Molim pomoc

Molim pomoc

offline
  • Pridružio: 28 Okt 2008
  • Poruke: 312

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:15:40 PM, on 11/4/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Ares\Ares.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\korisnik\Desktop\novembar\TR3.exe..exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - [Link mogu videti samo ulogovani korisnici]\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: GEST Service for program management. (GEST Service) - Unknown owner - C:\Program Files\GIGABYTE\GEST\GSvr.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Visibroker Activation Daemon (oad) - Unknown owner - C:\PROGRA~1\Borland\vbroker\bin\oad.exe
O23 - Service: VisiBroker Smart Agent (osagent) - Unknown owner - C:\PROGRA~1\Borland\vbroker\bin\osagent.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe

--
End of file - 3886 bytes

Dopuna: 04 Nov 2008 23:21

Molim vas proverite da li je sve u redu. Bio mi je aktiviran antivirus 2009.



offline
  • Piksi  Male
  • Elitni građanin
  • Pridružio: 13 Nov 2003
  • Poruke: 2435

Pozdrav...

U priloženom logu nema tragova malware-a.
Ipak, izvršićemo još jednu proveru ->

Arrow Preuzmi instalaciju za program Malwarebytes Anti-Malware sa sledećeg linka:
[Link mogu videti samo ulogovani korisnici]

Dvoklikom pokreni instalaciju - na samom kraju procesa, proveri da su obeležene opcije:
Update Malwarebytes' Anti-Malware;
Launch Malwarebytes Anti-Malware;

a zatim klikni Finish.

Nakon završenog ažuriranja program će se pokrenuti.

Izaberi opciju Perform Quick Scan i klikni Scan.

Po završetku procesa klikni OK, Show Results: u listi detektovanog malware-a (ako ga ima), obeleži sve stavke i klikni Remove Selected.

Po završetku procesa, logfile će se otvoriti u Notepad-u; iskopiraj ga u temu na forumu.
Ukoliko program zatraži restart kako bi se završio proces čišćenja, obavezno ga dozvoliti.

Napomena: ako dođe do restarta na kraju procesa čišćenja, logfile će biti dostupan na Logs kartici (obeleži ga i klikni Open).


Takođe, nakon svega, potrebno je postaviti i svež HijackThis logfile.



offline
  • Pridružio: 28 Okt 2008
  • Poruke: 312

Malwarebytes' Anti-Malware 1.30
Database version: 1367
Windows 5.1.2600 Service Pack 2

11/5/2008 1:53:13 PM
mbam-log-2008-11-05 (13-53-12).txt

Scan type: Quick Scan
Objects scanned: 50380
Time elapsed: 3 minute(s), 4 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
Neizmerno sam zahvalna sto izgleda da je sve u redu. Molim vas objasnite mi kako da postavim svez Hijack.

Dopuna: 05 Nov 2008 14:02

Posto sam amater za ove stvari, recite mi sta sam u stvari uradila i da li sad mogu ubuduce da skeniram i sa NOD-om?

offline
  • Piksi  Male
  • Elitni građanin
  • Pridružio: 13 Nov 2003
  • Poruke: 2435

U priloženom MBAM logu nema tragova nikakve infekcije, tako da nema potrebe da postavljate novi HijackThis log.

Obaveštenje koje ste opisali u ovom postu je obaveštenje NOD-a da je blokirana strana sa sumnjivim sadržajem.
Da nije bilo NOD-a, velika je verovatnoća da biste sada bili inficirani...

Naravno, redovno update-ujte Vaš NOD32 i slobodno možete skenirati sa njim.

HijackThis i Malwarebytes' Anti-Malware možete obrisati standardnom procedurom, s tim da MBAM i ne morate - Besplatan je, a može biti od koristi u budućnosti...

To je sve...

offline
  • Pridružio: 28 Okt 2008
  • Poruke: 312

Jos nesto, sada je, srecom, nestala i zuta znacka sa taskbara sto je opisano u Windows forumu.

offline
  • Piksi  Male
  • Elitni građanin
  • Pridružio: 13 Nov 2003
  • Poruke: 2435

'Žuta značka' je, uslovno rečeno, signal da postoje update-ovi za tvoj sistem, ili se neki od update-ova trenutno skida.
To su u stvari zakrpe kojima Microsoft popravlja greške i sigurnosne propuste u sistemu.
Obaveštenje je nestalo najverovatnije zato što su sve zakrpe preuzete i instalirane...

To je sve što se tiče ove teme.
Za dalju diskusiju o ovom ili bilo kom drugom 'problemu', a koji nije vezan za malware, možeš koristiti Windows forum.

Ko je trenutno na forumu
 

Ukupno su 1709 korisnika na forumu :: 358 registrovanih, 23 sakrivenih i 1328 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 15694 - dana 01 Feb 2026 12:23

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: 4fat, 8u47, A.R.Chafee.Jr., advokat84, Ageofloneliness, Aleksa-, aleksandar1888, AleksandarV, aleph_one, alzir86, amaterSRB, Antoni S, Apok, ArchaBasha, Asparagus, ast13, atmel, Automaticar, Avalon015, Ba4e, babaroga, BaneM75, Batinas, Batko.VD.65, Baždaranac, BB, Bbbggg1979, belov, bigbear, black_arrow, bluesky, Boban0312, boj.an, bojan84, bojan_t, bojcistv, Bojke549, boracbl1389, Boris.A, boromir, Borski1977, Bosnjo, bpop, brufen, bufanje, bukefal, Burundi, BZ, C-Gun, ceman, cemix, cenejac111, Chainsaw, Cicumile, CLIPPER, Clouseau, comi991, Comyymoc, Cp6uH, CrazyDiablo, crnitrn, cvrle312, Dado78, darcaud, darkkran, darkojbn, Darth Malak, DeerHunter, deimos25, dejan1972, dekan.m, Dekanovic, Deki Duga Devetka, delboy, Demi87, deri3891, Despot1, dexteroza, Dimitrise93, Django777, Djole3621, djonsule, djordjemiklusev, djukapfc, Djuro2000, dnr, Dogma21, dok80, doom83, Dorcolac, Dovla 1980, draganca, Draganeli, draganl, draganst, DragoslavS, Drugsparrow, Dukelander, dulleo, Dzigy, Dzumanga, Ercomero, esko_hz, Fabius, FilipSRB, Flanker-G, Fog of War, Folkstar, Fructo, Frunze, Fulcrum, g0xy, gasha, GazdaDjoka, Gforce_6, Giro77, gmlale, gobrad, goran.vvv, Goran_, Great White, Grochow, halkin gol, Hans Gajger, havoc995, hellenic, hyla, Ice, igorpet, Igritelj, Igrutinovic, IpMan, IQ116, Ir, ivan1973, ivanhoe31, Ivoo, Jakonjveliki, jalos, Jan, JaV, Joco Skljoco, jodzula, Jomini, Jose, Jozo74, Još malo pa deda, K a s p e r, Kajzer Soze, Kazablankasrb, kirucar, KizJ, Kobrim, kokodakalo, kondenzator, Korle, Koser, KostaN, kreker, Kruger, kuntakinte, kuntalo, Kuroje, kybonacci, lacko, laganini123, lakson001, Laluvr, laurusri, Lep1na, Levi, littlebunny, livada123, lmn, lord_80, LostInSpaceandTime, Lucije Kvint, LUDI, ludvig 78, luja, luka35, madza, magyar, maiden6657, Makarid, maksi007, Manesaur, Manjane, MarijaC84, Markan90, marki231, Marko Marković, marko.markovic, MaschinenPistole, mercedesamg, metallac777, Might is Right, Mihajlo, Miki01, milanpetkovicv, MILJEVINAC, Milometer, milos97, MiroslavD, Miska13, Miškić, Mićko, mnn2, Momiroquai79, morava_01, Mrav Obrad, Muki 123, nazgul75, Nebojsa81, nebojsag, nelezele, Neutral-M, neutrino, nevjerna beba, nick79, Nikolajevic, nixos, nizam, Njubara, nnovakis, novator, Ns1975, oddsock, OnforSadunac, Orc, OREMUS, ostoja, ozzy, paladin71, Pantaaa, peho_atropin, pein, Pekman, Permaldar, Pero Petković, petar0301, Phalanx, Piani Jazzer, picknick, Posluzilac, posmatrac300, Povratak1912, precan, predragc, prikolica, Primus17, procesor, promajauglavi, Pururin, Ran, Ray1973, reader, rebro1974, redstar72, Remain, RiV, Rocky I, RS28, s putnik, sabros, Samo gledam, samojednoimeznam, SamostalniReferent, sap, sasabanjac, Sava89, sekula80, Semberija, Semprini, sevenino, Sevetar, Silence, Sioux7674, siwoti, skok, Sky diver 29, Smiljkovich, Solunac na steroidima, spektorsky, Srbin do koske, Srky Boy, Steeeefan, stefanmpurtic, stegonosa, steksi, stevo svinja, strn, Su 57, suponik, tachinni, Tandrčak, Tankosić, TBoy, Teodorasim, The_new_Statesman, theBorer, tmanda323, tomo2, Troja, tuja, Tumansky, Tunguska55, UAV operator, Underwood, urosbg, uruk, Username1000, Utd4ce, Valter071, VanZan, vargas, vathra, Vatreni Zmaj, vdeki, Velibor Radoja, Velizar Laro, veljko82, veljkovicdani, Veljko™, vensla, vespa nikola, vidra boy, vjetar, vlada13874, vladaa012, vlahale, vobo, Vojo06, Vojvoda81, VojvodaMisic, Volkhov-M, VOŽD, vrlenija, vukan0799, Wehicle, wize, wolf431, x78186, zaoka, Zastava, Zeljo980, ZetaMan, zexon, zil10, zivojin32, zodiac94, zoran-ruma, Zoran_Partizan, Zvone, ZZZ, Žoržo, Žrnov, 1107