Windows problemi

Poćetnik sam pa bih želeo neka uputstva ukloliko je to neko voljan da mi da ogovor, pa i uputstvo u vezi je mog problema:
- pre godinu dana mi je upao virus Trojan u kompjuter koji sam po mojoj oceni eliminiso antivirusom Kasperski 6.Ali nakon svakog novog skeniranja Kasperski me je upozoravao na kraju celokupnog teksta: Sistem volume information in risk!
- nakon Kasperskog uzeo sam utility Dr.Web, koji mi je posle Kasperskog nasao još 52 Trojanca i normalno on ih je unistio,
- nakon isteka aktivnog prerioda Kasperskog antivirusa, uzeo sam besplatni probni Eset-nod 32, koji nikada ništa nije primetio da postoje neke promene u sistemu niti da ima virusa.
- nakon isteka aktivne zaštite nod32, uzeo sam Avast antivirus, besplatna varijanta, koji je odmah konstatovao 5 Trojana, i koje je odmah po mom nalogu likvidirao.
- trenutno sam nakon godinu dana a možda i nešto više uzeo utility Dr.web. On mi je sada našao 120 Trojanca koje je takodje po mom nalogu unistio. Verujem da više nemam Trojan-virus.
-Odmah nakon skeniranja sa Dr.Web utilityes, skenirao sam u safe mode 2x pc i dobio u samom skeniranju ogroman broj registrija koji su oštećeni.
Zbog ovoga sam se zabrinuo dali mi sistem radi normalno ili delimično, i dali imam uslova da sva ova oštečenja mogu da vratim u prvobintno - normalno - originalno stanje.
1. Dali postoji takva mogućnost
2.Koji su to alati
3. Kakav je tehnički postupak
4. Dali ja kao amater, mogu reći (pošto sam početnik) mogu nešto da uradim
5. Ako ja to ne budem mogao dali neko može da me uputi kako to da vratim na prvobitno stanje.

Imam OS xp-Profesional
Version 2002
Service Pack 1
AMD Athlon, 64 Procesor 3000+
1,81 GHz
1GB. Ram
U okolini u kojoj živim nemam nekog potvrdjenog majstora-stručnjaka. Pošto živim na Kosovu, da bih otišao u Srbiju imam velikih problema sa granicom.
Očekujem razumevanje, i zahvaljujem se - Stojan

Šta je sada dali vi radite normalno ili pravite zamke?
Ja imam problem i ne mogu sada da studiram Vaše PRAVO.


Auf viedersehen!

Upoznat sam sa forumom, pišem isključivo srpskim pravopisom, što bi to trebali da vidite, osim ako imate neke vase posebne komplekse više vrednosti?

Moja adresa je: [email protected]

Da li misliš da je ovo nečija dežurna tehnička podrška koja će da pročita poruku u 5:02 i odgovori do 5:12? Pošto i ti živiš u Srbiji, verovatno znaš da je to vreme kada većina spava pa je bolje da sačekaš da neko pročita pitanje i odgovori ako može, na ovakav način samo odbijaš moguće odgovore.

To što Kasperski prijavljuje Sistem volume information in risk! je verovatno zato što postoji virus u nekom backup-u, isključi sistem restore pa će to da bude obrisano, posle ponovo uključi. Nemoj mnogo da veruješ raznim alatima, oni često daju lažna upozorenja. Ako ti sistem radi normalno, verovatno je sve u nekom redu. Da li inače imaš neki antivirus stalno aktivan ili samo povremeno proveravaš? Ako si na internetu, to je obavezno, kao i neki firewall koji će da spreče nezvane goste, to je mnogo lakše nego da ih posle očistiš.
Ako je ipak sistem oštećen, a svi ovi programi nisu uspeli da ga oporave, reinstalacija je uvek sigurno rešenje.

ja bih stavio potpuno nov system,nebi se zezao sa tim ,ali mislim da bi pre valjano pitanje bilo da li znas kako se stavlja nov O.S.?
Bezuvrede,ali naveo si da si pocetnik.
pozz

---

Najlaksi nacin ti je da
1. FORMATIRAS
2. Reinstalacija samog windowsa

---

I covece, predji na Service Pack 2, mani se od jedinice. ;)

Imam jedan problem.Kad se digne sistem posle 1 min odem u Task Menager i tamo gde treba posle svakog otvorenog procesa da pise ko je otvorio tj. system ili administrator nista ne pise.Posle nekih 5 minuta se to pojavi ,ali ima jos jedan problem kad otvorim Task Menager odaberem neki program i stisnem End now iz maticne ploce se cuje zvik bip tj plopne.Uradio sam system restore vratio ga mesec dana unazad ali problem je jos tu!Napominjem da je Windows reinstaliran pre 4 meseca.Pc radi normalno pusta filmove zvuk je tu slika je tu,sve ok brzo radi itd.ali ovaj me problem jako nervira i nebi da dajem majstoru neke velike pare ako i sam mogu da popravim ovaj problem.Sta da radimmmm.Unapred hvala

Pozdrav!
Pokušaćemo da otklonimo sumnju vezanu za malware.
Dostavi mi najpre sledeći log.
Preuzmi OSAM Autorun Manager, raspakuj ga i pokreni.
Nakon završene kompletne analize sačuvaj .html log, zatim ga prikači ovde
uz novu poruku.

---

Report of OSAM: Autorun Manager v5.0.11926.0
http://www.online-solutions.ru/en/
Saved at 21:40:58 on 01.03.2012

OS: Windows XP Professional Service Pack 2 (Build 2600)
Default Browser: Mozilla Corporation Firefox 9.0.1

Scanner Settings
Rootkits detection (hidden registry)
Rootkits detection (hidden files)
Retrieve files information
Check Microsoft signatures

Filters
Trusted entries
Empty entries
Hidden registry entries (rootkit activity)
Exclusively opened files
Not found files
Files without detailed information
Existing files
Non-startable services
Non-startable drivers
Active entries
Disabled entries

Risk Name Publisher Full Path Status
Common
%SystemRoot%\Tasks
|||| "GoogleUpdateTaskUserS-1-5-21-1292428093-1078081533-725345543-1003Core.job" "Google Inc." C:\Documents and Settings\Home\Local Settings\Application Data\Google\Update\GoogleUpdate.exe File exists
|||| "GoogleUpdateTaskUserS-1-5-21-1292428093-1078081533-725345543-1003UA.job" "Google Inc." C:\Documents and Settings\Home\Local Settings\Application Data\Google\Update\GoogleUpdate.exe File exists
"SBWUpdateTask_Logon_84cb3404-000EA6E0AD63.job" "Speedbit Ltd." C:\PROGRA~1\COMMON~1\SpeedBit\SBUpdate\SBUpdate.exe File exists
"SBWUpdateTask_Time_84cb3404-000EA6E0AD63.job" "Speedbit Ltd." C:\PROGRA~1\COMMON~1\SpeedBit\SBUpdate\SBUpdate.exe File exists
Control Panel Objects
%SystemRoot%\system32
|||||| "FlashPlayerCPLApp.cpl" "Adobe Systems Incorporated" C:\WINDOWS\system32\FlashPlayerCPLApp.cpl File exists
|||||| "javacpl.cpl" "Sun Microsystems, Inc." C:\WINDOWS\system32\javacpl.cpl File exists
HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls
|||||| "SMAX3CP" "Analog Devices, Inc." C:\Program Files\Analog Devices\SoundMAX\SMax3CP.cpl File exists
Drivers
HKLM\SYSTEM\CurrentControlSet\Services
|||||| "asgibokj" (asgibokj) "Microsoft Corporation" C:\WINDOWS\system32\drivers\asgibokj.sys Hidden registry entry, rootkit activity | File signed by Microsoft
|||||| "aslm75" (aslm75) C:\WINDOWS\system32\drivers\aslm75.sys File found, but it contains no detailed information
|||||| "aswFsBlk" (aswFsBlk) "AVAST Software" C:\WINDOWS\system32\drivers\aswFsBlk.sys File exists
|||||| "aswRdr" (aswRdr) "AVAST Software" C:\WINDOWS\system32\drivers\aswRdr.sys File exists
|||||| "aswSnx" (aswSnx) "AVAST Software" C:\WINDOWS\system32\drivers\aswSnx.sys File exists
|||||| "aswSP" (aswSP) "AVAST Software" C:\WINDOWS\system32\drivers\aswSP.sys File exists
|||||| "avast! Asynchronous Virus Monitor" (Aavmker4) "AVAST Software" C:\WINDOWS\system32\drivers\Aavmker4.sys File exists
|||||| "avast! Network Shield Support" (aswTdi) "AVAST Software" C:\WINDOWS\system32\drivers\aswTdi.sys File exists
|||||| "avast! Standard Shield Support" (aswMon2) "AVAST Software" C:\WINDOWS\system32\drivers\aswMon2.sys File exists
"Changer" (Changer) C:\WINDOWS\system32\drivers\Changer.sys File not found
"i2omgmt" (i2omgmt) C:\WINDOWS\system32\drivers\i2omgmt.sys File not found
"lbrtfdc" (lbrtfdc) C:\WINDOWS\system32\drivers\lbrtfdc.sys File not found
|||||| "NTSIM" (NTSIM) "VIA Technologies, Inc. " C:\WINDOWS\system32\ntsim.sys File exists
"PCIDump" (PCIDump) C:\WINDOWS\system32\drivers\PCIDump.sys File not found
"PDCOMP" (PDCOMP) C:\WINDOWS\system32\drivers\PDCOMP.sys File not found
"PDFRAME" (PDFRAME) C:\WINDOWS\system32\drivers\PDFRAME.sys File not found
"PDRELI" (PDRELI) C:\WINDOWS\system32\drivers\PDRELI.sys File not found
"PDRFRAME" (PDRFRAME) C:\WINDOWS\system32\drivers\PDRFRAME.sys File not found
|||||| "PxHelp20" (PxHelp20) "Sonic Solutions" C:\WINDOWS\System32\Drivers\PxHelp20.sys File exists
|||||| "Secdrv" (Secdrv) "Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K." C:\WINDOWS\System32\DRIVERS\secdrv.sys File exists
|||||| "sptd" (sptd) "Duplex Secure Ltd." C:\WINDOWS\System32\Drivers\sptd.sys File is exclusively opened, access blocked
|||||| "vsdatant" (vsdatant) "Zone Labs Inc." C:\WINDOWS\system32\vsdatant.sys File exists
"WDICA" (WDICA) C:\WINDOWS\system32\drivers\WDICA.sys File not found
Explorer
HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components
|||||| {89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" "Microsoft Corporation" C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install File exists
{904063C3-FBCA-DB03-86F9-F6CBFF8EA932} "StubPath" C:\WINDOWS\system32\system32\win32.exe s File not found
HKLM\Software\Classes\Folder\shellex\ColumnHandlers
|||||| {F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" "Adobe Systems, Inc." C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll File exists
HKLM\Software\Classes\Protocols\Filter
|||||| {1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" "Microsoft Corporation" C:\WINDOWS\system32\mscoree.dll File exists
|||||| {1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" "Microsoft Corporation" C:\WINDOWS\system32\mscoree.dll File exists
|||||| {1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" "Microsoft Corporation" C:\WINDOWS\system32\mscoree.dll File exists
|||||| {807553E5-5146-11D5-A672-00B0D022E945} "text/xml" "Microsoft Corporation" C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL File exists
HKLM\Software\Classes\Protocols\Handler
|||||| {32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" "Microsoft Corporation" C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL File exists
|||||| {3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" "Microsoft Corporation" C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL File exists
|||||| {0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" "Microsoft Corporation" C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL File exists
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
|||||| {472083B0-C522-11CF-8763-00608CC02F24} "avast" "AVAST Software" C:\Program Files\Alwil Software\Avast5\ashShell.dll File exists
{42071714-76d4-11d1-8b24-00a0c9068ff3} "Display Panning CPL Extension" deskpan.dll File not found
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Encryption Context Menu" File not found | COM-object registry key not found
|||||| {42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" "Microsoft Corporation" C:\Program Files\Microsoft Office\OFFICE11\msohev.dll File exists
|||||| {00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" "Microsoft Corporation" C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL File exists
|||||| {0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" "Microsoft Corporation" C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL File exists
{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shell extensions for file compression" File not found | COM-object registry key not found
|||||| {E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" "Microsoft Corporation" C:\WINDOWS\system32\dfshim.dll File exists
|||||| {e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" "Microsoft Corporation" C:\WINDOWS\system32\dfshim.dll File exists
|||||| {5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll File exists
|||||| {BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Web Folders" "Microsoft Corporation" C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL File exists
|||||| {B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" "Alexander Roshal" C:\Program Files\WinRAR\rarext.dll File exists
Internet Explorer
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
|||| "DAEMON Tools Toolbar" C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll File exists
"ITBarLayout" File not found | COM-object registry key not found
"SpeedBit Video Downloader" C:\Program Files\SPEEDbit Video Downloader\Toolbar\tbcore3.dll File exists
"www.GTAViceCity.ru Toolbar" C:\Program Files\www.GTAViceCity.ru\tbwww..dll File not found
HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks
{e3600b2b-4c86-4697-96bc-74d4d209f6bc} "www.GTAViceCity.ru Toolbar" C:\Program Files\www.GTAViceCity.ru\tbwww..dll File not found
HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units
|||| {8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_29"
http://java.sun.com/update/1.6...tall-1_6_0_29-windows-i586.cab "Sun Microsystems, Inc." C:\Program Files\Java\jre6\bin\npjpi160_29.dll File exists
|||| {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} "Java Plug-in 1.6.0_29"
http://java.sun.com/update/1.6...tall-1_6_0_29-windows-i586.cab "Sun Microsystems, Inc." C:\Program Files\Java\jre6\bin\npjpi160_29.dll File exists
|||| {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_29"
http://java.sun.com/update/1.6...tall-1_6_0_29-windows-i586.cab "Sun Microsystems, Inc." C:\Program Files\Java\jre6\bin\npjpi160_29.dll File exists
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions
|||| {FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" "Microsoft Corporation" C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL File exists
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar
|||| "DAEMON Tools Toolbar" C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll File exists
"SpeedBit Video Downloader" C:\Program Files\SPEEDbit Video Downloader\Toolbar\tbcore3.dll File exists
{e3600b2b-4c86-4697-96bc-74d4d209f6bc} "www.GTAViceCity.ru Toolbar" C:\Program Files\www.GTAViceCity.ru\tbwww..dll File not found
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
|||||| {18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" "Adobe Systems Incorporated" C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll File exists
{FF7C3CF0-4B15-11D1-ABED-709549C10000} "GrabberObj Class" "SpeedBit" C:\Program Files\SPEEDbit Video Downloader\Toolbar\grabber.dll File exists
|||| {DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" "Sun Microsystems, Inc." C:\Program Files\Java\jre6\bin\jp2ssv.dll File exists
|||| {E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" "Sun Microsystems, Inc." C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll File exists
{92A9ACF4-9333-43AE-9698-DB283326F87F} "SBCONVERT Class" C:\Program Files\SPEEDbit Video Downloader\Toolbar\tbcore3.dll File exists
{389943B0-C3A2-4E69-82CB-8596A84CB3DC} "SearchPredictObj Class" "SpeedBit Ltd." C:\Program Files\SearchPredict\SearchPredict.dll File exists
{BB19B9EB-1828-466f-9B0B-209F0109A46B} "Video to MP3 Pro" "Speedbit Ltd." C:\Program Files\Video2mp3pro\BHO\V2MP3BHO.dll File exists
{e3600b2b-4c86-4697-96bc-74d4d209f6bc} "www.GTAViceCity.ru Toolbar" C:\Program Files\www.GTAViceCity.ru\tbwww..dll File not found
Logon
%AllUsersProfile%\Start Menu\Programs\Startup
|||||| "desktop.ini" C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini File exists
"ZoneAlarm.lnk" "Zone Labs Inc." C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe Shortcut exists | File exists
%UserProfile%\Start Menu\Programs\Startup
|||||| "desktop.ini" C:\Documents and Settings\Home\Start Menu\Programs\Startup\desktop.ini File exists
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
|||| "Google Update" "Google Inc." "C:\Documents and Settings\Home\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c File exists
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
|||||| "ASUS Probe" C:\Program Files\ASUS\Probe\AsusProb.exe File found, but it contains no detailed information
|||||| "avast5" "AVAST Software" C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui File exists
|||| "Smapp" "Analog Devices, Inc." C:\Program Files\Analog Devices\SoundMAX\SMTray.exe File exists
|||| "StartCCC" "Advanced Micro Devices, Inc." "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" File exists
|||| "SunJavaUpdateSched" "Sun Microsystems, Inc." "C:\Program Files\Common Files\Java\Java Update\jusched.exe" File exists
Print Monitors
HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors
|||||| "Microsoft Document Imaging Writer Monitor" "Microsoft Corporation" C:\WINDOWS\system32\mdimon.dll File exists
Services
HKLM\SYSTEM\CurrentControlSet\Services
|||||| "##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##" (Bonjour Service) "Apple Computer, Inc." C:\Program Files\Bonjour\mDNSResponder.exe File exists
|||||| ".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) "Microsoft Corporation" C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe File exists
|||||| "ASP.NET State Service" (aspnet_state) "Microsoft Corporation" C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe File exists
|||||| "ATI Smart" (ATI Smart) C:\WINDOWS\system32\ati2sgag.exe File exists
|||||| "avast! Antivirus" (avast! Antivirus) "AVAST Software" C:\Program Files\Alwil Software\Avast5\AvastSvc.exe File exists
|||||| "FLEXnet Licensing Service" (FLEXnet Licensing Service) "Macrovision Europe Ltd." C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe File exists
|||||| "Java Quick Starter" (JavaQuickStarterService) "Sun Microsystems, Inc." C:\Program Files\Java\jre6\bin\jqs.exe File exists
|||| "Machine Debug Manager" (MDM) "Microsoft Corporation" C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE File exists
|||||| "Office Source Engine" (ose) "Microsoft Corporation" C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE File exists
|||||| "SoundMAX Agent Service" (SoundMAX Agent Service (default)) "Analog Devices, Inc." C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe File exists
|||||| "TrueVector Internet Monitor" (vsmon) "Zone Labs Inc." C:\WINDOWS\system32\ZoneLabs\vsmon.exe File exists
Winlogon
HKCU\Control Panel\IOProcs
"MVB" mvfs32.dll File not found
Winsock Providers
HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries
|||||| "mdnsNSP" "Apple Computer, Inc." C:\Program Files\Bonjour\mdnsNSP.dll File exists
If You have questions or want to get some help, You can visit http://forum.online-solutions.ru

Nadam se da sam dobro ovo uradio.Msm barem se nadam :)

Preuzmi Malwarebytes Anti-Malware.
Pokreni instalaciju i tokom instalacije proveri da li su obeležene opcije:

*Update Malwarebytes' Anti-Malware;
*Launch Malwarebytes' Anti-Malware;

...zatim klikni na Finish.
Nakon ažuriranja program će se pokrenuti.
Odaberi opciju Perform Quick Scan i klikni Scan.
Kada skeniranje bude završeno klikni Ok, Show Result.
Ukoliko se na listi bude nalazio detektovani malware, štikliraj sve objekte i klikni Remove Selected.
Obavezno dozvoliti restart Windowsa ako program to zatraži.
Nakon završenog procesa program će kreirati log file.
Kopiraj sadržaj tog log-a ovde u temu.

---

Malwarebytes Anti-Malware (Trial) 1.60.1.1000
www.malwarebytes.org

Database version: v2012.03.02.02

Windows XP Service Pack 2 x86 NTFS
Internet Explorer 6.0.2900.2180
Home :: HOME-C7F1EC7ED1 [administrator]

Protection: Enabled

3/2/2012 10:05:33 AM
mbam-log-2012-03-02 (10-11-39).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 169089
Time elapsed: 5 minute(s), 51 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 5
C:\Documents and Settings\Home\Application Data\logs.dat (Bifrose.Trace) -> No action taken.
C:\WINDOWS\system32\H@tKeysH@@k.DLL (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\system32\logg.dat (Backdoor.Bifrose) -> No action taken.
C:\Documents and Settings\Home\Local Settings\Temp\UuU.uUu (Malware.Trace) -> No action taken.
C:\Documents and Settings\Home\Local Settings\Temp\XxX.xXx (Malware.Trace) -> No action taken.

(end)

PC se restartova i malo mu je duze trebalo da se podigne.sad sam gledao u task menager-u meni tih prvih 5 minuta neocitava User-a.Plopce i dalje kad god Windows izbaci da li hocu da sacuvam fajl ili da ga odbacim i tako te stvari!Pitao bih vas da li to moze da bude do nekih podesavanja ili tako nesto!i kako mogu da vratim sva podesavanja na Default!

Pokušaj pomoću ovog programa da dovedeš u red Task Manager.
Pokreni program, selektuj samo Task Manager za reparaciju i klikni na Re-Enable. Restartuj računar i proveri kakvo je stanje.

---

Uradio sve kako ste mi rekli ali opet isti problem.pre neki dan sam gledao nesto na youtub-u i to sam isprobavao na tim videima kazu da to fercera ali mozda je zbog toga ovaj problem i nastao.evo pa pogledajte.
http://www.youtube.com/watch?v=HlROhjTIJvs
http://www.youtube.com/watch?v=W7V6KVk_O98 mislim da je ovaj u pitanju
http://www.youtube.com/watch?v=rYSPLAXrB94
http://www.youtube.com/watch?v=LdqdHaJctaY
http://www.youtube.com/watch?v=ivo-Sfx9haY

Pazi ovako: koristiš Win XP SP2, kojeg se i rođeni proizvođač davno odrekao. Nije ti dovoljan samo AV, moraš zakrpiti rupe na operativnom sistemu da ti se malware ne uvlači na mala vrata i blokira rad AV skenera.

Drugo, Aleksandar Maletić ti je napomenuo



a u tvom izveštaju stoji:



Da li si ih uklonio prema onome kako je traženo od tebe, ili si samo poterao skener i okačio ovde izveštaj?

Treće, računar ti je definitivno zaražen, pronađeni su i tragovi nimalo naivnih trojanaca, vreme je da, ako već nisi, skeniraš računar iz safe mode-a ili pomoću nekog LiveCD rešenja, jer ovo društvo koje se uselilo kod tebe ume sasvim lepo da se sakrije.

Moja preporuka je da pokreneš Safe Mode with Networking (prilikom paljenja računara pritiskaš uzastopno F8 taster sve dok ne dobiješ meni u kojem ti se nudi više varijanti Safe Mode-a, Normal Mode, Last Known Good Configuration itd., pa odaberi onaj malo pre pomenuti), a zatim preuzmi svežu kopiju Dr.Web CureIt! i odradi sken i dezinfikuj/ukloni sve što se pronađe. Probaj i kako se u safe mode-u otvara task manager, ako radi kako treba, definitivno imaš problema sa malware-om ili oštećenim drajverima.

Druga opcija je da skineš i narežeš Dr.Web LiveCD, pa sa njega bootuješ računar, odradiš skeniranje i potamaniš sve što nađe. Možeš iskoristiti i Kaspersky RescueDisk 10 ako želiš.

Preporučujem da kad odradiš sva ova skeniranja i bootuješ se nazad u normalni mod, pokreneš sfc /scannow iz command prompta, moguće i da su neki sistemski fajlovi oštećeni iz bilo kog razloga, pa da zato brljavi.

Pratio sve ono sto je taj malwer program trazio od mene skenirao/uklonio i restartovao racunar.E sad posto mi rezac neradi kako treba neverujem da cu Dr.Web CureIt! moci narezati na cd pa ga tako boot-ovati .Da li to moze samo da se skine pa u safe modu pokrenuti kao aplikacija ili tako nesto posto nisam upoznat sa tim programom.Koristim avast home anti virus i prvo sto sam uradio jeste skeniranje celokupnog hdd-a,naravno nista nije nasao.Probavao sam sa System restroe ali opet se problem pojavljuje.

M
oze li nesto da mi pomogne vracanje na Last Known Good Configuration??????

DR.Web Cureit! prikazuje ovo sta da radim?

To što ti Dr.Web CureIt pokazuje jeste Emergency mode koji možeš da aktiviraš tako što ćeš kliknuti na Ok. To je čak i preporuka, no tada je jedino skener aktivan i nijedan drugi prozor ili program ne možeš da pokreneš tokom rada.
Pokušaj sa Dr.Web CureIt-om, ako ne bude uspeha uradi sledeće. Rekao si da ti ne radi čitač, onda pokušaj ovako:

Preuzmi Kaspersky Virus Removal Tool.
Restartuj Windows i pritiskaj taster F8.
U meniju odaberi opciju Safe Mode.
Pokreni Kaspersky Virus Removal Tool 2011.
Štikliraj "I accept the license agreement" i klikni na Start.
Kada se program startuje, odaberi opciju Settings i pod karticom Scan scope štikliraj sve objekte.
Pod karticom Action obeleži Select action i proveri da li su štiklirane opcije:
*Disinfect;
*Delete if disinfection fails;
Zatim u gornjem levom uglu odaberi karticu Automatic Scan.
Klikni na Start scanning da bi pokrenuo skeniranje.
Proces će potrajati. Nakon završenog skeniranja restartuj Windows.

---