Nekaj se čudnoga izleglo u kanti....

[Dechec]

Zadnjih par dana mi se događaju jako čudne stvari kad dojdem na net... kad se spojim, malo surfam, sve se nekako uspori, i na radnoj mi se površini pojave dvije ikone:
1: Online pharmacy
2:Fast loans

a home page se pretvori u blank.,, naravno pojavi se i nova dial up konekcija, bez broja (samo stoji 1- jedinica) i ostalih podataka.
Probao sam sa ad ware 6.0, uvijek nešto najde, ja to obrišem, i konekciju, i sve na kaj naidem, ali vrag se opet pojavi,,, za popizditi. Ima li netko možda ideju koji je to vrag....
I naravno kako se toga riješiti. A bogme je naporno...

[Costa]

Uklanjanje spywarea:

1. Ad-aware - Trazi, uklanja i stiti od spywarea

1. SpyBot S&D - Trazi, uklanja i stiti od spywarea

2. CWShredder - Uklanja "ukleti" Cool Web Search

3. SpywareBlaster - Stiti od zlih activex skripti

4. BHO - Stiti od BHO (Browser Helper Objects ili programa koji se iz nekog razloga pokrecu s vasim browserom)

5. SpywareGuard - Zastita od spywarea u realnom vremenu (kao antivirusni prog.)

6. HijackThis - Prikazuje sumnjive informacije te ih sredjuje ovisno o tome sto korisnik odabire - Ak' se ne kuzite u software, najbolje je postati log na PCEkspert ili na neko drugo mjesto gdje ce vam drugi reci sto odabrati

Ovo zadnje bi bilo najbolje.

[Dechec]

Probat ču sve redom. Neznam kako ali se taj vrag s "abaut blank" stranicom na webu , smjesti i u moj home page. Ad-warw svaki put pronađe nekoliko raznih sr.., očistim to, ali se kod sljedečeg spajanja na net stvar opet pojavi. Sad sam stavio i spywareblaster, on je našao toga tonu (dvije), označio sam sve i stavio protect. neznam dalje kao če biti. Skinuo sam i onaj zadnji na ponudi, pa budem i njega instalirao (Hijackthis), pa se onda čujemo.
Za sada hvala...
bokac svima, ma gdje bili

[Dechec]

Ništa i ništa, jednostavno se vražja stvar pojavi odnekud svaki put. Ni ona dva programa aza skidanje spama ništa ne pomažu. Skinuo sam zadnji dodatak s neta, ima toga dosta, ali. Nakon spajanja na net, pojavi se u mopjim konekcijama, još jedna veza:
Dial up conection, i izgleda da tom samo bira nekog vraga.
Zanimljivo je to što se oni prozorčići koji pokazuju vezu, izgube pa ispada da nisam spojen a ustvari ja sam i dalje na netu, vrijeme ide.
Scenirao sam i sa onim "HijackThis"-om, imam log ali kome da ga pošaljem ?

Help, spašavajte, več sam potpuno lud..
bokac

[Costa]

Originally posted by vsantek5
...
Scenirao sam i sa onim "HijackThis"-om, imam log ali kome da ga pošaljem ?

Help, spašavajte, več sam potpuno lud..
bokac

Mozes ovdje.

[LightForce1308]

Kako skinit Spyware guard. probo sam sa flashGetom, i običnim IE-ovim al stalno mi skida down.html

BTW, jel ima neka fora da se namjesti da automatski ispravlja malo u veliko slovo nakon točke. To gadno izgleda, a neda mi se stalno ispravljat.

[KeLLe]

Stavi si firewall.

Zone Alarm

[Dechec]

E, dragi moji evo famozni log od "HijackThis"-a, pa ako netko kuži i zna kaj mi to živi u kanti bez mog znanja, i jo bolje kako to istrijebiti neka slobodno, uz veliku zahvalu, javi...

Logfile of HijackThis v1.97.7
Scan saved at 22:24:50, on 9.3.2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
D:\PROGRA~1\NORTON~1\NORTON~2\GHOSTS~2.EXE
D:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
D:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
D:\WINDOWS\System32\nvsvc32.exe
D:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\SOUNDMAN.EXE
D:\Program Files\Gigabyte\Gigabyte Windows Utility Manager\ET4\et4Tray.exe
D:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
D:\Program Files\Common Files\Symantec Shared\ccApp.exe
D:\WINDOWS\Twain_32\FlatBed\HotKey.exe
D:\WINDOWS\System32\ctfmon.exe
D:\WINDOWS\System32\RUNDLL32.EXE
D:\Program Files\Brojac impulsa\Brojac3.exe
D:\DOCUME~1\ChoroDj\LOCALS~1\Temp\svshost.exe
E:\Za spržiti - programs -- itd\Anti - spam alati\Hijackhits\HijackThis.exe
D:\Program Files\Messenger\msmsgs.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.2020search.com/search/9884/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.htnet.hr/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.2020search.com/search/9884/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.2020search.com/search/9884/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.2020search.com/search/9884/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - D:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FFFFFEF0-5B30-21D4-945D-000000000000} - D:\PROGRA~1\STARDO~1\SDIEInt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - D:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [EasyTuneIV] D:\Program Files\Gigabyte\Gigabyte Windows Utility Manager\ET4\et4Tray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CloneCDElbyCDFL] "D:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [NeroCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [EPSON Stylus C42 Series] D:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C42 Series" /O6 "USB001" /M "Stylus C42"
O4 - HKLM\..\Run: [ccApp] "D:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "D:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [HotKey] D:\WINDOWS\Twain_32\FlatBed\HotKey.exe
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [Brojac Impulsa] D:\Program Files\Brojac impulsa\Brojac3.exe
O4 - HKCU\..\Run: [EPSON Stylus C42 Series] D:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /A "D:\WINDOWS\System32\E_SA2.tmp"
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: Download with Star Downloader - D:\Program Files\Star Downloader\sdie.htm
O8 - Extra context menu item: I&zvoz u Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O15 - Trusted Zone: *.i-lookup.com
O15 - Trusted Zone: *.offshoreclicks.com
O15 - Trusted Zone: *.teensguru.com
O15 - Trusted Zone: *.xxxtoolbar.com
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...7990.725162037
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab


To bi bilo to.. hmmm
bokac svima, ma gdje bili

[nino]

Dećec vi imate previše problema sa vašom kantom. Nisam baš neki stručnjak ali ja bih vašu kantu zveknuo u zid ili bih ištekao vaš kompjuter iz struje i poslao ga na godišnji. Vaš odani prijatelj Nino.

[Dechec]

Dobar savjet Nino: i sam več dobrano razmišljam o tome da izveden neku nepodopštinu sa kantom, jer su mi razno-razne čudne pojave popile sve živce, tako da sve mislim kako će ovaj XP završiti karijeru s formatom.
Pozdrav tebi
i naravno: bokac svima, ma gdje bili

[Costa]

Originally posted by vsantek5
E, dragi moji evo famozni log od "HijackThis"-a, pa ako netko kuži i zna kaj mi to živi u kanti bez mog znanja, i jo bolje kako to istrijebiti neka slobodno, uz veliku zahvalu, javi...

U jebote. Sta si ti radio, tj. gdje si ti sve bio

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = about :blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.2020search.com/search/9884/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about :blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.htnet.hr/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about :blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.2020search.com/search/9884/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = about :blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.2020search.com/search/9884/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about :blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about :blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.2020search.com/search/9884/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about :blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about :blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about :blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about :blank
O2 - BHO: (no name) - {FFFFFEF0-5B30-21D4-945D-000000000000} - D:\PROGRA~1\STARDO~1\SDIEInt.dll
O15 - Trusted Zone: *.i-lookup.com
O15 - Trusted Zone: *.offshoreclicks.com
O15 - Trusted Zone: *.teensguru.com
O15 - Trusted Zone: *.xxxtoolbar.com
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.c...37990.725162037

Restartaj komp pa opet postaj log.

Vidim da je pokrenut "D:\DOCUME~1\ChoroDj\LOCALS~1\Temp\svshost.exe", a ne mogu naci pomocu cega. Vjerovatno koristi neku skriptu ili se smjestio negdje gdje HijackThis ne smatra da je opasno. Uglavnom, izbrisi "D:\DOCUME~1\ChoroDj\LOCALS~1\Temp\svshost.exe". Ako ce ti se javljati greska da file ne postoji pri loadanju Windowsa onda jednostavno pokrenes regedit (START>RUN i upises regedit", pozicioniras se u sam root (na pocetak) i pretrazis za svshost i pazi kaj brises jer sigurno se smjestio u liniju nekog korsnog programa.

[tor]

O15 - Trusted Zone: *.xxxtoolbar.com

[LightForce1308]

ajd ljudi jel bi mogo i meni neko pomoč. ja sam nešt briso sam, imam i spywareblaster i adaware i s hijackom sam nešt briso, al ona prva 3 se stalno vračaju.

Logfile of HijackThis v1.97.7
Scan saved at 21:20:06, on 11.3.2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\pctspk.exe
C:\Program Files\Kerio\Personal Firewall\persfw.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\EPOX\USDM\USDM.EXE
C:\documents and settings\biohazard\local settings\temp\~vis0001\fsg_4104.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
C:\Program Files\iMesh\Client\iMeshClient.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Winamp\winamp.exe
C:\Documents and Settings\Biohazard\Desktop\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchcentral.cc/search.php?v=4&aff=4701
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchcentral.cc/index.php?v=4&aff=4701
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://searchcentral.cc/index.php?v=4&aff=4701
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [CountrySelection] pctptt.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [EPoXUSDM] "C:\Program Files\EPOX\USDM\USDM.EXE" "5000"
O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner\RivaTuner.exe" /S
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Trickler] "c:\documents and settings\biohazard\local settings\temp\~vis0001\fsg_4104.exe"
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup
O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\RunOnce: [tlc] C:\WINDOWS\update12.js
O4 - Startup: iMesh.lnk = C:\Program Files\iMesh\Client\iMeshClient.exe
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Save Flash with Flash Catcher - res://C:\Program Files\Common Files\justDo\IECatcher.DLL/FlashCatcher.htm
O9 - Extra button: Flash Catcher (HKLM)
O9 - Extra 'Tools' menuitem: Flash Catcher (HKLM)
O9 - Extra button: FlashGet (HKLM)
O9 - Extra 'Tools' menuitem: &FlashGet (HKLM)
O10 - Hijacked Internet access by New.Net
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{52791412-1BA0-4F11-A1D6-4A65B85F1676}: NameServer = 161.53.114.135 161.53.114.145



BTW onaj fsg_414 je od DIVX-a, njega sam blokiro firewallom, tak da on nesmeta, a bez njega mi divx neradi.

Fala

[Dechec]