Poslao: 03 Apr 2007 22:15
|
offline
- oblak
- Legendarni građanin
- Glavni moderator foruma Mobilni telefoni
- Pridružio: 14 Feb 2005
- Poruke: 6355
|
bobby kad budes imao vremena napisi sta mislis o ovome?
imao sam neki grdan spy mislim da je sve ok ali pogledaj....
Logfile of HijackThis v1.99.1
Scan saved at 10:15:25 AM, on 4/4/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\yz\YzDock.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Kerio\Personal Firewall\PERSFW.EXE
E:\Software\bezbednost os-a\spy i adware\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\pchealth\helpctr\System\panels\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\pchealth\helpctr\System\panels\blank.htm
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareBlock Class - {0A87E45F-537A-40B4-B812-E2544C21A09F} - (no file)
O2 - BHO: (no name) - {206E52E0-D52E-11D4-AD54-0000E86C26F6} - C:\PROGRA~1\FRESHD~1\FRESHD~1\fdcatch.dll
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - (no file)
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [kav] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKCU\..\Run: [YzDock] C:\Program Files\yz\YzDock.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger offff\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger offff\msmsgs.exe
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program Files\Autodesk Map 5\AcDcToday.ocx
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\Autodesk Map 5\AcPreview.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{364B48DB-1A40-4B89-B3DC-E2AEC7FD4315}: NameServer = 80.74.160.12 80.74.160.14
O17 - HKLM\System\CS1\Services\Tcpip\..\{364B48DB-1A40-4B89-B3DC-E2AEC7FD4315}: NameServer = 80.74.160.12 80.74.160.14
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall\persfw.exe
|
|
|
|
Poslao: 04 Apr 2007 15:04
|
offline
- rapha
- Mod u pemziji
- Pridružio: 14 Feb 2005
- Poruke: 9113
- Gde živiš: Beograd
|
Jel baš želiš da to Bobby uradi ili može i neko drugi pošto Bobby nije trenutno na forumu?
|
|
|
|
|
Poslao: 04 Apr 2007 22:37
|
offline
- bobby
- Administrator
- Pridružio: 04 Sep 2003
- Poruke: 24135
- Gde živiš: Wien
|
Ja sam vec preuzeo drugi slucaj, a za vise necu imati vremena do vikenda.
Stvarno sam mrtvosan...
|
|
|
|
Poslao: 04 Apr 2007 23:19
|
offline
- oblak
- Legendarni građanin
- Glavni moderator foruma Mobilni telefoni
- Pridružio: 14 Feb 2005
- Poruke: 6355
|
e sta ti je sljaka covece...
|
|
|
|
Poslao: 05 Apr 2007 14:28
|
offline
- rapha
- Mod u pemziji
- Pridružio: 14 Feb 2005
- Poruke: 9113
- Gde živiš: Beograd
|
Ok, ja ću onda preuzeti, izvini što si čekao..
Javljam ti se ubrzo.
Dopuna: 05 Apr 2007 14:28
Reci mi jesi li koristio FlashGet i Internet Download Accelerator? Zašto se Windows Messenger nalazi u direktorijumu koji se zove Windows offf?
|
|
|
|
Poslao: 05 Apr 2007 20:39
|
offline
- oblak
- Legendarni građanin
- Glavni moderator foruma Mobilni telefoni
- Pridružio: 14 Feb 2005
- Poruke: 6355
|
zato sto ga peimenujem i on me vise nesmara....
efektno nema sta...
koristim freshdownload trenutno...
mada sam nesto isprobavao... i sa IDA-om i sa Flashget-om
|
|
|
|
Poslao: 06 Apr 2007 12:35
|
offline
- rapha
- Mod u pemziji
- Pridružio: 14 Feb 2005
- Poruke: 9113
- Gde živiš: Beograd
|
Ako više ne koristiš IDA i FlashGet možeš štiklirati sledeće linije:
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - (no file)
O9 - Extra button: (no name) - {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} - (no file)
pa klikni na Fix Checked, jer su u pitanju "repovi" od IDA i FlashGet. Ako ih koristiš ne diraj ih..
Inače, komp je čist..
|
|
|
|
Poslao: 06 Apr 2007 13:56
|
offline
- oblak
- Legendarni građanin
- Glavni moderator foruma Mobilni telefoni
- Pridružio: 14 Feb 2005
- Poruke: 6355
|
da da jos jedan od dokaza da unistall nikada ne uradi sve do kraja
|
|
|
|
|