MyCity » Ambulanta -> Arhiva Ambulante » Restartovanje kompa prilikom logovanja na win

Restartovanje kompa prilikom logovanja na win

Napisano na dan: 5.9.2007
1

Restartovanje kompa prilikom logovanja na win
Sledeća strana Pagination

Idi na vrh

Poslao: 05 Sep 2007 17:34
Idi na vrh
offline
  • Pridružio: 01 Sep 2007
  • Poruke: 65
  • Gde živiš: Beograd

Logfile of HijackThis v1.99.1
Scan saved at 17:32:11, on 5.9.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\CursorXP\CursorXP.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\compaq\Downloads\utorrent.exe
C:\compaq\Downloads\hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [Link mogu videti samo ulogovani korisnici]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [Link mogu videti samo ulogovani korisnici]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [Link mogu videti samo ulogovani korisnici]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [Link mogu videti samo ulogovani korisnici]
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = [Link mogu videti samo ulogovani korisnici]
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: EMail_Notifier toolbar - {85c5b796-eda5-4353-b26e-a5d181ad9cd0} - C:\Program Files\EMail_Notifier\tbEMa0.dll
O3 - Toolbar: EMail_Notifier toolbar - {85c5b796-eda5-4353-b26e-a5d181ad9cd0} - C:\Program Files\EMail_Notifier\tbEMa0.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [CorelDRAW Graphics Suite 11b] "C:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe" /title="CorelDRAW Graphics Suite 12" /date=090807 serial=DR12WNG-0249275-TMV lang=EN
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [CursorXP] "C:\Program Files\CursorXP\CursorXP.exe"
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Download by Orbit - [Link mogu videti samo ulogovani korisnici]\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - [Link mogu videti samo ulogovani korisnici]\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Do&wnload selected by Orbit - [Link mogu videti samo ulogovani korisnici]\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - [Link mogu videti samo ulogovani korisnici]\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: Download &Flash Movies - C:\Program Files\Flash2X\Flash Hunter\save.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - [Link mogu videti samo ulogovani korisnici]\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - [Link mogu videti samo ulogovani korisnici]
O17 - HKLM\System\CCS\Services\Tcpip\..\{1DEB922C-9ED2-4EA1-B7E7-0FDBAE30859F}: NameServer = 194.106.162.10 194.106.162.3
O17 - HKLM\System\CS2\Services\Tcpip\..\{1DEB922C-9ED2-4EA1-B7E7-0FDBAE30859F}: NameServer = 194.106.162.10 194.106.162.3
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: IconPackager Repair - {1799460C-0BC8-4865-B9DF-4A36CD703FF0} - C:\Program Files\Stardock\Object Desktop\IconPackager\iprepair.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" -r (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe



Poslao: 05 Sep 2007 17:41
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Sta imas instalirano od Symanteca?

Promeni ime foldera u kojem ti se nalazi HijackThis, kao i ime samog programa (exe fajla), posto ima malwarea koji se sakriva ukoliko se to ime vidi medju aktivnim procesima.
Nakon toga napravi novi log i postavi ga ovde.



Poslao: 05 Sep 2007 17:47
Idi na vrh
offline
  • Pridružio: 01 Sep 2007
  • Poruke: 65
  • Gde živiš: Beograd

Od Symanteca koliko ja znam nista...

evo novog loga..ime novog foldera HT..ime programa HT

Logfile of HijackThis v1.99.1
Scan saved at 17:46:53, on 5.9.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\CursorXP\CursorXP.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\compaq\Downloads\utorrent.exe
C:\Program Files\Adobe\Adobe Photoshop CS2\Photoshop.exe
C:\WINDOWS\system32\svchost.exe
C:\DOCUME~1\Vedas\LOCALS~1\Temp\Adobelm_Cleanup.0001
C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
C:\DOCUME~1\Vedas\LOCALS~1\Temp\Adobelm_Cleanup.0001
C:\HT\HT.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [Link mogu videti samo ulogovani korisnici]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [Link mogu videti samo ulogovani korisnici]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [Link mogu videti samo ulogovani korisnici]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [Link mogu videti samo ulogovani korisnici]
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = [Link mogu videti samo ulogovani korisnici]
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: EMail_Notifier toolbar - {85c5b796-eda5-4353-b26e-a5d181ad9cd0} - C:\Program Files\EMail_Notifier\tbEMa0.dll
O3 - Toolbar: EMail_Notifier toolbar - {85c5b796-eda5-4353-b26e-a5d181ad9cd0} - C:\Program Files\EMail_Notifier\tbEMa0.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [CorelDRAW Graphics Suite 11b] "C:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe" /title="CorelDRAW Graphics Suite 12" /date=090807 serial=DR12WNG-0249275-TMV lang=EN
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [CursorXP] "C:\Program Files\CursorXP\CursorXP.exe"
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Download by Orbit - [Link mogu videti samo ulogovani korisnici]\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - [Link mogu videti samo ulogovani korisnici]\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Do&wnload selected by Orbit - [Link mogu videti samo ulogovani korisnici]\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - [Link mogu videti samo ulogovani korisnici]\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: Download &Flash Movies - C:\Program Files\Flash2X\Flash Hunter\save.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - [Link mogu videti samo ulogovani korisnici]\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - [Link mogu videti samo ulogovani korisnici]
O17 - HKLM\System\CCS\Services\Tcpip\..\{1DEB922C-9ED2-4EA1-B7E7-0FDBAE30859F}: NameServer = 194.106.162.10 194.106.162.3
O17 - HKLM\System\CS2\Services\Tcpip\..\{1DEB922C-9ED2-4EA1-B7E7-0FDBAE30859F}: NameServer = 194.106.162.10 194.106.162.3
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: IconPackager Repair - {1799460C-0BC8-4865-B9DF-4A36CD703FF0} - C:\Program Files\Stardock\Object Desktop\IconPackager\iprepair.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" -r (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

Poslao: 05 Sep 2007 17:53
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Jel ti je ranije bio instaliran Norton antivirus?
Vidim sada medju procesima nesto od Adobea, molim te da poiskljucujes programe koje si ti pokrenuo dok pravis log, ovako to samo odvlaci paznju.

Ja ne vidim nista sporno u logu (osim ukoliko budes rekao da nikada nisi imao Symantec Norton antivirus).

Eventualno, Alcohol programi su poznati po problematicnosti, pa mozda ne bi bilo lose da probas da li ce problem nestati kada deinstaliras taj program.

Za sledecu poruku spremi sledece:
preuzmi program Deckard's System Scanner.
Preporučuje se čuvanje programa direktno na Desktop radi lakšeg i bržeg pokretanja.

Program se startuje prosto - dvoklikom na ikonu. Skeniranje i provera sistema se odvija kroz par koraka i traje maksimalno par minuta.

Rezultat je log main.txt koji Deckard's System Scanner kreira i otvara automatski po završtetku skeniranja. Kompletan sadržaj tog loga je potrebno kopirati i postovati na forum u sledećem postu radi analize.

Poslao: 05 Sep 2007 18:28
Idi na vrh
offline
  • Pridružio: 01 Sep 2007
  • Poruke: 65
  • Gde živiš: Beograd

Norton bio pre 6 meseci....

Deckard's System Scanner v20070826.66
Run by Vedas on 2007-09-05 18:23:41
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- HijackThis (run as Vedas.exe) -----------------------------------------------

Unable to find log (file not found); running clone.
-- HijackThis Clone ------------------------------------------------------------

Emulating logfile of HijackThis v1.99.1
Scan saved at 2007-09-05 18:23:48
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (7.00.6000.16512)

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\RTHDCPL.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\CursorXP\CursorXP.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Vedas\Desktop\dss.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [Link mogu videti samo ulogovani korisnici]
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = [Link mogu videti samo ulogovani korisnici]
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [Link mogu videti samo ulogovani korisnici]
R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [Link mogu videti samo ulogovani korisnici]
R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Search Page = [Link mogu videti samo ulogovani korisnici]
R0 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Start Page = [Link mogu videti samo ulogovani korisnici]
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: EMail_Notifier toolbar - {85c5b796-eda5-4353-b26e-a5d181ad9cd0} - C:\Program Files\EMail_Notifier\tbEMa0.dll
O3 - Toolbar: EMail_Notifier toolbar - {85c5b796-eda5-4353-b26e-a5d181ad9cd0} - C:\Program Files\EMail_Notifier\tbEMa0.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
O4 - HKEY_LOCAL_MACHINE\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKEY_LOCAL_MACHINE\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKEY_LOCAL_MACHINE\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKEY_LOCAL_MACHINE\..\Run: [CorelDRAW Graphics Suite 11b] "C:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe" /title="CorelDRAW Graphics Suite 12" /date=090807 serial=DR12WNG-0249275-TMV lang=EN
O4 - HKEY_LOCAL_MACHINE\..\Run: [ISUSPM Startup] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" -startup
O4 - HKEY_LOCAL_MACHINE\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKEY_LOCAL_MACHINE\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKEY_LOCAL_MACHINE\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKEY_LOCAL_MACHINE\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKEY_LOCAL_MACHINE\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKEY_LOCAL_MACHINE\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKEY_LOCAL_MACHINE\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKEY_LOCAL_MACHINE\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKEY_LOCAL_MACHINE\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
O4 - HKEY_LOCAL_MACHINE\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [CursorXP] "C:\Program Files\CursorXP\CursorXP.exe"
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Download by Orbit - [Link mogu videti samo ulogovani korisnici]\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - [Link mogu videti samo ulogovani korisnici]\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Do&wnload selected by Orbit - [Link mogu videti samo ulogovani korisnici]\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - [Link mogu videti samo ulogovani korisnici]\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: Download &Flash Movies - C:\Program Files\Flash2X\Flash Hunter\save.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - [Link mogu videti samo ulogovani korisnici]\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - (file missing)
O9 - Extra 'Tools' menuitem: (no name) - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - (file missing)
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing)
O9 - Extra 'Tools' menuitem: (no name) - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - [Link mogu videti samo ulogovani korisnici]
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - [Link mogu videti samo ulogovani korisnici]
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - [Link mogu videti samo ulogovani korisnici]
O17 - HKLM\SYSTEM\CCS\Services\Tcpip\..\{1DEB922C-9ED2-4EA1-B7E7-0FDBAE30859F}: NameServer = 194.106.162.10 194.106.162.3
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll
O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\system32\
O21 - SSODL: 0aMCPClient - {F5DF91F9-15E9-416B-A7C3-7519B11ECBFC} - C:\Program Files\Common Files\Stardock\MCPCore.dll
O21 - SSODL: IconPackager Repair - {1799460C-0BC8-4865-B9DF-4A36CD703FF0} - C:\Program Files\Stardock\Object Desktop\IconPackager\iprepair.dll
O23 - Service: Adobe LM Service - Adobe Systems - "C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe



-- Files created between 2007-08-05 and 2007-09-05 -----------------------------

2007-09-05 17:45:47 0 d-------- C:\HT
2007-09-04 23:55:23 81549 --a------ C:\WINDOWS\system32\drivers\klin.dat
2007-09-04 23:55:23 82061 --a------ C:\WINDOWS\system32\drivers\klick.dat
2007-09-04 23:54:46 0 d-------- C:\Program Files\Kaspersky Lab
2007-09-04 23:54:46 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-09-04 23:04:27 127456 --a------ C:\WINDOWS\system32\IPDETECT.EXE <Not Verified; ; IPDETECT>
2007-09-04 23:04:25 152126 --a------ C:\WINDOWS\system32\drivers\L1E9P2.BIN
2007-09-04 23:04:24 176128 --a------ C:\WINDOWS\autoclk.exe <Not Verified; ; autoclk Application>
2007-09-04 23:04:23 212992 --a------ C:\WINDOWS\system32\unaddrv.exe <Not Verified; Analog Devices.; UnADdrv>
2007-09-04 23:04:23 152126 --a------ C:\WINDOWS\system32\drivers\L1E9P0.BIN
2007-09-04 23:04:23 200704 --a------ C:\WINDOWS\system32\coclassfast.dll
2007-09-04 23:04:23 46892 --a------ C:\WINDOWS\system32\ADADIX16.DLL
2007-09-04 23:04:23 24576 --a------ C:\WINDOWS\enddisk32.exe
2007-09-04 23:04:22 152126 --a------ C:\WINDOWS\system32\drivers\L1E9P1.BIN
2007-09-04 23:04:22 152126 --a------ C:\WINDOWS\system32\drivers\L1E9I2.BIN
2007-09-04 23:04:22 152126 --a------ C:\WINDOWS\system32\drivers\L1E9I1.BIN
2007-09-04 23:04:22 152126 --a------ C:\WINDOWS\system32\drivers\L1E9I0.BIN
2007-09-04 23:04:21 152146 --a------ C:\WINDOWS\system32\drivers\L1E4P2.BIN
2007-09-04 23:04:21 152145 --a------ C:\WINDOWS\system32\drivers\L1E4P1.BIN
2007-09-04 23:04:21 152145 --a------ C:\WINDOWS\system32\drivers\L1E4P0.BIN
2007-09-04 23:04:21 152308 --a------ C:\WINDOWS\system32\drivers\L1E4I2.BIN
2007-09-04 23:04:21 152306 --a------ C:\WINDOWS\system32\drivers\L1E4I1.BIN
2007-09-04 23:04:21 152306 --a------ C:\WINDOWS\system32\drivers\L1E4I0.BIN
2007-09-04 23:03:44 0 d-------- C:\Documents and Settings\Vedas\Application Data\InstallShield
2007-09-04 23:00:58 0 d-------- C:\Program Files\SAGEM
2007-09-02 23:47:34 0 d-------- C:\Documents and Settings\All Users\Application Data\TEMP
2007-09-02 11:02:27 0 d-------- C:\Documents and Settings\Vedas\Application Data\Joost
2007-09-02 11:02:00 0 d-------- C:\Program Files\Joost
2007-09-01 23:15:50 0 d-------- C:\Documents and Settings\Vedas\Application Data\X3mE Yamb
2007-09-01 23:15:49 0 d-------- C:\Documents and Settings\All Users\Application Data\X3mE Yamb
2007-09-01 23:15:03 0 d-------- C:\Program Files\X3mE Yamb
2007-09-01 22:43:17 0 d-------- C:\Program Files\wxRecnik
2007-09-01 21:01:07 0 d-------- C:\Documents and Settings\LocalService\Application Data\Webroot
2007-09-01 20:59:48 0 d-------- C:\Program Files\Webroot
2007-09-01 20:59:48 0 d-------- C:\Documents and Settings\All Users\Application Data\Webroot
2007-09-01 20:56:34 0 d-------- C:\Documents and Settings\Vedas\Application Data\Webroot
2007-08-28 17:53:38 0 d-------- C:\Program Files\NCH Swift Sound
2007-08-28 17:53:38 0 d-------- C:\Documents and Settings\Vedas\Application Data\NCH Swift Sound
2007-08-28 17:50:10 0 d-------- C:\Program Files\PC Doc Pro
2007-08-28 16:48:49 0 d-------- C:\Program Files\WhatsRunning
2007-08-26 17:42:24 0 d-------- C:\Program Files\SuperBladePro
2007-08-26 14:08:42 0 d-------- C:\Program Files\Magic Swf2Gif
2007-08-20 23:49:10 0 d-------- C:\WINDOWS\Replay Media Catcher
2007-08-20 23:49:02 0 d-------- C:\Program Files\Replay Media Catcher
2007-08-19 13:50:15 0 d-------- C:\Program Files\Sidebar
2007-08-19 12:02:32 0 d-------- C:\Program Files\Premium Clock
2007-08-18 21:34:02 0 d-------- C:\Documents and Settings\Vedas\Application Data\Leadertech
2007-08-18 21:09:15 0 d-------- C:\Documents and Settings\Vedas\Application Data\AdobeUM
2007-08-18 20:46:11 0 d-------- C:\Documents and Settings\Vedas\Application Data\Teleca
2007-08-18 20:45:19 0 d-------- C:\Program Files\Common Files\Teleca Shared


-- Find3M Report ---------------------------------------------------------------

2007-09-05 18:19:59 0 d-------- C:\Documents and Settings\Vedas\Application Data\uTorrent
2007-09-05 17:58:49 0 d-------- C:\Documents and Settings\Vedas\Application Data\Adobe
2007-09-04 23:18:16 4212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2007-09-04 23:04:18 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-09-04 00:18:50 0 d-------- C:\Program Files\WLM Ripper
2007-09-03 23:21:48 100 --a------ C:\WINDOWS\system32\prsgrc.dll
2007-09-02 14:08:35 0 d-------- C:\Documents and Settings\Vedas\Application Data\Samsung
2007-09-02 13:48:27 1024 --a------ C:\WINDOWS\system32\gp6lceu.dll
2007-09-02 13:48:26 1024 --a------ C:\WINDOWS\system32\grcauth2.dll
2007-09-02 13:48:26 1024 --a------ C:\WINDOWS\system32\grcauth1.dll
2007-09-02 13:48:25 1024 --a------ C:\WINDOWS\system32\clauth2.dll
2007-09-02 13:48:24 72 --a------ C:\WINDOWS\system32\ssprs.dll
2007-09-02 13:48:24 1024 --a------ C:\WINDOWS\system32\clauth1.dll
2007-08-31 19:12:08 0 d-------- C:\Documents and Settings\Vedas\Application Data\Skype
2007-08-31 18:43:36 0 d-------- C:\Program Files\Tapur
2007-08-30 01:24:29 512 --a------ C:\ScanSectorLog.dat
2007-08-28 18:34:17 0 d-------- C:\Program Files\Latinski recnik
2007-08-26 13:43:03 0 d-------- C:\Documents and Settings\Vedas\Application Data\Alien Skin
2007-08-26 11:41:30 0 d-------- C:\Program Files\eMule
2007-08-19 13:43:36 0 d-------- C:\Program Files\Hair Pro 2006 Light
2007-08-19 13:43:06 0 d-------- C:\Program Files\MumboJumbo
2007-08-19 13:40:39 0 d-------- C:\Program Files\UseNeXT
2007-08-18 20:45:19 0 d-------- C:\Program Files\Common Files
2007-08-05 22:19:00 2158 --a------ C:\WINDOWS\mozver.dat
2007-07-19 06:42:00 0 d-------- C:\Program Files\Java
2007-07-11 06:59:36 0 d-------- C:\Documents and Settings\Vedas\Application Data\Tapur
2007-07-10 19:54:20 0 d-------- C:\Program Files\TechSmith
2007-07-10 19:52:05 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-07-08 21:26:33 0 d-------- C:\Documents and Settings\Vedas\Application Data\Orbit
2007-07-08 16:55:57 0 d-------- C:\Program Files\Orbitdownloader
2007-07-05 23:43:32 0 d-------- C:\Program Files\Slide
2007-07-05 23:42:46 0 d-------- C:\Program Files\Common Files\Symantec Shared
2007-06-24 13:45:14 964704 --a------ C:\WINDOWS\Cedevita ScreenBubbler.scr
2007-06-23 16:39:11 4 --a------ C:\WINDOWS\info147.sys


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [18.05.2006 08:27 C:\WINDOWS\RTHDCPL.exe]
"Alcmtr"="ALCMTR.EXE" [03.05.2005 12:43 C:\WINDOWS\Alcmtr.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [12.07.2007 04:00]
"CorelDRAW Graphics Suite 11b"="C:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe" [25.11.2003 14:39]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [17.04.2004 13:41]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [13.04.2004 07:07]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [09.07.2001 12:50]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [27.10.2006 01:47]
"NvCplDaemon"="RUNDLL32.exe" [04.08.2004 03:07 C:\WINDOWS\system32\rundll32.exe]
"nwiz"="nwiz.exe" [17.01.2007 00:40 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="RUNDLL32.exe" [04.08.2004 03:07 C:\WINDOWS\system32\rundll32.exe]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [16.02.2007 10:54]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [01.05.2007 10:15]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [01.01.2007 23:22]
"RegistryMechanic"="" []
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" [19.05.2007 22:36]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [04.08.2004 03:07]
"CursorXP"="C:\Program Files\CursorXP\CursorXP.exe" [19.01.2005 17:44]

C:\Documents and Settings\Vedas\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [26.10.2006 21:24:54]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.exe.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [31.1.2007 22:29:42]
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [31.1.2007 22:29:42]
DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [4.9.2007 23:04:25]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [3.4.1999 18:50:14]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Vedas^Start Menu^Programs^Startup^Slide.exe.lnk]
backup=C:\WINDOWS\pss\Slide.exe.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ProfileWatcher]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
SkyTel.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"avast! Web Scanner"=3 (0x3)
"avast! Mail Scanner"=3 (0x3)
"avast! Antivirus"=2 (0x2)
"Automatic LiveUpdate Scheduler"=2 (0x2)
"aswUpdSv"=2 (0x2)




-- End of Deckard's System Scanner: finished at 2007-09-05 18:24:55 ------------

Poslao: 05 Sep 2007 18:41
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Skini Norton Removal Tool:
[Link mogu videti samo ulogovani korisnici]

Startuj i ocisti to sto je ostalo od Nortona, posto moze biti da imamo konflikt izmedju KAV-a i tog ostatka Nortona.

Kada to odradis (trazice restart), otvori sledecu formu:
[Link mogu videti samo ulogovani korisnici]

Tu mi skupi u jedan ZIP i uploaduj na proveru sledece fajlove:
C:\WINDOWS\info147.sys
C:\WINDOWS\system32\prsgrc.dll
C:\WINDOWS\system32\gp6lceu.dll
C:\WINDOWS\system32\grcauth2.dll
C:\WINDOWS\system32\grcauth1.dll
C:\WINDOWS\system32\clauth2.dll
C:\WINDOWS\system32\ssprs.dll
C:\WINDOWS\system32\clauth1.dll
C:\WINDOWS\system32\coclassfast.dll
C:\WINDOWS\system32\ADADIX16.DLL
C:\WINDOWS\enddisk32.exe

Ukoliko neki od njih nije vidljiv, onda pogleda uputstvo za ukljucivanje prikaza skrivenih fajlova u Exploreru:
[Link mogu videti samo ulogovani korisnici]

Poslao: 05 Sep 2007 19:19
Idi na vrh
offline
  • Pridružio: 01 Sep 2007
  • Poruke: 65
  • Gde živiš: Beograd

Uspesno sam uploadovao kao mc.zip

Poslao: 05 Sep 2007 19:27
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Vecina fajlova su bili djubre, fajlovi kakve obicno prave spyware i trojanci, ali trojanca medju njima nisam nasao.

Jel ono sa sklanjanjem Nortona pomoglo nesto?

Jel ti je problem da skines 8-9mb sa neta? Ako nije, da znam, da te uputim na Ewido micro.

Poslao: 05 Sep 2007 19:41
Idi na vrh
offline
  • Pridružio: 01 Sep 2007
  • Poruke: 65
  • Gde živiš: Beograd

Nortona sam uklonio mada mi nije trazio restart ja sam ga restarovao.

Sistem se ovaj put bez problema podigao i radi kako treba.

Nije mi problem imam solidnu konekciju...adsl 512.

Poslao: 05 Sep 2007 19:46
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Skini Ewido micro (8Mb) :
[Link mogu videti samo ulogovani korisnici]

Kako se radi sa Ewido micro:
- na prvom ekranu odaberi sve particije (štikliraj polja ispred njih)
- klikni na dugme Start Scan
- nakon završenog skeniranja klikni na Save Report i snimi log fajl na sigurno mesto
- klikni na Remove Infections
- iskopiraj nam ovde sadržaj log fajla koji je malopre snimljen

Nakon skeniranja sa Ewidom i postavljanja log fajla, postavi nam i svez log programa HijackThis.

***
Ewido micro je samo za jednu upotrebu. To je pojednostavnjena verzija AVG Anti-Spyware 7.5 (bivsi Ewido), ciju probnu verziju (30 dana) mozes skinuti odavde: [Link mogu videti samo ulogovani korisnici]

MyCity » Ambulanta -> Arhiva Ambulante » Restartovanje kompa prilikom logovanja na win

Ko je trenutno na forumu
 

Ukupno su 1444 korisnika na forumu :: 117 registrovanih, 8 sakrivenih i 1319 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: A.R.Chafee.Jr., Agape, Aleksa 3215, anta, ArchaBasha, armor, Aska, Avalon015, bankulen, bbrasnjo3, benne, Bickoooo, Boris BM, Borkanović, BOXRR, bufanje, bukefal, BWG, cemix, Centauro, Cian, crnirocko, cvrle312, Dambi, darkangel, Dejan_vw, DejanSt, dejno, del boy, Denaya, Dioniss, DonRumataEstorski, Dorcolac, DPera, Duh sa sekirom, Electron, famoso, Flotikius, Frunze, gregorxix, grunff2, GveX, Hitri, HPkopun, jalos, Jovan1983, Jozo74, kobaja77, koliko, kolle.the.kid, Kosmos Banja Luka, Kubovac, kunktator, Kvazar, Lazur_01, Lucije Kvint, mack8, Malahit, marsovac 2, matejman, micke83, milanstankovic087, milenko crazy north, Milometer, milos.cbr, mir, mita92, Mitch22, momcilob55, Mravojed, Myamoto Musashi, Nemanja.M, nemkea71, Neutral-M, Njubara, nnnnnnnnnn, Panter, panzerwaffe, Parker, perko91, ping15, Plavi Jadran, procesor, promajauglavi, RajkoB, rajkoplje, Ranutovac, raso7, RD84, redstar011, rovac, ruma, samojednoimeznam, septembar, sickmouse, singa, Sićko, Skok23, smerch, stegonosa, synergia, Tas011, TRAVUNIJA, trpche, trutcina, TTN, vaci, Vlado82, Vladovbl, XRF_d, yiyi, zeka013, Zorge, zozan, Zrcalo, šumar bk2, Đole64