Ne radi tastatura!!!

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Uloguj se preko Facebooka da bi skinuo fajl:

Pozdrav

Novi sam clan na forumu , a takodje sam cuo od brojnih korisnika da "dizete iz mrtvih". Pojavio mi se iznenadni problem, ne radi tastatura, da napomenem koristim laptop , nije nikakva externa tastatura (juce fino ugasio PC radila danas upalio ne radi). U Device manageru mi pokazuje problem sa drajverima kao da su "corrupted or missing code 39". "Izguglao" sam neka resenja za ovaj problem, resim ga ali se opet vrati. Sumnjam u neki malware koji izmeni te podatke u registri bazi. Isto mi se desavalo da kad izaberem opciju show hidden files....u folder options i izaberem OK sve se vrati na pocetno stanje kao da sam pritisnuo Cancel, mada sam i za ovo nalazio privremena resenja ali nije to to. Pretpostavljam da imam brojnih virusa
Logovi su sledeci:


DDS (Ver_09-10-26.01) - NTFSx86
Run by dzona at 17:45:14,57 on cet 19.11.2009
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_05
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.338 [GMT 1:00]

AV: Kaspersky Internet Security *On-access scanning enabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *enabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\MATLAB6p5\webserver\bin\win32\matlabserver.exe
C:\WINDOWS\system32\o2flash.exe
C:\WINDOWS\Installer\MSI156C.tmp
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Babylon\Babylon-Pro\Babylon.exe
C:\firefox-ultimate-optimizer-11\Firefox Ultimate Optimizer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\USB Disk Security\USBGuard.exe
C:\Program Files\AIMP2\AIMP2.exe
C:\Documents and Settings\dzona\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
udefault_page_url = hxxp://www.microsoft.com
uWindow Title = Microsoft Internet Explorer
mDefault_Page_URL = hxxp://www.microsoft.com
mStart Page = hxxp://www.microsoft.com
mWindow Title = Microsoft Internet Explorer
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: IEVkbdBHO Class: {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - c:\program files\kaspersky lab\kaspersky internet security 2010\ievkbd.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_05\bin\ssv.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Babylon IE plugin: {9cfaccb6-2f3f-4177-94ea-0d2b72d384c1} - c:\program files\babylon\babylon-pro\utils\BabylonIEPI.dll
BHO: {c9f97205-62a3-41f2-9f2c-d99392f882eb} - CIEDownloadManager Object
BHO: FilterBHO Class: {e33cf602-d945-461a-83f0-819f76a199f8} - c:\program files\kaspersky lab\kaspersky internet security 2010\klwtbbho.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Babylon Client] c:\program files\babylon\babylon-pro\Babylon.exe -AutoStart
mRun: [USB Antivirus] c:\program files\usb disk security\USBGuard.exe
mRun: [avp] "c:\program files\kaspersky lab\kaspersky internet security 2010\avp.exe"
mRun: [FirefoxUltimateOptimizer] "c:\firefox-ultimate-optimizer-11\Firefox Ultimate Optimizer.exe"
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
dRunOnce: [nltide_2] regsvr32 /s /n /i:U shell32
dRunOnce: [KeyScrambler] c:\program files\keyscrambler\getting_started.html
IE: Add to Anti-Banner - c:\program files\kaspersky lab\kaspersky internet security 2010\ie_banner_deny.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: Translate this web page with Babylon - c:\program files\babylon\babylon-pro\utils\BabylonIEPI.dll/ActionTU.htm
IE: Translate with Babylon - c:\program files\babylon\babylon-pro\utils\BabylonIEPI.dll/Action.htm
IE: {753BBC4B-CC73-4fb8-A5B5-CA09C804C1DD} - res://c:\program files\flash capture\fciext.dll/FCIEXT.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - res://c:\program files\babylon\babylon-pro\utils\BabylonIEPI.dll/ActionTU.htm
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_05\bin\ssv.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {4248FE82-7FCB-46AC-B270-339F08212110} - {4248FE82-7FCB-46AC-B270-339F08212110} - c:\program files\kaspersky lab\kaspersky internet security 2010\klwtbbho.dll
IE: {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - {B745F984-EF2E-40D6-A9AC-D8CED7230E61}
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - c:\program files\kaspersky lab\kaspersky internet security 2010\klwtbbho.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~2\office12\GR99D3~1.DLL
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll
Notify: klogon - c:\windows\system32\klogon.dll
Notify: opnlJaBr - opnlJaBr.dll
AppInit_DLLs: c:\progra~1\kasper~1\kasper~2\mzvkbd3.dll,c:\progra~1\kasper~1\kasper~2\kloehk.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\wpdshserviceobj.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL
SEH: {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - No File

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\dzona\applic~1\mozilla\firefox\profiles\1gk3djcj.default\
FF - prefs.js: browser.startup.homepage - hxxp://google.ba
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - component: c:\program files\mozilla firefox\extensions\linkfilter@kaspersky.ru\components\KavLinkFilter.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-1-29 33808]
R0 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [2006-2-27 34880]
R0 O2SDRDR;O2SDRDR;c:\windows\system32\drivers\o2sd.sys [2006-2-20 29056]
R2 SCPDFV4ReadSpool;SolidConverterPDFv4ReadSpool;c:\windows\installer\MSI156C.tmp [2009-11-12 189688]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\tuneup utilities 2010\TuneUpUtilitiesService32.exe [2009-10-29 1021256]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [2009-5-16 19472]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\tuneup utilities 2010\TuneUpUtilitiesDriver32.sys [2009-10-14 10064]
S3 AVPsys;AVPsys;c:\windows\system32\drivers\cdaudio.sys [2001-8-17 18688]
S3 EverestDriver;Lavalys EVEREST Kernel Driver;\??\c:\program files\lavalys\everest ultimate edition\kerneld.wnt --> c:\program files\lavalys\everest ultimate edition\kerneld.wnt [?]
S3 KeyScrambler;KeyScrambler;c:\windows\system32\drivers\keyscrambler.sys --> c:\windows\system32\drivers\keyscrambler.sys [?]
S3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2009-5-13 31760]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [2009-9-2 136704]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [2009-9-2 8320]
S3 sea1bus;Sony Ericsson Device 0A1 driver (WDM);c:\windows\system32\drivers\sea1bus.sys [2009-1-30 61536]

=============== Created Last 30 ================

2009-11-16 21:26:30 0 d-----w- c:\program files\K-Lite Codec Pack
2009-11-16 17:37:37 0 d-----w- c:\program files\WinDjView
2009-11-12 21:25:12 0 d-----w- c:\program files\TuneUp Utilities 2010
2009-11-12 21:24:45 0 d-sh--w- c:\docume~1\alluse~1\applic~1\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
2009-11-12 19:53:41 0 d-----w- c:\docume~1\dzona\applic~1\SolidDocuments
2009-11-12 19:48:16 0 d-----w- c:\program files\SolidDocuments
2009-11-12 19:47:12 0 d-----w- c:\docume~1\alluse~1\applic~1\SolidDocuments
2009-11-12 16:46:38 0 d-----w- c:\docume~1\dzona\applic~1\MathWorks
2009-11-11 20:31:24 0 d-----w- c:\program files\Nero
2009-11-11 20:31:09 0 d-----w- c:\docume~1\alluse~1\applic~1\Nero
2009-11-05 18:02:53 0 d-----w- c:\program files\SopCast
2009-10-31 21:47:22 0 d-----w- c:\program files\TeamViewer
2009-10-31 20:11:12 0 d-----w- c:\program files\Sybase
2009-10-31 19:57:31 0 d-----w- c:\docume~1\dzona\applic~1\TeamViewer
2009-10-31 14:02:02 0 d-----w- c:\program files\VeryPDF Image2PDF v3.2
2009-10-30 19:09:46 0 d-----w- c:\program files\AIMP2 Tools

==================== Find3M ====================

2009-11-09 18:00:00 85504 ----a-w- c:\windows\system32\ff_vfw.dll
2009-11-07 19:50:31 3350 --sha-w- c:\windows\system32\KGyGaAvL.sys
2009-10-29 19:43:20 29512 ----a-w- c:\windows\system32\TURegOpt.exe
2009-10-15 18:14:33 95259 ----a-w- c:\windows\system32\drivers\klick.dat
2009-10-15 18:14:33 108059 ----a-w- c:\windows\system32\drivers\klin.dat
2009-02-28 15:30:48 28 ----a-w- c:\program files\deviceinfo
2009-02-28 14:35:59 8704 ----a-w- c:\program files\rpchromebrowserrecordhelper.dll
2009-03-16 13:18:25 56 --sh--r- c:\windows\system32\326CC3F28F.sys
2009-01-15 16:54:45 16384 --sha-w- c:\windows\system32\config\systemprofile\cookies\index.dat
2009-01-15 16:54:45 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\index.dat
2009-01-13 22:23:22 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009011320090114\index.dat
2009-01-15 16:54:45 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\temporary internet files\content.ie5\index.dat
2009-06-24 00:18:53 3021344 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-06-24 00:18:53 352288 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-06-24 00:21:36 604140 --sha-w- c:\windows\system32\drivers\ISwift3.dat

============= FINISH: 17:45:56,29 ===============




https://www.mycity.rs/must-login.png

https://www.mycity.rs/must-login.png

https://www.mycity.rs/must-login.png

https://www.mycity.rs/must-login.png

Moram naglasiti da mi je izbacilo nesto prilikom prvog skeniranja kod Gmer1 (nesto ROOTKIT nisam zapamtio sta pise, al u svakom slucaju sam morao izabrati OK), pretpostavljam da je to bilo na kraju

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Pozdrav...


Ovde ima tragova malware-a, no nisam baš siguran da će uklanjanje istoga da reši probleme sa tastaturom.




Preuzmi sUBs-ov ComboFix sa sledeće adrese na Desktop:


Bleeping Computer
Klikni desnim tasterom na link i odaberi opciju Save Target As... (Save Link As..., Save Linked Content As... ili sličnu);
Kada se otvori dijalog za izbor lokacije na kojoj treba sačuvati file, odaberi Desktop i klikni Save.



Kada preuzimanje programa bude završeno:
deaktiviraj zaštitni softver (uputstvo);
zatvori pokrenute programe;
dvoklikom pokreni program ComboFix.
U toku rada, ComboFix će:proveriti postoji li novija verzija programa:
klikni Yes ako bude ponuđeno preuzimanje iste. prikazati DISCLAIMER OF WARRANTY ON SOFTWARE:
klikni Yes kako bi proces bio nastavljen.ako Recovery Console nije instalirana, ponuditi instalaciju:
obavezno prihvati klikom na Yes i isprati postupak.postaviti/dati određeni broj upita/obaveštenja:
prihvati klikom na Yes ili OK.po potrebi, restartovati Windows (više puta);
na kraju rada, otvoriti Notepad sa izveštajem o skeniranju.

Iskopiraj izveštaj koji je ComboFix napravio u temu na forumu:
klikni desnim tasterom miša u prozor Notepad-a i izaberi Select All;
klikni desnim tasterom miša na obeleženi tekst i izaberi Copy;
klikni desnim tasterom miša u polje za pisanje poruke i izaberi Paste.

Napomena:Izveštaj će biti sačuvan pod nazivom ComboFix.txt na sistemskoj particiji (tipična lokacija: C:\ComboFix.txt);
Ukoliko nakon slanja poruke primetiš da izveštaj nije kompletan, iskoristi opciju Prikači fajl za prilaganje file-a C:\ComboFix.txt uz poruku.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Napisano: 20 Nov 2009 14:09

Uradio sam sve kako pise, zavrsilo skeniranje, ali nema izvestaja koji je combofix napravio. Da li ponovo da pokrenem combofix?

Dopuna: 20 Nov 2009 15:05

Nisam opet uspeo, posle onih complete stage 50, izbaci mi "plavi ekran smrti" i restartuje se comp, a cim ucita windows izbaci mi onu report o greski "ono send, dont send"....a loga nema

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Probaj opet. Obavezno ugasi antivirus.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Napisano: 20 Nov 2009 15:47

Probao vec treci put sve isto, pise preparing log report pojavi se plavi ekran nesto pise na njemu ne stignem ni procitati pa restart...neznam u cemu je problem, ugasio antivirus i stopirao protekciju ....

Dopuna: 20 Nov 2009 15:49

nesto ovako izbaci

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Ništa onda, idemo na drugi program.




Preuzmi program OTL sa donjeg linka na Desktop:


OTL download
Klikni dati link - u prozoru koji se otvori, klikni Save;
kada se otvori dijalog za izbor lokacije na kojoj treba sačuvati file, odaberi Desktop i klikni Save.

Dvoklikom pokreniOTL;

klikni Run Scan;

po završetku skeniranja, izveštaj (koji će biti automatski sačuvan na Desktop-u kao OTL.Txt) će se otvoriti u Notepad-u.

Priloži izveštaj OTL.Txt uz poruku korišćenjem opcije Prikači fajl.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Hvala Bora u svakom slucaju na pomoci! Danas mi je combofix posle update-a zeznuo stvar i morao sam opet dizati sistem stalno mi se restartovao PC kad dodje do dela kad treba loading windows. Cujemo se sledeci put ako bude bilo kakvih problema , nadam se da ce tada biti uspesnije...Kao sto neko i rece ComboFix je toliko komplexan program da mali BUG moze zeznuti system...Sretno. Pozdrav