MyCity » Zaštita od zlonamernih programa -> Zaštitni programi » LSA Shell da li je virus ili potreban windows file?

LSA Shell da li je virus ili potreban windows file?

Napisano na dan: 8.9.2007

LSA Shell da li je virus ili potreban windows file?
Sledeća strana Pagination

Idi na vrh

Poslao: 08 Sep 2007 12:00
Idi na vrh
offline
  • Zora
  • Pridružio: 22 Okt 2004
  • Poruke: 1451
  • Gde živiš: ni na nebu ni na zemlji

ZA me pitao da li da blokira program Isass.exe

dolje je bio opis sta je to LSA Shell.

prije sam uvek rekla 'deny' ,
ali danas sam htela znati sta je to..
i Kao obicno kad pitam Google dobijem masu mogucih odgovora ...procitala sam da nije opasan..
i propustila sam ga samo da se rijesim prozorcica -opomene..

ali kad sam dalje citala onda je ispalo da moze biti 'worm' sasser..
uh, bas sam pozalila sto nisam odmah pitala vas.

onda sam nasla kako se ispise log file ..sa hijackthis.exe..
(a tu ste me vi zbunili u nekom topicu ..da li je bezopasno koristiti taj program.. je ali ipak sam to uradila..

pa evo , molim 'doktore' za dijagnozu Smile

i recite mi molim vas ,da znam vec jednom,

sta da radim s tim Isass.exe kad me ZA pita? Bebee Dol
Bebee Dol
hvala!
evo log.
Logfile of HijackThis v1.99.1
Scan saved at 11:43:18, on 2007-09-08
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\NewSoft\Presto! PageManager 7.15\Pmsb.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [Link mogu videti samo ulogovani korisnici]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [Link mogu videti samo ulogovani korisnici]
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Webshots Toolbar - {C17590D2-ECB4-4b15-8820-F58798DCC118} - C:\Program Files\Webshots\WSToolbar4IE.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [dvd43] C:\Program Files\dvd43\dvd43_tray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\RunOnce: [C:\PROGRA~1\Canon\CAMERA~1\CAMERA~1\STIREG~1.DLL] C:\WINDOWS\system32\regsvr32.exe /s "C:\PROGRA~1\Canon\CAMERA~1\CAMERA~1\STIREG~1.DLL"
O4 - HKLM\..\RunOnce: [C:\PROGRA~1\Canon\CAMERA~1\CAMERA~2\STIREG~1.DLL] C:\WINDOWS\system32\regsvr32.exe /s "C:\PROGRA~1\Canon\CAMERA~1\CAMERA~2\STIREG~1.DLL"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Personal.lnk = C:\Program Files\Personal\bin\Personal.exe
O8 - Extra context menu item: &Download by Orbit - [Link mogu videti samo ulogovani korisnici]\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Webshots Photo Search - [Link mogu videti samo ulogovani korisnici]\Program Files\Webshots\WSToolbar4IE.dll/MENUSEARCH.HTM
O8 - Extra context menu item: &Yahoo! Search - [Link mogu videti samo ulogovani korisnici]\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - [Link mogu videti samo ulogovani korisnici]\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - [Link mogu videti samo ulogovani korisnici]\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - [Link mogu videti samo ulogovani korisnici]\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - [Link mogu videti samo ulogovani korisnici]\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: IE7pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7Pro\IE7Pro.dll
O9 - Extra 'Tools' menuitem: IE7pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7Pro\IE7Pro.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: *.handelsbanken.se
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{F2898519-5040-42F9-9F4B-E4806A2FAA21}: NameServer = 195.67.199.15 195.67.199.16
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8-) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe



Registruj se da bi učestvovao u diskusiji. Registrovanim korisnicima se NE prikazuju reklame unutar poruka.
Poslao: 08 Sep 2007 17:04
Idi na vrh
offline
  • DEMIAN  Male
  • Legendarni građanin
  • IT Manager
  • Pridružio: 25 Mar 2005
  • Poruke: 3706
  • Gde živiš: The darkest place on earth..

Ne vidim ništa maliciozno u logu koji si postavila.

Napravila si grešku u pisanju:
lsass.exe (početno L) je legitiman Windows-ov fajl. [on je izlistan u tvom logu kao proces]
Isass.exe (početno I kako si ti napisala) bi bio trojan/backdoor.

Citat:sta da radim s tim lsass.exe kad me ZA pita?
Možeš ovo kao i do sada ako nemaš neke smetnje a možeš i da ga pustiš out Smile



Poslao: 08 Sep 2007 19:14
Idi na vrh
offline
  • Zora
  • Pridružio: 22 Okt 2004
  • Poruke: 1451
  • Gde živiš: ni na nebu ni na zemlji

hvala ti mnogo na objasnjenju.
i ti imas zanimljiv 'signature'

MyCity » Zaštita od zlonamernih programa -> Zaštitni programi » LSA Shell da li je virus ili potreban windows file?

Ko je trenutno na forumu
 

Ukupno su 1159 korisnika na forumu :: 177 registrovanih, 23 sakrivenih i 959 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 15694 - dana 01 Feb 2026 12:23

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: 9k38, A.R.Chafee.Jr., aleksandar1888, ALEKSICMILE, aleksjevt, alkatraz080, alternator, Asparagus, Barista, batana, Belisarius, blejač, blue, bojan_t, Bojcca, Bosnjo, Botovac, bpop, BraneS, branko7, brufen, bukefal, cakija, cane2010, cekic, cikadeda, Cirkon, Colt D, DeerHunter, deki1001, Djota1, Dogma21, Dolinc, draganl, dragoljub11987, Duh16, Dungorth, EXIT78, FGR, flash12, Fliper, Fog of War, Futurama, Georgius, gregorxix, grenadir, Grochow, Hans Gajger, havoc995, Holy Saber, Iii, Ilija84, Ir, ivan_8282, ivanhoe31, Jager715510, Jakonjveliki, Jan, Jeremiah, JK, Joint Chief, Jonbonjovi, K-1A, Kajzer Soze, Kapetan993, kaput21, klepesina, Kole1975, kovacicbozo, kybonacci, Le Banner, M1los, Mackomen, maiden6657, mango, Marko Marković, marsovac 2, matrix_1, maxim_von_burdengate, MDrasko, Meklejn, milanpb, mile.ilic75, Mile14, Miletić Zoran, miljannis, MiloradKomadic, Milos ZA, milos1231, milosdam, miroslav tamnavski, mishkooo, mm1811, morava_01, Mr. Majevica, mrm, Naj-Turs, Naturelo, Ne doznajem se u oružje, nebkv, neko iz mase, Nemanja94, nevjerna beba, nikolapetkovic, Ognjen D., orfanel, orjen, Papadubi, Permaldar, Pero Petković, Perudin_92, Petar888, petrovicrs, precan, prikolica, pristinski korpus, PuškeiPlavuše, Radogost, RajkoB, raketaš, raptorsi, renvoi, Ripanjac, rodoljub, royst33, sale755, SamoGledam, sarma, Sass Drake, Seeker, Semberija, Semprini, sevenino, Sharpshooter, Smor, StankoVrankovic, stegonosa, steksi, Stoilkovic, styg, t84dar, Tas011, TheDictator, tmanda323, tomigun, tomo-hr, Tomo988, tuja, Tumansky, tvlada, Tvrtko I, UAV operator, vathra, Vatreni Zmaj, vensla, virked, Vlada78, vladimir070, VNVK, vobo, VOŽD, VPV, vuk77, vzd1389, Wehicle, wize, xAlex2, XBMC, Yugol33, Zastava, zil10, Zjmc, zombicar153, zoran-ruma, Zoran1959, Zvrk, Žrnov