MyCity » Ambulanta -> Arhiva Ambulante » Usporen komp totalno

Usporen komp totalno

Napisano na dan: 7.6.2007
1

Usporen komp totalno
Sledeća strana Pagination

Idi na vrh

Poslao: 07 Jun 2007 22:23
Idi na vrh
offline
  • Pridružio: 19 Jul 2005
  • Poruke: 1783

Logfile of HijackThis v1.99.1
Scan saved at 10:26:52 PM, on 6/7/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\TIADSL~1\bin\win2k\tidslmon.exe
C:\WINDOWS\SYSTEM32\SRPSKEY.EXE
C:\Program Files\VMware\VMware Workstation\vmware-tray.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\system32\vmnat.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Dusan\Desktop\mrkavac\Mrkavac.exe

O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Encarta Web Companion Helper Object - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Program Files\Common Files\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: FlashGet - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\Program Files\FlashGet\fgiebar.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Encarta Web Companion - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Program Files\Common Files\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O4 - HKLM\..\Run: [TIxDSL] C:\PROGRA~1\TIADSL~1\bin\win2k\tidslmon.exe
O4 - HKLM\..\Run: [srpskey] C:\WINDOWS\SYSTEM32\SRPSKEY.EXE
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [vmware-tray] C:\Program Files\VMware\VMware Workstation\vmware-tray.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - [Link mogu videti samo ulogovani korisnici]\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - [Link mogu videti samo ulogovani korisnici]\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - [Link mogu videti samo ulogovani korisnici]\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - [Link mogu videti samo ulogovani korisnici]\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - [Link mogu videti samo ulogovani korisnici]\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Open using &Advanced JPEG Compressor - C:\Program Files\Advanced JPEG Compressor\ajcieex.htm
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
O9 - Extra button: Encarta Search Bar - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O17 - HKLM\System\CCS\Services\Tcpip\..\{5F5F46E6-02FB-46B3-990A-0AA90003246D}: NameServer = 77.105.0.19 77.105.0.18
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - AppInit_DLLs: "C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll"
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r (file missing)
O23 - Service: Canon Camera Access Library 8 (CCALib8-) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: VMware Agent Service (ufad-ws60) - Unknown owner - C:\Program Files\VMware\VMware Workstation\vmware-ufad.exe" -d "C:\Program Files\VMware\VMware Workstation\\" -s ufad-p2v.xml (file missing)
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe

Imam ADSL 256/64

Jel treba jos nesto mozda Question



Poslao: 07 Jun 2007 23:01
Idi na vrh
offline
  • Pridružio: 06 Apr 2005
  • Poruke: 1023

cini mi se da je log cist aj da probamo sa GMER-om


Skeniraj komp sa GMER-om i postavi log da proverimo da nema nekih rootkitova...

Uradi sledeće:
Preuzmi fajl gmer.zip sa ovog linka i sačuvaj na Desktop-u.
Raspakuj ga u neki folder.

Dupli klik na gmer.exe za početak: Izaberi Rootkit Tab na vrhu.
Klikni na Scan.
Kada je skeniranje završeno, klik na Copy dugme ispod - ovo će sačuvati to u Clipboard.
U polju za pisanje poruke na forumu klikni desno dugme misa i odaberi opciju Paste.



Poslao: 07 Jun 2007 23:52
Idi na vrh
offline
  • Pridružio: 19 Jul 2005
  • Poruke: 1783

GMER 1.0.12.12244 - [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2007-06-07 23:55:57
Windows 5.1.2600 Service Pack 2


---- System - GMER 1.0.12 ----

SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwClose
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwCreateKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwCreateProcess
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwCreateProcessEx
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwCreateSection
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwCreateSymbolicLinkObject
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwCreateThread
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwDeleteKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwDeleteValueKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwDuplicateObject
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwEnumerateKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwEnumerateValueKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwFlushKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwInitializeRegistry
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwLoadKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwLoadKey2
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwNotifyChangeKey
SSDT kl1.sys ZwOpenFile
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwOpenKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwOpenProcess
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwOpenSection
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwQueryKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwQueryMultipleValueKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwQuerySystemInformation
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwQueryValueKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwReplaceKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwRestoreKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwResumeThread
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwSaveKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwSetContextThread
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwSetInformationFile
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwSetInformationKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwSetInformationProcess
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwSetSecurityObject
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwSetValueKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwSuspendThread
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwTerminateProcess
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwUnloadKey
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys ZwWriteVirtualMemory
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[284]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[285]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[286]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[287]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[288]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[289]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[290]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[291]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[292]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[293]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[294]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[295]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys SSDT[296]

Code \??\C:\WINDOWS\system32\drivers\klif.sys FsRtlCheckLockForReadAccess
Code \??\C:\WINDOWS\system32\drivers\klif.sys IoIsOperationSynchronous

---- Kernel code sections - GMER 1.0.12 ----

.text ntoskrnl.exe!KiDispatchInterrupt + BA 804DB92E 7 Bytes JMP BAE4DCD0 \??\C:\WINDOWS\system32\drivers\klif.sys
.text ntoskrnl.exe!IoIsOperationSynchronous 804E8752 5 Bytes JMP BAE4AC50 \??\C:\WINDOWS\system32\drivers\klif.sys
.text ntoskrnl.exe!FsRtlCheckLockForReadAccess 804FBE09 5 Bytes JMP BAE4A760 \??\C:\WINDOWS\system32\drivers\klif.sys
? C:\WINDOWS\system32\drivers\sptd.sys The process cannot access the file because it is being used by another process.
.text USBPORT.SYS!DllUnload F7C227AE 5 Bytes JMP 82ABB1B8
? System32\Drivers\athjyzu7.SYS The system cannot find the file specified.
? C:\WINDOWS\system32\DRIVERS\update.sys

---- User code sections - GMER 1.0.12 ----

.text C:\WINDOWS\explorer.exe[2020] RPCRT4.dll!NdrComplexArrayMemorySize + AC 77E89980 4 Bytes [ 62, 0B, FF, 00 ]
.text C:\WINDOWS\explorer.exe[2020] SHELL32.dll!StrStrW + FFE2DA6E 7C9C8920 4 Bytes [ D2, 04, FF, 00 ]
.text C:\WINDOWS\explorer.exe[2020] SHELL32.dll!StrStrW + FFE2DAE6 7C9C8998 4 Bytes [ FC, 04, FF, 00 ]
.text C:\WINDOWS\explorer.exe[2020] SHELL32.dll!StrStrW + FFE33B46 7C9CE9F8 4 Bytes [ 04, 03, FF, 00 ]
.text C:\WINDOWS\explorer.exe[2020] SHELL32.dll!StrStrW + FFE33B56 7C9CEA08 4 Bytes [ 00, 04, FF, 00 ]
.text C:\WINDOWS\explorer.exe[2020] SHELL32.dll!StrStrW + FFE34A96 7C9CF948 4 Bytes [ 54, 04, FF, 00 ]
.text ...
.text C:\WINDOWS\explorer.exe[2020] SHELL32.dll!ILLoadFromStream + 397 7CA0617C 4 Bytes [ E0, 0B, FF, 00 ]
.text C:\WINDOWS\explorer.exe[2020] SHELL32.dll!ILLoadFromStream + 54F 7CA06334 4 Bytes [ 50, 05, FF, 00 ]
.text C:\WINDOWS\explorer.exe[2020] SHELL32.dll!ILLoadFromStream + 65F 7CA06444 4 Bytes [ 26, 05, FF, 00 ]
.text C:\WINDOWS\explorer.exe[2020] SHELL32.dll!DAD_ShowDragImage + 2370 7CA09E68 4 Bytes [ 22, 06, FF, 00 ]
.text C:\Program Files\Winamp\winamp.exe[2540] USER32.dll!SetScrollInfo 77D49056 7 Bytes JMP 01ADB7C6 C:\Program Files\Winamp\Plugins\gen_jumpex.dll
.text C:\Program Files\Winamp\winamp.exe[2540] USER32.dll!GetScrollInfo 77D517F8 7 Bytes JMP 01ADB74E C:\Program Files\Winamp\Plugins\gen_jumpex.dll
.text C:\Program Files\Winamp\winamp.exe[2540] USER32.dll!ShowScrollBar 77D5F2CA 5 Bytes JMP 01ADB84A C:\Program Files\Winamp\Plugins\gen_jumpex.dll
.text C:\Program Files\Winamp\winamp.exe[2540] USER32.dll!GetScrollPos 77D5F6DC 5 Bytes JMP 01ADB776 C:\Program Files\Winamp\Plugins\gen_jumpex.dll
.text C:\Program Files\Winamp\winamp.exe[2540] USER32.dll!SetScrollPos 77D5F728 5 Bytes JMP 01ADB7F1 C:\Program Files\Winamp\Plugins\gen_jumpex.dll
.text C:\Program Files\Winamp\winamp.exe[2540] USER32.dll!GetScrollRange 77D5F75F 5 Bytes JMP 01ADB79B C:\Program Files\Winamp\Plugins\gen_jumpex.dll
.text C:\Program Files\Winamp\winamp.exe[2540] USER32.dll!SetScrollRange 77D5F973 5 Bytes JMP 01ADB81C C:\Program Files\Winamp\Plugins\gen_jumpex.dll
.text C:\Program Files\Winamp\winamp.exe[2540] USER32.dll!EnableScrollBar 77D97BC5 7 Bytes JMP 01ADB726 C:\Program Files\Winamp\Plugins\gen_jumpex.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] kernel32.dll!LoadResource 7C809FB5 7 Bytes JMP 27001B70 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] kernel32.dll!FindResourceExW 7C80AC88 7 Bytes JMP 27001AE0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] kernel32.dll!FindResourceW 7C80BBCE 7 Bytes JMP 27001A60 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] kernel32.dll!SizeofResource 7C80BC69 7 Bytes JMP 27001C20 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] kernel32.dll!LockResource 7C80CC97 5 Bytes JMP 27001CD0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] kernel32.dll!CreateEventA 7C8307DD 5 Bytes JMP 27001840 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] kernel32.dll!SetUnhandledExceptionFilter 7C8447B5 5 Bytes JMP 004DE392 C:\Program Files\MSN Messenger\msnmsgr.exe
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] ADVAPI32.dll!CryptDeriveKey 77DEA685 7 Bytes JMP 27001000 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] ADVAPI32.dll!CryptDecrypt 77DEA7B1 2 Bytes JMP 27001050 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] ADVAPI32.dll!CryptDecrypt + 3 77DEA7B4 4 Bytes [ 21, AF, CC, CC ]
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] USER32.dll!PeekMessageW 77D4929B 5 Bytes JMP 27003A20 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] USER32.dll!CreateWindowExW 77D4FF50 5 Bytes JMP 27003330 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] USER32.dll!SetWindowRgn 77D502DD 7 Bytes JMP 27004D80 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] USER32.dll!CreateDialogParamW 77D584EE 5 Bytes JMP 27004E20 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] USER32.dll!SetWindowPlacement 77D5DF46 5 Bytes JMP 27004CA0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] USER32.dll!MessageBoxIndirectW 77D96093 5 Bytes JMP 27004F80 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] USER32.dll!TrackPopupMenuEx 77D9CB1A 5 Bytes JMP 270041F0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] WS2_32.dll!send 71AB428A 5 Bytes JMP 27009150 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] WS2_32.dll!WSARecv 71AB4318 5 Bytes JMP 27008F40 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] WS2_32.dll!recv 71AB615A 5 Bytes JMP 27008DB0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] WS2_32.dll!WSASend 71AB6233 5 Bytes JMP 270092D0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] WS2_32.dll!closesocket 71AB9639 5 Bytes JMP 270094E0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] SHELL32.dll!Shell_NotifyIconW 7CA21B5A 5 Bytes JMP 27002B10 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] ole32.dll!CoInitializeEx 774FEF7B 5 Bytes JMP 27001D30 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] ole32.dll!CoRegisterClassObject 77517EB8 5 Bytes JMP 27001E30 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] WININET.dll!HttpOpenRequestA 771C2B19 5 Bytes JMP 27007D00 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] WININET.dll!InternetCloseHandle 771C4DAC 5 Bytes JMP 27007FE0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] WININET.dll!HttpSendRequestA 771C6209 5 Bytes JMP 27007F30 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\MSN Messenger\msnmsgr.exe[2856] WININET.dll!InternetReadFile 771C812C 5 Bytes JMP 27007E60 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll

---- Devices - GMER 1.0.12 ----

Device \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE 82FD61D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_CLOSE 82FD61D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_READ 82FD61D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_WRITE 82FD61D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_INFORMATION 82FD61D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_INFORMATION 82FD61D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_EA 82FD61D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_EA 82FD61D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_FLUSH_BUFFERS 82FD61D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_VOLUME_INFORMATION 82FD61D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_VOLUME_INFORMATION 82FD61D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_DIRECTORY_CONTROL 82FD61D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_FILE_SYSTEM_CONTROL 82FD61D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CONTROL 82FD61D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SHUTDOWN 82FD61D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_LOCK_CONTROL 82FD61D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_CLEANUP 82FD61D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_SECURITY 82FD61D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_SECURITY 82FD61D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_QUOTA 82FD61D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_QUOTA 82FD61D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_PNP 82FD61D8
Device \Driver\NetBT \Device\NetBT_Tcpip_{97399CBD-8351-4C7A-9D14-2976D459B3C2} IRP_MJ_CREATE 82C4D6F0
Device \Driver\NetBT \Device\NetBT_Tcpip_{97399CBD-8351-4C7A-9D14-2976D459B3C2} IRP_MJ_CLOSE 82C4D6F0
Device \Driver\NetBT \Device\NetBT_Tcpip_{97399CBD-8351-4C7A-9D14-2976D459B3C2} IRP_MJ_DEVICE_CONTROL 82C4D6F0
Device \Driver\NetBT \Device\NetBT_Tcpip_{97399CBD-8351-4C7A-9D14-2976D459B3C2} IRP_MJ_INTERNAL_DEVICE_CONTROL 82C4D6F0
Device \Driver\NetBT \Device\NetBT_Tcpip_{97399CBD-8351-4C7A-9D14-2976D459B3C2} IRP_MJ_CLEANUP 82C4D6F0
Device \Driver\NetBT \Device\NetBT_Tcpip_{97399CBD-8351-4C7A-9D14-2976D459B3C2} IRP_MJ_PNP 82C4D6F0
Device \Driver\NetBT \Device\NetBT_Tcpip_{5F5F46E6-02FB-46B3-990A-0AA90003246D} IRP_MJ_CREATE 82C4D6F0
Device \Driver\NetBT \Device\NetBT_Tcpip_{5F5F46E6-02FB-46B3-990A-0AA90003246D} IRP_MJ_CLOSE 82C4D6F0
Device \Driver\NetBT \Device\NetBT_Tcpip_{5F5F46E6-02FB-46B3-990A-0AA90003246D} IRP_MJ_DEVICE_CONTROL 82C4D6F0
Device \Driver\NetBT \Device\NetBT_Tcpip_{5F5F46E6-02FB-46B3-990A-0AA90003246D} IRP_MJ_INTERNAL_DEVICE_CONTROL 82C4D6F0
Device \Driver\NetBT \Device\NetBT_Tcpip_{5F5F46E6-02FB-46B3-990A-0AA90003246D} IRP_MJ_CLEANUP 82C4D6F0
Device \Driver\NetBT \Device\NetBT_Tcpip_{5F5F46E6-02FB-46B3-990A-0AA90003246D} IRP_MJ_PNP 82C4D6F0
Device \Driver\usbohci \Device\USBPDO-0 IRP_MJ_CREATE 82D8D1D8
Device \Driver\usbohci \Device\USBPDO-0 IRP_MJ_CLOSE 82D8D1D8
Device \Driver\usbohci \Device\USBPDO-0 IRP_MJ_DEVICE_CONTROL 82D8D1D8
Device \Driver\usbohci \Device\USBPDO-0 IRP_MJ_INTERNAL_DEVICE_CONTROL 82D8D1D8
Device \Driver\usbohci \Device\USBPDO-0 IRP_MJ_POWER 82D8D1D8
Device \Driver\usbohci \Device\USBPDO-0 IRP_MJ_SYSTEM_CONTROL 82D8D1D8
Device \Driver\usbohci \Device\USBPDO-0 IRP_MJ_PNP 82D8D1D8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_CREATE 82F6A1D8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_CLOSE 82F6A1D8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_READ 82F6A1D8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_WRITE 82F6A1D8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_FLUSH_BUFFERS 82F6A1D8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_DEVICE_CONTROL 82F6A1D8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_INTERNAL_DEVICE_CONTROL 82F6A1D8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_SHUTDOWN 82F6A1D8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_POWER 82F6A1D8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_SYSTEM_CONTROL 82F6A1D8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_PNP 82F6A1D8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_CREATE 82F6A1D8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_CLOSE 82F6A1D8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_READ 82F6A1D8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_WRITE 82F6A1D8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_FLUSH_BUFFERS 82F6A1D8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_DEVICE_CONTROL

Poslao: 07 Jun 2007 23:56
Idi na vrh
offline
  • Pridružio: 19 Jul 2005
  • Poruke: 1783

Koliko vidim nije sve prekopirao u post-u Shocked

Ovaj text mi izgleda drugacije pa eto ga ispod ako zatreba.

[Link mogu videti samo ulogovani korisnici]

Poslao: 08 Jun 2007 00:25
Idi na vrh
offline
  • Pridružio: 06 Apr 2005
  • Poruke: 1023

ovaj fajl mi je sumnjim:
athjyzu7.SYS

ukljuci prikaz skrivenih fajlova i foldera i probaj da ga nadjes, trebalo bi da se nalazi:
WINDOWS\system32\drivers\athjyzu7.SYS

ako ga nadjes upoaduj ga ovde: [Link mogu videti samo ulogovani korisnici]

Poslao: 08 Jun 2007 00:31
Idi na vrh
offline
  • Pridružio: 19 Jul 2005
  • Poruke: 1783

Nema nigde tog fajla Shocked

Poslao: 08 Jun 2007 00:57
Idi na vrh
offline
  • Pridružio: 06 Apr 2005
  • Poruke: 1023

i u logu pise da fajl ne postoji tj da ne moze da ga nadje ali sam hteo da proverim.
Ostalo deluje cisto, mozes jos odraditi:

Bitdefender online scan - [Link mogu videti samo ulogovani korisnici]
- potreban je da Internet Explorer sa ukljucenim ActiveX
- iskopiraj nam ovde sadrzaj log fajla

ili

Ewido micro - [Link mogu videti samo ulogovani korisnici] (oko 8mb za skidanje):
- na prvom ekranu odaberi sve particije (štikliraj polja ispred njih)
- klikni na dugme Start Scan
- nakon završenog skeniranja klikni na Save Report i snimi log fajl na sigurno mesto
- klikni na Remove Infections
- iskopiraj nam ovde sadrzaj log fajla

Poslao: 11 Jun 2007 12:00
Idi na vrh
offline
  • Pridružio: 19 Jul 2005
  • Poruke: 1783

Odradicu to sutra cim ustanem , znaci nisam odustao i sigurno cu uraditi Exclamation

Dopuna: 11 Jun 2007 12:00

Ovako ...

Kad god sam krenuo da radim "Bitdefender online scan" uvek mi je pisalo da mu treba 400 sati do kraja Shocked

Pokusavao sam nekoliko puta i na kraju je pisalo da treba 2 sata do kraja i cekao sam ...

na nekih 50 minuta do kraja skeniranje je puklo , samo je izasao IE i tako posle svaki put cim startujem scan ...

Reinstalirao sam win na kraju i sada je sve ok

Hvala Everybodys_fool na pomoci Exclamation

Poslao: 11 Jun 2007 13:05
Idi na vrh
offline
  • Pridružio: 06 Apr 2005
  • Poruke: 1023

nema na cemu.

Steta sto nije ispalo bez reinstaliranja.

Poslao: 11 Jun 2007 13:16
Idi na vrh
offline
  • Pridružio: 19 Jul 2005
  • Poruke: 1783

A mozda mu je stvarno i bilo vreme , ipak je to win Mr. Green

MyCity » Ambulanta -> Arhiva Ambulante » Usporen komp totalno

Ko je trenutno na forumu
 

Ukupno su 1086 korisnika na forumu :: 78 registrovanih, 8 sakrivenih i 1000 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: 100ka, Asparagus, babaroga, bankulen, bbogdan, bbrasnjo3, Bickoooo, bojan581, bojanM84, bojcistv, BORUTUS, Clouseau, CraniumWhite, DeerHunter, DENIRO, Django777, djboj, Djokkinen, DjordjeDj01, djuradj, draganl, dule10savic, Electron, elenemste, famoso, Feller, flash12, FOX, g_g, goxin, GveX, HrcAk47, Igritelj, Insan, ivan1973, jalos, Jose, kojotuzamku, krkalon, Kubovac, kunktator, Lieutenant, Lotus, M74AB3, maiden6657, mean_machine, mercedesamg, Miki01, mikrimaus, milenko crazy north, opt1, Orfanelin, pein, pera bager, Povratak1912, predragc, raptorsi, Razdroid, Rebel Frank, sabros, samo opusteno, sasovsky, silikon, stalja, tanakadzo, Tas011, Trpe Grozni, Vlad000, Vladko, vobo, voja64, Vrač, vukajlo71, vukdra, yiyi, YugoSlav, Zorge, |_MeD_|