MyCity » Ambulanta -> Arhiva Ambulante » Pojavilo mi se na ekranu Error Safe!

Pojavilo mi se na ekranu Error Safe!

Napisano na dan: 15.12.2006
1

Pojavilo mi se na ekranu Error Safe!
Sledeća strana Pagination

Idi na vrh

Poslao: 15 Dec 2006 22:07
Idi na vrh
offline
  • Pridružio: 15 Avg 2006
  • Poruke: 2381
  • Gde živiš: Trenutno nigde...

Kao sto naslov kaze pojavilo mi se Error Safe i pise dali hocu da nastavim jer kompjuter ima mnogo gresaka i ja kliknuo OK i onda je trezio i pronasao 4 problema!

E sad, ovo je samo Trial verzija, a ja bih Free i dali postoji tako nesto!?
Ako razumete sta hocu da pitam!? smešak



Poslao: 15 Dec 2006 22:13
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Mogu da te obavestim da si pao na trik i da ti je sada racunar najverovatnije zarazen.

Pogledaj forum Ambulanta i u njemu teme izdvojene sa "Vazno", pa postavi ovde HJT log.

Nakon sto postavis log, ja cu da premestim temu u Ambulantu.



Poslao: 16 Dec 2006 02:24
Idi na vrh
offline
  • Pridružio: 15 Avg 2006
  • Poruke: 2381
  • Gde živiš: Trenutno nigde...

Logfile of HijackThis v1.99.1
Scan saved at 02:14:59, on 2006-12-17
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program\GOTOSO~1\VADERE~1\Vaderetro_oe.exe
C:\Program\Delade filer\Ulead Systems\AutoDetector\monitor.exe
C:\apps\ABoard\ABoard.exe
C:\Program\Delade filer\Real\Update_OB\realsched.exe
C:\apps\ABoard\AOSD.exe
C:\Program\Grisoft\AVGFRE~1\avgamsvr.exe
D:\Documents and Settings\goran.049747020057\Mina dokument\Winamp\winampa.exe
C:\Program\Java\jre1.5.0_09\bin\jusched.exe
C:\Program\Grisoft\AVGFRE~1\avgcc.exe
C:\Program\QuickTime\qttask.exe
C:\Program\MYWEBS~1\bar\2.bin\mwsoemon.exe
C:\Program\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program\HbTools\Bin\4.8.2.0\HbtWeatherOnTray.exe
C:\Program\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program\MSN Messenger\msnmsgr.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program\Emoticons Mail\emomail.exe
C:\Program\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program\Hbtools\HBTV\HBTV.exe
C:\Program\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\Program\Delade filer\Ulead Systems\DVD\ULCDRSvr.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\svchost.exe
C:\Program\HbTools\Bin\4.8.2.0\HbtSrv.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program\Internet Explorer\iexplore.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = [Link mogu videti samo ulogovani korisnici]
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = [Link mogu videti samo ulogovani korisnici]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [Link mogu videti samo ulogovani korisnici]\APPS\IE\offline\sw.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = [Link mogu videti samo ulogovani korisnici]
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = [Link mogu videti samo ulogovani korisnici]
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program\MyWebSearch\SrchAstt\2.bin\MWSSRCAS.DLL
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program\MyWebSearch\SrchAstt\2.bin\MWSSRCAS.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program\MyWebSearch\bar\2.bin\MWSBAR.DLL
O2 - BHO: TVEngine Helper /fleok=1D8A83A5C2E6107C91A475760EA83FA5EF80752B94E2DE7A547A42203AC1 - {4B18DD50-C996-44fc-AC52-0FECFF82ED58} - c:\program\hbtools\hbtv\hbtvhelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program\SPYBOT~1\SDHelper.dll
O2 - BHO: HbTools - {74CC49F7-EB32-4A08-B204-948962A6E3DB} - C:\Program\HbTools\Bin\4.8.2.0\HbtHostIE.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program\Delade filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program\google\googletoolbar1.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program\google\googletoolbar1.dll
O3 - Toolbar: H&otbar - {74CC49F7-EB32-4A08-B204-948962A6E3DB} - C:\Program\HbTools\Bin\4.8.2.0\HbtHostIE.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /SYNC
O4 - HKLM\..\Run: [PHIME2002A] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /IMEName
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] "C:\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [Vade Retro Outlook Express] "C:\Program\GOTOSO~1\VADERE~1\Vaderetro_oe.exe"
O4 - HKLM\..\Run: [Ulead AutoDetector v2] "C:\Program\Delade filer\Ulead Systems\AutoDetector\monitor.exe"
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program\Delade filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] "D:\Documents and Settings\goran.049747020057\Mina dokument\Winamp\winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [SpywareTerminator] "d:\Program\SPYWAR~2\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\Program\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\Program\MYWEBS~1\bar\2.bin\MWSBAR.DLL,S
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\Program\MYWEBS~1\bar\2.bin\mwsoemon.exe
O4 - HKLM\..\Run: [WeatherOnTray] C:\Program\HbTools\Bin\4.8.2.0\HbtWeatherOnTray.exe
O4 - HKLM\..\Run: [goikmuup] C:\WINDOWS\system32\zcoxmgvt.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\Program\MYWEBS~1\bar\2.bin\mwsoemon.exe
O4 - HKCU\..\Run: [9] "D:\Program\Vidalia\vidalia.exe"
O4 - HKCU\..\Run: [EZ Smileys] "D:\EZ Smileys\EZSmileys.exe"
O4 - HKCU\..\Run: [Emoticons Mail] C:\Program\Emoticons Mail\emomail.exe
O4 - HKCU\..\Run: [Error Safe] "C:\Program\Error Safe Free\ers.exe" /min
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\Program\FlashGet\flashget.exe (file missing)
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\Program\FlashGet\flashget.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\sw.htm
O18 - Protocol: ebk - {1E411CE8-FE8B-4973-B8E0-6EA2CC3C6B06} - C:\WINDOWS\system32\ebkp.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: altmannsberger - {210b4043-35ca-4aa0-8796-191f9663dfb3} - (no file)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\Program\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\Program\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\Program\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Boonty Games - BOONTY - C:\Program\Delade filer\BOONTY Shared\Service\Boonty.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Spyware Terminator Clam Service (sp_clamsrv) - Unknown owner - C:\Program\WinClamAVShield\sp_clamsrv.exe (file missing)
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program\Delade filer\Ulead Systems\DVD\ULCDRSvr.exe

Poslao: 16 Dec 2006 15:51
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Za pocetak, sledece fajlove spakuj u jedan ZIP, i uploaduj nam na:
[Link mogu videti samo ulogovani korisnici]

Fajlovi su:
C:\Program\GOTOSO~1\VADERE~1\Vaderetro_oe.exe
D:\Documents and Settings\goran.049747020057\Mina dokument\Winamp\winampa.exe
C:\APPS\IE\offline\sw.htm
C:\WINDOWS\system32\zcoxmgvt.exe
D:\Program\Vidalia\vidalia.exe"
D:\EZ Smileys\EZSmileys.exe"
C:\Program\Emoticons Mail\emomail.exe
C:\WINDOWS\system32\ebkp.dll
C:\Program\Delade filer\BOONTY Shared\Service\Boonty.exe

kao i cele foldere;
C:\Program\MyWebSearch
C:\Program\HbTools
C:\Program\Error Safe Free

Ukoliko znas cemu sluze sledeci programi, i sam si ih instalirao, onda njihove fajlove ne moras da uploadujes:
Boonty
Vidalia
Emoticons Mail
EZSmileys
Vade Retro Outlook Express

WinAmp je takodje sumnjiv zato sto radi sa desktopa, a ne iz foldera u kojem se obicno instaliraju programi.

I jos nesto, molim te da sledeci put iskljucis programe koje si sam ukljucio pre nego sto napravis sledeci log, posto nam to samo pravi vise posla.

Poslao: 16 Dec 2006 23:24
Idi na vrh
offline
  • Pridružio: 15 Avg 2006
  • Poruke: 2381
  • Gde živiš: Trenutno nigde...

uploadovao sam 2 foldera, a ovaj treci nije mogao i cekao sam 20 minuta na upload ali nista! Sta da radim?

Poslao: 16 Dec 2006 23:28
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Jel je taj treci folder veci od 10mb kada se spakuje?

Poslao: 16 Dec 2006 23:37
Idi na vrh
offline
  • Pridružio: 15 Avg 2006
  • Poruke: 2381
  • Gde živiš: Trenutno nigde...

Jao Boby zaboravio sam koji sam folder uploadovao!

Ovde imam, celi folderi od (44,3 KB),
celi folderi_1 (10,8 MB)
i celi folderi_2 (2,42 MB)

Poslao: 16 Dec 2006 23:42
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Onaj od 10,8 razbij na dva ZIP-a.

U onome sto si vec uploadovao, nasao sam preko 30 malicioznih fajlova.

Poslao: 17 Dec 2006 00:45
Idi na vrh
offline
  • Pridružio: 15 Avg 2006
  • Poruke: 2381
  • Gde živiš: Trenutno nigde...

Boby, ovo sam ti malopre poslao ali ovaj od 23 MB, ZIP-om 8 MB nece nikako da se razbije!
Ima samo jedna ikonica i kad kliknem da se otvori pise samo OK i kao neko upozorenje!
Neznam zasto, nemogu nikako da pristupim,a da ih uploadujem celih 8 MB sam pokusavao nekoliko puta i nista! Zaustavi se na polovini!

Poslao: 17 Dec 2006 00:58
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Sve ovo sto si mi do sada poslao je maliciozno, znaci lose.
Ako nije frka, sutra ujutru cu da ti napisem uputstvo za otklanjanje, posto sam sada umoran i mogu nesto slucajno da izostavim.

Nisi mi rekao za ono ostalo sto sam ti potrazio, da li neke od tih programa prepoznajes (da li si ih ti instalirao)?

Ima u onom mom gornjem postu jos par stvari koje su mi jako bitne:

C:\APPS\IE\offline\sw.htm
C:\WINDOWS\system32\zcoxmgvt.exe
C:\WINDOWS\system32\ebkp.dll

Za one ostale programe sa spiska iz prethodnog posta zamolio bih te znaci da mi kazes da li si ih ti instalirao i da li znas cemu sluze, da te ne bih uputio da ih brises bezveze.

MyCity » Ambulanta -> Arhiva Ambulante » Pojavilo mi se na ekranu Error Safe!

Ko je trenutno na forumu
 

Ukupno su 957 korisnika na forumu :: 57 registrovanih, 7 sakrivenih i 893 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: 015, 33 bren, 6.5lapua, acatomic, Andrija357, babaroga, belov, bigfoot, bobomicek, Car89, darkangel, dejankm, DJUNTA, Dogma21, Duh sa sekirom, Georgius, Haris, HrcAk47, Igor Antonic, Inner-Cell, Ivan001, jarovitt, kuntalo, kybonacci, Leonov, lord sir giga, LostInSpaceandTime, Lucije Kvint, Mahovljani, Makeitdrip, Manjane, Marko Marković, Mechanik, mercedesamg, Metanoja, Mi lao shu, mikrimaus, Milos ZA, milutin134, Mitraljeta, mladen.zovko, mnn2, moldway, pein, Podljub, Prečanin30, PrincipL, radoznao, royst33, Sirius, sova72, Srle993, stokssone, synergia, Underwood, Zec, 79693