MyCity » Ambulanta -> Arhiva Ambulante » Nepoznati proces

Nepoznati proces

Napisano na dan: 7.7.2007
1

Nepoznati proces
Sledeća strana Pagination

Idi na vrh

Poslao: 07 Jul 2007 18:21
Idi na vrh
offline
  • Pridružio: 02 Jan 2006
  • Poruke: 232

Na preporuku gradjana i uvazenih kolega i zbog ove teme
[Link mogu videti samo ulogovani korisnici]

Logfile of HijackThis v1.99.1
Scan saved at 12:34:43 PM, on 7/7/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Office Mouse Driver\MouseDrv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Downloads\T3\T3.exe.exe

O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [NvMediaCenter] "RunDLL32.exe" NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"
O4 - HKLM\..\Run: [WireLessMouse] "C:\Program Files\Office Mouse Driver\StartAutorun.exe" MouseDrv.exe
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: &Download by Orbit - [Link mogu videti samo ulogovani korisnici]\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - [Link mogu videti samo ulogovani korisnici]\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\ie_banner_deny.htm
O8 - Extra context menu item: Do&wnload selected by Orbit - [Link mogu videti samo ulogovani korisnici]\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - [Link mogu videti samo ulogovani korisnici]\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: E&xport to Microsoft Excel - [Link mogu videti samo ulogovani korisnici]\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{35C89F7B-7EF2-43BE-8B4F-B1C2EAD63D29}: NameServer = 82.208.208.10 213.246.55.5
O20 - AppInit_DLLs: "C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll"
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

Dopuna: 07 Jul 2007 18:21

Jel ima nechega sumnjivog?



Poslao: 08 Jul 2007 14:14
Idi na vrh
offline
  • DEMIAN  Male
  • Legendarni građanin
  • IT Manager
  • Pridružio: 25 Mar 2005
  • Poruke: 3706
  • Gde živiš: The darkest place on earth..

Slikaj i postuj nam screenshot registrija sa ove putanje:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Obrati pažnju da se vide svi ključevi koje ovaj path sadrži.



Poslao: 08 Jul 2007 15:36
Idi na vrh
offline
  • Pridružio: 02 Jan 2006
  • Poruke: 232

Ja sam ugasio sporni proces i on je jednostavno nestao,ali evo ti screenshot registry-ja


[Link mogu videti samo ulogovani korisnici]

Poslao: 08 Jul 2007 23:02
Idi na vrh
offline
  • m4rk0  Male
  • Administrator
  • Administrator tech foruma
  • Marko Vasić
  • Gladijator - Maximus Decimus Meridius
  • Pridružio: 14 Jan 2005
  • Poruke: 15766
  • Gde živiš: Majur (Colosseum)

Heh, trebao si pre gasenja tog procesa da uradis screenshot registry-ja (cisto zbog analize), al dobro, gotovo je sad Smile

Poslao: 16 Jul 2007 00:45
Idi na vrh
offline
  • Pridružio: 02 Jan 2006
  • Poruke: 232

Komp mi se neshto chudno ponasha neko vreme od ovog procesa i sada videh da imam neke procese koji su mi opet nepoznati pa vas molim da mi odgovorite.


[Link mogu videti samo ulogovani korisnici]


[Link mogu videti samo ulogovani korisnici]

Predpostavljam da se ovaj proces pojavio jer sam ugasio komp na silu (pao napon struje i ugasio sam ga preko prekidach na napajanju),ali neshto mi je se chudno dogadja poshto ga nekad zakochi kada je na netu a to mi se ranije nije desavalo.

Logfile of HijackThis v1.99.1
Scan saved at 12:50:25 AM, on 7/16/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Office Mouse Driver\MouseDrv.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Winamp\winamp.exe
C:\WINDOWS\system32\svchost.exe
C:\Downloads\T3\T3.exe.exe

O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [NvMediaCenter] "RunDLL32.exe" NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"
O4 - HKLM\..\Run: [WireLessMouse] "C:\Program Files\Office Mouse Driver\StartAutorun.exe" MouseDrv.exe
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: &Download by Orbit - [Link mogu videti samo ulogovani korisnici]\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - [Link mogu videti samo ulogovani korisnici]\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\ie_banner_deny.htm
O8 - Extra context menu item: Do&wnload selected by Orbit - [Link mogu videti samo ulogovani korisnici]\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - [Link mogu videti samo ulogovani korisnici]\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: E&xport to Microsoft Excel - [Link mogu videti samo ulogovani korisnici]\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{35C89F7B-7EF2-43BE-8B4F-B1C2EAD63D29}: NameServer = 82.208.208.10 213.246.55.5
O20 - AppInit_DLLs: "C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll"
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

Poslao: 16 Jul 2007 19:35
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Jeste, taj dumprep se javlja nakon nasilnog gasenja racunara.
Mozes ga iskljuciti stikliranjem sledece linije u HijackThis-u:
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
pa nakon toga klik na Fix Checked

Taj proces inace sluzi da napravi izvestaj koji mozes poslati MS-u na analizu, da utvrde da li je njihov Windows kriv za iznenadni pad sistema.

Poslao: 16 Jul 2007 21:41
Idi na vrh
offline
  • Pridružio: 02 Jan 2006
  • Poruke: 232

Jel mi mozesh reci za ostale procese da li su sumnjivi ili maliciozni.KIS i Spyware Terminator ne prijavljuju nishta.

Poslao: 16 Jul 2007 21:48
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Pa ima jedna cudna stvar, drugi DNS server ti je neki Francuski, imas li ideju zasto?

Poslao: 17 Jul 2007 00:34
Idi na vrh
offline
  • Pridružio: 02 Jan 2006
  • Poruke: 232

Pa ne bash!Shta da mu radim?

Poslao: 17 Jul 2007 19:35
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Odradi sledece:

- skini sledeci program: [url=https://www.mycity.rs/must-login.png
- Startuj i klikni na Scan
- Nakon sto se zavrsi skeniranje na Desktopu ces imati fajl catchme.log. Otvori taj log fajl u Notepadu i iskopiraj sadrzaj u sledecu poruku

MyCity » Ambulanta -> Arhiva Ambulante » Nepoznati proces

Ko je trenutno na forumu
 

Ukupno su 1096 korisnika na forumu :: 138 registrovanih, 14 sakrivenih i 944 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 20624 - dana 04 Apr 2026 04:18

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: 10x10.9, 16.mabr, 357magnum, _Rade, AleksandarV, AleksSE, amaterSRB, amonsrb, Armadillo, Asteker, Automaticar, Ba4e, Betty25, bladesu, Bobrock1, Bojan85, bojan_t, bojank, bokicacar, bounty hunters, bpop, BraneS, CCCP, CHARLIE JA., CikaKURE, Comyymoc, Dannyboy, Dare, del boy, deLacy, dexteroza, DezurniOperativni, DH, Dioniss, DonerEbal, DonRumataEstorski, dragan_mig31, draganl, dusanobr, dushanmil990, Dusko_Dugousko, DzigiNS, Electron, ElGenius, EODBiH, Feller, Fliper, gaga23, GH69, Giskard, GveX, Haris, Holy Saber, iceburn, ivan_8282, ivran064, Jakonjveliki, jalos, janezek67, jarovitt, Jeremiah, Joint Chief, Jomini, Kajzer Soze, kaput21, kihot, Kobrim, Kontrausluga, krasta, kuntakinte, Kupresko polje, Laluvr, Lance Guest, leopard83, LjubisaR, Lobo, lord sir giga, LostInSpaceandTime, luja, luka35, madza, Makarid, maksi007, Malahit, mane123, Manjane, Marko00, marsi, MaschinenPistole, max power, Miki01, mkukoleca, mm1811, moldway, morava_01, Naj-Turs, nazgul75, nenad81, nerislav2025, niksa517, Ns1975, omen, ostoja, Pale2025, pisac12, PrincipL, rakivan, razumihin, Regrut Boskica, Rupert, sevenino, shiro, Siti2, Smor, Solunac na steroidima, tachinni, Tajpan, taomaster, tmanda323, Topaz9, Tribal, TTN, UAV operator, vathra, Vatreni Zmaj, vdeki, veljko82, vidra boy, vidra1, vlad4, Vlada1389, vladetije, Vlajman1957, volimpivuvolimrakiju, Vukasin1981, vuksa72, wizzardone, zmajbre