Gasenje compjutera

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

OK,Laku noc

Dopuna: 02 Okt 2007 22:05

Hop la,imal koga zivoga



Dopuna: 02 Okt 2007 22:21

Evo ovaj moj comp sam pise nekakva slova i brojeve.jel poludio ili imam nekakvu zarazu ?

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Otvori sledeci link:
ftp://kav2006:Fynb02dbhec60@data.kaspersky.ru/
Odatle skini KisKav6Remove.zip
Raspakuj sadrzaj tog zip fajl u poseban folder.
Restartuj komp u SafeMode i tu pokreni avp_remove.cmd kog si malopre raspakovao iz zip fajla.
Restartuj sada komp u normalan mod rada i napravi novi HijackThis log koji ces postaviti ovde.

Dopuna: 02 Okt 2007 22:24

dubo ::Evo ovaj moj comp sam pise nekakva slova i brojeve.jel poludio ili imam nekakvu zarazu ?

Eh, kada bih ja sada samo mogao da pogodim gde ih ispisuje, koje brojeve i slova ispisuje itd itd...

Dopuna: 02 Okt 2007 22:27

I da, mogao si ranije da se javis.
Ja radim obicno do 18:00, stignem kuci za pola sata, tako da sam ispred kompa vec pre 19:00. Najbolje je u to vreme da se javis, pa da stignemo vise stvari da odradimo i probamo za jedno vece.
Bicu tu jos kratko, pa na spavanjac.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Ja radim malo duze, do 21:00 a kuci sad u 21:30 pa tako da nemogu ranij e radnim danom,Evo napravio sam log. Logfile of HijackThis v1.99.1
Scan saved at 22:55:01, on 03.10.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SYSTEM32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Eset\nod32kui.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\Programme\Eset\nod32krn.exe
C:\Programme\Agnitum\Outpost Firewall\outpost.exe
C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Dokumente und Einstellungen\M L\Desktop\op2.exe\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = home.sweetim.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\pchealth\helpctr\System\panels\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\pchealth\helpctr\System\panels\blank.htm
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn0\yt.dll
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: CInterceptor Object - {38D3FE60-3D53-4F37-BB0E-C7A97A26A156} - C:\Programme\Pando Networks\Pando\PandoIEPlugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Programme\BitComet\tools\BitCometBHO_1.1.8.30.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Programme\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Outpost Firewall] "C:\Programme\Agnitum\Outpost Firewall\outpost.exe" /waitservice
O4 - HKLM\..\Run: [OutpostFeedBack] C:\Programme\Agnitum\Outpost Firewall\feedback.exe /dump:os_startup
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Programme\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Programme\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Programme\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Outpost Firewall Pro Quick Tune - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\Programme\Agnitum\Outpost Firewall\Plugins\BrowserBar\ie_bar.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Programme\BitComet\tools\BitCometBHO_1.1.8.30.dll
O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Programme\Paltalk Messenger\Paltalk.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall der Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O12 - Plugin for .spop: C:\Programme\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - tools.ebayimg.com/eps/wl/activex/eBay_Enhan.....0-3-30.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - der.de/scan8/oscan8.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) -
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - update.microsoft.com/microsoftupdate/v6/V5C.....5340005968
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programme\Eset\nod32krn.exe
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - C:\Programme\Agnitum\Outpost Firewall\outpost.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

Dopuna: 03 Okt 2007 18:51

Ista kaze ovaj log,jeli se sta popravilo.Jos mi se otvaraju same stranice i opet ode u Standby sam.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Cudno, zaista cudno...

Onaj gore program je trebao da deinstalira ostatke KAV-a, ali se sledeca linija uporno pojavljuje:
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll

Fajl C:\WINDOWS\system32\klogon.dll mi uploaduj preko sledece forme:
http://www.mycity.rs/ambulanta-upload.php
Zelim da proverim da li je stvarno KAV-ov fajl ili nesto pokusava da nas slaze.

Ajmo da probamo jos i Ewido Micro, da vidimo da li ce on nesto da nadje zasto ti se stranice same otvaraju.
Ewido micro je samo za jednu upotrebu, a tezak je 8mb (prvo ce se skinuti 150kb koji ce skinuti ostatak).
Ukoliko ti internet veza nije losa, mogli bi da probamo sa njim.

Skini Ewido micro:
http://downloads.ewido.net/ewido_micro.exe

Kako se radi sa Ewido micro:
- na prvom ekranu odaberi sve particije (štikliraj polja ispred njih)
- klikni na dugme Start Scan
- nakon završenog skeniranja klikni na Save Report i snimi log fajl na sigurno mesto
- klikni na Remove Infections
- iskopiraj nam ovde sadržaj log fajla koji je malopre snimljen

Nakon skeniranja sa Ewidom i postavljanja log fajla, postavi nam i svez log programa HijackThis.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

e ovako ovaj fajl nemogu da otvorim posto nece ,a zavrsio sam skeniranje sa Ewido i nasao mi je trojanca nekakvog.Evo sad log fajl a sad cu poslati i od HijaksThis. __________________________________________________
ewido anti-spyware online scanner
http://www.ewido.net
__________________________________________________


Name: TrackingCookie.Serving-sys
Path: C:\Dokumente und Einstellungen\M L\Cookies\m l@bs.serving-sys[1].txt
Risk: Medium

Name: TrackingCookie.Ivwbox
Path: C:\Dokumente und Einstellungen\M L\Cookies\m l@ivwbox[1].txt
Risk: Medium

Name: TrackingCookie.Serving-sys
Path: C:\Dokumente und Einstellungen\M L\Cookies\m l@serving-sys[1].txt
Risk: Medium

Name: TrackingCookie.Tribalfusion
Path: C:\Dokumente und Einstellungen\M L\Cookies\m l@tribalfusion[1].txt
Risk: Medium

Name: TrackingCookie.Weborama
Path: C:\Dokumente und Einstellungen\M L\Cookies\m l@weborama[2].txt
Risk: Medium

Name: TrackingCookie.Ivwbox
Path: :mozilla.25:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.2o7
Path: :mozilla.31:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.2o7
Path: :mozilla.32:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.2o7
Path: :mozilla.33:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.2o7
Path: :mozilla.34:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.2o7
Path: :mozilla.41:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Yadro
Path: :mozilla.63:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Esomniture
Path: :mozilla.99:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Doubleclick
Path: :mozilla.100:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Tradedoubler
Path: :mozilla.102:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Tradedoubler
Path: :mozilla.104:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Tradedoubler
Path: :mozilla.105:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Imrworldwide
Path: :mozilla.106:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Imrworldwide
Path: :mozilla.107:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Komtrack
Path: :mozilla.125:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Komtrack
Path: :mozilla.126:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Komtrack
Path: :mozilla.127:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Komtrack
Path: :mozilla.128:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Googleadservices
Path: :mozilla.129:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Atdmt
Path: :mozilla.142:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Esomniture
Path: :mozilla.145:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Live
Path: :mozilla.163:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Live
Path: :mozilla.164:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Live
Path: :mozilla.165:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Googleadservices
Path: :mozilla.168:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Mediaplex
Path: :mozilla.173:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Overture
Path: :mozilla.219:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Overture
Path: :mozilla.220:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Weborama
Path: :mozilla.222:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Skype
Path: :mozilla.227:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Skype
Path: :mozilla.228:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Skype
Path: :mozilla.229:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.2o7
Path: :mozilla.234:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Quarterserver
Path: :mozilla.241:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Serving-sys
Path: :mozilla.242:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Serving-sys
Path: :mozilla.244:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Serving-sys
Path: :mozilla.245:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Serving-sys
Path: :mozilla.246:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Serving-sys
Path: :mozilla.247:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Serving-sys
Path: :mozilla.248:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Adition
Path: :mozilla.249:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Adition
Path: :mozilla.250:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Revsci
Path: :mozilla.264:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Revsci
Path: :mozilla.265:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: TrackingCookie.Clickhype
Path: :mozilla.311:C:\Dokumente und Einstellungen\M L\Anwendungsdaten\Mozilla\Firefox\Profiles\98v41ro5.default\cookies.txt
Risk: Medium

Name: Trojan.KeyLogger.478
Path: C:\Dokumente und Einstellungen\M L\Eigene Dateien\Programi za pc\xp_simulation_setup\Tutorial.exe
Risk: High

Dopuna: 03 Okt 2007 23:00

A evi sad HijackThis Logfile of HijackThis v1.99.1
Scan saved at 22:57:45, on 04.10.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SYSTEM32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Eset\nod32krn.exe
C:\Programme\Agnitum\Outpost Firewall\outpost.exe
C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Eset\nod32kui.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\MSN Messenger\msnmsgr.exe
C:\Programme\MSN Messenger\usnsvc.exe
C:\Dokumente und Einstellungen\M L\Desktop\op2.exe\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = home.sweetim.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\pchealth\helpctr\System\panels\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\pchealth\helpctr\System\panels\blank.htm
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn0\yt.dll
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: CInterceptor Object - {38D3FE60-3D53-4F37-BB0E-C7A97A26A156} - C:\Programme\Pando Networks\Pando\PandoIEPlugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Programme\BitComet\tools\BitCometBHO_1.1.8.30.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Programme\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Outpost Firewall] "C:\Programme\Agnitum\Outpost Firewall\outpost.exe" /waitservice
O4 - HKLM\..\Run: [OutpostFeedBack] C:\Programme\Agnitum\Outpost Firewall\feedback.exe /dump:os_startup
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Programme\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Programme\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Programme\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Outpost Firewall Pro Quick Tune - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\Programme\Agnitum\Outpost Firewall\Plugins\BrowserBar\ie_bar.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Programme\BitComet\tools\BitCometBHO_1.1.8.30.dll
O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Programme\Paltalk Messenger\Paltalk.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall der Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O12 - Plugin for .spop: C:\Programme\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - tools.ebayimg.com/eps/wl/activex/eBay_Enhan.....0-3-30.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - der.de/scan8/oscan8.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) -
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - update.microsoft.com/microsoftupdate/v6/V5C.....5340005968
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programme\Eset\nod32krn.exe
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - C:\Programme\Agnitum\Outpost Firewall\outpost.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Kazi mi sta je bilo sa onim sto sam te pitao u prvom delu poruke?
Ima li cega?
Za onaj odlazak u standby sumnjam na konflikt izmedju ostataka KAV-a i sadasnjeg NOD-a.

Sto se tice otvaranja stranica, u kojem browseru se otvaraju (IE ili FireFox) i koje se adrese otvaraju?

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

E uspio sam da uploadujem onaj fajl sto si rekao da ti posaljem.

Dopuna: 03 Okt 2007 23:10

Otvara se recimo moja Startseite sa FireFox par puta i onda recimo tamo kad trazim(u google primjer) nesto ponekad se ubaci samo koji broj ili pokoje slovo.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Taj fajl jeste od Kasperskog, sto znaci da ga nisi lepo deinstalirao.
Cudi me da nije pomogao ni onaj program za koji sam ti dao link.

Probaj sledece: skeniraj ponovo HijackThisom i stikliraj polje ispred sledece linije:
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
klikni na Fix Checked

nakon toga restartuj komp i napravi novi log, pa vidi da li je ta linija jos uvek tu ili je uspesno uklonjena.

Dopuna: 03 Okt 2007 23:13

Ah, ovo sto mi pricas za Firefox, to mi vise lici na pokvarenu tastaturu.
Probaj drugu tastaturu (pozajmi od drugara), ali nemoj neku bezicnu vec obicnu.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Izgleda da je otislo,evo novi Hijaks Logfile of HijackThis v1.99.1
Scan saved at 23:33:26, on 04.10.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SYSTEM32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Eset\nod32krn.exe
C:\Programme\Agnitum\Outpost Firewall\outpost.exe
C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Eset\nod32kui.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\svchost.exe
C:\Dokumente und Einstellungen\M L\Desktop\op2.exe\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = home.sweetim.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\pchealth\helpctr\System\panels\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\pchealth\helpctr\System\panels\blank.htm
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn0\yt.dll
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: CInterceptor Object - {38D3FE60-3D53-4F37-BB0E-C7A97A26A156} - C:\Programme\Pando Networks\Pando\PandoIEPlugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Programme\BitComet\tools\BitCometBHO_1.1.8.30.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Programme\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Outpost Firewall] "C:\Programme\Agnitum\Outpost Firewall\outpost.exe" /waitservice
O4 - HKLM\..\Run: [OutpostFeedBack] C:\Programme\Agnitum\Outpost Firewall\feedback.exe /dump:os_startup
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Programme\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Programme\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Programme\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Outpost Firewall Pro Quick Tune - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\Programme\Agnitum\Outpost Firewall\Plugins\BrowserBar\ie_bar.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Programme\BitComet\tools\BitCometBHO_1.1.8.30.dll
O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Programme\Paltalk Messenger\Paltalk.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall der Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O12 - Plugin for .spop: C:\Programme\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - tools.ebayimg.com/eps/wl/activex/eBay_Enhan.....0-3-30.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - der.de/scan8/oscan8.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) -
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - update.microsoft.com/microsoftupdate/v6/V5C.....5340005968
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programme\Eset\nod32krn.exe
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - C:\Programme\Agnitum\Outpost Firewall\outpost.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

Dopuna: 04 Okt 2007 22:38

E mislim da smo sredili problem,neide vise u Standby modus i sad se ponasa normalno,a sto si rekao za tastaturu i ja mislim da je do nje
bilo,posto sam je bio skoro zamjenio a sad cu kupiti drugu.I tako, zahvaljujem se na pomoci,trudu i strpljenju pa uzivaj,