AAA UPOOMOOOC Vista je poludelaaaa

[DanteEx]

pozdrav narode ja palim svoju online igru Cabal Online i avast home mi pronadje neki kao skriveni proces u system32(nnTp.sys tako nesto) i misli da je infekcija...startujem ga da uradi test memo nista kaze ok a posle mi kaze da je naso neki virus u RAM i da treba da resteujem komp jel on to poludeo ili sta?PLS ODGOVORAJTE STO PRE moram da ucim

[genius]

I po cemu je sad to Vista poludela sto si ti dobio virusa...

[magna86]

ajde probaj da downloadujes i pokrenes SmitFraudFix
http://siri.urz.free.fr/Fix/SmitfraudFix.exe

SmitFraudFix uputstvo:
http://www.2-viruses.com/smitfraudfix-tutorial.html



ukoliko se problem i dalje pojavljuje...skini i updateuj
http://www.besttechie.net/tools/mbam-setup.exe
obavi skeniranje iz safe moda (quick scan)
.................................................. ...............
kao i ovo updateuj i skeniraj (nemoj iz safe moda)
http://www.safer-networking.org/en/mirrors/index.html


a ukoliko i dalje imas problem...

Skini HiJackThis program sa sledeceg linka:
http://www.majorgeeks.com/download5554.html
Stavi ga u zaseban folder na Desktop
Promeni naziv foldera i programa (opcija Rename) u Systav.exe

* Pokreni HijackThis
* Izaberi opciju "Do a system scan and save the logfile"
* Na kreju skeniranja program ce izbaciti tekstualni log.
* taj log kopiraj ovde ( opcije copy / paste)
srecno

[DanteEx]

imam net od sbb-a koji kazu da mi je komp firewallaovan od modema i njihovih servera..el to istina?

[DanteEx]

Rezultati ce biti 2 nastavka preveliki je log


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:58:52, on 7.10.2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe
C:\Acer\Empowering Technology\eAudio\eAudio.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Program Files\Acer Arcade Deluxe\SportsCap\Kernel\MagicSports\MSPMirage.exe
C:\Program Files\Acer Arcade Deluxe\TV Joy\TVEService.exe
C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Users\Petar\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE
C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EX E
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\explorer.exe
C:\Users\Petar\Downloads\HiJackThis.exe

[DanteEx]

Nastavak br2.
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [url]http://hr.intl.acer.yahoo.com[/url]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [url]http://hr.intl.acer.yahoo.com[/url]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [url]http://go.microsoft.com/fwlink/?LinkId=54896[/url]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [url]http://go.microsoft.com/fwlink/?LinkId=54896[/url]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [url]http://hr.intl.acer.yahoo.com[/url]
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O3 - Toolbar: (no name) - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - (no file)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [eAudio] "C:\Acer\Empowering Technology\eAudio\eAudio.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [MSPService] C:\Program Files\Acer Arcade Deluxe\SportsCap\Kernel\MagicSports\MSPMirage.exe
O4 - HKLM\..\Run: [TVEService] "C:\Program Files\Acer Arcade Deluxe\TV Joy\TVEService.exe"
O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe"
O4 - HKLM\..\Run: [PLFSetL] C:\Windows\PLFSetL.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" -autorun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: OneNote Table Of Contents.onetoc2
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Empowering Technology Launcher.lnk = C:\Acer\Empowering Technology\eAPLauncher.exe

[DanteEx]

i broj 3
O8 - Extra context menu item: Add to Banner Ad Blocker - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Send image to &Bluetooth Device... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send page to &Bluetooth Device... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O13 - Gopher Prefix:
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA ~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPE R~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASP ER~1\kloehk.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: ALaunch Service (ALaunchService) - Unknown owner - C:\Acer\ALaunch\ALaunchSvc.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: eDataSecurity Service - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: lxbc_device - - C:\Windows\system32\lxbccoms.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: TVEnhance Background Capture Service (TBCS) (TVECapSvc) - Unknown owner - C:\Program Files\Acer Arcade Deluxe\TV Joy\Kernel\TV\TVECapSvc.exe
O23 - Service: TVEnhance Task Scheduler (TTS)) (TVESched) - Unknown owner - C:\Program Files\Acer Arcade Deluxe\TV Joy\Kernel\TV\TVESched.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\Windows\System32\ZoneLabs\vsmon.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 11528 bytes

[DanteEx]

skinuo sam kasperskog i on kaze neki network intusion atacker.MSSQL.worm.Helkern has been blocked...? ja skinuh ovaj zone alarm i on mi najde noces 5 napada jbt...sta je ovo?

[vasiljevic]

Ima na nekoliko mesta o tome: napad crv spolja i napada SQL baze, tako da nije opasan po tvoj komp, a i sam Kasperski ga blokirao tako da nemora da brines. Zato je i napravljen .

[DanteEx]

vasiljevic kaže:

Ima na nekoliko mesta o tome: napad crv spolja i napada SQL baze, tako da nije opasan po tvoj komp, a i sam Kasperski ga blokirao tako da nemora da brines. Zato je i napravljen .

el mogu ja da ga nekako otklonim...posto mi kaspersky istice njegova trial verzija za 29 dana ...i spy bot mi je naso neki adware kkoji je otklonio...sad mi je jedino cudno sto kad se startuje komp pojavi ono welcome od viste..a posle tirkizno plava boja na neko vreme.. el to zbog virusa ili je zbog resursa?oO

[vasiljevic]

Posto bas nije napisano potpuno sta koristis, pretpostavicu da je u pitanju Kasperski Internet Securiti paket koji ima u sebi u firewall (zato sto ista situacija se javlja i kod mene ). To obavestenje je obavestenje firewall dela koji je blokirao pristup doticnoj stetocini do tvog kompjutera. Dakle, nema tu otklanjanja jer nije ni stigao na kompjuter. Inace, verovatno to blokira i Zone Alarm, ali ti ne prijavljuje kao Kasperski (verovatno je bilo podeseno da ne prijavljuje napade male i srednje opasnosti). Sve u svemu, nema opasnosti i sve je pod kontrolom.

Ono sto otkloni Spyboot je sigurno adware, i nema opasnosti oko njegove upotrebe. Jedan od najboljih programa te vrste, dosta ga ljudi koristi samog ili u saradnji sa drugima. A to sto se desava je sad pitanje kakav je kompjuter (procesor, graficka, HD, posebno kolicina RAMa...). Vista je odlican sistem, vrlo stabilan za ovo kratko vreme koliko je na trzistu, mada i dalje pomalo bagovita i idalje trazi gomilu i RAMa i mesta na HDu. Plus dosta toga preventivno ucitava (programa koje redovno koristis). Sve ovo mogu biti razlozi zasto se tako ponasa na pocetku. Iskreno, nisam bas previse koristio Vistu, nekako mi brze i lakse ide sa XPom. Ono sto stoji kao dobro pravilo je preskaniraj ceo komp sa Kasperskim, ako ima virusa nacice ih i ukloniti.

[DanteEx]

ma ok ja igram igru cabal online i kaspersky mi non stop blokira game guard(anti-hackerski program protiv varanja)koji je deo cabala ako se on ne startuje nishta onda...recite mi kako da ga stavim u allowed listu ja sam nesto pokusho al to ne vredi...jedino mi preostaje da iskljucim ceo antivirus pre starta igre pa kad se startuje tek onda da ukljucujem nazad KAV!:S

[DanteEx]

eheheheheh naso sam 2009 verziju BitDefender..nadam se da ce ovaj da me stiti ko 10 na XP

[vasiljevic]

Nisam video post pre, pa da odgovorim kako se podesava kod kasperskog da programi idu na net. U principu je ovako: otvoris settings, pod protection sa leve strane ima firewall, klik na njega i tada sa desne strane imas pod delom koji pokazuje nacin filtracije dugme settings(prvo na koej naidjes odozgo). Otvara se prozorce i na prvom tabu (rules for applications) ima sa desne strane dugme add i preko browse nadjes pomenuti game guard i das mu potrebna ovlascenja (mozes i sva ako mislis da je to potrebno). To bi bilo dovoljno da on radi kako treba.

[magna86]

Ovako..ovaj tvoj Log je..sacuvaj boze...
kako li to samo radi

ali moze da se resi..potrebna je i tvoja dobra volja
(ovo je ono brutalno ciscenje tvog kompa od raznoraznih glupost)
zato uradi sledece:
skini ovaj program

http://www.ursoftware.com/

uninstaliraj sve sto ti netreba!!!
Uninstaliraj sva ta smeca,od Anti Virusa ostavi samo Kaspersky...
znaci spasi taj komp bede

-------------------------------------------

dalje:
pokrenuces ove programe:

Wise Registry Cleaner 3 Free

Wise Disk Cleaner 3 Free
http://www.wisecleaner.com/download.html

...........................................

skini i pokreni ovaj program..uncekiraj sve sto netreba
ili nezelis da se dize sa sistemom
http://www.mlin.net/StartupCPL.shtml


ovi programi ce ti max pomoci
ajmo sad na viruse i ostale gluposti...
updateuj Kaspersky (ostale AV programe si vec unintalirao)
pa skeniraj iz safe moda
restart..drzis F8 i selektujes safe mode

takodje ces da update ujes i skeniras i sa ovim programom
iz safe moda
http://www.besttechie.net/tools/mbam-setup.exe


skini i ovaj za svaki slucaj,updateuj i skeniraj (ne iz safe moda)
http://www.safer-networking.org/en/mirrors/index.html

===========================================

Posle svog ovog terorisanja sistema uradi sledece:
Stavi HijackThis u zaseban folder na Desktop
Promeni naziv foldera i programa (opcija Rename) u Systav.exe

Pokreni HijackThis
* Izaberi opciju "Do a system scan and save the logfile"
* Na kreju skeniranja program ce izbaciti tekstualni log.
* taj log kopiraj ovde ( opcije copy / paste)


Srecno