[1carly1]

Bok! Nedavno sam bio expieriencing problema sa pop-up prozore oni neće otići oni pop-up svake minute i da imam Norton 360 i trčanje oglas svjestan, ali se ništa nije promijenilo. Također sam primijetio problem sa iexplore trčanje napredak našto ja zatvorite Internet taj proces još uvijek radi. vrlo neugodno, može netko zna kako to riješiti?

[hAvAAck]

mali oteti ovo naći na http://www.trendsecure.com/portal/en...HJTInstall.exe
post log, i čekajte da netko poput evilfantasy Vam pomoći:)

[1carly1]

krivovjerje moj log

Logfile of Trend Micro HijackThis v2.0.2
Skenirajte spremljena u 07:50:55, on 15/02/2008
Platforma: Windows Vista (Winnt 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal

Pokretanje procesa:
C: \ Windows \ system32 \ Dwm.exe
C: \ Windows \ Explorer.exe
C: \ Windows \ system32 \ taskeng.exe
C: \ Program Files \ Windows Defender \ MSASCui.exe
C: \ Windows \ RtHDVCpl.exe
C: \ Acer \ Osnaživanje Tehnologija \ eDataSecurity \ eDSLoader.exe
C: \ Program Files \ Acer \ Acer Arcade \ PCMService.exe
C: \ Windows \ System32 \ hkcmd.exe
C: \ Windows \ System32 \ igfxpers.exe
C: \ Program Files \ Launch Manager \ LManager.exe
C: \ Program Files \ Apoint2K \ Apoint.exe
C: \ Program Files \ Common Files \ Symantec Shared \ ccApp.exe
C: \ Program Files \ Java \ jre1.6.0_02 \ bin \ jusched.exe
C: \ Program Files \ iTunes \ iTunesHelper.exe
C: \ Program Files \ Lexmark 3500-4500 Serije \ lxdimon.exe
C: \ Program Files \ Lexmark 3500-4500 Serije \ lxdiamon.exe
C: \ Program Files \ Windows Sidebar \ sidebar.exe
C: \ Program Files \ MSN Messenger \ msnmsgr.exe
C: \ Program Files \ IVT Corporation \ BlueSoleil \ BlueSoleil.exe
C: \ Program Files \ Google \ Google Updater \ GoogleUpdater.exe
C: \ Acer \ Empowering Technology \ enet \ ENMTRAY.EXE
C: \ Acer \ Empowering Technology \ EPOWER \ EPOWER_DMC.EXE
C: \ Acer \ Osnaživanje Tehnologija \ ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EX E
C: \ Acer \ Osnaživanje Tehnologija \ eRecovery \ ERAGENT.EXE
C: \ Windows \ system32 \ igfxsrvc.exe
C: \ Program Files \ Internet Explorer \ iexplore.exe
C: \ Program Files \ Internet Explorer \ iexplore.exe
C: \ Program Files \ Windows Sidebar \ sidebar.exe
C: \ Users \ Carly \ AppData \ Local \ Temp \ RtkBtMnt.exe
C: \ Program Files \ Apoint2K \ ApMsgFwd.exe
C: \ Program Files \ Apoint2K \ Apntex.exe
C: \ Windows \ system32 \ SearchFilterHost.exe
C: \ Program Files \ Trend Micro \ HijackThis \ HijackThis.exe

R1 - HKCU \ Software \ Microsoft \ Internet Explorer \ Main, Search Bar = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
R1 - HKCU \ Software \ Microsoft \ Internet Explorer \ Main, Search Page = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
R0 - HKCU \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://www.google.co.uk/
R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Page_URL = http://en.uk.acer.yahoo.com
R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://en.uk.acer.yahoo.com
R0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Search, SearchAssistant =
R0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Search, CustomizeSearch =
R1 - HKCU \ Software \ Microsoft \ Internet Explorer \ SearchURL, (Default) = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
R0 - HKCU \ Software \ Microsoft \ Internet Explorer \ Toolbar, LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - (EF99BD32-C1FB-11D2-892F-0090271D4F88) - C: \ Program Files \ Yahoo! \ Companion \ Instalira \ cpn \ yt.dll
O1 - Hosts::: 1 localhost
O2 - BHO: Yahoo! Toolbar Helper - (02478D38-C3F9-4EFB-9B51-7695ECA05670) - C: \ Program Files \ Yahoo! \ Companion \ Instalira \ cpn \ yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - (06849E9F-C8D7-4D59-B87D-784B7D6BE0B3) - C: \ Program Files \ Common Files \ Adobe \ Acrobat \ ActiveX \ AcroIEHelper.dll
O2 - BHO: (no name) - (1E8A6170-7264-4D0F-BEAE-D42A53123C75) - C: \ Program Files \ Common Files \ Symantec Shared \ coShared \ Browser \ 1,5 \ NppBho.dll
O2 - BHO: SSVHelper Class - (761497BB-D6F0-462C-B6EB-D4DAF1D92D43) - C: \ Program Files \ Java \ jre1.6.0_02 \ bin \ ssv.dll
O2 - BHO: (no name) - (7E853D72-626A-48EC-A868-BA8D5E23E045) - (no file)
O2 - BHO: ShowBarObj Class - (83A2F9B1-01A2-4AA5-87D1-45B6B8505E96) - C: \ Windows \ system32 \ ActiveToolBand.dll
O2 - BHO: Windows Live Sign-in Helper - (9030D464-4C02-4ABF-8ECC-5164760863C6) - C: \ Program Files \ Common Files \ Microsoft Shared \ Windows Live \ WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - (AA58ED58-01DD-4d91-8333-CF10577473F7) - c: \ program files \ google \ googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - (AF69DE43-7D58-4638-B6FA-CE66B5AD205D) - C: \ Program Files \ Google \ GoogleToolbarNotifier \ 2.1.1119.1736 \ s wg.dll
O2 - BHO: Windows Live Toolbar Helper - (BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0) - C: \ Program Files \ Windows Live Toolbar \ msntb.dll
O3 - Toolbar: Acer eDataSecurity Management - (5CBE3B7C-1E47-477e-A7DD-396DB0476E29) - C: \ Windows \ system32 \ eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar - (EF99BD32-C1FB-11D2-892F-0090271D4F88) - C: \ Program Files \ Yahoo! \ Companion \ Instalira \ cpn \ yt.dll
O3 - Toolbar: Norton Show Toolbar - (90222687-F593-4738-B738-FBEE9C7B26DF) - C: \ Program Files \ Common Files \ Symantec Shared \ coShared \ Browser \ 1,5 \ UIBHO.dll
O3 - Toolbar: Windows Live Toolbar - (BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0) - C: \ Program Files \ Windows Live Toolbar \ msntb.dll
O3 - Toolbar: & Google - (2318C2B1-4965-11d4-9B18-009027A5CD4F) - c: \ program files \ google \ googletoolbar1.dll
O4 - HKLM \ .. \ Run: [Windows Defender]% ProgramFiles% \ Windows Defender \ MSASCui.exe-hide
O4 - HKLM \ .. \ Run: [ALaunch] C: \ Acer \ ALaunch \ AlaunchClient.exe
O4 - HKLM \ .. \ Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM \ .. \ Run: [eDataSecurity Loader] C: \ Acer \ Osnaživanje Tehnologija \ eDataSecurity \ eDSloader.exe
O4 - HKLM \ .. \ Run: [PCMService] "C: \ Program Files \ Acer \ Acer Arcade \ PCMService.exe"
O4 - HKLM \ .. \ Run: [Adobe Reader Speed Launcher] "C: \ Program Files \ Adobe \ Reader 8,0 \ Reader \ Reader_sl.exe"
O4 - HKLM \ .. \ Run: [IgfxTray] C: \ Windows \ system32 \ igfxtray.exe
O4 - HKLM \ .. \ Run: [HotKeysCmds] C: \ Windows \ system32 \ hkcmd.exe
O4 - HKLM \ .. \ Run: [upornost] C: \ Windows \ system32 \ igfxpers.exe
O4 - HKLM \ .. \ Run: [LManager] C: \ programa ~ 1 \ Pokrećite ~ 1 \ LManager.exe
O4 - HKLM \ .. \ Run: [Apoint] C: \ Program Files \ Apoint2K \ Apoint.exe
O4 - HKLM \ .. \ Run: [Acer Tour Podsjetnik] C: \ Acer \ AcerTour \ Reminder.exe
O4 - HKLM \ .. \ Run: [WarReg_PopUp] C: \ Acer \ WR_PopUp \ WarReg_PopUp.exe
O4 - HKLM \ .. \ Run: [SetPanel] C: \ Acer \ APanel \ APanel.cmd
O4 - HKLM \ .. \ Run: [ccApp] "C: \ Program Files \ Common Files \ Symantec Shared \ ccApp.exe"
O4 - HKLM \ .. \ Run: [SunJavaUpdateSched] "C: \ Program Files \ Java \ jre1.6.0_02 \ bin \ jusched.exe"
O4 - HKLM \ .. \ Run: [QuickTime Task] "C: \ Program Files \ QuickTime \ QTTask.exe"-atboottime
O4 - HKLM \ .. \ Run: [iTunesHelper] "C: \ Program Files \ iTunes \ iTunesHelper.exe"
O4 - HKLM \ .. \ Run: [lxdimon.exe] "C: \ Program Files \ Lexmark 3.500-4.500 serije \ lxdimon.exe"
O4 - HKLM \ .. \ Run: [lxdiamon] "C: \ Program Files \ Lexmark 3.500-4.500 serije \ lxdiamon.exe"
O4 - HKCU \ .. \ Run: [Sidebar] C: \ Program Files \ Windows Sidebar \ sidebar.exe / Autorun
O4 - HKCU \ .. \ Run: [MsnMsgr] "C: \ Program Files \ MSN Messenger \ MsnMsgr.Exe" / background
O4 - HKLM \ .. \ Run: [oozestore] "C: \ programskipodaci \ Winbonebone.z4bj6"
O4 - HKLM \ .. \ Run: [Torbe Else Hole Lite] "C: \ programskipodaci \ Graditi Pet Store.e0cte"
O4 - HKCU \ .. \ Run: [swg] C: \ Program Files \ Google \ GoogleToolbarNotifier \ GoogleToolbarNo tifier.exe
O4 - HKUS \ S-1-5-19 \ .. \ Run: [Sidebar]% ProgramFiles% \ Windows Sidebar \ Sidebar.exe / detectMem (User 'LOCAL SERVICE')
O4 - HKUS \ S-1-5-19 \ .. \ Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll, ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS \ S-1-5-20 \ .. \ Run: [Sidebar]% ProgramFiles% \ Windows Sidebar \ Sidebar.exe / detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: BlueSoleil.lnk =?
O4 - Global Startup: Osnaživanje Tehnologija Launcher.lnk =?
O4 - Global Startup: Google Updater.lnk = C: \ Program Files \ Google \ Google Updater \ GoogleUpdater.exe
O8 - Extra kontekst meni stavka: & Windows Live Search - res: / / C: \ Program Files \ Windows Live Toolbar \ msntb.dll / search.htm
O8 - Extra kontekst meni stavka: E & zvezi u Microsoft Excel - res: / / C: \ programa ~ 1 \ MICROS ~ 2 \ Office12 \ EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - (2670000A-7350-4f3c-8081-5663EE0C6C49) - C: \ programa ~ 1 \ MICROS ~ 2 \ Office12 \ ONBttnIE.dll
O9 - Extra 'Tools' MENUITEM: S & kraj OneNote - (2670000A-7350-4f3c-8081-5663EE0C6C49) - C: \ programa ~ 1 \ MICROS ~ 2 \ Office12 \ ONBttnIE.dll
O9 - Extra button: Research - (92780B25-18CC-41C8-B9BE-3C9C571A8263) - C: \ programa ~ 1 \ MICROS ~ 2 \ Office12 \ REFIEBAR.DLL
O16 - DPF: (4F1E5B1A-2A80-42CA-8532-2D05CB959537) (MSN Photo Upload Tool) -- http://gfx1.hotmail.com/mail/w2/reso...PUplden-gb.cab
O20 - AppInit_DLLs: eNetHook.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C: \ Program Files \ Lavasoft \ Ad-Aware 2007 \ aawservice.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C: \ Windows \ system32 \ agrsmsvc.exe
O23 - Service: ALaunch Service (ALaunchService) - Unknown vlasnika - C: \ Acer \ ALaunch \ ALaunchSvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc - C: \ Program Files \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe
O23 - Service: BlueSoleil sakrih Service - Unknown vlasnika - C: \ Program Files \ IVT Corporation \ BlueSoleil \ BTNtService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C: \ Program Files \ Common Files \ Symantec Shared \ ccSvcHst.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C: \ Program Files \ Common Files \ Symantec Shared \ ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C: \ Program Files \ Common Files \ Symantec Shared \ ccSvcHst.exe
O23 - Service: CyberLink Background bilježenja Service (CBCS) (CLCapSvc) - Unknown vlasnika - C: \ Program Files \ Acer \ Acer Arcade \ Kernel \ TV \ CLCapSvc.exe
O23 - Service: CyberLink Task Planer (CTS) (CLSched) - Unknown vlasnika - C: \ Program Files \ Acer \ Acer Arcade \ Kernel \ TV \ CLSched.exe
O23 - Service: Symantec Lic NetConnect usluga (CLTNetCnService) - Symantec Corporation - C: \ Program Files \ Common Files \ Symantec Shared \ ccSvcHst.exe
O23 - Service: Host COM (comHost) - Symantec Corporation - C: \ Program Files \ Common Files \ Symantec Shared \ VAScanner \ comHost.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C: \ Program Files \ Acer \ Acer Arcade \ Kernel \ CLML_NTService \ CLMLServer.exe
O23 - Service: eDataSecurity Service - HiTRSUT - C: \ Acer \ Osnaživanje Tehnologija \ eDataSecurity \ eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc - C: \ Acer \ Osnaživanje Tehnologija \ eLock \ Service \ eLockServ.exe
O23 - Service: eNet Service - Acer Inc - C: \ Acer \ Osnaživanje Tehnologija \ eNet \ eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc - C: \ Acer \ Osnaživanje Tehnologija \ eRecovery \ eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown vlasnika - C: \ Acer \ Osnaživanje Tehnologija \ eSettings \ Service \ capuserv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C: \ Program Files \ Google \ Common \ Google Updater \ GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc - C: \ Program Files \ iPod \ bin \ iPodService.exe
O23 - Service: LightScribeService Direct Disc Označavanje Service (LightScribeService) - Hewlett-Packard Company - C: \ Program Files \ Common Files \ LightScribe \ LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C: \ programa ~ 1 \ Symantec \ LIVEUP ~ 1 \ LUCOMS ~ 1.EXE
O23 - Service: lxdiCATSCustConnectService - Lexmark International, Inc - C: \ Windows \ system32 \ spool \ drivers \ W32X86 \ 3 \ lxdise rv.exe
O23 - Service: lxdi_device - - C: \ Windows \ system32 \ lxdicoms.exe
O23 - Service: MobilityService - Unknown vlasnika - C: \ Acer \ Mobility Centar \ MobilityService.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C: \ Program Files \ Common Files \ Symantec Shared \ CCPD-LC \ symlcsvc.exe
O23 - Service: ePower Service (WMIService) - trpak - C: \ Acer \ Osnaživanje Tehnologija \ ePower \ ePowerSvc.exe
O23 - Service: XAudioService - Conexant Systems - C: \ Windows \ System32 \ Drivers \ xaudio.exe

--
End of file - 11.546 bajtova

[evilfantasy]

Download NoLop na Vašu radnu površinu s jednog od linkova ispod ...

• Link 1
• Link 2

• Zatvori imate bilo kakve programe prikazuju jer je potrebno ponovno pokrenuti
• Dvaput kliknite na NoLop.exe da ga
• Zatim kliknite na gumb s oznakom: Pretraživanje i uništiti
  • Vaše računalo sada će biti skenirani za zaražene datoteke
• Kada se skeniranje završi, ako je zaraženo, od vas će se tražiti da ponovno pokrenete
• Kliknite OK
• Sada kliknite na: Reboot
• Poruka trebali popup iz NoLop. Ako ne, Dvoklik program opet i ona će završiti.
• Post sadržaj C: \ NoLop.log u sljedećem odgovoru.

Napomena: Ako primate pogrešku ", mscomctl.ocx ili jedan od njegovih zavisnosti nisu ispravno registrirani, molimo preuzmite mscomctl.ocx na svoj system32 mapu onda ponovi program.


----------

Preuzimanje Vundofix.exe na radnu površinu.

• Dvokliknite VundoFix.exe da ga vode.
• Put ček pored Pokreni VundoFix kao zadatak.
• Primit ćete poruku rekavši vundofix će se zatvoriti i ponovno otvoriti u minutu ili manje. Kliknite U redu
• Kada VundoFix ponovo otvori, kliknite na Scan for Vundo gumb.
• Nakon što je učinio za skeniranje, kliknite na Remove Vundo gumb.
• Primit ćete brz molba ako želite ukloniti datoteke, kliknite DA
• Nakon što kliknete na Yes, vaš desktop će ići prazan jer počinje uklanjanjem Vundo.
• Kad je završio, on će zatražiti da će to shutdown računalo, kliknite na U redu.
• Okrenite se na vaše računalo.
• Molimo post sadržaj C: \vundofix.txt

Napomena: Moguće je da je naišao VundoFix datoteku ga nije mogao ukloniti. U ovom slučaju, VundoFix će se izvoditi na ponovno podizanje sustava, jednostavno slijedite gornje upute počevši od "Kliknite gumb Scan for Vundo" kada se pojavljuje na VundoFix ponovno podizanje sustava.

Javite Vundo završiti, ponekad može potrajati i više prolaza

----------

Molimo, preuzmite Combofix by sUBs jedan od linkova ispod.
(Isprobajte sve tri ako je potrebno)

• Link # 1
• Link # 2
• Link # 3

Važno! Combofix.exe MORA biti spremljene i otrča iz Desktop.

• Zatvori otvoriti bilo koju web preglednicima. (Firefox, Internet Explorer, etc) prije početka Combofix.
• Važno! Privremeno onemogućiti tvoj AntiVirus, Skripta za blokiranje i bilo koji protušpijunskih Zaštita u stvarnom vremenu prije obavlja scan.
  • Kliknite ovaj link da biste vidjeli popis sigurnosne programe, koji bi trebao biti onemogućen i kako onemogućiti ih.
  • Ako tvoj nije na popisu, a vi ne znate kako ga isključiti, molimo pitati.
• Upozorenje: Combofix disconnects vašem računalu s Interneta. Se veza automatski obnovljena prije Combofix izvrši njegove vožnji.
• Dvaput kliknite combofix.exe i slijedite upute.
  • Iz tipkovnice odaberite 1 i pritisnite Enter
• Kada završite, on će proizvesti prijava za vas.
• Pošta da se prijavite u vaš sljedeći odgovor.

Upozorenje: Ne mouseclick combofix's prozor dok je pokrenut. To svibanj uzrokovati da se štala

• Ako Combofix prometuje na poteškoće i prestaje preuranjeno, veza može biti ručno restored by ponovo pokrenuti računalo.
• Važno: Ne zaboravite ponovo uključili vaš protuvirusni i protušpijunski prije reconnecting na Internet.

----------

Next post molimo dodaj
NoLop log
Vundofix log
Combofix log