[ davor.v @ 27.01.2011. 22:25 ] @
Nisam u mogucnosti da udjem u svoj google nalog , facebook i youtube i na jos poneki sajt.
Na ostale normalno ulazim bez ikakvih problema.

Prilikom pokusaja da udjem pojavljuje mi se ovakva poruka :

http://www.flickr.com/photos/57706326@N05/5394177490/

a da bih se vratio i pokusao da udjem na drugu neku adresu moram dvaputa da kliknem na Leave page

http://www.flickr.com/photos/5...N05/5393579791/in/photostream/

Uradio sam i mbam log pa ako neko moze da pomogne bio bih veoma zahvalan.

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5622

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

1/27/2011 7:59:20 PM
mbam-log-2011-01-27 (19-59-12).txt

Scan type: Quick scan
Objects scanned: 135559
Time elapsed: 14 minute(s), 39 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowHelp (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMHelp (PUM.Hijack.Help) -> Bad: (1) Good: (0) -> No action taken.

Folders Infected:
(No malicious items detected)

Files Infected:
c:\windows\autokms.exe (RiskWare.Tool.CK) -> No action taken.
[ superbaka @ 27.01.2011. 22:43 ] @
autokms.exe je i legitiman proces, ali i trojanac, tako da je najbolje da ga upload-ujes na virustotal.com i vidis sta ce da ti kaze test... ove hijackere mozes da skines, mada kada su ovakve stvari u pitanju, ne bi bilo lose da to proveris i ispeglas sa HijackThis programom...

elem, ja sam malopre skenirao C: sa Malwarebytes' Anti-Malware i malo sam se smejao jer mi je kao Worm/Autoit prijavio .txt fajl od jednog bajta u kome je upisano samo "1", kao i neki rootkit fajl od 8,5 bajta :)
[ davor.v @ 27.01.2011. 22:53 ] @

Nisam bas vjest sa tim izrazima i procesima koje spominjes.
Mozes li mi malo bolje objasniti sta treba da radim jer ja informaticki nisam dovoljno pismen da pohvatam ono sto si napisao.
[ superbaka @ 27.01.2011. 23:02 ] @
idi na adresu http://www.virustotal.com pa klikni browse i izaberi fajl koji se nalazi na loakciji c:\windows\autokms.exe i klikni send file... ako ti vecina av programa na ovom sajtu kaze da je to virus, onda verovatno i jeste pa bi trebalo da ga uklonis, a kako - prostim ukucavanjem pretrage u Google remove autokms.exe i sledeci uputstva sa nekog od sajtova na kome je to objasnjeno...
sto se tice programa HijackThis, tu je malo komplikovanije... skini taj program, instaliraj i uradi scan pa nam okaci log da pogledamo za dalja uputstva...
[ davor.v @ 27.01.2011. 23:17 ] @
na virustotal nisam mogao da udjem nikako ...autokms.exe sam ubacio u search i sada ga nema nigdje ...mora da sam ga obrisao iz Malware Bytes-a

evo Hi Jack log

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:13:12 AM, on 1/28/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17093)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\htpatch.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Norton 360\Engine\4.3.0.5\ccSvcHst.exe
C:\WINDOWS\system32\PSIService.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Norton 360\Engine\4.3.0.5\ccSvcHst.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\TechSmith\Snagit 9\Snagit32.exe
C:\Program Files\TechSmith\Snagit 9\TSCHelp.exe
C:\Program Files\TechSmith\Snagit 9\SnagPriv.exe
C:\Program Files\TechSmith\Snagit 9\snagiteditor.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT2269050
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O1 - Hosts: 85.242.255.97 google.com
O1 - Hosts: 85.242.255.97 www.google.com
O1 - Hosts: 85.242.255.97 facebook.com
O1 - Hosts: 85.242.255.97 www.facebook.com
O1 - Hosts: 85.242.255.97 yahoo.com
O1 - Hosts: 85.242.255.97 www.yahoo.com
O1 - Hosts: 85.242.255.97 facebook.co.uk
O1 - Hosts: 85.242.255.97 www.facebook.co.uk
O1 - Hosts: 85.242.255.97 google.co.uk
O1 - Hosts: 85.242.255.97 www.google.co.uk
O1 - Hosts: 85.242.255.97 youtube.com
O1 - Hosts: 85.242.255.97 www.youtube.com
O1 - Hosts: 85.242.255.97 www.youtube.co.uk
O1 - Hosts: 85.242.255.97 youtube.com
O1 - Hosts: 85.242.255.97 blogspot.com
O1 - Hosts: 85.242.255.97 www.blogspot.com
O1 - Hosts: 85.242.255.97wikipedia.com
O1 - Hosts: 85.242.255.97 www.wikipedia.com
O1 - Hosts: 85.242.255.97 myspace.com
O1 - Hosts: 85.242.255.97 www.myspace.com
O1 - Hosts: 85.242.255.97 google.ca
O1 - Hosts: 85.242.255.97 www.google.fr
O1 - Hosts: 85.242.255.97 google.fr
O1 - Hosts: 85.242.255.97 www.google.es
O1 - Hosts: 85.242.255.97 google.es
O1 - Hosts: 85.242.255.97 www.google.pt
O1 - Hosts: 85.242.255.97 google.pt
O1 - Hosts: 85.242.255.97 www.sharecash.org
O1 - Hosts: 85.242.255.97 sharecash.org
O1 - Hosts: 85.242.255.97 www.forums.sharecash.org
O1 - Hosts: 85.242.255.97 www.google.ca
O1 - Hosts: 85.242.255.97 forums.sharecash.org
O1 - Hosts: 85.242.255.97 www.warez-bb.org
O1 - Hosts: 85.242.255.97 warez-bb.org
O1 - Hosts: 85.242.255.97 facebook.fr
O1 - Hosts: 85.242.255.97 www.facebook.fr
O1 - Hosts: 85.242.255.97 www.facebook.com
O1 - Hosts: 85.242.255.97 google.com
O1 - Hosts: 85.242.255.97 www.google.com
O1 - Hosts: 85.242.255.97 facebook.com
O1 - Hosts: 85.242.255.97 www.facebook.com
O1 - Hosts: 85.242.255.97 yahoo.com
O1 - Hosts: 85.242.255.97 www.yahoo.com
O1 - Hosts: 85.242.255.97 facebook.co.uk
O1 - Hosts: 85.242.255.97 www.facebook.co.uk
O1 - Hosts: 85.242.255.97 google.co.uk
O1 - Hosts: 85.242.255.97 www.google.co.uk
O1 - Hosts: 85.242.255.97 youtube.com
O1 - Hosts: 85.242.255.97 www.youtube.com
O1 - Hosts: 85.242.255.97 www.youtube.co.uk
O1 - Hosts: 85.242.255.97 youtube.com
O1 - Hosts: 85.242.255.97 blogspot.com
O1 - Hosts: 85.242.255.97 www.blogspot.com
O1 - Hosts: 85.242.255.97wikipedia.com
O1 - Hosts: 85.242.255.97 www.wikipedia.com
O1 - Hosts: 85.242.255.97 myspace.com
O1 - Hosts: 85.242.255.97 www.myspace.com
O1 - Hosts: 85.242.255.97 google.ca
O1 - Hosts: 85.242.255.97 www.google.fr
O1 - Hosts: 85.242.255.97 google.fr
O1 - Hosts: 85.242.255.97 www.google.es
O1 - Hosts: 85.242.255.97 google.es
O1 - Hosts: 85.242.255.97 www.google.pt
O1 - Hosts: 85.242.255.97 google.pt
O1 - Hosts: 85.242.255.97 www.sharecash.org
O1 - Hosts: 85.242.255.97 sharecash.org
O1 - Hosts: 85.242.255.97 www.forums.sharecash.org
O1 - Hosts: 85.242.255.97 www.google.ca
O1 - Hosts: 85.242.255.97 forums.sharecash.org
O1 - Hosts: 85.242.255.97 www.warez-bb.org
O1 - Hosts: 85.242.255.97 warez-bb.org
O1 - Hosts: 85.242.255.97 facebook.fr
O1 - Hosts: 85.242.255.97 www.facebook.fr
O1 - Hosts: 85.242.255.97 www.facebook.com
O1 - Hosts: 85.242.255.97 google.com
O1 - Hosts: 85.242.255.97 www.google.com
O1 - Hosts: 85.242.255.97 facebook.com
O1 - Hosts: 85.242.255.97 www.facebook.com
O1 - Hosts: 85.242.255.97 yahoo.com
O1 - Hosts: 85.242.255.97 www.yahoo.com
O1 - Hosts: 85.242.255.97 facebook.co.uk
O1 - Hosts: 85.242.255.97 www.facebook.co.uk
O1 - Hosts: 85.242.255.97 google.co.uk
O1 - Hosts: 85.242.255.97 www.google.co.uk
O1 - Hosts: 85.242.255.97 youtube.com
O1 - Hosts: 85.242.255.97 www.youtube.com
O1 - Hosts: 85.242.255.97 www.youtube.co.uk
O1 - Hosts: 85.242.255.97 youtube.com
O1 - Hosts: 85.242.255.97 blogspot.com
O1 - Hosts: 85.242.255.97 www.blogspot.com
O1 - Hosts: 85.242.255.97wikipedia.com
O1 - Hosts: 85.242.255.97 www.wikipedia.com
O1 - Hosts: 85.242.255.97 myspace.com
O1 - Hosts: 85.242.255.97 www.myspace.com
O1 - Hosts: 85.242.255.97 google.ca
O1 - Hosts: 85.242.255.97 www.google.fr
O1 - Hosts: 85.242.255.97 google.fr
O1 - Hosts: 85.242.255.97 www.google.es
O1 - Hosts: 85.242.255.97 google.es
O1 - Hosts: 85.242.255.97 www.google.pt
O1 - Hosts: 85.242.255.97 google.pt
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\Snagit 9\SnagitBHO.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\4.3.0.5\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\4.3.0.5\IPSBHO.DLL
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Snagit - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\Snagit 9\SnagitIEAddin.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\4.3.0.5\coIEPlg.dll
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKUS\S-1-5-19\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Free YouTube Download - C:\Documents and Settings\Administrator\Application Data\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Documents and Settings\Administrator\Application Data\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~1\Office14\ONBttnIE.dll/105
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/wi...t/wuweb_site.cab?1292380418562
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files\Norton 360\Engine\4.3.0.5\ccSvcHst.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

--
End of file - 11356 bytes
[ Aleksandar Maletic @ 27.01.2011. 23:19 ] @
Skini Avast 5 Free http://www.avast.com/free-antivirus-download , update-uj ga i odradi Quick scan, ukoliko nesto detektuje, obrisi naravno...takodje, update-uj Malwarebytes i odradi Quick scan, nakon zavrsetka skeniranja idi na Ok, Show Results i na kraju Remove Selected...mozda ce ti zatraziti restart, ucini kako ti program nalaze...
Preuzmi SUPERAntiSpyware Free http://www.superantispyware.com/superantispyware.html , takodje ga update-uj i odradi Quick scan, nakon toga brisi detektovano...
Mozda cu te malo vise opteretiti svim ovim programima, ali urodice plodom...
Podnesi nam na kraju izvestaj sta je koji program uradio da znamo da li da radimo drugacije...
[ davor.v @ 27.01.2011. 23:25 ] @
Uradicu kako si mi rekao ali to ce da potraje.
Javicu vam rezultate cim bude gotovo sve.
[ superbaka @ 27.01.2011. 23:46 ] @
sve je ovde manje vise OK, mada bih ja pola stvari pocistio da mi ne opterecuje sistem ali to je nebitno...
jedino sto mi je sumnjivo su ovi O1 objekti... da li neko zna o cemu se radi?

da li su to ti sajtovi na koje ne mozes da ides?
ako nista drugo, mozes da probas da stikliras jedan po jedan O1 objekat pa kliknes Fix i sacuvas backup, pa proveris da li ti taj sajt radi... ako nesto zeznes, uvek mozes iz backupa da povratis svaku pojedinacnu stavku...

edit:
http://whois.domaintools.com/85.242.255.97

Citat:
*** PLEASE READ THIS ***
remarks: I am NOT hacking into your computer!
remarks: I am listed here as contact for network IP blocks
remarks: allocated and assigned to PTComunicacoes, SA ISP services.
remarks: Please DO NOT send me any reports of network abuse.
remarks: For Security Incidents please use


[ goran9888 @ 28.01.2011. 00:28 ] @
Momci, razumem ja da hocete da pomognete coveku, ali morate onda stvari gledati mnogo detaljnije sa razumevanjem i da za ono sto napisete budete 100% sigurni da je to tako.



Idemo redom ...


@superbaka

Citat:

autokms.exe je i legitiman proces, ali i trojanac


Jok. To je Activator za MS Office. U svakom slucaju, korisniku ce trebati jer mu Office nije licenciran.


Citat:
tako da je najbolje da ga upload-ujes na virustotal.com


Zasto? Na VT-u taj fajl je skeniran mnogo puta.
Evo pa pogledaj: http://www.virustotal.com/file...67f8420a7b29219a3e3-1294780652

Citat:

ove hijackere mozes da skines, mada kada su ovakve stvari u pitanju, ne bi bilo lose da to proveris i ispeglas sa HijackThis programom...


Sta su to hijackeri?
Znas li ti sta je HJT i da njime moze da se unisti operativni sistem? Lepo si se izrazio, "ispeglas". :D

Inace, HJT je dijagnosticki/fix alat koji koriste izuceni helperi kao pomoc u uklanjanju malware-a. U poslednje vreme se slabo koristi s'obzirom da veliki broj novog malware-a uopste i ne primecuje.


Citat:
ja sam malopre skenirao C: sa Malwarebytes' Anti-Malware i malo sam se smejao jer mi je kao Worm/Autoit prijavio .txt fajl od jednog bajta u kome je upisano samo "1", kao i neki rootkit fajl od 8,5 bajta :)



Nista tu nije smesno. Nasao ti je najverovatnije ostatke od neke infekcije. Iz log-a mozda moze i da se vidi koja je infekcija bila u pitanju.


Citat:
jedino sto mi je sumnjivo su ovi O1 objekti... da li neko zna o cemu se radi?


Procitaj: http://en.wikipedia.org/wiki/Hosts_%28file%29

Inace, HJT nam tim linijama pokazuje redirekcije tj. izmenjen hosts file. Kada covek hoce da ode na neki sajt od onih izlistanih, bude redirektovan sto je i sam napisao u prvoj poruci.



@Aleksandar Maletic

Lepo si ti to objasnio coveku, ali ne znam da li si primetio da on vec ima instaliran Norton na racunaru. Zamisli taj racunar koji ima i Avast i Norton i MBAM i SAS i jos milion nekih zastita. Bolji bi predlog bio npr samo boot scan Avast-om.



@davor.v


Procitaj privatnu poruku.


Da li Norton prijavljuje neku infekciju?
Ukoliko prelazis na Avast, obavezno deinstaliraj Norton-a.
[ davor.v @ 28.01.2011. 01:21 ] @

@Aleksandar Maletic

odradio sam sve kako si mi napisao ali nista ne nadjoh vise sem onog sto je Malware Bytes nasao prvi puta, a to je deletirano

@goran9888

nisam deinstalisao Norton ali cu to da uradim ..inace Norton mi takodje nije nista prijavio


hvala svima na pomoci i trudu, a sutra nastavljam da se borim sa ovim problemom...
[ cyBerManIA @ 28.01.2011. 07:17 ] @
Pa ne moze da otvori nijedan od tih sajtova, zato sto je u hosts fajlu definisana druga ip adresa za sve te sajtove..
ovako, kad pokusas da otvoris neki sajt tipa facebook,yahoo,google...itd tvoj sistem ne resolvuje IP adresu trazenog sajta, jer je IP sajta vec definisana u hosts fajlu.
Kao sto vidis, za sve te sajtove (popularne) je data ista IP adresa.Na toj IP adresi se nalazi kviz koji kada ga ti popunis, ta osoba koja ga je postavila uzima pare.Fora je jedino sto nikad nema odgovarajucih kvizeva za nasu zemlju
Znaci, kucanjem npr youtube.com,wikipedia,face... ti ne ides na te sajtove, vec na neki peti server.

Uzrok: nakacio si neki malware koji je dodao te linije texta u hosts fajlu.Pisao ga je neko ko zeli da zaradi pare na kvarno
Resenje: nadji hosts file. Nalazi se u windows\system32\drivers folderu.
Zadnje linije bi trebalo da izgledaju ovako:
Code:
#    127.0.0.1       localhost
#    ::1             localhost


Ispod toga kod tebe ide nastavak tipa:
Code:
85.242.255.97 google.com
85.242.255.97 www.google.com
85.242.255.97 facebook.com
85.242.255.97 www.facebook.com
85.242.255.97 yahoo.com

Obrisi taj nastavak. Tacnije, obrisi sve sto nije pod komentar ( # ) a nalazi se ispod linije:
Code:
#    ::1             localhost


ps. 8i15 je ujutru.Jos nisam spavao.Ukoliko je nesto nejasno napisano, ne zamerite.

Pozdrav
[ davor.v @ 28.01.2011. 13:18 ] @
Code:
Obrisi taj nastavak. Tacnije, obrisi sve sto nije pod komentar ( # ) a nalazi se ispod linije:
Code:
#    ::1             localhost


problem rijesen, obrisan nastavak u tom fajlu i sada sve radi kako treba...

zahvaljujem svima na trudu u rjesavanju problema, a posebno cyBerManIA na pomoci...

Citat:
ps. 8i15 je ujutru.Jos nisam spavao.Ukoliko je nesto nejasno napisano, ne zamerite.

Pozdrav


iako umoran i neispavan uradio si extra posao i mnogo mi pomogao...

[ superbaka @ 28.01.2011. 19:29 ] @
@goran9888

lepo si i ti meni objasnio, ali da nije bilo HiJackThis loga ne bismo videli gde je problem i nasli resenje, zar ne?
[ Aleksandar Maletic @ 28.01.2011. 21:45 ] @
Citat:
superbaka: @goran9888

lepo si i ti meni objasnio, ali da nije bilo HiJackThis loga ne bismo videli gde je problem i nasli resenje, zar ne?


Gresis... Goran ti je prvo postavio najprostije pitanje jer se obicno od takvih polazi, pitao te je za antivirus...sve se postupno radi, a sledeci korak je recimo trebao da bude postavljanje ComboFix ili DDS log-a u kome se sve moze videti...