Pitanje za sve kompjuterske doktore

Sinoc sam otisao na internet i pokusao sam da nesto potrazim na Googlu.Kada sam kliknuo na zeljeni sajt ikompjuter me je prebacio na neki search-daily.com.I od tada mi ne da mira.Ipak postoji jedna specificnost ove pojave jer se javlja samo na Internet Exploreru.Ne na Fire Fox koju ne koristim cesto.
Skenirao sam sa
AD-AWARE SE personal
AVG
ESET, spol. s r.o.
Priznajem da su mi pronasli mnoge crve i kolacice ,ali mi nisu resili problem.
Nadam se da neko od prisutnih ima ideju kako da mi pomogne.
Unapred hvala

Logfile of HijackThis v1.99.1
Scan saved at 17:25:42, on 7.9.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\WINDOWS\SOUNDMAN.EXE
D:\programi\google\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
D:\programi\Quick\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
D:\programi\Skype\Skype.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\sistray.exe
C:\WINDOWS\system32\svchost.exe
D:\Sony\VolumeWatcher\SPUVolumeWatcher.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Vuk\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {3A315AF9-6805-4180-A25D-1502D74A999F} - c:\windows\system32\mbjambj.dll
O2 - BHO: (no name) - {69D2C938-13CF-4F0F-AB83-8FFC7972898B} - c:\windows\system32\vnxciytj.dll
O2 - BHO: (no name) - {EA75D23B-2ABB-4C1F-A0D7-D5E2932F72CA} - c:\windows\system32\qqdfkndq.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O4 - HKLM\..\Run: [ccApp] -
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Picasa Media Detector] D:\programi\google\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\programi\Quick\iTunesHelper.exe"
O4 - HKLM\..\Run: [outlook] C:\Program Files\outlook\outlook.exe /auto
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "D:\programi\Skype\Skype.exe" /nosplash /minimized
O4 - Startup: Picture Motion Browser Media Check Tool.lnk = D:\Sony\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {33331111-1111-1111-1111-611111193423} -
O16 - DPF: {33331111-1111-1111-1111-615111193427} -
O20 - Winlogon Notify: blfkoshn - C:\WINDOWS\SYSTEM32\mbjambj.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

SPYBOT je nasao
Avenue A. Inc
Doubleclick
Fastclick
i sve je probleme sredio,ali me kompjuter i dalje,na pretrazivacima,prebacuje na nezeljene sajtove.

Promeni naziv programa iz ''hijackthis'' u ''123'' i postavi novi log.

dr_Boro a šta sa ovima ?

O2 - BHO: (no name) - {3A315AF9-6805-4180-A25D-1502D74A999F} - c:\windows\system32\mbjambj.dll
O2 - BHO: (no name) - {69D2C938-13CF-4F0F-AB83-8FFC7972898B} - c:\windows\system32\vnxciytj.dll
O2 - BHO: (no name) - {EA75D23B-2ABB-4C1F-A0D7-D5E2932F72CA} - c:\windows\system32\qqdfkndq.dll
O16 - DPF: {33331111-1111-1111-1111-611111193423} -
O16 - DPF: {33331111-1111-1111-1111-615111193427} -
O20 - Winlogon Notify: blfkoshn - C:\WINDOWS\SYSTEM32\mbjambj.dll

I izvinjavam se za upad , bolestan sam nešto danas , pa me kasnije nece biti.

Kako misliš šta sa ovima?

Video sam te stavke, ali mislim da log nije kompletan. Izgleda kao Vundo, zato tražim promenu imena HT-a. Ima tu još nekih stvari... Onaj outlook.exe je verovatno crv, a nisam siguran i da je Norton u funkciji ( O4 - HKLM\..\Run: [ccApp] - ).


Edit: samo ti upadaj... pa nije ovo moj privatni forum...

Ništa ne brini , aj rešavaj to , stvarno ti se divim za trud koji ulažeš , ja nemogu jer mi ono vreme koje imam ni ne dozvoljava to.

Ipak je postavljač teme tražio pomoć od doktora, tako da dr_Bora ima prioritet

bolestan sam nešto danas , pa me kasnije nece biti.

Kliknite za proširenje...

Snejks, nemoj da nas plašiš :shock:

Eh Bukvalisto

Kradljivac je sigurno u pitanju .Za pocetak tools pa internet options pa general pa tu postavi use blank.
A za ostalo nek ti pomognu malo iskusniji.

Zanimljiv prevod... Nego, hijjacker ili worm, svakako upisuje u registry, tako da ovo i ne pomaže puno. A zašto (usput) malo više ne koristiš Firefox

Hvala momci, samo bez offtopica vise, covjeku je potrebna pomoc...
End offtopic.

OK, back to Topic. Evo, na Lavasoft-ovom forumu slične teme - sa srećnim krajem: http://www.lavasoftsupport.com/index.php?showtopic=1567
Predlog: mislim da je bolje da se ovi Hijjack logovi stavljaju kao attachment - mnogo su dugački za post..

A Brajana nema li nema

promenio sam ime u 123.exe i evo loga
Logfile of HijackThis v1.99.1
Scan saved at 16:00:39, on 8.9.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\WINDOWS\SOUNDMAN.EXE
D:\programi\google\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
D:\programi\Quick\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
D:\programi\Skype\Skype.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\WINDOWS\system32\sistray.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
D:\Sony\VolumeWatcher\SPUVolumeWatcher.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Vuk\Desktop\123.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {3A315AF9-6805-4180-A25D-1502D74A999F} - c:\windows\system32\mbjambj.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {69D2C938-13CF-4F0F-AB83-8FFC7972898B} - c:\windows\system32\vnxciytj.dll
O2 - BHO: (no name) - {EA75D23B-2ABB-4C1F-A0D7-D5E2932F72CA} - c:\windows\system32\qqdfkndq.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O4 - HKLM\..\Run: [ccApp] -
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Picasa Media Detector] D:\programi\google\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\programi\Quick\iTunesHelper.exe"
O4 - HKLM\..\Run: [outlook] C:\Program Files\outlook\outlook.exe /auto
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "D:\programi\Skype\Skype.exe" /nosplash /minimized
O4 - Startup: Picture Motion Browser Media Check Tool.lnk = D:\Sony\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {33331111-1111-1111-1111-611111193423} -
O16 - DPF: {33331111-1111-1111-1111-615111193427} -
O20 - Winlogon Notify: blfkoshn - C:\WINDOWS\SYSTEM32\mbjambj.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

Izvinjavam se sto nisam se ranije javio,ali juce sam bio zauzet.
Zahvaljujem svima na strpljenju i razumevanju.

Mogao bih i cesce da koristim Fire Fox,ali ovaj kompjuter koristi i moja majka,a ona se navukla na Internet Explorer i ne verujem da bi bez njega mogla i da radi.
U svakom slucaju zelim da mi kompjuter bude cist.

Dodatak za doktora Boru
Nemam Norton i komp mi stiti Symatec AntiVirus program

Download-uj VundoFix.

Pokreni ga i izaberi opciju Scan For Vundo.
Nakon završenog skeniranja, klikni na Remove Vundo. Isprati postupak do kraja potvrdno odgovarajući na sva pitanja. Kompjuter će se restartovati.

Nakon toga pokreni HijackThis, izaberi opciju Do a system scan only, i čekiraj sledeću liniju:

O4 - HKLM\..\Run: [outlook] C:\Program Files\outlook\outlook.exe /auto

a zatim klikni na Fix Checked.

Restartuj kompjuter a zatim potraži i, ukoliko postoji, obriši file:

C:\Program Files\outlook\outlook.exe

Nakon toga postavi ovde novi HijackThis log i iskopiraj sadržaj file-a C:\vundofix.txt.

Btw: Norton = Symantec...

Brajane, nisam gledao log, jer sam tanak sa vremenom, to ce nas dr.Bora da sredi, ali me zbunjuje par stvari:

U prvom postu si pomenuo
AVG I ESET, sto vec dva Av (antivirusna programa), sad pominjes Symentec sto u stvari i jeste Norton Antivirus, jer Norton dolazi iz kompanije Symantec, cisto da imas informaciju..

Ako sam dobro razumio ti imas najmanje 2 a mozda i 3 AV prgrama sto moze da bude dodatni prolem vec postojecem kojem imas...

U svakom slucaju ako se Dr.Bora ne pojavi uskoro, nastojacu, shodno vremenu koje imam da ti pomognem..

AVG i Esst sam instalirao samo radi skeniranja i cim su skeniranja zavrsena odmah sam ih deinstalirao,a to da Norton dolazi iz Symantec nisam znao.Nisam upucen u te stvari.

Vundo Fix nije nasao nijedan virus.

Da li da nastavim sa savetima koje mi je dr Bora dao?

Pokreni HijackThis, skeniraj i čekiraj sledeće linije:

O2 - BHO: (no name) - {3A315AF9-6805-4180-A25D-1502D74A999F} - c:\windows\system32\mbjambj.dll
O2 - BHO: (no name) - {69D2C938-13CF-4F0F-AB83-8FFC7972898B} - c:\windows\system32\vnxciytj.dll
O2 - BHO: (no name) - {EA75D23B-2ABB-4C1F-A0D7-D5E2932F72CA} - c:\windows\system32\qqdfkndq.dll
O4 - HKLM\..\Run: [outlook] C:\Program Files\outlook\outlook.exe /auto
O16 - DPF: {33331111-1111-1111-1111-611111193423} -
O16 - DPF: {33331111-1111-1111-1111-615111193427} -
O20 - Winlogon Notify: blfkoshn - C:\WINDOWS\SYSTEM32\mbjambj.dll

a zatim zatvori sve prozore Internet Explorera i klikni na Fix Checked.

Restartuj PC, potraži i ako postoje obriši sledeće:

c:\windows\system32\mbjambj.dll
c:\windows\system32\vnxciytj.dll
c:\windows\system32\qqdfkndq.dll
C:\Program Files\outlook\outlook.exe

Nakon toga postavi novi HT log.