MyCity » Ambulanta -> Arhiva Ambulante » explorer zeza :)

explorer zeza :)

Napisano na dan: 26.10.2007
3

explorer zeza :)
Pagination Prethodna strana

Idi na vrh

Poslao: 27 Okt 2007 02:35
Idi na vrh
offline
  • nea 
  • Novi MyCity građanin
  • Pridružio: 25 Okt 2007
  • Poruke: 14

ok, označila sam ono gore... i ak sam dobro shvatila, treba ti ovaj file...
[Link mogu videti samo ulogovani korisnici]



Poslao: 27 Okt 2007 03:24
Idi na vrh
offline
  • DEMIAN  Male
  • Legendarni građanin
  • IT Manager
  • Pridružio: 25 Mar 2005
  • Poruke: 3706
  • Gde živiš: The darkest place on earth..

Skini i pokreni ovaj fajl kod tebe na računaru.
[Link mogu videti samo ulogovani korisnici]

Sačekaj 10-15tak sec, pa napravi log sa listom servisa (kao u ovom zadnjem tvom postu) da proverim..



Poslao: 27 Okt 2007 06:51
Idi na vrh
offline
  • nea 
  • Novi MyCity građanin
  • Pridružio: 25 Okt 2007
  • Poruke: 14

--> [Link mogu videti samo ulogovani korisnici]

Poslao: 27 Okt 2007 19:19
Idi na vrh
offline
  • DEMIAN  Male
  • Legendarni građanin
  • IT Manager
  • Pridružio: 25 Mar 2005
  • Poruke: 3706
  • Gde živiš: The darkest place on earth..

Izvini što si čekala ovoliko na odgovor.

Skini sada [url=https://www.mycity.rs/must-login.png fajl[/url], raspakuj to iz arhive i pokreni StreamDel.bat. Na prozoru koji ce se pojaviti pisaće da li je nađen i obrisan ADS (Alternate Data Stream) koga se trebamo rešiti.

Poslao: 27 Okt 2007 23:51
Idi na vrh
offline
  • nea 
  • Novi MyCity građanin
  • Pridružio: 25 Okt 2007
  • Poruke: 14

obrisan je, valjda... Razz

Logfile of HijackThis v1.99.1
Scan saved at 23:46:59, on 27.10.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
C:\Program Files\MessengerDiscovery\MessengerDiscovery Live.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Winamp\winamp.exe
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\PC\Desktop\čišćenje win\HJT\TR3.exe

R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: (no name) - {2F60EBF4-9FAD-4A07-AB48-DA2A9E5B23C7} - (no file)
O2 - BHO: Ofb1 - {3E1500AC-87A5-416b-A211-82E848649DA9} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O3 - Toolbar: &Crawler Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: I&zvoz u Microsoft Excel - [Link mogu videti samo ulogovani korisnici]\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Istraživanje - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{2D5021DB-4C10-4CAE-A4F7-494200A57A0F}: NameServer = 195.29.149.197 195.29.149.196
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apache2.2 - Unknown owner - C:\Documents and Settings\PC\Desktop\xampplite\xampplite\apache\bin\apache.exe" -k runservice (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

Poslao: 28 Okt 2007 00:07
Idi na vrh
offline
  • DEMIAN  Male
  • Legendarni građanin
  • IT Manager
  • Pridružio: 25 Mar 2005
  • Poruke: 3706
  • Gde živiš: The darkest place on earth..

Skeniraj opet HJT-om računar, idi na opciju "Do a system scan only" , označi ovu liniju (u onom kvadratiću pored nje) i klikni na "Fix Checked".

O2 - BHO: (no name) - {2F60EBF4-9FAD-4A07-AB48-DA2A9E5B23C7} - (no file)
O2 - BHO: Ofb1 - {3E1500AC-87A5-416b-A211-82E848649DA9} - (no file)

Reci mi kakva je situacija sada sa sistemom ? I dalje problem neki ili ne ?

Poslao: 28 Okt 2007 00:42
Idi na vrh
offline
  • nea 
  • Novi MyCity građanin
  • Pridružio: 25 Okt 2007
  • Poruke: 14

ne, sad je sve ok... Very Happy

tnx...
ako/kad dođeš u zg, vodim te na pivu... Mr. Green

Poslao: 28 Okt 2007 00:52
Idi na vrh
offline
  • DEMIAN  Male
  • Legendarni građanin
  • IT Manager
  • Pridružio: 25 Mar 2005
  • Poruke: 3706
  • Gde živiš: The darkest place on earth..

nea ::vodim te na pivu... Mr. Green
Važi se.. Wink

Ostalo ti je samo da isključiš, restartuješ PC pa zatim ponovo uključiš System Restore jer sadrži bekap (nije aktivno) malware-a. Uputstvo za to ti je ispod.

Topic ostaje otvoren još neko vreme, ako kojim slučajem postoji (ili se javi) neki problem - slobodno se javi.
Pozz

--------------------------------------

Iskljucivanje System Restore-a

Na Desktopu, desni klik na My Computer.
Odaberite Properties.
Odaberite System Restore tab.
Stiklirajte Turn off System Restore.
Kliknite na dugme Apply.
Kliknite na dugme OK.

Ukljucivanje System Restore-a

Na Desktopu, desni klik na My Computer.
Odaberite Properties.
Odaberite System Restore tab.
Destiklirajte Turn off System Restore.
Kliknite na dugme Apply.
Kliknite na dugme OK.

MyCity » Ambulanta -> Arhiva Ambulante » explorer zeza :)

Ko je trenutno na forumu
 

Ukupno su 730 korisnika na forumu :: 121 registrovanih, 11 sakrivenih i 598 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 15694 - dana 01 Feb 2026 12:23

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: 357magnum, abramac, aleksandar11332, AleksandarV, Alexandar-1973, ALEXV, Apok, aramis s, Aska, Ba4e, Batko.VD.65, bb929, Belac91, Bickoooo, bobpp, Bojan198527, bojank, Boroš, BOXRR, BraneS, bunker, CCCP, Chainsaw, chichabg, cvrle312, cyprus, Dado78, dankisha, darkkran, dejan1972, DJUNTA, Dogma21, draganca, dragoljub11987, dukajov, Dungorth, Ercomero, Goran 0000, goran.vvv, Great White, istokzapad, Jakonjveliki, jodzula, Jovan1983, K-1A, kaisarevic1, Kajzer Soze, Kalem, kapela, Karapan, kmnmada, kozhedub, Kriglord, kuntakinte, laurusri, lord sir giga, Luke Pathfinder, M74AB3, Manjane, markolopin, marsi, Mastrum Ridkali, mercedesamg, milenko crazy north, milos1231, mist-mist, mnn2, moldway, monomah, Mzee, nelezele, nerislav2025, neutrino, nikola11, Novakomp, oblivion, Otto Grunf, Pantarej, Panter, Papadubi, pein, perunnurep, Pilipenda, PlayerOne, Povratak1912, rebro1974, Remarqe, RILE-NS, Rothmans, royst33, S2M, sabros, saputnik plavetnila, Solunac na steroidima, Sone0883, sova72, sspp, StalniPromatrač, stefan95, stegonosa, synergia, Tasman0081, troki1971, TTN, varda, VBoss, Veless, vidra1, Viktor Petrenko, Vlad000, vladaa012, vlahale, vukajlo71, vuksa72, vzd1389, Zandar, Zastava, Zeljo980, zixmix, zoran77, 79693