MyCity » Ambulanta -> Arhiva Ambulante » dali je neki virus u pitanju

dali je neki virus u pitanju

Napisano na dan: 18.2.2007

dali je neki virus u pitanju
Sledeća strana Pagination

Idi na vrh

Poslao: 18 Feb 2007 13:46
Idi na vrh
offline
  • Pridružio: 22 Avg 2006
  • Poruke: 425
  • Gde živiš: Kranj

kod rođaka sam pa kaze da mu kom sporo radi i antivirusan prog je nasao nekoliko trojanaca i odstranio ih je pa me zanima dali je kom cist hvala za odgovore
Logfile of HijackThis v1.99.1
Scan saved at 13:46:22, on 18.2.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Lexmark 2300 Series\lxcgmon.exe
C:\Program Files\Lexmark 2300 Series\ezprint.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Atomic Alarm Clock\AtomicAlarmClock.exe
C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\en-us\bin\WindowsSearch.exe
C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\en-us\bin\WindowsSearchIndexer.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGserv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\lxcgcoms.exe
C:\Program Files\Skype\Plugin Manager\SkypePM.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
D:\Program Files\eMule\emule.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrator\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = [Link mogu videti samo ulogovani korisnici]
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [Link mogu videti samo ulogovani korisnici]
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = [Link mogu videti samo ulogovani korisnici]
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: MSN Search Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll
O3 - Toolbar: MSN Search Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [LXCGCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [lxcgmon.exe] "C:\Program Files\Lexmark 2300 Series\lxcgmon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 2300 Series\ezprint.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [IncrediMail] C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [SkinClock] C:\Program Files\Atomic Alarm Clock\AtomicAlarmClock.exe
O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\en-us\bin\WindowsSearch.exe
O8 - Extra context menu item: &MSN Search - [Link mogu videti samo ulogovani korisnici]\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll/search.htm
O8 - Extra context menu item: I&zvoz v Microsoft Excel - [Link mogu videti samo ulogovani korisnici]\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open in new background tab - [Link mogu videti samo ulogovani korisnici]\Program Files\MSN Toolbar Suite\TAB\02.05.0001.1119\en-us\msntabres.dll/229?4688078d3d9458e964da8c9503af343
O8 - Extra context menu item: Open in new foreground tab - [Link mogu videti samo ulogovani korisnici]\Program Files\MSN Toolbar Suite\TAB\02.05.0001.1119\en-us\msntabres.dll/230?4688078d3d9458e964da8c9503af343
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\npjpi150_11.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\npjpi150_11.dll
O9 - Extra button: Raziskovanje - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - [Link mogu videti samo ulogovani korisnici]
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - [Link mogu videti samo ulogovani korisnici]
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: LXCGCustomerConnect - Unknown owner - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGserv.exe
O23 - Service: lxcg_device - Unknown owner - C:\WINDOWS\system32\lxcgcoms.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe



Poslao: 18 Feb 2007 15:56
Idi na vrh
offline
  • DEMIAN  Male
  • Legendarni građanin
  • IT Manager
  • Pridružio: 25 Mar 2005
  • Poruke: 3706
  • Gde živiš: The darkest place on earth..

Log ne pokazuje vidljive znakove infekcije..

Jedino na šta bih ti sugerisao iz ovo što vidim je da imaš instaliran dodatak za MSN mesenger - MSN Plus! čija besplatna verzija dolazi opciono sa adware-om.
Preporuka je da ne koristi neki antispyware program za otklanjanje ovih reklama već da to uradi po uputstvima koja su mu data na oficijalnom sajtu programa MSN Plus!. - [Link mogu videti samo ulogovani korisnici]

Citat:What does Messenger Plus! Live install on my computer?

When you install Messenger Plus! Live, several files are copied to your computer. All the files placed in "C:\Program Files\Messenger Plus! Live" have either been developed by ourselves (all the files that are signed) or come from third parties that have been carefully reviewed. For those who choose to give their support by installing the optional sponsor program, the sponsor's uninstallation program is copied in "C:\Program Files\Adverts" and is only used to uninstall the sponsor from Add/Remove Programs. Messenger Plus! Live does not install any system wide hook and keeps user related files in "Documents & Settings".

Citat:How can I uninstall the sponsor program?

To uninstall the sponsor, simply go in the "Add/Remove Programs" window, select "Messenger Plus! Live & Sponsor" and follow the instructions. You will be given the choice of uninstalling the sponsor only (if you still want to keep Messenger Plus! without the ads) or everything altogether. Note that if the software is listed as "Messenger Plus! Live" and if the uninstaller doesn't inform you of the presence of the sponsor, it means that the Messenger Plus!'s sponsor is currently not installed and that the advertisements you may be seeing are coming from something else installed in your system.

If the sponsor was installed but damaged by a third party program, the uninstaller will inform you of the problem. In that case, the easiest procedure is generally to disable your anti-adware/spyware, reinstall Messenger Plus! Live with its sponsor and launch the uninstaller again, this will ensure that nothing interferes with the proper uninstallation of the program. When launched, the sponsor's uninstaller will simply ask you to confirm the number displayed on screen and will then proceed with the uninstallation. You can then re-enable your anti-adware/spyware product and contact them about the problem you experienced because of their improper removal of Messenger Plus!'s files.
Ne koristim ovaj software. Napominjem da postoji mogućnost da ti je rad i funkcionisanje programa zavisno od tih pop up reklama.

Spor rad računara ne mora da znači da je to posledica delovanje nekog malware-a. Ovde to nije vidljivo. Neznam specifikaciju hardware-a i nisam upoznat za korisničkim navikama tvog rodjaka tako da ne mogu da pričam napamet.
Uglavnom: redovna defragmentacija HDD-a, manje aktivnih procesa koji su mu nepotrebni, redovno čišćenje temp & junk fajlova, registrija i sl.. Poneki tweak sistema itd i trebalo bi da ubrza računar. Dosta toga je opširno opisano u windows delu, možeš da ga uputiš i na te savete..

Pozz



Poslao: 18 Feb 2007 16:24
Idi na vrh
offline
  • Pridružio: 22 Avg 2006
  • Poruke: 425
  • Gde živiš: Kranj

hvala za odgovor tema se po moje moze zakljuciti a ja cu da deinstaliram ovaj dodatak za msn

Poslao: 18 Feb 2007 16:29
Idi na vrh
offline
  • DEMIAN  Male
  • Legendarni građanin
  • IT Manager
  • Pridružio: 25 Mar 2005
  • Poruke: 3706
  • Gde živiš: The darkest place on earth..

Niko ti nije preporučio da deinstaliraš kompletan program. To je instalirao tvoj rodjak. Možda se njemu svidja i koristi mu Smile
Ja lično ne volim pop up reklame.. a ovde se i adware smatra nepoželjnim programom na računaru. Ja sam ti dao preporuku kako da probaš da se rešiš reklama, ne da pod obavezno izbaciš software.
To je tvoj izbor.

Poslao: 18 Feb 2007 21:29
Idi na vrh
offline
  • Pridružio: 22 Avg 2006
  • Poruke: 425
  • Gde živiš: Kranj

ma on nije ono instalirao to mu se jedan prijatelj nalozio a on mi se stalno zalio oko reklama i rekao je da izbrisemo tako sam i uradio odlucitav je bila njegova inace hvala za odgovore i za pomoc jos jednom

19 Feb 2007 19:31 bobby Zaključavanje topica Razlog: Javiti se na PP ukoliko je potrebno otkljucavanje teme  

MyCity » Ambulanta -> Arhiva Ambulante » dali je neki virus u pitanju

Ko je trenutno na forumu
 

Ukupno su 811 korisnika na forumu :: 147 registrovanih, 11 sakrivenih i 653 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 15694 - dana 01 Feb 2026 12:23

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: 9191vs, acatomic, advokat84, amonsrb, Andrija357, ArmFPGA, Betty25, boj.an, Bombarder, boskelazo, BrusLi, Bubimir, bufanje, cavatina, Chainsaw, CVOJ 410.lad PVO, d.arsenal321, dane007, Darth Malak, dekan.m, DENIRO, DezurniOperativni, Dimitrise93, Dioniss, DonRumataEstorski, Dorcolac, Dr.Strangelove, Draganeli, drimer, DrMrPr, dulleo, dusanobr, Fabius, Flanker-G, Georgius, ginjica, gobrad, goran.vvv, GrobarPovratak, Hamo77, Hans Gajger, ikan, Insan, ivran064, jerome75, Jester, Kajzer_Soze, Kazablankasrb, kibihrchak, kolateralnasteta, kovinacc, kripo, ladro, Lazur_01, Lep1na, Lester Freamon, littlebunny, lord sir giga, lucianovercetti, Lucije Kvint, luka35, Luke Pathfinder, mackenzie, magyar, Makarid, marki231, Marko Marković, MarkoW, Maruti, Mig 29, mikidragi, mikrimaus, Millennium, milos1231, Milos1987, Milun24, MiroslavD, moldway, Mr. Majevica, mux, Mzee, nebidrag, nefs, NklJov123, ozzy, Pero, PITT, PlayerOne, PO1974, Povratak1912, procesor, proka89, proljece, radoznao, rambod, Ray1973, Rothmans, royst33, Rupert, Sava89, Sawages, shiro, sickmouse, Sir Budimir, Sirius, skvara, Spectator, Srle993, ss10, sslay, StankoVrankovic, starlights, stemark, Stevan Visoki, Stoorb, synergia, tamno.nebo, Tandrkalo, tomo2, Troja, Tumansky, USSVoyager, VanZan, varda, vathra, Vatreni Zmaj, vazduh, vedko, Velizar Laro, veljko82, vidra boy, vidra1, VJ, Vlada78, vladas87, vlahale, voja64, vojnik švejk, vukajlo71, Walkers, wolf1, Wrangler, x9, zillbg, zivojin32, zoran-ruma, Žrnov