Zakucava racunar...

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Uloguj se preko Facebooka da bi skinuo fajl:

DDS (Ver_09-07-30.01) - NTFSx86
Run by Petrovic at 21:26:14,59 on ned 06.09.2009
Internet Explorer: 6.0.2900.2180
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1279.853 [GMT 2:00]

AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
C:\WINDOWS\Explorer.EXE
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Documents and Settings\Petrovic\Local Settings\Application Data\Google\Update\1.2.183.7\GoogleCrashHandler.exe
C:\WINDOWS\TEMP\hxpsvxdsqe.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\TEMP\hxpsvxdsqe.exe
C:\Documents and Settings\Petrovic\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Petrovic\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Petrovic\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Petrovic\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Petrovic\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Documents and Settings\Petrovic\Desktop\dds.pif

============== Pseudo HJT Report ===============

BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
uRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NVMCTRAY.DLL,NvTaskbarInit
uRun: [Google Update] "c:\documents and settings\petrovic\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [MsnMsgr] "c:\program files\msn messenger\MsnMsgr.Exe" /background
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NVCLOCK] Rundll32 nvclock.dll,fnNvclock
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\petrovic\applic~1\mozilla\firefox\profiles\ny6p79w4.default\
FF - plugin: c:\documents and settings\petrovic\local settings\application data\google\update\1.2.183.7\npGoogleOneClick8.dll

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\mozilla firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");

============= SERVICES / DRIVERS ===============

R?2 AlerterALG;Alerter AlerterALG;c:\windows\temp\hxpsvxdsqe.exe service --> c:\windows\temp\hxpsvxdsqe.exe service [?]
R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-9-1 11608]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-9-1 108289]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-9-1 185089]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-9-1 55656]
R3 usnjsvc;Messenger Sharing Folders USN Journal Reader service;c:\program files\msn messenger\usnsvc.exe [2007-1-19 97136]
R3 VGAUTI;VGAUTI;c:\windows\system32\drivers\vgauti.sys [2009-9-1 36076]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\f:\ntglm7x.sys --> f:\NTGLM7X.sys [?]

=============== Created Last 30 ================

2009-09-06 21:25 <DIR> --d-h--- c:\windows\PIF
2009-09-06 19:46 <DIR> --d----- c:\windows\pss
2009-09-06 18:57 <DIR> --d----- c:\windows\system32\SoftwareDistribution
2009-09-05 14:23 86,400 a------- c:\windows\~GLC0000.TMP
2009-09-05 14:09 <DIR> --d----- C:\spoolerlogs
2009-09-04 23:41 608,158 a------- C:\mod_jsn_imageshow_pro_1.0.6_j10.zip
2009-09-04 20:04 <DIR> --d----- C:\Skener
2009-09-04 19:57 492 a------- c:\windows\MAXLINK.INI
2009-09-04 19:56 <DIR> --d----- c:\program files\ABBYY FineReader 4.0 Sprint
2009-09-04 19:53 176,128 a------- c:\windows\system32\PuzzSaver.scr
2009-09-04 19:53 <DIR> --d----- c:\program files\BearPaw 1200CU Plus
2009-09-04 19:53 <DIR> --d----- c:\program files\Temp
2009-09-04 15:25 268 a---h--- C:\sqmdata00.sqm
2009-09-04 15:25 244 a---h--- C:\sqmnoopt00.sqm
2009-09-04 14:42 <DIR> --d----- c:\docume~1\petrovic\applic~1\URSoft
2009-09-04 14:42 <DIR> --d----- c:\program files\Your Uninstaller 2008
2009-09-02 18:11 <DIR> --d----- c:\program files\common files\Vbox
2009-09-02 17:00 <DIR> --d----- c:\docume~1\petrovic\applic~1\ACD Systems
2009-09-02 17:00 <DIR> --d----- c:\docume~1\alluse~1\applic~1\ACD Systems
2009-09-02 17:00 <DIR> --d----- c:\program files\common files\ACD Systems
2009-09-02 17:00 <DIR> --d----- c:\program files\ACD Systems
2009-09-02 13:47 <DIR> --d----- c:\program files\Skype
2009-09-02 13:43 <DIR> --d----- c:\documents and settings\petrovic\Contacts
2009-09-02 13:42 <DIR> --d----- c:\program files\MSN Messenger
2009-09-02 00:37 <DIR> --d----- c:\docume~1\petrovic\applic~1\Thinstall
2009-09-01 17:34 26,496 ac------ c:\windows\system32\dllcache\usbstor.sys
2009-09-01 16:45 <DIR> --d----- c:\program files\common files\Macromedia Shared
2009-09-01 16:45 974,848 a------- c:\windows\system32\mfc70.dll
2009-09-01 16:45 487,424 a------- c:\windows\system32\msvcp70.dll
2009-09-01 16:45 344,064 a------- c:\windows\system32\msvcr70.dll
2009-09-01 16:44 <DIR> --d----- c:\program files\common files\Macromedia
2009-09-01 16:43 <DIR> --d----- c:\program files\Macromedia
2009-09-01 16:16 421 a------- c:\windows\wcx_ftp.ini
2009-09-01 15:51 <DIR> --d----- C:\Downloads
2009-09-01 15:05 <DIR> a-d----- C:\xampp
2009-09-01 13:57 <DIR> --d----- c:\program files\ffdshow
2009-09-01 00:24 135,168 a----r-- c:\windows\UNDPX2A.exe
2009-09-01 00:24 53,693 a----r-- c:\windows\UNDPX2A.sys
2009-09-01 00:24 15,429 a----r-- c:\windows\system32\drivers\Sacm2A.sys
2009-09-01 00:20 139 a------- c:\windows\msicpl.ini
2009-09-01 00:17 <DIR> --d----- c:\program files\Total Commander
2009-09-01 00:16 55,656 a------- c:\windows\system32\drivers\avgntflt.sys
2009-09-01 00:16 <DIR> --d----- c:\program files\Avira
2009-09-01 00:16 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Avira
2009-09-01 00:14 <DIR> --d----- c:\program files\MSI
2009-09-01 00:13 306,688 a------- c:\windows\IsUninst.exe
2009-09-01 00:07 6,400 a------- c:\windows\system32\drivers\splitter.sys
2009-09-01 00:07 82,944 ac------ c:\windows\system32\dllcache\wdmaud.sys
2009-09-01 00:07 82,944 a------- c:\windows\system32\drivers\wdmaud.sys
2009-09-01 00:07 52,864 ac------ c:\windows\system32\dllcache\dmusic.sys
2009-09-01 00:07 52,864 a------- c:\windows\system32\drivers\DMusic.sys
2009-09-01 00:07 54,272 ac------ c:\windows\system32\dllcache\swmidi.sys
2009-09-01 00:07 54,272 a------- c:\windows\system32\drivers\swmidi.sys
2009-09-01 00:05 80,896 a----r-- c:\windows\system32\drivers\NVENET.sys
2009-09-01 00:05 1,024 a----r-- c:\windows\system32\drivers\jedih2rx.bin
2009-09-01 00:05 122 a----r-- c:\windows\system32\drivers\ramsed.bin
2009-09-01 00:05 42 a----r-- c:\windows\system32\drivers\jedireg.pat
2009-09-01 00:05 650 -------- c:\windows\system32\nvsmb.nvu
2009-09-01 00:05 77,824 -------- c:\windows\system32\nvumctl.exe
2009-09-01 00:05 897 -------- c:\windows\system32\nvmctl.nvu
2009-09-01 00:05 77,824 a----r-- c:\windows\system32\nvugart.exe
2009-09-01 00:05 18,688 a----r-- c:\windows\system32\drivers\nv_agp.SYS
2009-09-01 00:05 1,431 a----r-- c:\windows\system32\nvgart.nvu
2009-09-01 00:05 <DIR> --d----- c:\windows\system32\ReinstallBackups
2009-08-31 20:48 <DIR> --d----- c:\documents and settings\Petrovic
2009-08-31 19:02 7,552 a------- c:\windows\system32\drivers\MSKSSRV.sys
2009-08-31 19:02 4,992 a------- c:\windows\system32\drivers\MSPQM.sys
2009-08-31 19:02 5,376 a------- c:\windows\system32\drivers\MSPCLOCK.sys
2009-08-31 19:02 3,072 a------- c:\windows\system32\drivers\audstub.sys
2009-08-31 19:02 130,048 ac------ c:\windows\system32\dllcache\ksproxy.ax
2009-08-31 19:02 4,096 ac------ c:\windows\system32\dllcache\ksuser.dll
2009-08-31 19:02 130,048 a------- c:\windows\system32\ksproxy.ax
2009-08-31 19:02 16,128 a------- c:\windows\system32\drivers\MODEMCSA.sys
2009-08-31 19:02 4,096 a------- c:\windows\system32\ksuser.dll
2009-08-31 19:01 57,472 a------- c:\windows\system32\drivers\redbook.sys
2009-08-31 18:59 74,240 a------- c:\windows\system32\usbui.dll
2009-08-31 18:56 <DIR> --d----- c:\program files\common files\ODBC
2009-08-31 18:56 <DIR> --d----- c:\program files\common files\SpeechEngines
2009-08-31 18:55 <DIR> --d--r-- c:\documents and settings\all users\Documents
2009-08-31 18:55 797,189 ac------ c:\windows\system32\dllcache\NT5IIS.CAT
2009-08-31 18:54 <DIR> --d----- C:\Documents and Settings
2009-08-31 18:53 261 a------- c:\windows\system32\$winnt$.inf
2009-08-31 17:27 <DIR> --dsh--- c:\documents and settings\all users\DRM
2009-08-31 17:26 <DIR> --d-h--- c:\program files\WindowsUpdate
2009-08-31 17:25 <DIR> --d----- c:\program files\common files\MSSoap
2009-08-31 17:22 <DIR> --d----- c:\program files\Online Services
2009-08-31 17:22 <DIR> --d----- c:\program files\Messenger
2009-08-31 17:22 <DIR> --d----- c:\program files\MSN Gaming Zone
2009-08-31 17:21 <DIR> --d----- c:\program files\Windows NT

==================== Find3M ====================

2009-08-31 17:51 86,327 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2009-08-31 17:24 21,640 a------- c:\windows\system32\emptyregdb.dat

============= FINISH: 21:27:22,21 ===============






https://www.mycity.rs/must-login.png

https://www.mycity.rs/must-login.png

https://www.mycity.rs/must-login.png

https://www.mycity.rs/must-login.png

https://www.mycity.rs/must-login.png

Danas super radio...otiso do druga i vratio se, a on iz cista mira samo zakuca...

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Pozdrav...




Preuzmi The Avenger na Desktop.
Raspakuj arhivu u neki folder

Dvoklikom pokreni avenger.exe

Iskopiraj tekst koji se nalazi unutar Kod polja u (beli) prozor programa:

 
Files to delete:
c:\windows\temp\hxpsvxdsqe.exe
C:\WINDOWS\system32\drivers\rotscxbqpgrjge.sys

Drivers to delete:
rotscxqjlhmnkd
AlerterALG



Klikni Execute, a zatim Yes u sledeća dva prozora koji će se otvoriti

Kompjuter će se restartovati (u određenim slučajevima: dva puta) i započeti će proces čišćenja/skeniranja

Kada proces bude završen, logfile C:\avenger.txt će se otvoriti u Notepad-u
Iskopiraj sadržaj dobijenog loga u temu na forumu.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Napisano: 06 Sep 2009 22:34

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "c:\windows\temp\hxpsvxdsqe.exe" deleted successfully.
File "C:\WINDOWS\system32\drivers\rotscxbqpgrjge.sys" deleted successfully.
Driver "rotscxqjlhmnkd" deleted successfully.
Driver "AlerterALG" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

Dopuna: 06 Sep 2009 22:38

Uh sad mi je malo bolje...

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Uloguj se preko Facebooka da bi skinuo fajl:

Skini i dvoklikom pokreni: https://www.mycity.rs/must-login.png

Iskopiraj ovde log koji će se otvoriti u Notepadu.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

log je prazan...

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Ponovo ćemo koristiti program The Avenger.

Dvoklikom pokreni avenger.exe

Iskopiraj tekst koji se nalazi unutar Kod polja u (beli) prozor programa:


Files to delete:
C:\WINDOWS\system32\rotscxppjejlvm.dll
C:\WINDOWS\system32\rotscxyyxyprrp.dat
C:\WINDOWS\system32\rotscxttygomua.dll
C:\WINDOWS\system32\rotscxbmsowqpu.dat
C:\WINDOWS\system32\rotscxwsp.dll



Klikni Execute, a zatim Yes u sledeća dva prozora koji će se otvoriti

Kompjuter će se restartovati (u određenim slučajevima: dva puta) i započeti će proces čišćenja/skeniranja

Kada proces bude završen, logfile C:\avenger.txt će se otvoriti u Notepad-u

Iskopiraj sadržaj dobijenog loga u temu na forumu.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "C:\WINDOWS\system32\rotscxppjejlvm.dll" deleted successfully.
File "C:\WINDOWS\system32\rotscxyyxyprrp.dat" deleted successfully.
File "C:\WINDOWS\system32\rotscxttygomua.dll" deleted successfully.
File "C:\WINDOWS\system32\rotscxbmsowqpu.dat" deleted successfully.

Error: file "C:\WINDOWS\system32\rotscxwsp.dll" not found!
Deletion of file "C:\WINDOWS\system32\rotscxwsp.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Completed script processing.

*******************

Finished! Terminate.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Trenutno stanje?

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Sad radi kao sat... Mislim nema bagovanja nijednog programa...
najvaznije da komp vise ne zakucava...

ne izbaciva mi vise rotscxbqpgrjge.sys u procesu task menagera...


Hvala puno...

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Obriši folder C:\Avenger i sve korišćene programe.

Zatim treba da isključiš System Restore i zatim da ga ponovo uključiš:

http://www.mycity.rs/Uputstva/Kako-iskljuciti-uklj.....Vista.html


To je sve.