-3-9 1029456]
S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2006-2-16 4096]
S3 WFIOCTL;WFIOCTL;c:\program files\winfast\wfdtv\WFIOCTL.sys [2008-5-14 9446]

============== File Associations ===============

regfile=regedit.exe "%1" %*

=============== Created Last 30 ================

2009-07-30 16:31 <DIR> --d----- C:\_OTM
2009-07-21 00:52 352 a---h--- c:\windows\nod32fixtemdono.reg
2009-07-21 00:51 <DIR> --d----- c:\program files\ESET
2009-07-21 00:47 360,192 a------- c:\windows\system32\TuneUpDefragService.exe
2009-07-18 23:41 54,156 a---h--- c:\windows\QTFont.qfn
2009-07-18 23:41 1,409 a------- c:\windows\QTFont.for
2009-07-11 21:31 <DIR> --d----- C:\VundoFix Backups
2009-07-11 17:58 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Jes-Soft
2009-07-09 18:34 25 a------- c:\windows\cdplayer.ini
2009-07-09 18:34 <DIR> --d----- c:\program files\common files\xing shared

==================== Find3M ====================

2009-07-13 13:36 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-13 13:36 19,096 a------- c:\windows\system32\drivers\mbam.sys
2009-07-09 18:34 499,712 a------- c:\windows\system32\msvcp71.dll
2009-07-09 18:34 348,160 a------- c:\windows\system32\msvcr71.dll
2009-06-26 18:18 659,456 a------- c:\windows\system32\wininet.dll
2009-06-26 18:18 81,920 a------- c:\windows\system32\ieencode.dll
2009-06-16 16:55 119,808 a------- c:\windows\system32\t2embed.dll
2009-06-16 16:55 82,432 a------- c:\windows\system32\fontsub.dll
2009-06-03 21:27 1,290,752 a------- c:\windows\system32\quartz.dll
2009-06-01 16:18 15,688 a------- c:\windows\system32\lsdelete.exe
2009-05-13 08:38 29,480 a------- c:\windows\system32\msxml3a.dll
2009-05-12 22:42 87,608 a------- c:\docume~1\pc\applic~1\inst.exe
2009-05-12 22:42 47,360 a------- c:\docume~1\pc\applic~1\pcouffin.sys
2009-05-07 17:44 344,064 a------- c:\windows\system32\localspl.dll
2008-05-15 16:32 32 a------- c:\docume~1\alluse~1\applic~1\ezsid.dat

============= FINISH: 17:32:32.26 ===============

Hajde sad obrisi OTM iz kompjutera,restartuj kompjuter pa pokreni HijackThis log i proveri jel se nalazi neka od ovih linija

O4 - HKLM\..\Run: [run32] C:\Win\lsass.exe

O4 - HKLM\..\Run: [run32] c:\_otm\movedfiles\07302009_163103\win\lsass.exe

ili mi postavi HJT log..kako ti lakse

Potpis

http://www.itfix.biz/images/Malware.JPG

Kako se brise otm? Ja sam ga odavno izbrisao ,desni klik i delete.Ako se tako brise :(
Bolje da majstor provjeri...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:46:26, on 7/30/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\_OTM\MovedFiles\07302009_163103\Win\lsass.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\PC\Desktop\123\123.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar.dll
O4 - HKLM\..\Run: [Device Detector] DevDetect.exe -autorun
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [run32] C:\_OTM\MovedFiles\07302009_163103\Win\lsass.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\googletoolbar.dll/cmsearch.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 6529 bytes

boze...svasta...

Pazljivo isprati uputstvo za skidanje Combofix

http://www.elitesecurity.org/t...e-programa-HijackThis-ComboFix

znaci pre skidanja obavezno iskljuci AntiVirus program,
znaci pokreni ESET AV >> idi na "Setup >> izaberi "Antivirus and antispyware"
opciju i klikni na "Temporarily disable Antivirus and antispyware protection"

pa po datom uputstvu pokreni skriptu i postavi mi log koji CF napravi na kraju

Potpis

http://www.itfix.biz/images/Malware.JPG

Nadam se da sam sve odradio kako treba jer isass je i dalje tu :( !

ComboFix 09-07-29.04 - PC 07/30/2009 18:08.1.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2046.1598 [GMT 2:00]
Running from: c:\documents and settings\PC\Desktop\ComboFix.exe
AV: ESET Smart Security 3.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET Personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\PC\Application Data\.#
c:\documents and settings\PC\Application Data\inst.exe
c:\windows\Installer\19a771e.msi
c:\windows\Installer\a41ed.msi
c:\windows\Installer\fff055.msi
c:\windows\system32\Dvbpws.dll

.
((((((((((((((((((((((((( Files Created from 2009-06-28 to 2009-07-30 )))))))))))))))))))))))))))))))
.

2009-07-30 14:31 . 2009-07-30 14:31 -------- d-----w- C:\_OTM
2009-07-30 12:15 . 2009-07-30 12:15 328 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090730141520.bat
2009-07-29 08:54 . 2009-07-29 08:54 2883 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090729105403.bat
2009-07-27 18:06 . 2009-07-27 18:06 337 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090727200645.bat
2009-07-27 14:08 . 2009-07-27 14:08 551 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090727160838.bat
2009-07-26 18:17 . 2009-07-26 18:17 554 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090726201739.bat
2009-07-20 22:52 . 2008-01-07 12:29 352 ---ha-w- c:\windows\nod32fixtemdono.reg
2009-07-20 22:51 . 2009-07-20 22:51 -------- d-----w- c:\program files\ESET
2009-07-20 22:47 . 2009-07-20 22:47 360192 ----a-w- c:\windows\system32\TuneUpDefragService.exe
2009-07-20 19:06 . 2009-07-20 19:06 431 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090720210656.bat
2009-07-20 11:13 . 2009-07-20 11:13 345 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090720131348.bat
2009-07-20 11:10 . 2009-07-20 11:10 360 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090720131025.bat
2009-07-20 11:05 . 2009-07-20 11:05 354 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090720130559.bat
2009-07-20 11:01 . 2009-07-20 11:01 345 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090720130145.bat
2009-07-19 16:18 . 2009-07-19 16:18 352 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090719181830.bat
2009-07-11 19:31 . 2009-07-11 19:31 -------- d-----w- C:\VundoFix Backups
2009-07-11 15:58 . 2009-07-11 15:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Jes-Soft
2009-07-10 15:05 . 2009-07-10 15:05 557 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090710170525.bat
2009-07-10 14:52 . 2009-07-10 14:52 316 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090710165216.bat
2009-07-09 20:43 . 2009-07-09 20:46 -------- d-----w- c:\documents and settings\PC\Local Settings\Application Data\Temp
2009-07-09 20:43 . 2009-07-09 20:43 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2009-07-09 16:34 . 2009-07-09 16:34 -------- d-----w- c:\documents and settings\PC\Local Settings\Application Data\Real
2009-07-09 16:34 . 2009-07-09 16:34 -------- d-----w- c:\program files\Common Files\xing shared
2009-07-09 16:33 . 2009-07-09 16:33 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2009-07-08 19:42 . 2009-07-08 19:42 -------- d-----w- c:\program files\FLV Player

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-30 15:30 . 2008-11-18 22:55 169936 ----a-w- c:\documents and settings\PC\Application Data\Mozilla\Firefox\Profiles\1nptc0nz.default\FlashGot.exe
2009-07-30 12:15 . 2008-05-24 12:03 -------- d-----w- c:\documents and settings\PC\Application Data\WinFF
2009-07-29 22:32 . 2008-05-16 14:19 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-07-29 21:12 . 2008-05-15 14:35 -------- d-----w- c:\documents and settings\PC\Application Data\uTorrent
2009-07-28 21:05 . 2008-09-26 15:13 -------- d-----w- c:\documents and settings\PC\Application Data\Kingston
2009-07-27 14:30 . 2008-05-21 18:28 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-27 14:25 . 2008-06-01 08:05 3775176 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-07-20 22:51 . 2008-05-23 09:09 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET
2009-07-20 22:15 . 2008-05-15 13:25 -------- d-----w- c:\program files\Yahoo!
2009-07-13 11:36 . 2008-08-10 14:34 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-13 11:36 . 2008-05-21 18:28 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-11 12:53 . 2008-12-06 12:00 -------- d-----w- c:\program files\vanBasco's Karaoke Player
2009-07-10 14:43 . 2008-09-19 13:38 -------- d-----w- c:\program files\Google
2009-07-10 14:19 . 2009-01-31 01:18 -------- d-----w- c:\program files\TuneUp Utilities 2009
2009-07-09 16:34 . 2008-05-15 19:01 -------- d-----w- c:\program files\Common Files\Real
2009-07-09 16:34 . 2008-05-15 19:01 499712 ----a-w- c:\windows\system32\msvcp71.dll
2009-07-09 16:34 . 2008-05-15 19:01 348160 ----a-w- c:\windows\system32\msvcr71.dll
2009-07-08 18:52 . 2008-05-15 14:29 -------- d-----w- c:\documents and settings\PC\Application Data\Skype
2009-07-08 18:52 . 2008-05-15 14:32 -------- d-----w- c:\documents and settings\PC\Application Data\skypePM
2009-07-07 20:00 . 2009-06-24 14:12 25440 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\savapibridge.dll
2009-07-07 20:00 . 2009-06-24 14:12 1630560 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Resources.dll
2009-07-07 20:00 . 2009-06-24 14:11 2353480 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-Aware.exe
2009-07-07 19:20 . 2008-05-15 13:21 -------- d-----w- c:\documents and settings\PC\Application Data\Vso
2009-07-06 14:17 . 2009-06-24 14:12 314712 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\threatwork.exe
2009-07-06 14:17 . 2009-06-24 14:12 169312 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavamessage.dll
2009-07-06 14:17 . 2009-06-24 14:12 348496 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavalicense.dll
2009-07-06 14:17 . 2009-06-24 14:12 298336 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\UpdateManager.dll
2009-07-06 14:17 . 2009-06-01 14:18 84832 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\ShellExt.dll
2009-07-06 14:16 . 2009-06-01 14:09 246128 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\RPAPI.dll
2009-07-06 14:16 . 2009-06-24 14:11 85352 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Drivers\32\AAWDriverTool.exe
2009-07-06 14:16 . 2009-06-01 14:09 40288 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\PrivacyClean.dll
2009-07-06 14:16 . 2009-06-24 14:11 664424 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\CEAPI.dll
2009-07-06 14:16 . 2009-06-24 14:11 563064 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareCommand.exe
2009-07-06 14:16 . 2009-06-24 14:11 566632 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe
2009-07-06 14:16 . 2009-06-24 14:10 629072 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWWSC.exe
2009-07-06 14:16 . 2009-06-24 14:10 520024 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWTray.exe
2009-07-06 14:16 . 2009-06-24 14:10 1029456 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe
2009-06-26 19:36 . 2009-06-26 19:36 -------- d-----w- c:\documents and settings\All Users\Application Data\KONAMI
2009-06-26 19:32 . 2009-06-26 19:32 -------- d-----w- c:\program files\KONAMI
2009-06-26 16:18 . 2004-08-03 22:56 659456 ----a-w- c:\windows\system32\wininet.dll
2009-06-26 16:18 . 2004-08-03 22:56 81920 ----a-w- c:\windows\system32\ieencode.dll
2009-06-24 14:19 . 2009-06-24 14:19 337 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090624161917.bat
2009-06-24 14:17 . 2009-06-24 14:17 789 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090624161739.bat
2009-06-23 18:55 . 2009-06-23 18:55 388 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090623205533.bat
2009-06-23 18:33 . 2009-06-23 18:33 924 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090623203351.bat
2009-06-23 18:30 . 2009-06-23 18:30 2958 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090623203031.bat
2009-06-21 22:13 . 2008-05-16 13:36 -------- d-----w- c:\documents and settings\PC\Application Data\BSplayer PRO
2009-06-21 22:11 . 2009-06-21 22:11 -------- d-----w- c:\program files\Adobe Media Player
2009-06-21 22:11 . 2009-06-21 22:11 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-06-21 22:10 . 2009-06-21 22:11 38208 ----a-w- c:\documents and settings\PC\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-06-16 14:55 . 2004-08-03 22:56 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:55 . 2001-08-23 10:00 82432 ----a-w- c:\windows\system32\fontsub.dll
2009-06-12 20:15 . 2009-06-12 20:15 2165 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090612221550.bat
2009-06-09 18:50 . 2009-06-09 18:50 313 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090609205015.bat
2009-06-07 15:27 . 2009-06-07 15:27 3765 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090607172718.bat
2009-06-06 16:48 . 2009-06-06 16:48 440 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090606184822.bat
2009-06-06 14:06 . 2009-06-06 14:06 313 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090606160652.bat
2009-06-03 19:27 . 2004-08-03 22:56 1290752 ----a-w- c:\windows\system32\quartz.dll
2009-06-01 14:18 . 2009-06-01 14:18 15688 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lsdelete.exe
2009-06-01 14:18 . 2009-05-13 14:10 15688 ----a-w- c:\windows\system32\lsdelete.exe
2009-05-29 16:56 . 2009-05-29 16:56 390664 ----a-w- c:\documents and settings\PC\Application Data\Real\RealPlayer\Update\RealPlayer11.exe
2009-05-13 14:04 . 2009-05-13 14:05 64160 ----a-w- c:\windows\system32\drivers\Lbd.sys
2009-05-13 14:04 . 2009-05-13 14:04 64160 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Drivers\32\lbd.sys
2009-05-13 06:42 . 2009-05-12 20:16 53319 ----a-w- c:\documents and settings\All Users\Application Data\TEMP\{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}\PostBuild.exe
2009-05-13 06:38 . 2008-07-10 14:33 29480 ----a-w- c:\windows\system32\msxml3a.dll
2009-05-12 20:42 . 2008-05-15 13:21 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys
2009-05-12 20:42 . 2008-05-15 13:21 47360 ----a-w- c:\documents and settings\PC\Application Data\pcouffin.sys
2009-05-12 20:42 . 2008-05-15 13:21 47360 ----a-w- c:\documents and settings\PC\Application Data\pcouffin.sys
2009-05-08 10:44 . 2009-05-08 10:44 319 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090508124456.bat
2009-05-07 15:44 . 2004-08-03 22:56 344064 ----a-w- c:\windows\system32\localspl.dll
2009-05-04 19:28 . 2009-05-04 19:28 322 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090504212841.bat
2009-07-26 19:34 . 2009-04-23 15:17 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
2008-05-16 23:53 . 2008-05-15 14:07 48 --sh--w- c:\windows\SEAB9B388.tmp
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-06-28 8466432]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2007-12-21 1443072]
"run32"="c:\_otm\MovedFiles\07302009_163103\Win\lsass.exe" [2002-01-01 552103]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" - c:\windows\system32\narrator.exe [2006-10-04 53760]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 10:41 294912 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\CyberLink\\PowerDVD9\\PowerDVD Cinema\\PowerDVDCinema.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD9\\PowerDVD9.exe"=
"c:\\Program Files\\KONAMI\\Pro Evolution Soccer 2009\\pes2009.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [5/13/2009 16:05 64160]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/1/2008 13:48 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2/1/2008 13:48 51440]
R2 {B154377D-700F-42cc-9474-23858FBDF4BD};Power Control [2009/05/13 08:40];c:\program files\CyberLink\PowerDVD9\000.fcl [2/28/2009 19:40 87536]
R2 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [12/21/2007 08:21 468224]
R3 camvid20;Philips ToUcam Camera; Video;c:\windows\system32\drivers\camdrv21.sys [5/14/2008 20:03 223232]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [3/9/2009 21:06 1029456]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2/16/2006 16:51 4096]
S3 WFIOCTL;WFIOCTL;c:\program files\WinFast\WFDTV\WFIOCTL.sys [5/14/2008 17:25 9446]
.
Contents of the 'Scheduled Tasks' folder

2009-07-29 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 14:16]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-Device Detector - DevDetect.exe
ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - (no file)


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
IE: &Google Search - c:\program files\Google\googletoolbar.dll/cmsearch.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\PC\Application Data\Mozilla\Firefox\Profiles\1nptc0nz.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.startup.homepage - hxxp://www.vijesti.cg.yu/
FF - component: c:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll
FF - plugin: c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npyaxmpb.dll

---- FIREFOX POLICIES ----
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-30 18:13
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{B154377D-700F-42cc-9474-23858FBDF4BD}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD9\000.fcl"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1288)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Lavasoft\Ad-Aware 2007\aawservice.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Common Files\ACD Systems\EN\DevDetect.exe
.
**************************************************************************
.
Completion time: 2009-07-30 18:16 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-30 16:16

Pre-Run: 44,667,514,880 bytes free
Post-Run: 45,848,989,696 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

228 --- E O F --- 2009-07-29 18:39

Otvori novi notepad i kopiraj ovo:



nazovi taj notepad kao CFScript i sacuvaj ga na Desktop

Prevuci CFScript preko Combofix-a ( kao na slici )

http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif

po zavrsetku skeniranja postavi log koji napravi CF

Potpis

http://www.itfix.biz/images/Malware.JPG

Mislim da je sada sve ok :) ?!

ComboFix 09-07-29.04 - PC 07/30/2009 18:46.2.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2046.1592 [GMT 2:00]
Running from: c:\documents and settings\PC\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\PC\Desktop\CFScript.txt
AV: ESET Smart Security 3.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET Personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
* Resident AV is active


FILE ::
"c:\_otm\MovedFiles\07302009_163103\Win\lsass.exe"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\_otm\MovedFiles\07302009_163103\Win\lsass.exe

.
((((((((((((((((((((((((( Files Created from 2009-06-28 to 2009-07-30 )))))))))))))))))))))))))))))))
.

2009-07-30 14:31 . 2009-07-30 14:31 -------- d-----w- C:\_OTM
2009-07-30 12:15 . 2009-07-30 12:15 328 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090730141520.bat
2009-07-29 08:54 . 2009-07-29 08:54 2883 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090729105403.bat
2009-07-27 18:06 . 2009-07-27 18:06 337 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090727200645.bat
2009-07-27 14:08 . 2009-07-27 14:08 551 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090727160838.bat
2009-07-26 18:17 . 2009-07-26 18:17 554 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090726201739.bat
2009-07-20 22:52 . 2008-01-07 12:29 352 ---ha-w- c:\windows\nod32fixtemdono.reg
2009-07-20 22:51 . 2009-07-20 22:51 -------- d-----w- c:\program files\ESET
2009-07-20 22:47 . 2009-07-20 22:47 360192 ----a-w- c:\windows\system32\TuneUpDefragService.exe
2009-07-20 19:06 . 2009-07-20 19:06 431 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090720210656.bat
2009-07-20 11:13 . 2009-07-20 11:13 345 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090720131348.bat
2009-07-20 11:10 . 2009-07-20 11:10 360 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090720131025.bat
2009-07-20 11:05 . 2009-07-20 11:05 354 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090720130559.bat
2009-07-20 11:01 . 2009-07-20 11:01 345 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090720130145.bat
2009-07-19 16:18 . 2009-07-19 16:18 352 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090719181830.bat
2009-07-11 19:31 . 2009-07-11 19:31 -------- d-----w- C:\VundoFix Backups
2009-07-11 15:58 . 2009-07-11 15:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Jes-Soft
2009-07-10 15:05 . 2009-07-10 15:05 557 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090710170525.bat
2009-07-10 14:52 . 2009-07-10 14:52 316 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090710165216.bat
2009-07-09 20:43 . 2009-07-09 20:46 -------- d-----w- c:\documents and settings\PC\Local Settings\Application Data\Temp
2009-07-09 20:43 . 2009-07-09 20:43 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2009-07-09 16:34 . 2009-07-09 16:34 -------- d-----w- c:\documents and settings\PC\Local Settings\Application Data\Real
2009-07-09 16:34 . 2009-07-09 16:34 -------- d-----w- c:\program files\Common Files\xing shared
2009-07-09 16:33 . 2009-07-09 16:33 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2009-07-08 19:42 . 2009-07-08 19:42 -------- d-----w- c:\program files\FLV Player

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-30 16:18 . 2008-11-18 22:55 169936 ----a-w- c:\documents and settings\PC\Application Data\Mozilla\Firefox\Profiles\1nptc0nz.default\FlashGot.exe
2009-07-30 12:15 . 2008-05-24 12:03 -------- d-----w- c:\documents and settings\PC\Application Data\WinFF
2009-07-29 22:32 . 2008-05-16 14:19 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-07-29 21:12 . 2008-05-15 14:35 -------- d-----w- c:\documents and settings\PC\Application Data\uTorrent
2009-07-28 21:05 . 2008-09-26 15:13 -------- d-----w- c:\documents and settings\PC\Application Data\Kingston
2009-07-27 14:30 . 2008-05-21 18:28 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-27 14:25 . 2008-06-01 08:05 3775176 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-07-20 22:51 . 2008-05-23 09:09 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET
2009-07-20 22:15 . 2008-05-15 13:25 -------- d-----w- c:\program files\Yahoo!
2009-07-13 11:36 . 2008-08-10 14:34 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-13 11:36 . 2008-05-21 18:28 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-11 12:53 . 2008-12-06 12:00 -------- d-----w- c:\program files\vanBasco's Karaoke Player
2009-07-10 14:43 . 2008-09-19 13:38 -------- d-----w- c:\program files\Google
2009-07-10 14:19 . 2009-01-31 01:18 -------- d-----w- c:\program files\TuneUp Utilities 2009
2009-07-09 16:34 . 2008-05-15 19:01 -------- d-----w- c:\program files\Common Files\Real
2009-07-09 16:34 . 2008-05-15 19:01 499712 ----a-w- c:\windows\system32\msvcp71.dll
2009-07-09 16:34 . 2008-05-15 19:01 348160 ----a-w- c:\windows\system32\msvcr71.dll
2009-07-08 18:52 . 2008-05-15 14:29 -------- d-----w- c:\documents and settings\PC\Application Data\Skype
2009-07-08 18:52 . 2008-05-15 14:32 -------- d-----w- c:\documents and settings\PC\Application Data\skypePM
2009-07-07 20:00 . 2009-06-24 14:12 25440 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\savapibridge.dll
2009-07-07 20:00 . 2009-06-24 14:12 1630560 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Resources.dll
2009-07-07 20:00 . 2009-06-24 14:11 2353480 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-Aware.exe
2009-07-07 19:20 . 2008-05-15 13:21 -------- d-----w- c:\documents and settings\PC\Application Data\Vso
2009-07-06 14:17 . 2009-06-24 14:12 314712 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\threatwork.exe
2009-07-06 14:17 . 2009-06-24 14:12 169312 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavamessage.dll
2009-07-06 14:17 . 2009-06-24 14:12 348496 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavalicense.dll
2009-07-06 14:17 . 2009-06-24 14:12 298336 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\UpdateManager.dll
2009-07-06 14:17 . 2009-06-01 14:18 84832 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\ShellExt.dll
2009-07-06 14:16 . 2009-06-01 14:09 246128 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\RPAPI.dll
2009-07-06 14:16 . 2009-06-24 14:11 85352 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Drivers\32\AAWDriverTool.exe
2009-07-06 14:16 . 2009-06-01 14:09 40288 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\PrivacyClean.dll
2009-07-06 14:16 . 2009-06-24 14:11 664424 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\CEAPI.dll
2009-07-06 14:16 . 2009-06-24 14:11 563064 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareCommand.exe
2009-07-06 14:16 . 2009-06-24 14:11 566632 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe
2009-07-06 14:16 . 2009-06-24 14:10 629072 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWWSC.exe
2009-07-06 14:16 . 2009-06-24 14:10 520024 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWTray.exe
2009-07-06 14:16 . 2009-06-24 14:10 1029456 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe
2009-06-26 19:36 . 2009-06-26 19:36 -------- d-----w- c:\documents and settings\All Users\Application Data\KONAMI
2009-06-26 19:32 . 2009-06-26 19:32 -------- d-----w- c:\program files\KONAMI
2009-06-26 16:18 . 2004-08-03 22:56 659456 ----a-w- c:\windows\system32\wininet.dll
2009-06-26 16:18 . 2004-08-03 22:56 81920 ----a-w- c:\windows\system32\ieencode.dll
2009-06-24 14:19 . 2009-06-24 14:19 337 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090624161917.bat
2009-06-24 14:17 . 2009-06-24 14:17 789 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090624161739.bat
2009-06-23 18:55 . 2009-06-23 18:55 388 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090623205533.bat
2009-06-23 18:33 . 2009-06-23 18:33 924 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090623203351.bat
2009-06-23 18:30 . 2009-06-23 18:30 2958 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090623203031.bat
2009-06-21 22:13 . 2008-05-16 13:36 -------- d-----w- c:\documents and settings\PC\Application Data\BSplayer PRO
2009-06-21 22:11 . 2009-06-21 22:11 -------- d-----w- c:\program files\Adobe Media Player
2009-06-21 22:11 . 2009-06-21 22:11 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-06-21 22:10 . 2009-06-21 22:11 38208 ----a-w- c:\documents and settings\PC\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-06-16 14:55 . 2004-08-03 22:56 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:55 . 2001-08-23 10:00 82432 ----a-w- c:\windows\system32\fontsub.dll
2009-06-12 20:15 . 2009-06-12 20:15 2165 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090612221550.bat
2009-06-09 18:50 . 2009-06-09 18:50 313 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090609205015.bat
2009-06-07 15:27 . 2009-06-07 15:27 3765 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090607172718.bat
2009-06-06 16:48 . 2009-06-06 16:48 440 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090606184822.bat
2009-06-06 14:06 . 2009-06-06 14:06 313 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090606160652.bat
2009-06-03 19:27 . 2004-08-03 22:56 1290752 ----a-w- c:\windows\system32\quartz.dll
2009-06-01 14:18 . 2009-06-01 14:18 15688 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lsdelete.exe
2009-06-01 14:18 . 2009-05-13 14:10 15688 ----a-w- c:\windows\system32\lsdelete.exe
2009-05-29 16:56 . 2009-05-29 16:56 390664 ----a-w- c:\documents and settings\PC\Application Data\Real\RealPlayer\Update\RealPlayer11.exe
2009-05-13 14:04 . 2009-05-13 14:05 64160 ----a-w- c:\windows\system32\drivers\Lbd.sys
2009-05-13 14:04 . 2009-05-13 14:04 64160 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Drivers\32\lbd.sys
2009-05-13 06:42 . 2009-05-12 20:16 53319 ----a-w- c:\documents and settings\All Users\Application Data\TEMP\{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}\PostBuild.exe
2009-05-13 06:38 . 2008-07-10 14:33 29480 ----a-w- c:\windows\system32\msxml3a.dll
2009-05-12 20:42 . 2008-05-15 13:21 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys
2009-05-12 20:42 . 2008-05-15 13:21 47360 ----a-w- c:\documents and settings\PC\Application Data\pcouffin.sys
2009-05-12 20:42 . 2008-05-15 13:21 47360 ----a-w- c:\documents and settings\PC\Application Data\pcouffin.sys
2009-05-08 10:44 . 2009-05-08 10:44 319 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090508124456.bat
2009-05-07 15:44 . 2004-08-03 22:56 344064 ----a-w- c:\windows\system32\localspl.dll
2009-05-04 19:28 . 2009-05-04 19:28 322 ----a-w- c:\documents and settings\PC\Application Data\WinFF\ff090504212841.bat
2009-07-26 19:34 . 2009-04-23 15:17 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
2008-05-16 23:53 . 2008-05-15 14:07 48 --sh--w- c:\windows\SEAB9B388.tmp
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-06-28 8466432]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2007-12-21 1443072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" - c:\windows\system32\narrator.exe [2006-10-04 53760]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 10:41 294912 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\CyberLink\\PowerDVD9\\PowerDVD Cinema\\PowerDVDCinema.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD9\\PowerDVD9.exe"=
"c:\\Program Files\\KONAMI\\Pro Evolution Soccer 2009\\pes2009.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [5/13/2009 16:05 64160]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/1/2008 13:48 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2/1/2008 13:48 51440]
R2 {B154377D-700F-42cc-9474-23858FBDF4BD};Power Control [2009/05/13 08:40];c:\program files\CyberLink\PowerDVD9\000.fcl [2/28/2009 19:40 87536]
R2 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [12/21/2007 08:21 468224]
R3 camvid20;Philips ToUcam Camera; Video;c:\windows\system32\drivers\camdrv21.sys [5/14/2008 20:03 223232]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [3/9/2009 21:06 1029456]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2/16/2006 16:51 4096]
S3 WFIOCTL;WFIOCTL;c:\program files\WinFast\WFDTV\WFIOCTL.sys [5/14/2008 17:25 9446]
.
Contents of the 'Scheduled Tasks' folder

2009-07-29 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 14:16]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-run32 - c:\_otm\MovedFiles\07302009_163103\Win\lsass.exe


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
IE: &Google Search - c:\program files\Google\googletoolbar.dll/cmsearch.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\PC\Application Data\Mozilla\Firefox\Profiles\1nptc0nz.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.startup.homepage - hxxp://www.vijesti.cg.yu/
FF - component: c:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll
FF - plugin: c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npyaxmpb.dll

---- FIREFOX POLICIES ----
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-30 18:50
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{B154377D-700F-42cc-9474-23858FBDF4BD}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD9\000.fcl"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1408)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Lavasoft\Ad-Aware 2007\aawservice.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\windows\system32\wdfmgr.exe
.
**************************************************************************
.
Completion time: 2009-07-30 18:54 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-30 16:54
ComboFix2.txt 2009-07-30 16:16

Pre-Run: 45,860,954,112 bytes free
Post-Run: 45,817,937,920 bytes free

217 --- E O F --- 2009-07-29 18:39

Ok...to je to
Start >> Run kopiraj sledece:

OK

to ce uninstalirati Combofix skriptu

Potpis

http://www.itfix.biz/images/Malware.JPG

Hvala ti puno, znas znanje :) !!
Posle restarta pojavljuje mi se da li da kliknem na Recovery Console ili operativni sistem.To je povezano sa combofixom?Treba li tako svaki put ili mogu i to da uklonim, a pri tome sam aktivirao skriptu za brisanje combofixa.Pozz

_{[Ovu poruku je menjao igor_cg dana 30.07.2009. u 19:31 GMT+1]}

hehe...Hvala
pazi,preporucljivo je da ostane ali ako hoces da je bas uklonis i ako ti smeta idi na C particijiu i
obrisi CMDCONS folder i CMDLDR file sa root-a kao i Boot.bak.
Start >> Run kucaj OK

Na Boot.ini tabu treba kliknuti na "Check All Boot Paths"
Windows će da prijavi nefunkcionalnu liniju i samo treba kliknuti Yes
pa OK

Potpis

http://www.itfix.biz/images/Malware.JPG

Ako je preporucljivo necemo ga dirati hvala jos jednom!

Pazi ovako prosto jednostavno u glavnom windows folderu postoji taj fajl lsass.exe i on mora da bude pokrenut non stop a ako vidis negde gde pise c:\win\isass.exe slobodno brisi, ako to isto nadjes u Registry slobodno brise jer win direktorijum u XP nepostoji postoji glavni folder pod imenu WINDOWS. Posle kad obrises svuda gde nadjes c:\win\ posle sa AV ponovo skeniraj komp kad nadje sve viruse samo ga restartuj i to je to. Nadam se da sam bio jasan.

Potpis

Ako te snadje muka pozovi hajduka
Pazi se hajduka ako ga snjadje muka

ok,hvala!!