MyCity » Ambulanta -> Arhiva Ambulante » Problem zvani svchost.exe

Problem zvani svchost.exe

Napisano na dan: 28.11.2007
1

Problem zvani svchost.exe
Sledeća strana Pagination

Idi na vrh

Poslao: 28 Nov 2007 17:27
Idi na vrh
offline
  • Gvelf  Male
  • Novi MyCity građanin
  • Pridružio: 09 Nov 2007
  • Poruke: 18

Dakle, svchost.exe koji se ranije nije palio mi uspori konekciju strasno. U network monitoru se upali, pa se ugasi i tako non-stop! Probao sam da ga zatvorim uz pomoc KIS, ali on se opet konektuje i otvara novi port.
Onda ga ja ugasim iz task menagera i internet pocne ponovo da radi normalno i svchost.exe se ne pojavljuje u network monitoru. Kada restartujem racunar, svchost.exe se ponovo upali i opet ista prica dok ga ne ugasim rucno!

Neveznano za ovo gore, kad pokusam da otvorim control panel javlja se greska "Windows Explorer has encountered a problem and needs to close"
Onda se pali Dr Watson i explorer exe. se restartuje i sve se vraca u normalu!
Sta se desava?


Logfile of HijackThis v1.99.1
Scan saved at 4:37:58 PM, on 11/28/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrator\Desktop\New Folder\TR3.exe

O2 - BHO: (no name) - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program

Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0A87E45F-537A-40B4-B812-E2544C21A09F} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} -

C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program

Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program

Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference

2001\A\ERS_DEF.HTM
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky

Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft

Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program

Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program

Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} -

C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common

Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra 'Tools' menuitem: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program

Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra button: Researcher - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Common

Files\Microsoft Shared\Reference 2001\EROProj.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} -

C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration -

{DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{2F507796-9AE2-42B9-90B6-E1B4BBEEADD0}: NameServer =

10.5.0.100
O17 - HKLM\System\CS1\Services\Tcpip\..\{2F507796-9AE2-42B9-90B6-E1B4BBEEADD0}: NameServer =

10.5.0.100
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} -

C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} -

C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems

Shared\Service\Adobelmsvc.exe
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program

Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky

Lab\Kaspersky Internet Security 7.0\avp.exe" -r (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation -

C:\WINDOWS\system32\nvsvc32.exe

Poslao: 28 Nov 2007 18:59
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Pre nego sto postavis log, tj. dok je log jos u Notepadu, potrazi u meniju Notepada opciju Word Wrap i iskljuci je.
Iskopiraj onda ponovo log ovde u poruku.

Poslao: 28 Nov 2007 19:18
Idi na vrh
offline
  • Gvelf  Male
  • Novi MyCity građanin
  • Pridružio: 09 Nov 2007
  • Poruke: 18

Ok, napravio sam nov, evo ga!


Logfile of HijackThis v1.99.1
Scan saved at 7:16:00 PM, on 11/28/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrator\Desktop\New Folder\TR3.exe

O2 - BHO: (no name) - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0A87E45F-537A-40B4-B812-E2544C21A09F} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [winxld] C:\Program Files\XSoft\xworking\xld.exe a
O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra 'Tools' menuitem: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra button: Researcher - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\EROProj.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{2F507796-9AE2-42B9-90B6-E1B4BBEEADD0}: NameServer = 10.5.0.100
O17 - HKLM\System\CS1\Services\Tcpip\..\{2F507796-9AE2-42B9-90B6-E1B4BBEEADD0}: NameServer = 10.5.0.100
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" -r (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

Poslao: 28 Nov 2007 19:34
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Nista, cist log.

btw. imam osecaj da ne znas cemu sluzi svchost.exe.
To je program preko kojeg funkcionisi sistemski servisi.
Verovatno neki od servisa pokusava da izadje na net, pa ti to vidis kao da svchost.exe pokusava da se konektuje negde.
Lako je moguce da se neki od legitimnih servisa koje imas prikljucuje na net, recimo da bi uradio update ili nesto slicno.

Poslao: 30 Nov 2007 17:16
Idi na vrh
offline
  • Gvelf  Male
  • Novi MyCity građanin
  • Pridružio: 09 Nov 2007
  • Poruke: 18

Ok, hvala! Znam sta je svchost.exe, ali mi je bilo cudno sto se pojavio pre par dana, a ja nisam u skorije vreme instalirao neku aplikaciju!
Hvala, jos jednom, najbolji ste!!!

Dopuna: 30 Nov 2007 17:16

LM, da malo osvezim temu, nadam se da nece biti problema, vezano je za ovo gore i svchost.exe.

svchost.exe konektuje na sledecu adresu : "ns.justicia.gov.bo", ukucam u google adresu i kad ja tamo.., ono medjutim! Nadjem na nekom forumu coveka koji je imao problem slican mom!
Evo, ostavicu link da ga pogledate :

Link

Valjda necu dobiti po usima zbog dugackog linka Smile
Zamolio bih da neko pogleda, pa da mi kaze sta misli o tome!

Poslao: 30 Nov 2007 22:00
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Ako sam dobro razumeo, tip kaze da je problem nestao sam od sebe.

ns.justicia.gov.bo - Ministarstvo Pravde Bolivije ?!?!

Poslao: 30 Nov 2007 22:53
Idi na vrh
offline
  • Gvelf  Male
  • Novi MyCity građanin
  • Pridružio: 09 Nov 2007
  • Poruke: 18

Da, kaze da nezna ni sam kako je nestalo!
I mene cudi sta ima da updejtuje na ns.justicia.gov.bo!?
Pomenuo je i "NTSpool.exe" i na mnogim forumima citam da je "undesirable program"
Al, ovo : "ns.justicia.gov.bo" mi nikako nije jasno!

Dopuna: 30 Nov 2007 22:53

Da, ja u system32 imam NTSpool.exe, al kontam da ima neke veze sa stampanjem!

Poslao: 30 Nov 2007 22:56
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Jesi li ti sam instalirao XSoftov XPCSpy keyloger na kompu?

Dopuna: 30 Nov 2007 22:56

Daj uploaduj mi taj NTSpool.exe preko sledece forme:
http://www.mycity.rs/ambulanta-upload.php

Poslao: 30 Nov 2007 23:04
Idi na vrh
offline
  • Gvelf  Male
  • Novi MyCity građanin
  • Pridružio: 09 Nov 2007
  • Poruke: 18

Uploudovao sam sad!
Ne, nisam instalirao!

Poslao: 30 Nov 2007 23:08
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Skini ComboFix sa jedne od sledecih adresa:
http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Startuj ga i ne diraj prozor programa dok skenira.
Sledi uputstva na ekranu. Kada zavrsi pojavice se log koji ces nam ovde iskopirati.

MyCity » Ambulanta -> Arhiva Ambulante » Problem zvani svchost.exe

Ko je trenutno na forumu
 

Ukupno su 1144 korisnika na forumu :: 41 registrovanih, 6 sakrivenih i 1097 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: Bobrock1, Brana01, cavatina, deLacy, Denaya, FOX, Gargantua, hatman, hologram, HrcAk47, ikan, Istman, Karla, Kubovac, kunktator, laki_bb, ljuba, Mcdado, mercedesamg, Mercury, Milos ZA, milutin134, mrav pesadinac, nebkv, nemkea71, panzerwaffe, pein, Ripanjac, S2M, saputnik plavetnila, slonic_tonic, Smiljke, Srle993, stegonosa, tomigun, vathra, YugoSlav, zbazin, zeo, žeks62, 1107