MyCity » Ambulanta -> Arhiva Ambulante » Problem

Problem

Napisano na dan: 23.2.2008
1

Problem
Sledeća strana Pagination

Idi na vrh

Poslao: 23 Feb 2008 21:15
Idi na vrh
offline
  • Pridružio: 30 Jan 2008
  • Poruke: 113

prilikom pokusaja otvaranja "control cnter"(nod32),pojavljuje mi se ovo:"Error occurred during communication with nod32 kernel service".Jedino mogu da skeniram,ali prilikom skeniranja ne pronalazi nista.
prijatalj mare mi je rekao da se obratim u ambulanti,jer postoji mogucnost da ipak imam neku zarazu.


Logfile of HijackThis v1.99.1
Scan saved at 21:07:09, on 23.02.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\VisualTooltip\VisualToolTip.exe
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\Programme\Windows Media Player\WMPNSCFG.exe
C:\Programme\Servis (Mare)\Clock (tclock2)\tclock2.exe
C:\DOKUME~1\As\LOKALE~1\Temp\{F52EE072-D565-411C-9C0A-6C7CFA0A555B}\VistaPerfectionStartButton.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Dokumente und Einstellungen\As\Desktop\provera\HT.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = [Link mogu videti samo ulogovani korisnici]
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [Link mogu videti samo ulogovani korisnici]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [Link mogu videti samo ulogovani korisnici]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [Link mogu videti samo ulogovani korisnici]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [Link mogu videti samo ulogovani korisnici]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [Link mogu videti samo ulogovani korisnici]
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\pchealth\helpctr\System\panels\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\pchealth\helpctr\System\panels\blank.htm
F2 - REG:system.ini: Shell=
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Programme\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll
O4 - HKLM\..\Run: [VisualTooltip] C:\Programme\VisualTooltip\VisualToolTip.exe
O4 - HKLM\..\Run: [AzMixerSel] C:\Programme\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Programme\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [nod32kui] "C:\Programme\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\WMPNSCFG.exe
O4 - Startup: TClock2.lnk = C:\Programme\Servis (Mare)\Clock (tclock2)\tclock2.exe
O4 - Startup: VistaPerfectionStartButton.lnk = C:\VTPFiles\VistaPerfectionStartButton.exe
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - [Link mogu videti samo ulogovani korisnici]\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O11 - Options group: [TABS] Tabbed Browsing
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - [Link mogu videti samo ulogovani korisnici]
O16 - DPF: {D1548A26-B8F6-4E86-AE74-E7062CCC2E2A} (igLoader Content on Demand) - [Link mogu videti samo ulogovani korisnici]
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - [Link mogu videti samo ulogovani korisnici]
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe



Poslao: 23 Feb 2008 22:34
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Skini ComboFix sa jedne od sledecih adresa na Desktop:
[Link mogu videti samo ulogovani korisnici]
[Link mogu videti samo ulogovani korisnici]

Startuj ga i ne diraj prozor programa dok skenira.
Sledi uputstva na ekranu. Kada zavrsi pojavice se log (C:\ComboFix.txt) koji ces nam ovde iskopirati.



Poslao: 23 Feb 2008 22:54
Idi na vrh
offline
  • Pridružio: 30 Jan 2008
  • Poruke: 113

ComboFix 08-02-24.2 - As 2008-02-23 22:43:56.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.49.1031.18.139 [GMT 1:00]
ausgeführt von:: C:\Dokumente und Einstellungen\As\Desktop\ComboFix.exe
* Neuer Wiederherstellungspunkt wurde erstellt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft\Network\Downloader\qmgr0.dat
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft\Network\Downloader\qmgr1.dat
C:\Dokumente und Einstellungen\As\Favoriten\Error Cleaner.url
C:\Dokumente und Einstellungen\As\Favoriten\Privacy Protector.url
C:\Dokumente und Einstellungen\As\Favoriten\Spyware&Malware Protection.url
C:\RECYCLER\mxfilerelatedcache.mxc2
C:\WINDOWS\Options\CABS\_desktop.ini
C:\WINDOWS\rs.txt
C:\WINDOWS\search_res.txt
C:\WINDOWS\system32\cfx32.ocx

----- BITS: Possible infected sites -----

[Link mogu videti samo ulogovani korisnici]
[Link mogu videti samo ulogovani korisnici]
[Link mogu videti samo ulogovani korisnici]
.
((((((((((((((((((((((( Dateien erstellt von 2008-01-24 bis 2008-02-24 ))))))))))))))))))))))))))))))
.

2008-02-23 21:18 . 2008-02-23 22:30 <DIR> d-------- C:\Programme\DC++
2008-02-23 20:43 . 2008-02-23 20:43 244 --ah----- C:\sqmnoopt02.sqm
2008-02-23 20:43 . 2008-02-23 20:43 232 --ah----- C:\sqmdata02.sqm
2008-02-23 18:27 . 2006-09-01 12:09 36,864 --a------ C:\WINDOWS\system32\drivers\hidclass.sys
2008-02-21 15:53 . 2008-02-21 15:53 <DIR> d-------- C:\Programme\Gemeinsame Dateien\MAGIX
2008-02-21 15:53 . 2007-04-27 10:43 120,200 --a------ C:\WINDOWS\system32\DLLDEV32i.dll
2008-02-21 14:39 . 2008-02-21 14:39 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Hypnotizer
2008-02-20 23:10 . 2008-02-20 23:10 244 --ah----- C:\sqmnoopt01.sqm
2008-02-20 23:10 . 2008-02-20 23:10 232 --ah----- C:\sqmdata01.sqm
2008-02-17 22:57 . 2008-02-18 11:48 <DIR> d-------- C:\Program Files
2008-02-06 02:20 . 2008-02-18 11:48 <DIR> d-------- C:\Programme\Winamp Toolbar
2008-02-06 02:20 . 2008-02-06 02:20 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Winamp Toolbar
2008-02-06 01:33 . 2008-02-17 13:53 <DIR> d-------- C:\Dokumente und Einstellungen\As\Anwendungsdaten\Winamp
2008-02-05 23:37 . 2008-02-18 19:23 <DIR> d-------- C:\Dokumente und Einstellungen\As\MAGIX Online Druck Service
2008-02-05 23:19 . 2008-02-21 16:34 <DIR> d-------- C:\Programme\MAGIX
2008-01-31 17:42 . 2008-02-07 20:03 <DIR> d-------- C:\Programme\Spybot - Search & Destroy
2008-01-26 15:50 . 2008-01-26 15:55 81,920 --a------ C:\WINDOWS\ALCFDRTM.VER
2008-01-26 15:50 . 2008-01-26 15:50 81,920 --a------ C:\WINDOWS\ALCFDRTM.EXE
2008-01-26 13:12 . 2008-01-26 19:57 <DIR> d--h----- C:\WINDOWS\msdownld.tmp
2008-01-24 23:57 . 2008-01-24 23:57 <DIR> d-------- C:\Programme\Gemeinsame Dateien\xing shared
2008-01-24 23:51 . 2008-01-24 23:51 <DIR> d-------- C:\Programme\Real

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-21 14:13 --------- d--h--w C:\Programme\InstallShield Installation Information
2008-02-18 10:47 --------- d-----w C:\Programme\Windows Media Connect 2
2008-02-09 22:10 --------- d-----w C:\Dokumente und Einstellungen\As\Anwendungsdaten\Azureus
2008-02-08 00:14 --------- d-----w C:\Programme\ESET
2008-02-07 20:31 34,520 ----a-w C:\Dokumente und Einstellungen\As\Anwendungsdaten\GDIPFONTCACHEV1.DAT
2008-02-06 01:20 --------- d-----w C:\Programme\Winamp
2008-02-05 22:44 --------- d-----w C:\Programme\CONEXANT
2008-02-05 22:44 --------- d-----w C:\Programme\Common Files
2008-02-05 21:51 --------- d-----w C:\Dokumente und Einstellungen\As\Anwendungsdaten\LimeWire
2008-02-05 21:50 --------- d-----w C:\Dokumente und Einstellungen\As\Anwendungsdaten\BearShare
2008-01-31 17:12 --------- d-----w C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2008-01-31 07:39 --------- d--h--w C:\Programme\Servis (Mare)
2008-01-26 15:00 --------- d-----w C:\Programme\Zweckform Design Galerie
2008-01-26 15:00 --------- d-----w C:\Programme\XP Hidden Application Enabler
2008-01-26 15:00 --------- d-----w C:\Programme\WinMX Music
2008-01-26 15:00 --------- d-----w C:\Programme\VisualTooltip
2008-01-26 15:00 --------- d-----w C:\Programme\Ubisoft
2008-01-26 15:00 --------- d-----w C:\Programme\Synaptics
2008-01-26 15:00 --------- d-----w C:\Programme\ScanSoft
2008-01-24 22:57 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-01-24 22:57 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2008-01-24 22:57 --------- d-----w C:\Programme\Gemeinsame Dateien\Real
2008-01-12 19:33 --------- d-----w C:\Programme\Brother
2008-01-12 19:33 --------- d-----w C:\Programme\BearShare Applications
2008-01-12 19:33 --------- d-----w C:\Programme\AVerMedia
2008-01-12 19:33 --------- d-----w C:\Programme\ATI Technologies
2007-09-02 16:35 471 ----a-w C:\Programme\Verknüpfung mit LEGO Media.lnk
2007-08-22 18:24 16 ---ha-w C:\Programme\mxfilerelatedcache.mxc2
2007-06-26 14:10 16,384 --sha-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
2007-06-26 14:10 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\index.dat
2007-06-26 14:10 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Verlauf\History.IE5\index.dat
2007-06-26 14:10 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Verlauf\History.IE5\MSHist012007062620070627\index.dat
.

------- Sigcheck -------

"C:\WINDOWS\system32\user32.dll"
----a-w 578,560 2006-12-13 10:35:35 C:\WINDOWS\system32\user32.dll

"C:\WINDOWS\system32\wininet.dll"
----a-w 818,688 2006-12-13 10:39:08 C:\WINDOWS\system32\wininet.dll

"C:\WINDOWS\system32\drivers\tcpip.sys"
----a-w 360,576 2006-12-13 10:39:21 C:\WINDOWS\system32\drivers\tcpip.sys

"C:\WINDOWS\system32\ntkrnlpa.exe"
----a-w 2,059,136 2006-12-13 10:48:03 C:\WINDOWS\system32\ntkrnlpa.exe
----a-w 2,059,136 2006-12-13 10:48:04 C:\WINDOWS\system32\VITrans\ntkrnlpa.exe

"C:\WINDOWS\system32\ntoskrnl.exe"
----a-w 2,181,632 2006-12-13 10:35:01 C:\WINDOWS\system32\ntoskrnl.exe
----a-w 2,181,632 2006-12-13 10:35:02 C:\WINDOWS\system32\VITrans\ntoskrnl.exe

"C:\WINDOWS\explorer.exe"
----a-w 1,425,920 2004-08-03 23:57:54 C:\WINDOWS\explorer.exe
----a-w 1,035,264 2004-08-03 23:57:54 C:\WINDOWS\system32\VITrans\explorer.exe
.
(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:57 15360]
"swg"="C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-20 18:19 68856]
"SpybotSD TeaTimer"="C:\Programme\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46 1460560]
"WMPNSCFG"="C:\Programme\Windows Media Player\WMPNSCFG.exe" [2006-11-03 08:56 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VisualTooltip"="C:\Programme\VisualTooltip\VisualToolTip.exe" [2006-10-06 08:21 942080]
"AzMixerSel"="C:\Programme\Realtek\InstallShield\AzMixerSel.exe" [2006-04-15 12:35 53248]
"ATICCC"="C:\Programme\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 16:41 45056]
"nod32kui"="C:\Programme\Eset\nod32kui.exe" [2007-06-28 15:57 921600]
"TkBellExe"="C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" [2008-01-24 23:57 185896]
"SynTPEnh"="C:\Programme\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 12:07 761946]

C:\Dokumente und Einstellungen\As\Startmen\Programme\Autostart\
TClock2.lnk - C:\Programme\Servis (Mare)\Clock (tclock2)\tclock2.exe [2007-06-26 21:20:20 90624]
VistaPerfectionStartButton.lnk - C:\VTPFiles\VistaPerfectionStartButton.exe [2007-06-28 14:23:54 393216]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"SynchronousMachineGroupPolicy"= 0 (0x0)
"SynchronousUserGroupPolicy"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)
"NoDesktopCleanupWizard"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SkyTel"=SkyTel.EXE
"SunJavaUpdateSched"="C:\Programme\Java\jre1.6.0_01\bin\jusched.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Programme\\LimeWire\\LimeWire.exe"=
"C:\\Programme\\DC++\\DCPlusPlus.exe"=


.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2008-02-24 22:45:36
Windows 5.1.2600 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostart Einträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
Zeit der Fertigstellung: 2008-02-24 22:46:06
ComboFix-quarantined-files.txt 2008-02-24 21:45:52

Poslao: 23 Feb 2008 23:09
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Izgleda kao da je ComboFix sredio stvari.
Ima li kakvih vidljivih simptoma?

Poslao: 24 Feb 2008 00:36
Idi na vrh
offline
  • Pridružio: 30 Jan 2008
  • Poruke: 113

samo da naglasim:sada vec i kada nesto startujem sa winamp-om,ili drugim programom...film,muzika...prekida svakih par sekundi,a to mi se nije desavalo do pre par sati.takodje i prilikom novog startovanja duze podize sistem.kada hocu iz jednog ordner u drugi da prebacim fail koji ima 700mb. potrebno mi je 35-40min.

Dopuna: 24 Feb 2008 0:20

izvini na mom odgovoru,ali tek sada mi je prikazalo tvoju poruku

Dopuna: 24 Feb 2008 0:36

wien ::samo da naglasim:sada vec i kada nesto startujem sa winamp-om,ili drugim programom...film,muzika...prekida svakih par sekundi,a to mi se nije desavalo do pre par sati.takodje i prilikom novog startovanja duze podize sistem.kada hocu iz jednog ordner u drugi da prebacim fail koji ima 700mb. potrebno mi je 35-40min.

Dopuna: 24 Feb 2008 0:20

izvini na mom odgovoru,ali tek sada mi je prikazalo tvoju poruku
takodje,nod32 mi je jos uvek neefikasan.
jos uvek kada hocu da ppogledam control center izbacuje prozor::"Error occurred during communication with nod32 kernel service".

Dopuna: 24 Feb 2008 0:36

wien ::

Dopuna: 24 Feb 2008 0:20

izvini na mom odgovoru,ali tek sada mi je prikazalo tvoju poruku
takodje,nod32 mi je jos uvek neefikasan.
jos uvek kada hocu da ppogledam control center izbacuje prozor::"Error occurred during communication with nod32 kernel service". [/quote]

Poslao: 24 Feb 2008 00:51
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Probaj da deinstaliras, pa ponovo instaliras NOD32.

Poslao: 24 Feb 2008 16:06
Idi na vrh
offline
  • Pridružio: 30 Jan 2008
  • Poruke: 113

Racunar mi sada radi odlicno,ali sada se namecu novi problemi.
Neznam da li da otvaram novu temu,ali svakako:
Deinstalirao sam nod32,i ponovo ga instalirao.Medjutim,kada startujem nod32 da skenira iz Safe Mode,odradi par minuta i ugasi mi racunar.Takodje kada startujem Spy.S&D u Safe Mode ugasi mi racunar,pre nego sto i otvori program.I kod Nod32,i kod slucaja sa Spy.S&D,kada ugasi nemoguce je startovati racunar sve dok se ne skine sa dovoda kompletne struje.Nakon toga opet prikopcam na struju i sve je OK. Sta bi mogao biti problem?

Poslao: 24 Feb 2008 21:20
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Napravi mi novi ComboFix log, kao i log GMER-om:

Preuzmi fajl gmer.zip sa ovog linka i sačuvaj na Desktop-u.
Raspakuj ga u neki folder.

Dupli klik na gmer.exe za početak: Izaberi Rootkit Tab na vrhu.
Klikni na Scan.
Kada je skeniranje završeno, klik na Copy dugme ispod - ovo će sačuvati to u Clipboard.
Iskoristi opciju Paste u Notepad-u da bi to prebacio u tekst. Snimi taj tekst iz Notepada kao file1.txt.
Ponovi ovo isto sa Autostart Tab-om. Snimi taj tekst iz Notepada kao file2.txt.

Iskopiraj nam ovde sadrzaj ta dva fajla koja smo malopre snimili

Poslao: 25 Feb 2008 17:02
Idi na vrh
offline
  • Pridružio: 30 Jan 2008
  • Poruke: 113

ComboFix 08-02-24.2 - As 2008-02-24 23:47:05.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.49.1031.18.128 [GMT 1:00]
ausgeführt von:: C:\Dokumente und Einstellungen\As\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((( Dateien erstellt von 2008-01-24 bis 2008-02-24 ))))))))))))))))))))))))))))))
.

2008-02-24 22:49 . 2008-02-24 22:49 <DIR> d-------- C:\WINDOWS\system32\xircom
2008-02-24 22:49 . 2008-02-24 22:49 <DIR> d-------- C:\Programme\microsoft frontpage
2008-02-24 22:10 . 2008-02-24 23:42 250 --a------ C:\WINDOWS\gmer.ini
2008-02-24 21:05 . 2008-02-24 22:24 <DIR> d-------- C:\Programme\DC++
2008-02-24 13:37 . 2008-02-24 13:36 512,096 --a------ C:\WINDOWS\system32\drivers\amon.sys
2008-02-24 13:37 . 2008-02-24 13:36 298,104 --a------ C:\WINDOWS\system32\imon.dll
2008-02-24 13:37 . 2008-02-24 13:36 15,424 --a------ C:\WINDOWS\system32\drivers\nod32drv.sys
2008-02-24 13:36 . 2008-02-24 14:48 <DIR> d-------- C:\Programme\ESET
2008-02-23 22:08 . 2006-12-13 11:34 36,864 --a------ C:\WINDOWS\system32\drivers\hidclass.sys
2008-02-23 20:43 . 2008-02-23 20:43 244 --ah----- C:\sqmnoopt02.sqm
2008-02-23 20:43 . 2008-02-23 20:43 232 --ah----- C:\sqmdata02.sqm
2008-02-21 15:53 . 2008-02-21 15:53 <DIR> d-------- C:\Programme\Gemeinsame Dateien\MAGIX
2008-02-21 15:53 . 2007-04-27 10:43 120,200 --a------ C:\WINDOWS\system32\DLLDEV32i.dll
2008-02-21 14:39 . 2008-02-21 14:39 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Hypnotizer
2008-02-20 23:10 . 2008-02-20 23:10 244 --ah----- C:\sqmnoopt01.sqm
2008-02-20 23:10 . 2008-02-20 23:10 232 --ah----- C:\sqmdata01.sqm
2008-02-17 22:57 . 2008-02-18 11:48 <DIR> d-------- C:\Program Files
2008-02-06 02:20 . 2008-02-18 11:48 <DIR> d-------- C:\Programme\Winamp Toolbar
2008-02-06 02:20 . 2008-02-06 02:20 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Winamp Toolbar
2008-02-06 01:33 . 2008-02-17 13:53 <DIR> d-------- C:\Dokumente und Einstellungen\As\Anwendungsdaten\Winamp
2008-02-05 23:37 . 2008-02-18 19:23 <DIR> d-------- C:\Dokumente und Einstellungen\As\MAGIX Online Druck Service
2008-02-05 23:19 . 2008-02-21 16:34 <DIR> d-------- C:\Programme\MAGIX
2008-01-31 17:42 . 2008-02-07 20:03 <DIR> d-------- C:\Programme\Spybot - Search & Destroy
2008-01-26 15:50 . 2008-01-26 15:55 81,920 --a------ C:\WINDOWS\ALCFDRTM.VER
2008-01-26 15:50 . 2008-01-26 15:50 81,920 --a------ C:\WINDOWS\ALCFDRTM.EXE
2008-01-26 13:12 . 2008-01-26 19:57 <DIR> d--h----- C:\WINDOWS\msdownld.tmp
2008-01-24 23:57 . 2008-01-24 23:57 <DIR> d-------- C:\Programme\Gemeinsame Dateien\xing shared
2008-01-24 23:51 . 2008-01-24 23:51 <DIR> d-------- C:\Programme\Real

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-24 22:06 70,144 ----a-w C:\WINDOWS\system32\dllcache\notepad.exe
2008-02-24 22:06 70,144 ----a-w C:\WINDOWS\NOTEPAD.EXE
2008-02-21 14:13 --------- d--h--w C:\Programme\InstallShield Installation Information
2008-02-18 10:47 --------- d-----w C:\Programme\Windows Media Connect 2
2008-02-09 22:10 --------- d-----w C:\Dokumente und Einstellungen\As\Anwendungsdaten\Azureus
2008-02-07 20:31 34,520 ----a-w C:\Dokumente und Einstellungen\As\Anwendungsdaten\GDIPFONTCACHEV1.DAT
2008-02-06 01:20 --------- d-----w C:\Programme\Winamp
2008-02-05 22:44 --------- d-----w C:\Programme\CONEXANT
2008-02-05 22:44 --------- d-----w C:\Programme\Common Files
2008-02-05 21:51 --------- d-----w C:\Dokumente und Einstellungen\As\Anwendungsdaten\LimeWire
2008-02-05 21:50 --------- d-----w C:\Dokumente und Einstellungen\As\Anwendungsdaten\BearShare
2008-01-31 17:12 --------- d-----w C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2008-01-31 07:39 --------- d--h--w C:\Programme\Servis (Mare)
2008-01-26 15:00 --------- d-----w C:\Programme\Zweckform Design Galerie
2008-01-26 15:00 --------- d-----w C:\Programme\XP Hidden Application Enabler
2008-01-26 15:00 --------- d-----w C:\Programme\WinMX Music
2008-01-26 15:00 --------- d-----w C:\Programme\VisualTooltip
2008-01-26 15:00 --------- d-----w C:\Programme\Ubisoft
2008-01-26 15:00 --------- d-----w C:\Programme\Synaptics
2008-01-26 15:00 --------- d-----w C:\Programme\ScanSoft
2008-01-24 22:57 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-01-24 22:57 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2008-01-24 22:57 --------- d-----w C:\Programme\Gemeinsame Dateien\Real
2008-01-12 19:33 --------- d-----w C:\Programme\Brother
2008-01-12 19:33 --------- d-----w C:\Programme\BearShare Applications
2008-01-12 19:33 --------- d-----w C:\Programme\AVerMedia
2008-01-12 19:33 --------- d-----w C:\Programme\ATI Technologies
2007-09-02 16:35 471 ----a-w C:\Programme\Verknüpfung mit LEGO Media.lnk
2007-08-22 18:24 16 ---ha-w C:\Programme\mxfilerelatedcache.mxc2
2007-06-26 14:10 16,384 --sha-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
2007-06-26 14:10 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\index.dat
2007-06-26 14:10 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Verlauf\History.IE5\index.dat
2007-06-26 14:10 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Verlauf\History.IE5\MSHist012007062620070627\index.dat
.

------- Sigcheck -------

"C:\WINDOWS\system32\user32.dll"
----a-w 578,560 2006-12-13 10:35:35 C:\WINDOWS\system32\user32.dll

"C:\WINDOWS\system32\wininet.dll"
----a-w 818,688 2006-12-13 10:39:08 C:\WINDOWS\system32\wininet.dll

"C:\WINDOWS\system32\drivers\tcpip.sys"
----a-w 360,576 2006-12-13 10:39:21 C:\WINDOWS\system32\drivers\tcpip.sys

"C:\WINDOWS\system32\ntkrnlpa.exe"
----a-w 2,059,136 2006-12-13 10:48:03 C:\WINDOWS\system32\ntkrnlpa.exe
----a-w 2,059,136 2006-12-13 10:48:04 C:\WINDOWS\system32\VITrans\ntkrnlpa.exe

"C:\WINDOWS\system32\ntoskrnl.exe"
----a-w 2,181,632 2006-12-13 10:35:01 C:\WINDOWS\system32\ntoskrnl.exe
----a-w 2,181,632 2006-12-13 10:35:02 C:\WINDOWS\system32\VITrans\ntoskrnl.exe

"C:\WINDOWS\explorer.exe"
----a-w 1,425,920 2004-08-03 23:57:54 C:\WINDOWS\explorer.exe
----a-w 1,035,264 2004-08-03 23:57:54 C:\WINDOWS\system32\VITrans\explorer.exe
.
(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{376892AE-1825-4E5F-9F85-23F9640051CC}]
2007-11-07 15:38 130048 --a------ C:\WINDOWS\Trntfiltr.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:57 15360]
"swg"="C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-20 18:19 68856]
"SpybotSD TeaTimer"="C:\Programme\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46 1460560]
"WMPNSCFG"="C:\Programme\Windows Media Player\WMPNSCFG.exe" [2006-11-03 08:56 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VisualTooltip"="C:\Programme\VisualTooltip\VisualToolTip.exe" [2006-10-06 08:21 942080]
"AzMixerSel"="C:\Programme\Realtek\InstallShield\AzMixerSel.exe" [2006-04-15 12:35 53248]
"ATICCC"="C:\Programme\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 16:41 45056]
"TkBellExe"="C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" [2008-01-24 23:57 185896]
"SynTPEnh"="C:\Programme\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 12:07 761946]
"nod32kui"="C:\Programme\Eset\nod32kui.exe" [2008-02-24 13:36 949376]

C:\Dokumente und Einstellungen\As\Startmen\Programme\Autostart\
TClock2.lnk - C:\Programme\Servis (Mare)\Clock (tclock2)\tclock2.exe [2007-06-26 21:20:20 90624]
VistaPerfectionStartButton.lnk - C:\VTPFiles\VistaPerfectionStartButton.exe [2007-06-28 14:23:54 393216]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"SynchronousMachineGroupPolicy"= 0 (0x0)
"SynchronousUserGroupPolicy"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)
"NoDesktopCleanupWizard"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SkyTel"=SkyTel.EXE
"SunJavaUpdateSched"="C:\Programme\Java\jre1.6.0_01\bin\jusched.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Programme\\LimeWire\\LimeWire.exe"=
"C:\\Programme\\DC++\\DCPlusPlus.exe"=


.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2008-02-24 23:48:01
Windows 5.1.2600 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostart Einträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
Zeit der Fertigstellung: 2008-02-24 23:48:41
ComboFix-quarantined-files.txt 2008-02-24 22:48:24
ComboFix2.txt 2008-02-24 21:46:07

Dopuna: 25 Feb 2008 0:04

[Link mogu videti samo ulogovani korisnici]

[Link mogu videti samo ulogovani korisnici]

Prvi put ovo radim,pa ako nisam dobro postupio ja s izvinjavam.

Dopuna: 25 Feb 2008 0:25

Samo jos da dodam da mi trazi i novu instalaciju drukera,kao da ga nema.

Dopuna: 25 Feb 2008 11:47

da,vec nekoliko puta mi izbacuje i prozor od Windows Firewall,da kada se ulogujem na neki sait,obavestava me da su pojedine funkcije u programu blokirane.
to mi se do sada nije desavalo,jer sam na tim saitovima se logovao svakodnevno

Dopuna: 25 Feb 2008 17:02

evo sada mi je Spy.S&D.pronasao,sto do sada nisam imao prilike da se susretnem sa time:
Cache-1
Coocie-2
History-1
Log -17

Mada ja sam pokusao da sve to kopiram i prebacim ovde kao link,pa neznam da li sam uspeo...


[Link mogu videti samo ulogovani korisnici]

Poslao: 25 Feb 2008 19:41
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Spakuj u jedan ZIP sledece fajlove:
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\VITrans\explorer.exe

Uploaduj mi taj ZIP preko sledece forme:
[Link mogu videti samo ulogovani korisnici]

MyCity » Ambulanta -> Arhiva Ambulante » Problem

Ko je trenutno na forumu
 

Ukupno su 1030 korisnika na forumu :: 138 registrovanih, 13 sakrivenih i 879 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 15694 - dana 01 Feb 2026 12:23

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: 037, 357magnum, _Rade, A.R.Chafee.Jr., Agape, alke12, amonsrb, Andrija357, Apok, Arsenije, badboys2, bb929, Betty25, blatruc82, blue, bojan_t, branko7, Colt D, cyprus, dearg, DeerHunter, dejan1972, deLacy, dendrit86, DezurniOperativni, Djevrek od kartona, djuradj, Djuza, Dogma21, dolinalima, doragan, draganl, DrFlyFisherman, Drugard72, dule10savic, dulleo, DuškoMraz, Džekson, Fliper, foksmolder, FOX, fugasa, Gogi_avio, Great White, GveX, ikan, IpMan, Jelly4183, Joja, Kajzer Soze, Kalem, Karla, Kazablankasrb, kolle.the.kid, Komanca, kovacicbozo, kovinacc, kozhedub, Lepi Jova, loon123, LostInSpaceandTime, Lucije Kvint, lucko1, Luke Pathfinder, Mae, Magarac, Magistar78, markolopin, Maschinekalibar, mat, Mcdado, mercedesamg, Mikoyan98, mikrimaus, milenko crazy north, Miler88, MiljanXD, milos1231, milutin134, mm1811, mocnijogurt, moldway, MrNo, nemkea71, nenad81, Neutral-M, NklJov123, Nmr, obsc, ozzy, peraklio, perunnurep, Petrusci, ping15, Povratak1912, proljece, promajauglavi, Radoslava, raptorsi, renvoi, Ripanjac, SamoGledam, silikon, Silvertooth, Singidunumac, Sir Budimir, Sirius, Smiljke, SOVO515, SpaDej, SPUTNJIK, stegonosa, Stoilkovic, Stoorb, Tas011, Tastatura ratnik, Teodor60, theNedjeljko, Tristan_Bantam, troki1971, tuf, ujke, vaci, vathra, Velizar Laro, vensla, Vlada1389, Vlada76, vladaa012, VPV, Vzor50, Walkers, wizzardone, wolf431, wolverined4, x011, xAlex2, Zanzibar