Usporen komp totalno

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Logfile of HijackThis v1.99.1
Scan saved at 10:26:52 PM, on 6/7/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\TIADSL~1\bin\win2k\tidslmon.exe
C:\WINDOWS\SYSTEM32\SRPSKEY.EXE
C:\Program Files\VMware\VMware Workstation\vmware-tray.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\system32\vmnat.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Dusan\Desktop\mrkavac\Mrkavac.exe

O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Encarta Web Companion Helper Object - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Program Files\Common Files\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: FlashGet - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\Program Files\FlashGet\fgiebar.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Encarta Web Companion - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Program Files\Common Files\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O4 - HKLM\..\Run: [TIxDSL] C:\PROGRA~1\TIADSL~1\bin\win2k\tidslmon.exe
O4 - HKLM\..\Run: [srpskey] C:\WINDOWS\SYSTEM32\SRPSKEY.EXE
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [vmware-tray] C:\Program Files\VMware\VMware Workstation\vmware-tray.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - [Link mogu videti samo ulogovani korisnici]\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - [Link mogu videti samo ulogovani korisnici]\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - [Link mogu videti samo ulogovani korisnici]\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - [Link mogu videti samo ulogovani korisnici]\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - [Link mogu videti samo ulogovani korisnici]\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Open using &Advanced JPEG Compressor - C:\Program Files\Advanced JPEG Compressor\ajcieex.htm
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
O9 - Extra button: Encarta Search Bar - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O17 - HKLM\System\CCS\Services\Tcpip\..\{5F5F46E6-02FB-46B3-990A-0AA90003246D}: NameServer = 77.105.0.19 77.105.0.18
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - AppInit_DLLs: "C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll"
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r (file missing)
O23 - Service: Canon Camera Access Library 8 (CCALib8-) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: VMware Agent Service (ufad-ws60) - Unknown owner - C:\Program Files\VMware\VMware Workstation\vmware-ufad.exe" -d "C:\Program Files\VMware\VMware Workstation\\" -s ufad-p2v.xml (file missing)
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe

Imam ADSL 256/64

Jel treba jos nesto mozda

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

cini mi se da je log cist aj da probamo sa GMER-om


Skeniraj komp sa GMER-om i postavi log da proverimo da nema nekih rootkitova...

Uradi sledeće:
Preuzmi fajl gmer.zip sa ovog linka i sačuvaj na Desktop-u.
Raspakuj ga u neki folder.

Dupli klik na gmer.exe za početak: Izaberi Rootkit Tab na vrhu.
Klikni na Scan.
Kada je skeniranje završeno, klik na Copy dugme ispod - ovo će sačuvati to u Clipboard.
U polju za pisanje poruke na forumu klikni desno dugme misa i odaberi opciju Paste.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

GMER 1.0.12.12244 - [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2007-06-07 23:55:57
Windows 5.1.2600 Service Pack 2


---- System - GMER 1.0.12 ----

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwClose
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwCreateKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwCreateProcess
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwCreateProcessEx
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwCreateSection
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwCreateSymbolicLinkObject
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwCreateThread
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwDeleteKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwDeleteValueKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwDuplicateObject
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwEnumerateKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwEnumerateValueKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwFlushKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwInitializeRegistry
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwLoadKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwLoadKey2
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwNotifyChangeKey
SSDT kl1.sys ZwOpenFile
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwOpenKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwOpenProcess
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwOpenSection
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwQueryKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwQueryMultipleValueKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwQuerySystemInformation
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwQueryValueKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwReplaceKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwRestoreKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwResumeThread
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwSaveKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwSetContextThread
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwSetInformationFile
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwSetInformationKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwSetInformationProcess
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwSetSecurityObject
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwSetValueKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwSuspendThread
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwTerminateProcess
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwUnloadKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwWriteVirtualMemory
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[284]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[285]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[286]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[287]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[288]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[289]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[290]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[291]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[292]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[293]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[294]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[295]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[296]

Code \??\C:\WINDOWS\system32\drivers\klif.sys FsRtlCheckLockForReadAccess
Code \??\C:\WINDOWS\system32\drivers\klif.sys IoIsOperationSynchronous

---- Kernel code sections - GMER 1.0.12 ----

.text ntoskrnl.exe!KiDispatchInterrupt + BA 804DB92E 7 Bytes JMP BAE4DCD0 \??\C:\WINDOWS\system32\drivers\klif.sys
.text ntoskrnl.exe!IoIsOperationSynchronous 804E8752 5 Bytes JMP BAE4AC50 \??\C:\WINDOWS\system32\drivers\klif.sys
.text ntoskrnl.exe!FsRtlCheckLockForReadAccess 804FBE09 5 Bytes JMP BAE4A760 \??\C:\WINDOWS\system32\drivers\klif.sys
? C:\WINDOWS\system32\drivers\sptd.sys The process cannot access the file because it is being used by another process.
.text USBPORT.SYS!DllUnload F7C227AE 5 Bytes JMP 82ABB1B8
? System32\Drivers\athjyzu7.SYS The system cannot find the file specified.
? C:\WINDOWS\system32\DRIVERS\update.sys

---- User code sections - GMER 1.0.12 ----

.text C:\WINDOWS\explorer.exe[2020] RPCRT4.dll!NdrComplexArrayMemorySize + AC 77E89980 4 Bytes [ 62, 0B, FF, 00 ]
.text C:\WINDOWS\explorer.exe[2020] SHELL32.dll!StrStrW + FFE2DA6E 7C9C8920 4 Bytes [ D2, 04, FF, 00 ]
.text C:\WINDOWS\explorer.exe[2020] SHELL32.dll!StrStrW + FFE2DAE6 7C9C8998 4 Bytes [ FC, 04, FF, 00 ]
.text C:\WINDOWS\explorer.exe[2020] SHELL32.dll!StrStrW + FFE33B46 7C9CE9F8 4 Bytes [ 04, 03, FF, 00 ]
.text C:\WINDOWS\explorer.exe[2020] SHELL32.dll!StrStrW + FFE33B56 7C9CEA08 4 Bytes [ 00, 04, FF, 00 ]
.text C:\WINDOWS\explorer.exe[2020] SHELL32.dll!StrStrW + FFE34A96 7C9CF948 4 Bytes [ 54, 04, FF, 00 ]
.text ...
.text C:\WINDOWS\explorer.exe[2020] SHELL32.dll!ILLoadFromStream + 397 7CA0617C 4 Bytes [ E0, 0B, FF, 00 ]
.text C:\WINDOWS\explorer.exe[2020] SHELL32.dll!ILLoadFromStream + 54F 7CA06334 4 Bytes [ 50, 05, FF, 00 ]
.text C:\WINDOWS\explorer.exe[2020] SHELL32.dll!ILLoadFromStream + 65F 7CA06444 4 Bytes [ 26, 05, FF, 00 ]
.text C:\WINDOWS\explorer.exe[2020] SHELL32.dll!DAD_ShowDragImage + 2370 7CA09E68 4 Bytes [ 22, 06, FF, 00 ]
.text C:\Program Files\Winamp\winamp.exe[2540] USER32.dll!SetScrollInfo 77D49056 7 Bytes JMP 01ADB7C6 C:\Program Files\Winamp\Plugins\gen_jumpex.dll
.text C:\Program Files\Winamp\winamp.exe[2540] USER32.dll!GetScrollInfo 77D517F8 7 Bytes JMP 01ADB74E C:\Program Files\Winamp\Plugins\gen_jumpex.dll
.text C:\Program Files\Winamp\winamp.exe[2540] USER32.dll!ShowScrollBar 77D5F2CA 5 Bytes JMP 01ADB84A C:\Program Files\Winamp\Plugins\gen_jumpex.dll
.text C:\Program Files\Winamp\winamp.exe[2540] USER32.dll!GetScrollPos 77D5F6DC 5 Bytes JMP 01ADB776 C:\Program Files\Winamp\Plugins\gen_jumpex.dll
.text C:\Program Files\Winamp\winamp.exe[2540] USER32.dll!SetScrollPos 77D5F728 5 Bytes JMP 01ADB7F1 C:\Program Files\Winamp\Plugins\gen_jumpex.dll
.text C:\Program Files\Winamp\winamp.exe[2540] USER32.dll!GetScrollRange 77D5F75F 5 Bytes JMP 01ADB79B C:\Program Files\Winamp\Plugins\gen_jumpex.dll
.text C:\Program Files\Winamp\winamp.exe[2540] USER32.dll!SetScrollRange 77D5F973 5 Bytes JMP 01ADB81C C:\Program Files\Winamp\Plugins\gen_jumpex.dll
.text C:\Program Files\Winamp\winamp.exe[2540] USER32.dll!EnableScrollBar 77D97BC5 7 Bytes JMP 01ADB726 C:\Program Files\Winamp\Plugins\gen_jumpex.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] kernel32.dll!LoadResource 7C809FB5 7 Bytes JMP 27001B70 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] kernel32.dll!FindResourceExW 7C80AC88 7 Bytes JMP 27001AE0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] kernel32.dll!FindResourceW 7C80BBCE 7 Bytes JMP 27001A60 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] kernel32.dll!SizeofResource 7C80BC69 7 Bytes JMP 27001C20 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] kernel32.dll!LockResource 7C80CC97 5 Bytes JMP 27001CD0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] kernel32.dll!CreateEventA 7C8307DD 5 Bytes JMP 27001840 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] kernel32.dll!SetUnhandledExceptionFilter 7C8447B5 5 Bytes JMP 004DE392 C:\Program Files\MSN Messenger\msnmsgr.exe
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] ADVAPI32.dll!CryptDeriveKey 77DEA685 7 Bytes JMP 27001000 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] ADVAPI32.dll!CryptDecrypt 77DEA7B1 2 Bytes JMP 27001050 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] ADVAPI32.dll!CryptDecrypt + 3 77DEA7B4 4 Bytes [ 21, AF, CC, CC ]
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] USER32.dll!PeekMessageW 77D4929B 5 Bytes JMP 27003A20 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] USER32.dll!CreateWindowExW 77D4FF50 5 Bytes JMP 27003330 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] USER32.dll!SetWindowRgn 77D502DD 7 Bytes JMP 27004D80 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] USER32.dll!CreateDialogParamW 77D584EE 5 Bytes JMP 27004E20 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] USER32.dll!SetWindowPlacement 77D5DF46 5 Bytes JMP 27004CA0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] USER32.dll!MessageBoxIndirectW 77D96093 5 Bytes JMP 27004F80 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] USER32.dll!TrackPopupMenuEx 77D9CB1A 5 Bytes JMP 270041F0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] WS2_32.dll!send 71AB428A 5 Bytes JMP 27009150 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] WS2_32.dll!WSARecv 71AB4318 5 Bytes JMP 27008F40 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] WS2_32.dll!recv 71AB615A 5 Bytes JMP 27008DB0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] WS2_32.dll!WSASend 71AB6233 5 Bytes JMP 270092D0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] WS2_32.dll!closesocket 71AB9639 5 Bytes JMP 270094E0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] SHELL32.dll!Shell_NotifyIconW 7CA21B5A 5 Bytes JMP 27002B10 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] ole32.dll!CoInitializeEx 774FEF7B 5 Bytes JMP 27001D30 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] ole32.dll!CoRegisterClassObject 77517EB8 5 Bytes JMP 27001E30 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] WININET.dll!HttpOpenRequestA 771C2B19 5 Bytes JMP 27007D00 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] WININET.dll!InternetCloseHandle 771C4DAC 5 Bytes JMP 27007FE0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] WININET.dll!HttpSendRequestA 771C6209 5 Bytes JMP 27007F30 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] WININET.dll!InternetReadFile 771C812C 5 Bytes JMP 27007E60 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll

---- Devices - GMER 1.0.12 ----

Device \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE 82FD61D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_CLOSE 82FD61D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_READ 82FD61D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_WRITE 82FD61D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_INFORMATION 82FD61D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_INFORMATION 82FD61D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_EA 82FD61D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_EA 82FD61D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_FLUSH_BUFFERS 82FD61D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_VOLUME_INFORMATION 82FD61D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_VOLUME_INFORMATION 82FD61D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_DIRECTORY_CONTROL 82FD61D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_FILE_SYSTEM_CONTROL 82FD61D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CONTROL 82FD61D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SHUTDOWN 82FD61D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_LOCK_CONTROL 82FD61D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_CLEANUP 82FD61D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_SECURITY 82FD61D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_SECURITY 82FD61D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_QUOTA 82FD61D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_QUOTA 82FD61D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_PNP 82FD61D8
Device \Driver\NetBT \Device\NetBT_Tcpip_{97399CBD-8351-4C7A-9D14-2976D459B3C2} IRP_MJ_CREATE 82C4D6F0
Device \Driver\NetBT \Device\NetBT_Tcpip_{97399CBD-8351-4C7A-9D14-2976D459B3C2} IRP_MJ_CLOSE 82C4D6F0
Device \Driver\NetBT \Device\NetBT_Tcpip_{97399CBD-8351-4C7A-9D14-2976D459B3C2} IRP_MJ_DEVICE_CONTROL 82C4D6F0
Device \Driver\NetBT \Device\NetBT_Tcpip_{97399CBD-8351-4C7A-9D14-2976D459B3C2} IRP_MJ_INTERNAL_DEVICE_CONTROL 82C4D6F0
Device \Driver\NetBT \Device\NetBT_Tcpip_{97399CBD-8351-4C7A-9D14-2976D459B3C2} IRP_MJ_CLEANUP 82C4D6F0
Device \Driver\NetBT \Device\NetBT_Tcpip_{97399CBD-8351-4C7A-9D14-2976D459B3C2} IRP_MJ_PNP 82C4D6F0
Device \Driver\NetBT \Device\NetBT_Tcpip_{5F5F46E6-02FB-46B3-990A-0AA90003246D} IRP_MJ_CREATE 82C4D6F0
Device \Driver\NetBT \Device\NetBT_Tcpip_{5F5F46E6-02FB-46B3-990A-0AA90003246D} IRP_MJ_CLOSE 82C4D6F0
Device \Driver\NetBT \Device\NetBT_Tcpip_{5F5F46E6-02FB-46B3-990A-0AA90003246D} IRP_MJ_DEVICE_CONTROL 82C4D6F0
Device \Driver\NetBT \Device\NetBT_Tcpip_{5F5F46E6-02FB-46B3-990A-0AA90003246D} IRP_MJ_INTERNAL_DEVICE_CONTROL 82C4D6F0
Device \Driver\NetBT \Device\NetBT_Tcpip_{5F5F46E6-02FB-46B3-990A-0AA90003246D} IRP_MJ_CLEANUP 82C4D6F0
Device \Driver\NetBT \Device\NetBT_Tcpip_{5F5F46E6-02FB-46B3-990A-0AA90003246D} IRP_MJ_PNP 82C4D6F0
Device \Driver\usbohci \Device\USBPDO-0 IRP_MJ_CREATE 82D8D1D8
Device \Driver\usbohci \Device\USBPDO-0 IRP_MJ_CLOSE 82D8D1D8
Device \Driver\usbohci \Device\USBPDO-0 IRP_MJ_DEVICE_CONTROL 82D8D1D8
Device \Driver\usbohci \Device\USBPDO-0 IRP_MJ_INTERNAL_DEVICE_CONTROL 82D8D1D8
Device \Driver\usbohci \Device\USBPDO-0 IRP_MJ_POWER 82D8D1D8
Device \Driver\usbohci \Device\USBPDO-0 IRP_MJ_SYSTEM_CONTROL 82D8D1D8
Device \Driver\usbohci \Device\USBPDO-0 IRP_MJ_PNP 82D8D1D8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_CREATE 82F6A1D8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_CLOSE 82F6A1D8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_READ 82F6A1D8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_WRITE 82F6A1D8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_FLUSH_BUFFERS 82F6A1D8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_DEVICE_CONTROL 82F6A1D8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_INTERNAL_DEVICE_CONTROL 82F6A1D8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_SHUTDOWN 82F6A1D8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_POWER 82F6A1D8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_SYSTEM_CONTROL 82F6A1D8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_PNP 82F6A1D8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_CREATE 82F6A1D8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_CLOSE 82F6A1D8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_READ 82F6A1D8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_WRITE 82F6A1D8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_FLUSH_BUFFERS 82F6A1D8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_DEVICE_CONTROL

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Uloguj se preko Facebooka da bi skinuo fajl:

Koliko vidim nije sve prekopirao u post-u

Ovaj text mi izgleda drugacije pa eto ga ispod ako zatreba.

[Link mogu videti samo ulogovani korisnici]

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

ovaj fajl mi je sumnjim:
athjyzu7.SYS

ukljuci prikaz skrivenih fajlova i foldera i probaj da ga nadjes, trebalo bi da se nalazi:
WINDOWS\system32\drivers\athjyzu7.SYS

ako ga nadjes upoaduj ga ovde: [Link mogu videti samo ulogovani korisnici]

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Nema nigde tog fajla

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

i u logu pise da fajl ne postoji tj da ne moze da ga nadje ali sam hteo da proverim.
Ostalo deluje cisto, mozes jos odraditi:

Bitdefender online scan - [Link mogu videti samo ulogovani korisnici]
- potreban je da Internet Explorer sa ukljucenim ActiveX
- iskopiraj nam ovde sadrzaj log fajla

ili

Ewido micro - [Link mogu videti samo ulogovani korisnici] (oko 8mb za skidanje):
- na prvom ekranu odaberi sve particije (štikliraj polja ispred njih)
- klikni na dugme Start Scan
- nakon završenog skeniranja klikni na Save Report i snimi log fajl na sigurno mesto
- klikni na Remove Infections
- iskopiraj nam ovde sadrzaj log fajla

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Odradicu to sutra cim ustanem , znaci nisam odustao i sigurno cu uraditi

Dopuna: 11 Jun 2007 12:00

Ovako ...

Kad god sam krenuo da radim "Bitdefender online scan" uvek mi je pisalo da mu treba 400 sati do kraja

Pokusavao sam nekoliko puta i na kraju je pisalo da treba 2 sata do kraja i cekao sam ...

na nekih 50 minuta do kraja skeniranje je puklo , samo je izasao IE i tako posle svaki put cim startujem scan ...

Reinstalirao sam win na kraju i sada je sve ok

Hvala Everybodys_fool na pomoci

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

nema na cemu.

Steta sto nije ispalo bez reinstaliranja.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

A mozda mu je stvarno i bilo vreme , ipak je to win