Kako da "ukinem" IE6 sa kompa?!

Taj browser me nervira, koristim FF2.0.0.4. A počeo je i da mi smeta. Sam iz čista mira traži konekciju i automatski ide na neki sajt koji je pun virusa i redovno dobijem neki.

Koristim NOD32 i sve ih prepozna. Ali ovo me smara. Hoću da IE6 nestane sa kompa.

U program files nađem njegov folder, uđem u njega, obrišem sve fajlove, kad ono, posle nekoliko trenutaka SVI SE VRATE!
Brisao sam i iz registry-a, ali nema vajde. IE6 je tvrdoglav.

Kako da ga izbacim zauvek?

Živeli,
Bane 17

---

http://www.elitesecurity.org/t...Kako-izbrisati-iExplorer-sa-XP

---

Mislim da su tvoj problem virusi, a ne IE6. Ni ja ga ne koristim, ali nemam nikakvih problema zato što mi i dalje stoji na kompu. S druge strane, ako ga i skloniš i dalje će ti ostati virusi.

I napravices jos hrpu problema pride, sto ces vidjeti iz teme ciji link sam ti dao. ;)
Uvijek sam se cudio ljudima koji hoce da uklone IE, ne vidim razlog/e da to ucine, najbolje ga je ignorisati (obrisati s-cut sa Desktop-a i sl.), i kao da ga nema. ;)

---

Vidite, IE6 mi otvara sajt sa sledećom adresom: 82.98.***.*** sa kojeg mi redovno NOD32 prepozna sledeće viruse:
Win32/BHO.G trojan; Win32/Adware.Virtumonde; Win32/Spy.VBStat.J trojan

Dakle stranica nema sadržaj, ne prikazuje mi ništa, a pun je .dll fajlova koje prepoznaje NOD32 kao viruse.

Ako je takva situacija, da je riskantno deinstalirati IE6, onda:

Postoji li način da se u samom IE6ici ubaci zabrana za posećivanje gore navedene IP adrese?
Ne preporučijem da je posećujete

Živeli,
Bane 17


<sub>[Goran Mijailovic: Izmenjen deo poruke koji se odnosi na "rizicnu" IP adresu]



[Ovu poruku je menjao Goran Mijailovic dana 25.07.2007. u 18:38 GMT+1]</sub>

---

U IE-u Imas Internet opcije (Tools - > Internet options )
U provoru koji se otvori izaberi drugi tab s leva Security i cetvrtu slicicu sa leva Restricted sites.
Videces dugme Locations . Kad ga pritisnes otvorice se novi prozor sa dugmetom Add i poljem za internet adresu.
Upisi adresu ovog servera i pritisni Add pa Ok.
U prvom prozoru pritisni Apply i OK.
Pozdrav

---

Hvala bato...

A jel postoji slična procedura za Mozilla 2.0.0.4?

_{[Ovu poruku je menjao mmwc dana 13.08.2007. u 13:57 GMT+1]}

---

Zabranu pristupa nekoj stranici mozes da odradis editovanjem windows host fajl-a npr. Kao sto je napisao moderator to je najmanji problem u ovom slucaju..

@Moderator
Jedna sugestija ako nije problem.. preporucio bih koriscenje HijackThis v1.99.1 jer ova zadnja TrendMicro-va verzija pokazala losijom nego stara. U to se mozete uveriti ako pogledate bilo koji jaci malware removal forum i ispratite verziju kojom se oni sluze. V2 je jedno bolje podrzana za Windows Vista OS. (mada ovaj OS i nisam nesto primetio na "terapijama" :))
Pozz

Naravno da sugestija nije problem, cak stavise dobrodosla je.
Ovako, licno koristim ver. 2.0 i zadovoljan sam njome, mada je i ta stabilna ver. 1.99.1 vise nego dokazana. Kad uhvatim malo vremena, testiracu obe verzije, i porediti rezultate.

OK, dosta off topic-a, da vidimo sta kaze bakiman, tj. njegov log. ;)

---

Stigao LOG fajl:
-----------------

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 0:47:18, on 19.6.2007
Platform: Windows XP (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\WINDOWS\nMtsk.exe
C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Motherboard Monitor 5\MBM5.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\Winamp\winamp.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
D:\Dokumenta\BB King.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Suggest - {5A263CF7-56A6-4D68-A8CF-345BE45BC911} - C:\Program Files\Yahoo!\Search\YSearchSuggest.dll
O2 - BHO: (no name) - {73BA12CB-F801-41F7-B199-0474FB66D090} - C:\WINDOWS\System32\tuvvtrs.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {C48F5D72-5CE7-4A37-B689-22BFC4C4A4AF} - C:\WINDOWS\System32\ssqpo.dll
O2 - BHO: (no name) - {CD3447D4-CA39-4377-8084-30E86331D74C} - C:\WINDOWS\System32\qlrjgite.dll (file missing)
O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [nMTaskBarService] nMtsk.exe
O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [GPLv3] rundll32.exe "C:\WINDOWS\System32\lqhsnlur.dll",realset
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: MBM 5.lnk = C:\Program Files\Motherboard Monitor 5\MBM5.exe
O4 - Global Startup: DSLMON.lnk = ?
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - (no file)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{6305D49A-2FBE-4361-9C73-59A167396C53}: NameServer = 194.106.162.10 194.106.162.2
O20 - Winlogon Notify: ssqpo - C:\WINDOWS\System32\ssqpo.dll
O20 - Winlogon Notify: tuvvtrs - C:\WINDOWS\SYSTEM32\tuvvtrs.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 5454 bytes
-----------------


Samo recite mi još kako da zabranim pristum sajtovima...


Živeli,
Banellone17

---

VundoFix V6.5.1

Checking Java version...

Java version is 1.4.2.6
Old versions of java are exploitable and should be removed.

Scan started at 0:43:32 20.6.2007

Listing files found while scanning....

C:\WINDOWS\System32\dowcenjq.dll
C:\WINDOWS\System32\gmdxtevw.dll
C:\windows\system32\j0231239.dll
C:\windows\system32\kmcelupw.exe
C:\windows\system32\oplaexpy.dll
C:\WINDOWS\System32\opqss.bak1
C:\WINDOWS\System32\opqss.bak2
C:\WINDOWS\System32\opqss.ini
C:\WINDOWS\System32\opqss.ini2
C:\WINDOWS\System32\opqss.tmp
C:\WINDOWS\System32\qlrjgite.dll
C:\WINDOWS\System32\ssqpo.dll
C:\WINDOWS\System32\tuvvtrs.dll
C:\windows\system32\wvetxdmg.ini
C:\windows\system32\ypxealpo.ini

Beginning removal...

Attempting to delete C:\WINDOWS\System32\gmdxtevw.dll
C:\WINDOWS\System32\gmdxtevw.dll Has been deleted!

Attempting to delete C:\windows\system32\j0231239.dll
C:\windows\system32\j0231239.dll Has been deleted!

Attempting to delete C:\windows\system32\kmcelupw.exe
C:\windows\system32\kmcelupw.exe Has been deleted!

Attempting to delete C:\windows\system32\oplaexpy.dll
C:\windows\system32\oplaexpy.dll Has been deleted!

Attempting to delete C:\WINDOWS\System32\opqss.bak1
C:\WINDOWS\System32\opqss.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\System32\opqss.bak2
C:\WINDOWS\System32\opqss.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\System32\opqss.ini
C:\WINDOWS\System32\opqss.ini Has been deleted!

Attempting to delete C:\WINDOWS\System32\opqss.ini2
C:\WINDOWS\System32\opqss.ini2 Has been deleted!

Attempting to delete C:\WINDOWS\System32\opqss.tmp
C:\WINDOWS\System32\opqss.tmp Has been deleted!

Attempting to delete C:\WINDOWS\System32\ssqpo.dll
C:\WINDOWS\System32\ssqpo.dll Has been deleted!

Attempting to delete C:\WINDOWS\System32\tuvvtrs.dll
C:\WINDOWS\System32\tuvvtrs.dll Could not be deleted.

Attempting to delete C:\windows\system32\wvetxdmg.ini
C:\windows\system32\wvetxdmg.ini Has been deleted!

Attempting to delete C:\windows\system32\ypxealpo.ini
C:\windows\system32\ypxealpo.ini Has been deleted!

Performing Repairs to the registry.
Done!

Beginning removal...

Attempting to delete C:\WINDOWS\System32\tuvvtrs.dll
C:\WINDOWS\System32\tuvvtrs.dll Has been deleted!

Performing Repairs to the registry.
Done!



-------------------------------





Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 0:51:35, on 20.6.2007
Platform: Windows XP (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\WINDOWS\nMtsk.exe
C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Motherboard Monitor 5\MBM5.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\Dokumenta\BB King.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Suggest - {5A263CF7-56A6-4D68-A8CF-345BE45BC911} - C:\Program Files\Yahoo!\Search\YSearchSuggest.dll
O2 - BHO: (no name) - {6439B7B6-DF8D-442E-9E0A-790A91770B03} - C:\WINDOWS\System32\ssqpo.dll (file missing)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [nMTaskBarService] nMtsk.exe
O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: MBM 5.lnk = C:\Program Files\Motherboard Monitor 5\MBM5.exe
O4 - Global Startup: DSLMON.lnk = ?
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - (no file)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{6305D49A-2FBE-4361-9C73-59A167396C53}: NameServer = 194.106.162.10 194.106.162.2
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 5005 bytes


Živeli,
Banellone17

PS Ono što sam uočio jeste da za čak ~500b je manji log fajl od prvog (BB King)
PS2 Šta tačno da upišem u windows host file za blokadu IP adrese?!?!

<sub>[Ovu poruku je menjao bakiman dana 20.06.2007. u 01:21 GMT+1]

[Ovu poruku je menjao mmwc dana 13.08.2007. u 15:18 GMT+1]</sub>

---

JA ne zna gde si ti video da postoji taj fajl što si napisao da ga Avenger obriše. U log fajlu od tog prodrama mi je rekao da ne postoji taj fajl i da naravno ništa nije obrisao.

Ali evo log fajla BB Kinga...


Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 0:41:47, on 21.6.2007
Platform: Windows XP (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\WINDOWS\nMtsk.exe
C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Motherboard Monitor 5\MBM5.exe
C:\WINDOWS\System32\wuauclt.exe
D:\Dokumenta\BB King.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Suggest - {5A263CF7-56A6-4D68-A8CF-345BE45BC911} - C:\Program Files\Yahoo!\Search\YSearchSuggest.dll
O2 - BHO: (no name) - {6439B7B6-DF8D-442E-9E0A-790A91770B03} - C:\WINDOWS\System32\ssqpo.dll (file missing)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [nMTaskBarService] nMtsk.exe
O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: MBM 5.lnk = C:\Program Files\Motherboard Monitor 5\MBM5.exe
O4 - Global Startup: DSLMON.lnk = ?
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - (no file)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 4836 bytes


_{[Ovu poruku je menjao mmwc dana 13.08.2007. u 14:14 GMT+1]}

---

U logu od VundoFix-a ima taj fajl, u tvojoj prethodnoj poruci. Pokreni VundoFix opet pa pogledaj da li ga pronalazi (ako ne, onda OK)?
Sad jos ovo radis: pokreni HJT (BB.exe), skeniraj i kad zavrsi skeniranje, stavi kvacice (stikliraj) sljedece redove:

Kad ih stikliras, pozatvaraj sve ostale prozore (ukljucujuci i ovaj, znaci nijedan program niti browser ne smije da bude otvoren, samo prozor od HijackThis-a) i tek tada pritisni dugme Fix checked.
Okaci i taj log ovdje, da vidimo rezultate. Veoma je bitno da nam javis jel' doslo do kakvih pomaka u ponasanju racunara?

Naravno, i dalje se pridrzavaj sigurnosnih uputstava (azuriraj Antivirus, Antyspyware, skeniraj iz Safe Mode-a, sto vec imas u TOP temi).

---

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 15:37:06, on 23.6.2007
Platform: Windows XP (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\WINDOWS\nMtsk.exe
C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Motherboard Monitor 5\MBM5.exe
C:\WINDOWS\System32\WISPTIS.EXE
D:\Dokumenta\PRGM\BB King.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [nMTaskBarService] nMtsk.exe
O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: MBM 5.lnk = C:\Program Files\Motherboard Monitor 5\MBM5.exe
O4 - Global Startup: DSLMON.lnk = ?
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{6305D49A-2FBE-4361-9C73-59A167396C53}: NameServer = 194.106.162.10 194.106.162.2
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 4577 bytes



Nema više da prijavljuje viruse, a ono da sam bezveze traži konekciju, dešava se vrlo retko sad.

Inače, ja sam stavio zabranu u win host file-u, samo nisam siguran da je dobro upisano.

Ajde sad to mi objasnite ljudi...

Živeli,
Banellone17

---

Gornji log ti je cist, nadam se da si ponovio ono sa VundoFix-om i da nije nista pronasao?
Ubuduce, preventivno drzi NOD32 (kao i ostali zastitni software) uvijek update-ovanog, te povremeno odradjuj skeniranje citavog sistema.

Sto se tice editovanja hosts fajla i zabrane pojedinih Internet stranica, na sljedecem linku ima nesto o time:
http://www.elitesecurity.org/p1450370, s tim da je ovdje u linku pokazan default hosts fajl, a ti ukoliko zelis da blokiras jos neku stranicu dodajes je dole ispod.
Evo, uzecemo na primjer da zelis da zabranis sajt: www.nekisajt.com.

Tada bi tvoj hosts fajl izgledao ovako:


Ovako mozes da blokiras i neku IP adresu, sto i jeste bilo tvoje inicijalno pitanje.

---

Za sad sam virus free.

Ja sam slično uradio to blokiranje.

WHF izgleda ovako:

# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost
127.0.0.1 82.98.235.61
127.0.0.1 207.226.178.149

Može li ovako, jer sajt nema ime, već samo IP adresu.

Živeli,
Banellone17

---

Nemam problema sa računarom više.

Našao mi je za moju prvu IP adresu 135 sajtova?!

Hoću da blokiram te dve IP adrese jer su mi stizali virusi sa tih "sajtova".

Živeli,
Banellone17

_{[Ovu poruku je menjao mmwc dana 13.08.2007. u 14:17 GMT+1]}

---

Pa Copy/Paste tih sajtova u HF (na nacin kako ti je gore pokazano), i to bi trebalo biti to. Nemoj da te buni sto ih ima dosta, pa oni predefinisani HF fajlovi u sebi sadrze na stotine i hiljade stranica.

Evo, zakacicu ti primjer jednog "gotovog" hosts fajla.

I jos nesto, moras da izbjegavas sumnjive stranice, bez obzira kakvu zastitu koristio, tu ti nema efikasne pomoci, ako se bahato ponasas. Znaci, samo sigurne lokacije i bez brige.

---