MyCity » Ambulanta -> Arhiva Ambulante » Bsod i virus koji nemogu da obrisem.

Bsod i virus koji nemogu da obrisem.

Napisano na dan: 23.9.2009

Bsod i virus koji nemogu da obrisem.
Sledeća strana Pagination

Idi na vrh

Poslao: 23 Sep 2009 16:53
Idi na vrh
offline

Problem je nastao danas odkako sam po dviljim stranicama trazio keygen za jednu igru. Imam kablovski internet 2MB/512kb. Koristim ESS 4.0 i on kaze ovo "Operating memory - Win32/Olmarik trojan - unable to clean". Ja mislim da ovaj virus nije sam vec da ima i drustvo. Ali AMF tim ce to najbolje da vidi iz prilozenog. Ja mislim da kod bsoda 007d, ali me nemojte uzeti za rijec.

DDS (Ver_09-07-30.01) - NTFSx86
Run by MM at 16:09:10,31 on 23.09.2009
Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_15
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1527.927 [GMT 2:00]

AV: ESET Smart Security 4.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET Personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\DOCUME~1\MM\LOCALS~1\Temp\a.exe
C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\System32\TUProgSt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\MM\My Documents\Downloads\dds.scr

============== Pseudo HJT Report ===============

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Windows Live Pomoc za prijavu: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
uRun: [MsnMsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [PopRock] c:\docume~1\mm\locals~1\temp\a.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [DrvLsnr] c:\program files\analog devices\soundmax\DrvLsnr.exe
mRun: [itype] "c:\program files\microsoft intellitype pro\itype.exe"
mRun: [egui] "c:\program files\eset\eset smart security\egui.exe" /hide /waitservice
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
dRunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32
dRunOnce: [IE7-11] rundll32 advpack.dll,LaunchINFSection NR_IE7en.inf,AfterUserStart
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - [Link mogu videti samo ulogovani korisnici]
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - [Link mogu videti samo ulogovani korisnici]
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - [Link mogu videti samo ulogovani korisnici]
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - [Link mogu videti samo ulogovani korisnici]
TCP: {B1BFA8EF-4B4B-4A63-84E7-5475B526EA7B} = 91.191.38.7 91.191.38.8
Notify: igfxcui - igfxsrvc.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\wpdshserviceobj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\mm\applic~1\mozilla\firefox\profiles\rriiknaa.default\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\mozilla firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");

============= SERVICES / DRIVERS ===============

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-2-6 106208]
R1 hwinterface;hwinterface;c:\windows\system32\drivers\hwinterface.sys [2007-5-15 3026]
R2 ekrn;ESET Service;c:\program files\eset\eset smart security\ekrn.exe [2009-2-6 727720]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [2009-9-14 603904]
S3 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys [2009-8-10 16456]
S3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys [2009-8-10 11088]

=============== Created Last 30 ================

2009-09-22 21:41 <DIR> --d----- c:\documents and settings\mm\Tracing
2009-09-22 21:40 <DIR> --d----- c:\program files\Microsoft
2009-09-22 21:39 <DIR> --d----- c:\program files\Windows Live SkyDrive
2009-09-22 21:35 <DIR> --d----- c:\program files\common files\Windows Live
2009-09-14 22:57 603,904 a------- c:\windows\system32\TUProgSt.exe
2009-09-14 22:57 27,904 a------- c:\windows\system32\uxtuneup.dll
2009-09-14 22:57 362,240 a------- c:\windows\system32\TuneUpDefragService.exe
2009-09-14 22:57 <DIR> --d----- c:\docume~1\mm\applic~1\TuneUp Software
2009-09-14 22:57 <DIR> --d----- c:\docume~1\alluse~1\applic~1\TuneUp Software
2009-09-14 22:57 <DIR> --d----- c:\program files\TuneUp Utilities 2009
2009-09-14 22:56 <DIR> --dsh--- c:\docume~1\alluse~1\applic~1\{55A29068-F2CE-456C-9148-C869879E2357}
2009-09-11 19:05 <DIR> --d----- c:\docume~1\mm\applic~1\ColorCop
2009-09-11 11:36 32,128 ac------ c:\windows\system32\dllcache\usbccgp.sys
2009-09-11 11:36 32,128 a------- c:\windows\system32\drivers\usbccgp.sys
2009-09-11 11:28 26,112 ac------ c:\windows\system32\dllcache\usbser.sys
2009-09-11 11:28 26,112 a------- c:\windows\system32\drivers\usbser.sys
2009-09-10 19:14 <DIR> --d----- c:\docume~1\alluse~1\applic~1\McAfee Security Scan
2009-08-27 20:40 <DIR> --d----- c:\program files\common files\Autodata Limited Shared
2009-08-27 20:40 <DIR> --d----- C:\ADCDTEMP
2009-08-25 23:37 <DIR> --d----- c:\windows\Sims 3
2009-08-25 23:37 <DIR> --d----- c:\program files\Sims 3

==================== Find3M ====================

2009-08-28 18:50 505,392 a------- c:\windows\system32\msvcp71.dll
2009-08-23 20:26 86,327 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2009-08-18 23:13 685,816 a------- c:\windows\system32\drivers\sptd.sys
2009-08-04 22:37 98,304 a------- c:\windows\system32\CmdLineExt.dll
2009-07-29 16:03 22,720 a------- c:\windows\system32\emptyregdb.dat
2009-07-26 16:44 48,448 a------- c:\windows\system32\sirenacm.dll
2009-07-25 05:23 411,368 a------- c:\windows\system32\deploytk.dll
2009-07-19 11:05 411,704 a------- c:\windows\system32\pwNative.exe
2009-07-19 11:05 16,456 a------- c:\windows\system32\pwdrvio.sys
2009-07-19 11:05 11,088 a------- c:\windows\system32\pwdspio.sys

============= FINISH: 16:10:36,50 ===============


[Link mogu videti samo ulogovani korisnici]

[Link mogu videti samo ulogovani korisnici]



Poslao: 23 Sep 2009 18:28
Idi na vrh
offline
  • helen1  Male
  • Anti Malware Fighter
    Rank 2
  • Master učitelj
  • Pridružio: 27 Avg 2005
  • Poruke: 8652
  • Gde živiš: Novi Beograd

Zdravo,

Preuzmi sUBs-ov ComboFix sa sledeće adrese na Desktop:


Bleeping Computer
Klikni desnim tasterom na link i odaberi opciju Save Target As... (Save Link As..., Save Linked Content As... ili sličnu);
Kada se otvori dijalog za izbor lokacije na kojoj treba sačuvati file, odaberi Desktop i klikni Save.



Kada preuzimanje programa bude završeno:
deaktiviraj zaštitni softver (uputstvo);
zatvori pokrenute programe;
dvoklikom pokreni program ComboFix.
U toku rada, ComboFix će:proveriti postoji li novija verzija programa:
klikni Yes ako bude ponuđeno preuzimanje iste. prikazati DISCLAIMER OF WARRANTY ON SOFTWARE:
klikni Yes kako bi proces bio nastavljen.ako Recovery Console nije instalirana, ponuditi instalaciju:
obavezno prihvati klikom na Yes i isprati postupak.postaviti/dati određeni broj upita/obaveštenja:
prihvati klikom na Yes ili OK.po potrebi, restartovati Windows (više puta);
na kraju rada, otvoriti Notepad sa izveštajem o skeniranju.

Iskopiraj izveštaj koji je ComboFix napravio u temu na forumu:
klikni desnim tasterom miša u prozor Notepad-a i izaberi Select All;
klikni desnim tasterom miša na obeleženi tekst i izaberi Copy;
klikni desnim tasterom miša u polje za pisanje poruke i izaberi Paste.

Napomena:Izveštaj će biti sačuvan pod nazivom ComboFix.txt na sistemskoj particiji (tipična lokacija: C:\ComboFix.txt);
Ukoliko nakon slanja poruke primetiš da izveštaj nije kompletan, iskoristi opciju Prikači fajl za prilaganje file-a C:\ComboFix.txt uz poruku.



Poslao: 23 Sep 2009 19:06
Idi na vrh
offline

@helen1 ja imam dual boot Vista i Xp od kako sam zadnji put ugasio XP nazalost on vise nece da se pokrece cak ni u safe modu, nista mi drugo ne preostaje osim formata. E sada malo puno skrecem sa teme, ali da pitam hoceli biti kakvih problema kad formatiram C: i instaliram Xp, na D: mi je Vista, hoceli mi opet pitati koji cu OS ili ce nesto da se zezne pa da dize koji on hoce?

Poslao: 23 Sep 2009 19:10
Idi na vrh
offline
  • helen1  Male
  • Anti Malware Fighter
    Rank 2
  • Master učitelj
  • Pridružio: 27 Avg 2005
  • Poruke: 8652
  • Gde živiš: Novi Beograd

Bojim se da moze biti problema, narocito ako je prvo instaliran xp pa vista.

Bolje pitaj u forum Windows.

MyCity » Ambulanta -> Arhiva Ambulante » Bsod i virus koji nemogu da obrisem.

Ko je trenutno na forumu
 

Ukupno su 1666 korisnika na forumu :: 105 registrovanih, 10 sakrivenih i 1551 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 15694 - dana 01 Feb 2026 12:23

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: 357magnum, Aleksej, AleksSE, AMCXXL, Antoni S, Apok, aramis s, blatruc82, bojan1234, Bokiboks, Boris90, Boroš, bpop, braca57, Cicumile, cifra, CikaKURE, cojapop, Crazzer, cvrle312, Daba75, dekan.m, Demi87, Dimitrije Paunovic, djole01, djordjemiklusev, djuradj, Djuza, dnevnasoba, DonerEbal, doom83, drale12, dushan, Dzuki, Ezbuck, Fabius, FOX, Fructo, Georgius, Giro77, Goran 0000, gost321, ILGromovnik, Ivan Germanovic, jalos, Jezekijel, Kalu128338, Komanca, Koridor, kovinacc, Kubovac, ladro, lafa008, littlebunny, ljuba.b, Lošmi, magyar, Malahit, MareMarkic, Maschinekalibar, mercedesamg, milutin134, nekdo, nemkea71, nerislav2025, niki-mini_maki, nixos, Nmr, obsc, ostoja, PO1974, Polifon, Povratak1912, saki80, sale76, samocitam, sasovsky, Semprini, Sevetar, singa, Sir Budimir, skylab1111, Smd, Sone1983, stegonosa, Stoilkovic, stokssone, synergia, Tila Painen, tomigun, TripleMMM, TRZH92, tuf, Vanderx, vathra, Vatreni Zmaj, Veless, VX1, W123, Walkers, yip314, Zdilar, zdrebac, Zedi100, Zoran1959