Zaštita i održavanje računara

[RAJIC]

dakle AVG vise ne javlja nista a ono sa combofix-om sam uradio ali nisam iskljucio AVG da li sam sa zeznuo?

[Basa Mrkalj]

Nisi nista zeznuo, ajde da deinstaliras Combofix
klikni start\ run\ ukucaj Combofix /u pa ok
Sacekaj da se deinstalacija zavrsi. To je to.

[RAJIC]

Basa Mrkalj kaže:

Nisi nista zeznuo, ajde da deinstaliras Combofix
klikni start\ run\ ukucaj Combofix /u pa ok
Sacekaj da se deinstalacija zavrsi. To je to.

pokaxuje da Combofix /u ne moze da pronadje kako da ga deinstaliram?

[RAJIC]

da li combofix moze jednostavno da se izbrise i da to bude ok?

[Basa Mrkalj]

Obriši folder C:\QooBox pa posle ponovo ukucaj combofix /u to ce da ti resetuje system restore.

[RAJIC]

obrisao kao sto si rekao i opet nece

[NIx Car]

Basa Mrkalj kaže:

Nisi nista zeznuo, ajde da deinstaliras Combofix
klikni start\ run\ ukucaj Combofix /u pa ok
Sacekaj da se deinstalacija zavrsi. To je to.

RAJIC kaže:

da li combofix moze jednostavno da se izbrise i da to bude ok?

Basa Mrkalj kaže:

Obriši folder C:\QooBox pa posle ponovo ukucaj combofix /u to ce da ti resetuje system restore.

pa kako covek moze da nadje combofix /u kada mu je obrisan qoobox

[RAJIC]

i sta sad ? da li smeta ako se ne deinstalira i da li se moze samo obrisati?

[Basa Mrkalj]

Ne smeta nista, mozes i sam rucno da iskljucis system restore, pa da ga ponovo ukljucis, to je poenta.

[RAJIC]

Basa Mrkalj kaže:

Ne smeta nista, mozes i sam rucno da iskljucis system restore, pa da ga ponovo ukljucis, to je poenta.

uradio a system restore ne radi , prozor je beo

[Basa Mrkalj]

Ja sam sad pogledao ovaj tvoj zadnji log, da li si ti ispratio moje uputstvo do kraja, posto vidim da je log maltene identican kao i prethodni, kao da nista nismo radili.
Drugo, prvo si imao dva antivirusa oba instalirana na D particiju, Avast i Avg
Sad si deinstalirao Avast, a instalirao si kaspersky 7 antivirus i Avg takodje na D particiju oba.
D:\AVG\avgwdsvc.exe
D:\kasperski\avp.exe

Daj molim te deinstaliraj oba antivirusa i instaliraj jedan na C particiju i pusti da odradi skan.

[RAJIC]

kaspersky nemam to je samo ostatak aavg cu instalirati u c

[Basa Mrkalj]

Nisi ga dobro deinstalirao i ostao je aktivan. trebalo bi da se nalazi na C:\Program Files\AOL\Active Virus Shield\ odnodno D kod tebe.
Nesto ti nisi odradio kako treba sa scriptom koju sam ti napisao, jer nije moguce da se ponove fajlovi u logu posle tretmana sa CF, ako je uradjeno kako treba.

Kazi mi da li sad imas problem koji si imao pre posto je CF nesto automatski obrisao prilikom skeniranja.

[RAJIC]

Basa Mrkalj kaže:

Nisi ga dobro deinstalirao i ostao je aktivan. trebalo bi da se nalazi na C:\Program Files\AOL\Active Virus Shield\ odnodno D kod tebe.
Nesto ti nisi odradio kako treba sa scriptom koju sam ti napisao, jer nije moguce da se ponove fajlovi u logu posle tretmana sa CF, ako je uradjeno kako treba.

Kazi mi da li sad imas problem koji si imao pre posto je CF nesto automatski obrisao prilikom skeniranja.

da li sam trebao da taj tekst koji si napisao da iskopiram na forumu gde si napisao? onaj problem sad nevidim ali mi ne radi sistem restore

[Basa Mrkalj]

Ajde molim te odradi jos jednom Combofix, znaci instaliraj ga pokreni i ne diraj prozor programa dok skenira, prati uputstva. Posle toga odradi Hijack This i oba loga postavi ovde na forum. Ako mozes postavi ih kao Atach fajl, lakse mi je da gledam. A ja cu da ti napisem scriptu i poslacu je takodje kao Atach file, posle ces samo da je prevuces na ikonicu Combo fixa.

[RAJIC]

ovo je novo

[RAJIC]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:54:32, on 13.11.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20627)
Boot mode: Normal

Spoiler za log:

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\TBPanel.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
D:\COPERNIC\Copernic Desktop Search - Home\DesktopSearchService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\MSI\DualCoreCenter\DualCoreCenter.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {BBD07672-076D-472D-BA82-EE6488CEC130} - C:\WINDOWS\system32\avwa.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: Copernic Desktop Search - Home - {968631B6-4729-440D-9BF4-251F5593EC9A} - D:\COPERNIC\Copernic Desktop Search - Home\DesktopSearchBand300000074.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dl

[RAJIC]

Spoiler za log:

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Gainward] C:\WINDOWS\TBPanel.exe /A
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [Copernic Desktop Search - Home] "D:\COPERNIC\Copernic Desktop Search - Home\DesktopSearchService.exe" /tray
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BandwidthMonitor] D:\monitor\BandwidthMonitor\BWMonitor.exe
O4 - HKCU\..\Run: [WinFast NetMeeting Launcher] C:\Program Files\WinFast\WFTVFM\WFLauncher.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Yahoo! Widgets.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
O4 - Global Startup: DualCoreCenter.lnk = C:\Program Files\MSI\DualCoreCenter\StartUpDualCoreCenter.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: Statistika mrežnog Anti-Virusa - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{5A276CB3-E4AC-480B-AAF3-F5EB58C94C45}: NameServer = 79.101.33.6 79.101.33.7
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - D:\ARES\chatServer.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Kasperski Anti-Virus 7.0 (AVP) - Unknown owner - D:\kasperski\avp.exe (file missing)
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762# # (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: UPSmart - Unknown owner - C:\Program Files\Commander Pro\UPServ.exe (file missing)

--
End of file - 9950 bytes

[Basa Mrkalj]

Rajicu, sad je sve ok. combofix je ocistio automatski ovaj fajl "c:\windows\system32\avwa.dll " tako da ja mislim da sad ne bi trebao da imas vise problema. Mozes samo da deinstaliras Combofix, ajde probaj sa Start \ run \ cobofix /u

[RAJIC]

Basa Mrkalj kaže:

Rajicu, sad je sve ok. combofix je ocistio automatski ovaj fajl "c:\windows\system32\avwa.dll " tako da ja mislim da sad ne bi trebao da imas vise problema. Mozes samo da deinstaliras Combofix, ajde probaj sa Start \ run \ cobofix /u

pa rekao sam da se ono vise ne pojavljuje ali sad mi ne radi sistem restore. da li to ima veze sa tim? a combofix ne mogu da deinstaliram tako