Problem

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

prilikom pokusaja otvaranja "control cnter"(nod32),pojavljuje mi se ovo:"Error occurred during communication with nod32 kernel service".Jedino mogu da skeniram,ali prilikom skeniranja ne pronalazi nista.
prijatalj mare mi je rekao da se obratim u ambulanti,jer postoji mogucnost da ipak imam neku zarazu.


Logfile of HijackThis v1.99.1
Scan saved at 21:07:09, on 23.02.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\VisualTooltip\VisualToolTip.exe
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\Programme\Windows Media Player\WMPNSCFG.exe
C:\Programme\Servis (Mare)\Clock (tclock2)\tclock2.exe
C:\DOKUME~1\As\LOKALE~1\Temp\{F52EE072-D565-411C-9C0A-6C7CFA0A555B}\VistaPerfectionStartButton.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Dokumente und Einstellungen\As\Desktop\provera\HT.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = search.bearshare.com/sidebar.html?src=ssb
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = google.at/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\pchealth\helpctr\System\panels\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\pchealth\helpctr\System\panels\blank.htm
F2 - REG:system.ini: Shell=
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Programme\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll
O4 - HKLM\..\Run: [VisualTooltip] C:\Programme\VisualTooltip\VisualToolTip.exe
O4 - HKLM\..\Run: [AzMixerSel] C:\Programme\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Programme\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [nod32kui] "C:\Programme\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\WMPNSCFG.exe
O4 - Startup: TClock2.lnk = C:\Programme\Servis (Mare)\Clock (tclock2)\tclock2.exe
O4 - Startup: VistaPerfectionStartButton.lnk = C:\VTPFiles\VistaPerfectionStartButton.exe
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O11 - Options group: [TABS] Tabbed Browsing
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - miniclip.com/games/ricochet-lost-worlds/de/ReflexiveWebGameLoader.cab
O16 - DPF: {D1548A26-B8F6-4E86-AE74-E7062CCC2E2A} (igLoader Content on Demand) - miniclip.com/igloader/igloader.CAB
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - signin3.valueactive.com/Register/Branding/olr3313/OCX/flashax.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Skini ComboFix sa jedne od sledecih adresa na Desktop:
http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Startuj ga i ne diraj prozor programa dok skenira.
Sledi uputstva na ekranu. Kada zavrsi pojavice se log (C:\ComboFix.txt) koji ces nam ovde iskopirati.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

ComboFix 08-02-24.2 - As 2008-02-23 22:43:56.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.49.1031.18.139 [GMT 1:00]
ausgeführt von:: C:\Dokumente und Einstellungen\As\Desktop\ComboFix.exe
* Neuer Wiederherstellungspunkt wurde erstellt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft\Network\Downloader\qmgr0.dat
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft\Network\Downloader\qmgr1.dat
C:\Dokumente und Einstellungen\As\Favoriten\Error Cleaner.url
C:\Dokumente und Einstellungen\As\Favoriten\Privacy Protector.url
C:\Dokumente und Einstellungen\As\Favoriten\Spyware&Malware Protection.url
C:\RECYCLER\mxfilerelatedcache.mxc2
C:\WINDOWS\Options\CABS\_desktop.ini
C:\WINDOWS\rs.txt
C:\WINDOWS\search_res.txt
C:\WINDOWS\system32\cfx32.ocx

----- BITS: Possible infected sites -----

hxxp://77.91.228.180
hxxp://thenetworkcom.com
hxxp://onsafepro.com
.
((((((((((((((((((((((( Dateien erstellt von 2008-01-24 bis 2008-02-24 ))))))))))))))))))))))))))))))
.

2008-02-23 21:18 . 2008-02-23 22:30 <DIR> d-------- C:\Programme\DC++
2008-02-23 20:43 . 2008-02-23 20:43 244 --ah----- C:\sqmnoopt02.sqm
2008-02-23 20:43 . 2008-02-23 20:43 232 --ah----- C:\sqmdata02.sqm
2008-02-23 18:27 . 2006-09-01 12:09 36,864 --a------ C:\WINDOWS\system32\drivers\hidclass.sys
2008-02-21 15:53 . 2008-02-21 15:53 <DIR> d-------- C:\Programme\Gemeinsame Dateien\MAGIX
2008-02-21 15:53 . 2007-04-27 10:43 120,200 --a------ C:\WINDOWS\system32\DLLDEV32i.dll
2008-02-21 14:39 . 2008-02-21 14:39 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Hypnotizer
2008-02-20 23:10 . 2008-02-20 23:10 244 --ah----- C:\sqmnoopt01.sqm
2008-02-20 23:10 . 2008-02-20 23:10 232 --ah----- C:\sqmdata01.sqm
2008-02-17 22:57 . 2008-02-18 11:48 <DIR> d-------- C:\Program Files
2008-02-06 02:20 . 2008-02-18 11:48 <DIR> d-------- C:\Programme\Winamp Toolbar
2008-02-06 02:20 . 2008-02-06 02:20 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Winamp Toolbar
2008-02-06 01:33 . 2008-02-17 13:53 <DIR> d-------- C:\Dokumente und Einstellungen\As\Anwendungsdaten\Winamp
2008-02-05 23:37 . 2008-02-18 19:23 <DIR> d-------- C:\Dokumente und Einstellungen\As\MAGIX Online Druck Service
2008-02-05 23:19 . 2008-02-21 16:34 <DIR> d-------- C:\Programme\MAGIX
2008-01-31 17:42 . 2008-02-07 20:03 <DIR> d-------- C:\Programme\Spybot - Search & Destroy
2008-01-26 15:50 . 2008-01-26 15:55 81,920 --a------ C:\WINDOWS\ALCFDRTM.VER
2008-01-26 15:50 . 2008-01-26 15:50 81,920 --a------ C:\WINDOWS\ALCFDRTM.EXE
2008-01-26 13:12 . 2008-01-26 19:57 <DIR> d--h----- C:\WINDOWS\msdownld.tmp
2008-01-24 23:57 . 2008-01-24 23:57 <DIR> d-------- C:\Programme\Gemeinsame Dateien\xing shared
2008-01-24 23:51 . 2008-01-24 23:51 <DIR> d-------- C:\Programme\Real

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-21 14:13 --------- d--h--w C:\Programme\InstallShield Installation Information
2008-02-18 10:47 --------- d-----w C:\Programme\Windows Media Connect 2
2008-02-09 22:10 --------- d-----w C:\Dokumente und Einstellungen\As\Anwendungsdaten\Azureus
2008-02-08 00:14 --------- d-----w C:\Programme\ESET
2008-02-07 20:31 34,520 ----a-w C:\Dokumente und Einstellungen\As\Anwendungsdaten\GDIPFONTCACHEV1.DAT
2008-02-06 01:20 --------- d-----w C:\Programme\Winamp
2008-02-05 22:44 --------- d-----w C:\Programme\CONEXANT
2008-02-05 22:44 --------- d-----w C:\Programme\Common Files
2008-02-05 21:51 --------- d-----w C:\Dokumente und Einstellungen\As\Anwendungsdaten\LimeWire
2008-02-05 21:50 --------- d-----w C:\Dokumente und Einstellungen\As\Anwendungsdaten\BearShare
2008-01-31 17:12 --------- d-----w C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2008-01-31 07:39 --------- d--h--w C:\Programme\Servis (Mare)
2008-01-26 15:00 --------- d-----w C:\Programme\Zweckform Design Galerie
2008-01-26 15:00 --------- d-----w C:\Programme\XP Hidden Application Enabler
2008-01-26 15:00 --------- d-----w C:\Programme\WinMX Music
2008-01-26 15:00 --------- d-----w C:\Programme\VisualTooltip
2008-01-26 15:00 --------- d-----w C:\Programme\Ubisoft
2008-01-26 15:00 --------- d-----w C:\Programme\Synaptics
2008-01-26 15:00 --------- d-----w C:\Programme\ScanSoft
2008-01-24 22:57 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-01-24 22:57 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2008-01-24 22:57 --------- d-----w C:\Programme\Gemeinsame Dateien\Real
2008-01-12 19:33 --------- d-----w C:\Programme\Brother
2008-01-12 19:33 --------- d-----w C:\Programme\BearShare Applications
2008-01-12 19:33 --------- d-----w C:\Programme\AVerMedia
2008-01-12 19:33 --------- d-----w C:\Programme\ATI Technologies
2007-09-02 16:35 471 ----a-w C:\Programme\Verknüpfung mit LEGO Media.lnk
2007-08-22 18:24 16 ---ha-w C:\Programme\mxfilerelatedcache.mxc2
2007-06-26 14:10 16,384 --sha-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
2007-06-26 14:10 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\index.dat
2007-06-26 14:10 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Verlauf\History.IE5\index.dat
2007-06-26 14:10 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Verlauf\History.IE5\MSHist012007062620070627\index.dat
.

------- Sigcheck -------

"C:\WINDOWS\system32\user32.dll"
----a-w 578,560 2006-12-13 10:35:35 C:\WINDOWS\system32\user32.dll

"C:\WINDOWS\system32\wininet.dll"
----a-w 818,688 2006-12-13 10:39:08 C:\WINDOWS\system32\wininet.dll

"C:\WINDOWS\system32\drivers\tcpip.sys"
----a-w 360,576 2006-12-13 10:39:21 C:\WINDOWS\system32\drivers\tcpip.sys

"C:\WINDOWS\system32\ntkrnlpa.exe"
----a-w 2,059,136 2006-12-13 10:48:03 C:\WINDOWS\system32\ntkrnlpa.exe
----a-w 2,059,136 2006-12-13 10:48:04 C:\WINDOWS\system32\VITrans\ntkrnlpa.exe

"C:\WINDOWS\system32\ntoskrnl.exe"
----a-w 2,181,632 2006-12-13 10:35:01 C:\WINDOWS\system32\ntoskrnl.exe
----a-w 2,181,632 2006-12-13 10:35:02 C:\WINDOWS\system32\VITrans\ntoskrnl.exe

"C:\WINDOWS\explorer.exe"
----a-w 1,425,920 2004-08-03 23:57:54 C:\WINDOWS\explorer.exe
----a-w 1,035,264 2004-08-03 23:57:54 C:\WINDOWS\system32\VITrans\explorer.exe
.
(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:57 15360]
"swg"="C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-20 18:19 68856]
"SpybotSD TeaTimer"="C:\Programme\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46 1460560]
"WMPNSCFG"="C:\Programme\Windows Media Player\WMPNSCFG.exe" [2006-11-03 08:56 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VisualTooltip"="C:\Programme\VisualTooltip\VisualToolTip.exe" [2006-10-06 08:21 942080]
"AzMixerSel"="C:\Programme\Realtek\InstallShield\AzMixerSel.exe" [2006-04-15 12:35 53248]
"ATICCC"="C:\Programme\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 16:41 45056]
"nod32kui"="C:\Programme\Eset\nod32kui.exe" [2007-06-28 15:57 921600]
"TkBellExe"="C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" [2008-01-24 23:57 185896]
"SynTPEnh"="C:\Programme\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 12:07 761946]

C:\Dokumente und Einstellungen\As\Startmen�\Programme\Autostart\
TClock2.lnk - C:\Programme\Servis (Mare)\Clock (tclock2)\tclock2.exe [2007-06-26 21:20:20 90624]
VistaPerfectionStartButton.lnk - C:\VTPFiles\VistaPerfectionStartButton.exe [2007-06-28 14:23:54 393216]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"SynchronousMachineGroupPolicy"= 0 (0x0)
"SynchronousUserGroupPolicy"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)
"NoDesktopCleanupWizard"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SkyTel"=SkyTel.EXE
"SunJavaUpdateSched"="C:\Programme\Java\jre1.6.0_01\bin\jusched.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Programme\\LimeWire\\LimeWire.exe"=
"C:\\Programme\\DC++\\DCPlusPlus.exe"=


.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, gmer.net
Rootkit scan 2008-02-24 22:45:36
Windows 5.1.2600 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostart Einträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
Zeit der Fertigstellung: 2008-02-24 22:46:06
ComboFix-quarantined-files.txt 2008-02-24 21:45:52

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Izgleda kao da je ComboFix sredio stvari.
Ima li kakvih vidljivih simptoma?

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

samo da naglasim:sada vec i kada nesto startujem sa winamp-om,ili drugim programom...film,muzika...prekida svakih par sekundi,a to mi se nije desavalo do pre par sati.takodje i prilikom novog startovanja duze podize sistem.kada hocu iz jednog ordner u drugi da prebacim fail koji ima 700mb. potrebno mi je 35-40min.

Dopuna: 24 Feb 2008 0:20

izvini na mom odgovoru,ali tek sada mi je prikazalo tvoju poruku

Dopuna: 24 Feb 2008 0:36

wien ::samo da naglasim:sada vec i kada nesto startujem sa winamp-om,ili drugim programom...film,muzika...prekida svakih par sekundi,a to mi se nije desavalo do pre par sati.takodje i prilikom novog startovanja duze podize sistem.kada hocu iz jednog ordner u drugi da prebacim fail koji ima 700mb. potrebno mi je 35-40min.

Dopuna: 24 Feb 2008 0:20

izvini na mom odgovoru,ali tek sada mi je prikazalo tvoju poruku
takodje,nod32 mi je jos uvek neefikasan.
jos uvek kada hocu da ppogledam control center izbacuje prozor::"Error occurred during communication with nod32 kernel service".

Dopuna: 24 Feb 2008 0:36

wien ::

Dopuna: 24 Feb 2008 0:20

izvini na mom odgovoru,ali tek sada mi je prikazalo tvoju poruku
takodje,nod32 mi je jos uvek neefikasan.
jos uvek kada hocu da ppogledam control center izbacuje prozor::"Error occurred during communication with nod32 kernel service". [/quote]

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Probaj da deinstaliras, pa ponovo instaliras NOD32.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Racunar mi sada radi odlicno,ali sada se namecu novi problemi.
Neznam da li da otvaram novu temu,ali svakako:
Deinstalirao sam nod32,i ponovo ga instalirao.Medjutim,kada startujem nod32 da skenira iz Safe Mode,odradi par minuta i ugasi mi racunar.Takodje kada startujem Spy.S&D u Safe Mode ugasi mi racunar,pre nego sto i otvori program.I kod Nod32,i kod slucaja sa Spy.S&D,kada ugasi nemoguce je startovati racunar sve dok se ne skine sa dovoda kompletne struje.Nakon toga opet prikopcam na struju i sve je OK. Sta bi mogao biti problem?

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Napravi mi novi ComboFix log, kao i log GMER-om:

Preuzmi fajl gmer.zip sa ovog linka i sačuvaj na Desktop-u.
Raspakuj ga u neki folder.

Dupli klik na gmer.exe za početak: Izaberi Rootkit Tab na vrhu.
Klikni na Scan.
Kada je skeniranje završeno, klik na Copy dugme ispod - ovo će sačuvati to u Clipboard.
Iskoristi opciju Paste u Notepad-u da bi to prebacio u tekst. Snimi taj tekst iz Notepada kao file1.txt.
Ponovi ovo isto sa Autostart Tab-om. Snimi taj tekst iz Notepada kao file2.txt.

Iskopiraj nam ovde sadrzaj ta dva fajla koja smo malopre snimili

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Uloguj se preko Facebooka da bi skinuo fajl:

ComboFix 08-02-24.2 - As 2008-02-24 23:47:05.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.49.1031.18.128 [GMT 1:00]
ausgeführt von:: C:\Dokumente und Einstellungen\As\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((( Dateien erstellt von 2008-01-24 bis 2008-02-24 ))))))))))))))))))))))))))))))
.

2008-02-24 22:49 . 2008-02-24 22:49 <DIR> d-------- C:\WINDOWS\system32\xircom
2008-02-24 22:49 . 2008-02-24 22:49 <DIR> d-------- C:\Programme\microsoft frontpage
2008-02-24 22:10 . 2008-02-24 23:42 250 --a------ C:\WINDOWS\gmer.ini
2008-02-24 21:05 . 2008-02-24 22:24 <DIR> d-------- C:\Programme\DC++
2008-02-24 13:37 . 2008-02-24 13:36 512,096 --a------ C:\WINDOWS\system32\drivers\amon.sys
2008-02-24 13:37 . 2008-02-24 13:36 298,104 --a------ C:\WINDOWS\system32\imon.dll
2008-02-24 13:37 . 2008-02-24 13:36 15,424 --a------ C:\WINDOWS\system32\drivers\nod32drv.sys
2008-02-24 13:36 . 2008-02-24 14:48 <DIR> d-------- C:\Programme\ESET
2008-02-23 22:08 . 2006-12-13 11:34 36,864 --a------ C:\WINDOWS\system32\drivers\hidclass.sys
2008-02-23 20:43 . 2008-02-23 20:43 244 --ah----- C:\sqmnoopt02.sqm
2008-02-23 20:43 . 2008-02-23 20:43 232 --ah----- C:\sqmdata02.sqm
2008-02-21 15:53 . 2008-02-21 15:53 <DIR> d-------- C:\Programme\Gemeinsame Dateien\MAGIX
2008-02-21 15:53 . 2007-04-27 10:43 120,200 --a------ C:\WINDOWS\system32\DLLDEV32i.dll
2008-02-21 14:39 . 2008-02-21 14:39 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Hypnotizer
2008-02-20 23:10 . 2008-02-20 23:10 244 --ah----- C:\sqmnoopt01.sqm
2008-02-20 23:10 . 2008-02-20 23:10 232 --ah----- C:\sqmdata01.sqm
2008-02-17 22:57 . 2008-02-18 11:48 <DIR> d-------- C:\Program Files
2008-02-06 02:20 . 2008-02-18 11:48 <DIR> d-------- C:\Programme\Winamp Toolbar
2008-02-06 02:20 . 2008-02-06 02:20 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Winamp Toolbar
2008-02-06 01:33 . 2008-02-17 13:53 <DIR> d-------- C:\Dokumente und Einstellungen\As\Anwendungsdaten\Winamp
2008-02-05 23:37 . 2008-02-18 19:23 <DIR> d-------- C:\Dokumente und Einstellungen\As\MAGIX Online Druck Service
2008-02-05 23:19 . 2008-02-21 16:34 <DIR> d-------- C:\Programme\MAGIX
2008-01-31 17:42 . 2008-02-07 20:03 <DIR> d-------- C:\Programme\Spybot - Search & Destroy
2008-01-26 15:50 . 2008-01-26 15:55 81,920 --a------ C:\WINDOWS\ALCFDRTM.VER
2008-01-26 15:50 . 2008-01-26 15:50 81,920 --a------ C:\WINDOWS\ALCFDRTM.EXE
2008-01-26 13:12 . 2008-01-26 19:57 <DIR> d--h----- C:\WINDOWS\msdownld.tmp
2008-01-24 23:57 . 2008-01-24 23:57 <DIR> d-------- C:\Programme\Gemeinsame Dateien\xing shared
2008-01-24 23:51 . 2008-01-24 23:51 <DIR> d-------- C:\Programme\Real

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-24 22:06 70,144 ----a-w C:\WINDOWS\system32\dllcache\notepad.exe
2008-02-24 22:06 70,144 ----a-w C:\WINDOWS\NOTEPAD.EXE
2008-02-21 14:13 --------- d--h--w C:\Programme\InstallShield Installation Information
2008-02-18 10:47 --------- d-----w C:\Programme\Windows Media Connect 2
2008-02-09 22:10 --------- d-----w C:\Dokumente und Einstellungen\As\Anwendungsdaten\Azureus
2008-02-07 20:31 34,520 ----a-w C:\Dokumente und Einstellungen\As\Anwendungsdaten\GDIPFONTCACHEV1.DAT
2008-02-06 01:20 --------- d-----w C:\Programme\Winamp
2008-02-05 22:44 --------- d-----w C:\Programme\CONEXANT
2008-02-05 22:44 --------- d-----w C:\Programme\Common Files
2008-02-05 21:51 --------- d-----w C:\Dokumente und Einstellungen\As\Anwendungsdaten\LimeWire
2008-02-05 21:50 --------- d-----w C:\Dokumente und Einstellungen\As\Anwendungsdaten\BearShare
2008-01-31 17:12 --------- d-----w C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2008-01-31 07:39 --------- d--h--w C:\Programme\Servis (Mare)
2008-01-26 15:00 --------- d-----w C:\Programme\Zweckform Design Galerie
2008-01-26 15:00 --------- d-----w C:\Programme\XP Hidden Application Enabler
2008-01-26 15:00 --------- d-----w C:\Programme\WinMX Music
2008-01-26 15:00 --------- d-----w C:\Programme\VisualTooltip
2008-01-26 15:00 --------- d-----w C:\Programme\Ubisoft
2008-01-26 15:00 --------- d-----w C:\Programme\Synaptics
2008-01-26 15:00 --------- d-----w C:\Programme\ScanSoft
2008-01-24 22:57 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-01-24 22:57 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2008-01-24 22:57 --------- d-----w C:\Programme\Gemeinsame Dateien\Real
2008-01-12 19:33 --------- d-----w C:\Programme\Brother
2008-01-12 19:33 --------- d-----w C:\Programme\BearShare Applications
2008-01-12 19:33 --------- d-----w C:\Programme\AVerMedia
2008-01-12 19:33 --------- d-----w C:\Programme\ATI Technologies
2007-09-02 16:35 471 ----a-w C:\Programme\Verknüpfung mit LEGO Media.lnk
2007-08-22 18:24 16 ---ha-w C:\Programme\mxfilerelatedcache.mxc2
2007-06-26 14:10 16,384 --sha-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
2007-06-26 14:10 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\index.dat
2007-06-26 14:10 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Verlauf\History.IE5\index.dat
2007-06-26 14:10 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Verlauf\History.IE5\MSHist012007062620070627\index.dat
.

------- Sigcheck -------

"C:\WINDOWS\system32\user32.dll"
----a-w 578,560 2006-12-13 10:35:35 C:\WINDOWS\system32\user32.dll

"C:\WINDOWS\system32\wininet.dll"
----a-w 818,688 2006-12-13 10:39:08 C:\WINDOWS\system32\wininet.dll

"C:\WINDOWS\system32\drivers\tcpip.sys"
----a-w 360,576 2006-12-13 10:39:21 C:\WINDOWS\system32\drivers\tcpip.sys

"C:\WINDOWS\system32\ntkrnlpa.exe"
----a-w 2,059,136 2006-12-13 10:48:03 C:\WINDOWS\system32\ntkrnlpa.exe
----a-w 2,059,136 2006-12-13 10:48:04 C:\WINDOWS\system32\VITrans\ntkrnlpa.exe

"C:\WINDOWS\system32\ntoskrnl.exe"
----a-w 2,181,632 2006-12-13 10:35:01 C:\WINDOWS\system32\ntoskrnl.exe
----a-w 2,181,632 2006-12-13 10:35:02 C:\WINDOWS\system32\VITrans\ntoskrnl.exe

"C:\WINDOWS\explorer.exe"
----a-w 1,425,920 2004-08-03 23:57:54 C:\WINDOWS\explorer.exe
----a-w 1,035,264 2004-08-03 23:57:54 C:\WINDOWS\system32\VITrans\explorer.exe
.
(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{376892AE-1825-4E5F-9F85-23F9640051CC}]
2007-11-07 15:38 130048 --a------ C:\WINDOWS\Trntfiltr.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:57 15360]
"swg"="C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-20 18:19 68856]
"SpybotSD TeaTimer"="C:\Programme\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46 1460560]
"WMPNSCFG"="C:\Programme\Windows Media Player\WMPNSCFG.exe" [2006-11-03 08:56 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VisualTooltip"="C:\Programme\VisualTooltip\VisualToolTip.exe" [2006-10-06 08:21 942080]
"AzMixerSel"="C:\Programme\Realtek\InstallShield\AzMixerSel.exe" [2006-04-15 12:35 53248]
"ATICCC"="C:\Programme\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 16:41 45056]
"TkBellExe"="C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" [2008-01-24 23:57 185896]
"SynTPEnh"="C:\Programme\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 12:07 761946]
"nod32kui"="C:\Programme\Eset\nod32kui.exe" [2008-02-24 13:36 949376]

C:\Dokumente und Einstellungen\As\Startmen�\Programme\Autostart\
TClock2.lnk - C:\Programme\Servis (Mare)\Clock (tclock2)\tclock2.exe [2007-06-26 21:20:20 90624]
VistaPerfectionStartButton.lnk - C:\VTPFiles\VistaPerfectionStartButton.exe [2007-06-28 14:23:54 393216]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"SynchronousMachineGroupPolicy"= 0 (0x0)
"SynchronousUserGroupPolicy"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)
"NoDesktopCleanupWizard"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SkyTel"=SkyTel.EXE
"SunJavaUpdateSched"="C:\Programme\Java\jre1.6.0_01\bin\jusched.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Programme\\LimeWire\\LimeWire.exe"=
"C:\\Programme\\DC++\\DCPlusPlus.exe"=


.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, gmer.net
Rootkit scan 2008-02-24 23:48:01
Windows 5.1.2600 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostart Einträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
Zeit der Fertigstellung: 2008-02-24 23:48:41
ComboFix-quarantined-files.txt 2008-02-24 22:48:24
ComboFix2.txt 2008-02-24 21:46:07

Dopuna: 25 Feb 2008 0:04

mycity.rs/must-login.png

mycity.rs/must-login.png

Prvi put ovo radim,pa ako nisam dobro postupio ja s izvinjavam.

Dopuna: 25 Feb 2008 0:25

Samo jos da dodam da mi trazi i novu instalaciju drukera,kao da ga nema.

Dopuna: 25 Feb 2008 11:47

da,vec nekoliko puta mi izbacuje i prozor od Windows Firewall,da kada se ulogujem na neki sait,obavestava me da su pojedine funkcije u programu blokirane.
to mi se do sada nije desavalo,jer sam na tim saitovima se logovao svakodnevno

Dopuna: 25 Feb 2008 17:02

evo sada mi je Spy.S&D.pronasao,sto do sada nisam imao prilike da se susretnem sa time:
Cache-1
Coocie-2
History-1
Log -17

Mada ja sam pokusao da sve to kopiram i prebacim ovde kao link,pa neznam da li sam uspeo...


mycity.rs/must-login.png

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Spakuj u jedan ZIP sledece fajlove:
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\VITrans\explorer.exe

Uploaduj mi taj ZIP preko sledece forme:
http://www.mycity.rs/ambulanta-upload.php