MyCity » Ambulanta -> Arhiva Ambulante » Slika na monitoru nestane

Slika na monitoru nestane

Napisano na dan: 29.6.2011
1

Slika na monitoru nestane
Sledeća strana Pagination

Idi na vrh

Poslao: 29 Jun 2011 15:12
Idi na vrh
offline
  • Pridružio: 29 Maj 2011
  • Poruke: 1444
  • Gde živiš: U svom svetu

Saznadoh da imam 32-bitni Windows

Pre 7 dana,na svaka dva dana,slika na monitoru nestane.Sva tri-cetiri puta se to dogodilo tokom mog kuckanja na tastaturi.Moram onda da resetujem komp,da bi sve bilo uredu.Dva dana sve bude ok,onda opet nestane.Nista drugo se ne poremeti,dakle ima tona,ali ne i slike.
Koristim kablovski internet
Windows xp
Hertz 75
SP 3
RADEON 9200 SE


DDS (Ver_2011-06-23.01) - NTFSx86

[Link mogu videti samo ulogovani korisnici]



Poslao: 29 Jun 2011 15:20
Idi na vrh
offline
  • Més que un club
  • Glavni vokal @ Harpun
  • Pridružio: 27 Feb 2009
  • Poruke: 3898
  • Gde živiš: Novi Sad,Klisa

Pozdrav Einmana

Nisi detaljno ispratila uputsva koja se nalaze ovde:
[Link mogu videti samo ulogovani korisnici]
U koraku #2 se jos i trazi da nam prekopiras sadrzaj izvestaja DDS.txt
Takodje bih te zamolio da odradis ono sto ti se trazi u koraku #3


NIx Car (AMF tim)



Poslao: 29 Jun 2011 15:47
Idi na vrh
offline
  • Pridružio: 29 Maj 2011
  • Poruke: 1444
  • Gde živiš: U svom svetu

Napisano: 29 Jun 2011 15:26

Sta li sam onda radila sat vremena Very Happy ?

Ok,potrudicu se da sve ispunim smešak

Dopuna: 29 Jun 2011 15:30

.
DDS (Ver_2011-06-23.01) - NTFSx86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17
Run by Ivana at 14:13:47 on 2011-06-29
Microsoft Windows XP Professional 5.1.2600.3.1250.385.1033.18.511.127 [GMT 2:00]
.
AV: ESET NOD32 Antivirus 4.2 *Enabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
svchost.exe
C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\System32\svchost.exe -k Akamai
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Firebird\Firebird_2_1\bin\fbguard.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Firebird\Firebird_2_1\bin\fbserver.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = [Link mogu videti samo ulogovani korisnici]
uSearch Page = [Link mogu videti samo ulogovani korisnici]
uSearch Bar = [Link mogu videti samo ulogovani korisnici]
uDefault_Search_URL = [Link mogu videti samo ulogovani korisnici]
uSearchAssistant = [Link mogu videti samo ulogovani korisnici]
uSearchURL,(Default) = [Link mogu videti samo ulogovani korisnici]
mSearchAssistant = [Link mogu videti samo ulogovani korisnici]{searchTerms}&f=4
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.7.6406.1642\swg.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Easy-WebPrint: {327c2873-e90d-4c37-aa9d-10ac9baba46c} - c:\program files\canon\easy-webprint\Toolband.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [Google Quick Search Box] "c:\program files\google\quick search box\GoogleQuickSearchBox.exe" /autorun
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - [Link mogu videti samo ulogovani korisnici]
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - [Link mogu videti samo ulogovani korisnici]
DPF: {CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA} - [Link mogu videti samo ulogovani korisnici]
DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} - [Link mogu videti samo ulogovani korisnici]
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - [Link mogu videti samo ulogovani korisnici]
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - [Link mogu videti samo ulogovani korisnici]
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - [Link mogu videti samo ulogovani korisnici]
TCP: DhcpNameServer = 212.62.32.1 212.62.32.5
TCP: Interfaces\{9ACC8226-C115-45C9-A299-9AE646343919} : DhcpNameServer = 212.62.32.1 212.62.32.5
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: cryptnet32 - cryptnet32.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\ivana\application data\mozilla\firefox\profiles\gg8mftdn.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo! Search
FF - prefs.js: browser.startup.homepage - [Link mogu videti samo ulogovani korisnici]
FF - prefs.js: keyword.URL - [Link mogu videti samo ulogovani korisnici]{searchTerms}&f=4&hl={language}&src=chrm
FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll
.
============= SERVICES / DRIVERS ===============
.
R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [2009-7-5 77312]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2010-7-29 115008]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2010-8-3 95896]
R2 Akamai;Akamai NetSession Interface;c:\windows\system32\svchost.exe -k Akamai [2004-8-4 14336]
R2 ekrn;ESET Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2010-11-4 810144]
R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;c:\program files\firebird\firebird_2_1\bin\fbguard.exe [2010-2-21 81920]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2010-6-16 363344]
R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\program files\firebird\firebird_2_1\bin\fbserver.exe [2010-2-21 2723840]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2010-6-16 20952]
S0 ehhwrnbkt;ehhwrnbkt;c:\windows\system32\drivers\ycdtdlixnw.sys [2011-3-5 53760]
S2 gupdate;Usluga Google ažuriranje (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-9-19 136176]
S3 gupdatem;Usluga Google ažuriranje (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-9-19 136176]
S4 usnjsvc;Messenger Sharing Folders USN Journal Reader service;c:\program files\msn messenger\usnsvc.exe [2006-12-3 94504]
.
=============== Created Last 30 ================
.
2011-06-01 09:13:53 348256 ----a-w- c:\documents and settings\all users\application data\microsoft\vstahost\corelphotopaint\9.0\1033\ResourceCache.dll
2011-06-01 09:11:46 348256 ----a-w- c:\documents and settings\all users\application data\microsoft\vstahost\coreldraw\9.0\1033\ResourceCache.dll
2011-06-01 09:10:29 416 ----a-w- c:\documents and settings\all users\application data\microsoft\msdn\9.0\1033\ResourceCache.dll
2011-06-01 09:10:17 -------- d-----w- c:\documents and settings\ivana\local settings\application data\Microsoft Help
2011-06-01 09:06:56 -------- d-----w- c:\program files\common files\Corel
2011-06-01 09:05:43 -------- d-----w- c:\program files\common files\Protexis
2011-06-01 09:05:39 -------- d-----w- c:\documents and settings\all users\application data\Corel
2011-06-01 08:56:13 -------- d-----w- c:\program files\Corel
2011-06-01 08:43:52 -------- d-----w- c:\windows\system32\XPSViewer
2011-06-01 08:43:07 89088 ----a-w- c:\windows\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
2011-06-01 08:42:28 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2011-06-01 08:42:28 117760 ------w- c:\windows\system32\prntvpt.dll
2011-06-01 08:42:27 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2011-06-01 08:42:27 597504 ------w- c:\windows\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2011-06-01 08:42:27 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2011-06-01 08:42:27 575488 ------w- c:\windows\system32\xpsshhdr.dll
2011-06-01 08:42:27 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2011-06-01 08:42:27 1676288 ------w- c:\windows\system32\xpssvcs.dll
2011-06-01 08:29:51 -------- d-----w- c:\documents and settings\all users\application data\CorelDRAW Graphics Suite X5
2011-06-01 07:28:52 -------- d-----w- c:\program files\common files\Akamai
.
==================== Find3M ====================
.
2011-04-13 22:40:10 4284416 ----a-w- c:\windows\system32\GPhotos.scr
2009-09-16 07:06:03 13644 ----a-w- c:\program files\common files\ycyhikodu.reg
.
============= FINISH: 14:14:03,04 ===============

Dopuna: 29 Jun 2011 15:35

Da li je ovo DDS.txt?

Dopuna: 29 Jun 2011 15:35

Sve mi se pomesalo.

Dopuna: 29 Jun 2011 15:47

[Link mogu videti samo ulogovani korisnici]



Da li sam uradila korak 2 i 3?Jel treba jos nesto?

Poslao: 29 Jun 2011 16:04
Idi na vrh
offline
  • Pridružio: 02 Feb 2008
  • Poruke: 14018
  • Gde živiš: Nish

Pozdrav Einmana!



Ja cu voditi ovaj slucaj, s'obzirom da kolega ima privatnih obaveza ...





Arrow


Nadji fajl:

c:\windows\system32\drivers\ycdtdlixnw.sys


i upload-uj mi ga putem sledeceg link-a:


[Link mogu videti samo ulogovani korisnici]







Arrow


Preuzmi Rootkit Unhooker na Desktop.

Dvoklikom pokreni program;

odaberi Report karticu;

klikni Scan i u prozoru koji se otvori štrikliraj stavke:

SSDT
Shadow SSDT
Processes
Drivers
Stealth Code
Files
Code Hooks
klikni OK i sačekaj završetak skeniranja.

Kada skeniranje bude završeno, klikni File > Save Report i sačuvaj izveštaj.

Izveštaj programa Rootkit Unhooker priloži uz poruku korišćenjem opcije Prikači fajl.








goran9888 (AMF Tim)

Poslao: 29 Jun 2011 20:42
Idi na vrh
offline
  • Pridružio: 29 Maj 2011
  • Poruke: 1444
  • Gde živiš: U svom svetu

Citat:
c:\windows\system32\drivers\ycdtdlixnw.sys


i upload-uj mi ga putem sledeceg link-a:


Moras mi pomoci,jer ja apsolutno nista ne znam oko ovog.Dakle,gde treba da trazim taj fajl?

Poslao: 29 Jun 2011 20:54
Idi na vrh
offline
  • Pridružio: 02 Feb 2008
  • Poruke: 14018
  • Gde živiš: Nish

Kako gde?


Pa napisao sam ti lokaciju.

Start -> Run -> %systemroot%\system32\drivers

U tom folderu nadji fajl pod imenom: ycdtdlixnw.sys i posalji mi ga putem linka koji sam ti ostavio u prethodnoj poruci.


Postupak je vise nego prost i veoma su male sanse da se pogresi.





Takodje mi ostavi i trazeni izvestaj Rootkit Unhooker-a.






goran9888 (AMF Tim)

Poslao: 29 Jun 2011 21:19
Idi na vrh
offline
  • Pridružio: 29 Maj 2011
  • Poruke: 1444
  • Gde živiš: U svom svetu

Napisano: 29 Jun 2011 21:10

Nasla sam i poslala taj fajl

Dopuna: 29 Jun 2011 21:19

Citat:
Preuzmi Rootkit Unhooker na Desktop.

Dvoklikom pokreni program;

odaberi Report karticu;

klikni Scan i u prozoru koji se otvori štrikliraj stavke:

SSDT
Shadow SSDT
Processes
Drivers
Stealth Code
Files
Code Hooks

klikni OK i sačekaj završetak skeniranja.


Uradila sam sve ovo,pocinje da skenira ali onda izadje prozor na kojem je stiklirano C D fajl.Trazi da izaberem fajl.Sta sada?

Poslao: 29 Jun 2011 21:24
Idi na vrh
offline
  • Pridružio: 29 Maj 2011
  • Poruke: 1444
  • Gde živiš: U svom svetu

tacnije pise:SELECT DISKS FOR SCAN
C: NTFS
D:NTFS

i to je vec stajalo stiklirano

Poslao: 29 Jun 2011 21:26
Idi na vrh
offline
  • Pridružio: 02 Feb 2008
  • Poruke: 14018
  • Gde živiš: Nish

Einmana ::Sta sada?


Po defaultu su sve particije striklirane. Ostavi tako i pritisni Ok; nastavice se skeniranje.







goran9888 (AMF Tim)

Poslao: 29 Jun 2011 21:35
Idi na vrh
offline
  • Pridružio: 29 Maj 2011
  • Poruke: 1444
  • Gde živiš: U svom svetu

Napisano: 29 Jun 2011 21:30

ok,jesam i to,ali sada se otvorio prozor PLEASE WAIT WHILE RKU MAKES SCAN .YOU CAN STOP SCAN BY PRESSING CANCEL. Ovo stoji vec 2 minute i ne mice se

Dopuna: 29 Jun 2011 21:35

..i dalje se ne mice taj prozor Sad

MyCity » Ambulanta -> Arhiva Ambulante » Slika na monitoru nestane

Ko je trenutno na forumu
 

Ukupno su 911 korisnika na forumu :: 128 registrovanih, 11 sakrivenih i 772 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 20624 - dana 04 Apr 2026 04:18

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: 357magnum, AC-DC, AleksandarV, aleph_one, alex71, Apok, aramis s, Arsenije, Asteker, Atomski čoban, Barista, Ben Roj, bojcistv, bokicacar, Boris90, boromir, bpvl, bufanje, BZ, CCCP, cekic, chichabg, Cicumile, darko_c, dejan1972, deki1001, dekir, dekiz, DENIRO, djordjemiklusev, DJUNTA, doktor097, doktor1964, dolinalima, doloress, Dorcolac2, draganst, dushkomkd, dzoni19, Džekson, Fructo, Georgius, havoc995, Holy Saber, istokzapad, ivan1973, Jakonjveliki, Jaz, Jerry Drake, JK, joca83, Kajzer Soze, kaput21, kondenzator, laki_bb, Lance Guest, lima, ludvig 78, magyar, malimedo01, matejman, Medojed, metallac777, mexo, MIg, Mihajlo, Milometer, mkukoleca, mnn2, moldway, N.e.m.a.nj.a., Naturelo, Natuzzi, neko iz mase, Nemanja.M, nevjerna beba, Niki2024, nikoladim, orfanel, paja69, Papadubi, Permaldar, PITT, Prašinar, precan, prikolica, Primus17, procesor, proka89, RajkoB, raptorsi, rebro1974, repac, Ripanjac, RiV, RJ, rodoljub, rovac, samojednoimeznam, SD izvidjac, Sharpshooter, Sirius, Smiljkovich, Smor, SOM, spektorsky, Srki98, Srle993, stalja, stefan95, stegonosa, t.e.m.p.l.a.r., tanzanija, Tas011, uruk, US_Rank_0, vathra, velisa andjelic, veljkovicdani, Vlada76, Vojkan Petrovic, vuk77, x9, zemljanin, ZlatniRez, Zoran1959, zule2, zzapNDjuric99