Savet za Hijack This log, šta brisati

Axa znaci ovo sto su mi oni pricali nije virus vec ima neke veze sa torentom? Trenutno nemam vremena da probam da skeniram komp. Sa ovim programima sto si mi dao pa kad budem imao uradicu... Drago mi je da ono nije nikakav virus ako si to htio da kazes

ovako...hm...programčići o kojima sam govorio su vrlo često virusi.a torrent je čest put zaraze tako da nemoj da se zavaravaš nego odradi to :D

---

evo nasao mi je ovaj antivirus sto si mi dao ovo je li to to? to je bio virus neki?

Hitman Pro je detektovao sumnjivo ponasanje koje nije karakteristicno za sistem koji normalno radi. Ako je Task Manager onesposobljen velika je verovatnoca da je malware to prouzrokovao. U tvom slucaju, malware vise nije prisutan, ali su ostale posledice. Hitman ti je ponudio Repair Task Manager-a, odradi to.

---

moze li neko da mi kaze ima li sta ovamo ovo je jedan drugi windows cini mi se da u njega nema upakovan virus kao u onaj
.
DDS (Ver_2011-06-23.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421
Run by laki at 23:17:15 on 2011-08-04
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.381.1033.18.4095.3174 [GMT 2:00]
.
AV: Kaspersky Anti-Virus *Enabled/Updated* {2EAA32A5-1EE1-1B22-95DA-337730C6E984}
SP: Kaspersky Anti-Virus *Enabled/Updated* {95CBD341-38DB-14AC-AF6A-08054B41A339}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\avp.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Rainmeter\Rainmeter.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\avp.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
mWinlogon: Userinit=userinit.exe
BHO: IEVkbdBHO Class: {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\ievkbd.dll
BHO: FilterBHO Class: {e33cf602-d945-461a-83f0-819f76a199f8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\klwtbbho.dll
mRun: [AVP] "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\avp.exe"
StartupFolder: C:\Users\laki\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\RAINME~1.LNK - C:\Program Files\Rainmeter\Rainmeter.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {4248FE82-7FCB-46AC-B270-339F08212110} - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\ievkbd.dll
IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\klwtbbho.dll
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
TCP: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{9462F3A6-F686-4A8A-AFA8-AC883CBE4582} : DhcpNameServer = 192.168.1.254
BHO-X64: IEVkbdBHO Class: {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\ievkbd.dll
BHO-X64: IEVkbdBHO - No File
BHO-X64: FilterBHO Class: {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\klwtbbho.dll
BHO-X64: link filter bho - No File
mRun-x64: [AVP] "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\avp.exe"
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\laki\AppData\Roaming\Mozilla\Firefox\Profiles\lbr8e0ms.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrlui.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
.
============= SERVICES / DRIVERS ===============
.
R1 kl2;kl2;C:\Windows\system32\DRIVERS\kl2.sys --> C:\Windows\system32\DRIVERS\kl2.sys [?]
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;C:\Windows\system32\DRIVERS\klim6.sys --> C:\Windows\system32\DRIVERS\klim6.sys [?]
R2 AVP;Kaspersky Anti-Virus Service;C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\avp.exe [2011-4-24 202296]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
R2 nvUpdatusService;NVIDIA Update Service Daemon;C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-8-4 2214504]
R3 klmouflt;Kaspersky Lab KLMOUFLT;C:\Windows\system32\DRIVERS\klmouflt.sys --> C:\Windows\system32\DRIVERS\klmouflt.sys [?]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;C:\Windows\system32\drivers\nvhda64v.sys --> C:\Windows\system32\drivers\nvhda64v.sys [?]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
.
=============== Created Last 30 ================
.
2011-08-04 15:37:43 -------- d-----w- C:\Windows\System32\SPReview
2011-08-04 15:37:32 -------- d-----w- C:\Windows\System32\EventProviders
2011-08-04 15:35:59 485888 ----a-w- C:\Windows\System32\secproc_isv.dll
2011-08-04 15:34:59 82944 ----a-w- C:\Windows\SysWow64\iccvid.dll
2011-08-04 15:33:58 529408 ----a-w- C:\Windows\System32\wbemcomn.dll
2011-08-04 14:47:52 -------- d-----w- C:\Windows\SysWow64\Wat
2011-08-04 14:47:52 -------- d-----w- C:\Windows\System32\Wat
2011-08-04 12:43:26 -------- d-----w- C:\Windows\Panther
2011-08-04 11:50:30 -------- d-----w- C:\Users\laki\AppData\Local\WindowsUpdate
2011-08-04 04:03:03 294912 ----a-w- C:\Windows\System32\browserchoice.exe
2011-08-04 03:53:27 -------- d-----w- C:\Users\laki\AppData\Roaming\Rainmeter
2011-08-04 03:53:22 -------- d-----w- C:\Program Files\Rainmeter
2011-08-04 03:36:34 -------- d-----w- C:\ProgramData\Kaspersky Lab
2011-08-04 03:36:34 -------- d-----w- C:\Program Files (x86)\Kaspersky Lab
2011-08-04 03:36:17 -------- d-sh--w- C:\Windows\Installer
2011-08-04 03:29:30 23112 ----a-w- C:\Windows\System32\drivers\hitmanpro35.sys
2011-08-04 03:29:13 -------- d-----w- C:\Program Files\Hitman Pro 3.5
2011-08-04 03:29:07 -------- d-----w- C:\ProgramData\Hitman Pro
2011-08-04 03:20:42 8578896 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{A1D7C883-516C-4B35-93E3-A6C51F5AA90C}\mpengine.dll
2011-08-04 03:14:26 861696 ----a-w- C:\Windows\System32\oleaut32.dll
2011-08-04 03:14:26 571904 ----a-w- C:\Windows\SysWow64\oleaut32.dll
2011-08-04 03:14:06 404640 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2011-08-04 03:11:07 31232 ----a-w- C:\Windows\SysWow64\prevhost.exe
2011-08-04 03:11:07 31232 ----a-w- C:\Windows\System32\prevhost.exe
2011-08-04 03:11:04 976896 ----a-w- C:\Windows\System32\inetcomm.dll
2011-08-04 03:11:04 741376 ----a-w- C:\Windows\SysWow64\inetcomm.dll
2011-08-04 03:10:59 90624 ----a-w- C:\Windows\System32\drivers\bowser.sys
2011-08-04 03:00:22 -------- d-----w- C:\Program Files (x86)\NVIDIA Corporation
2011-08-04 03:00:09 739432 ----a-w- C:\Windows\System32\easyupdatusapiu64.dll
2011-08-04 03:00:09 6300776 ----a-w- C:\Windows\System32\nvcpl.dll
2011-08-04 03:00:09 61544 ----a-w- C:\Windows\System32\nvshext.dll
2011-08-04 03:00:09 3040872 ----a-w- C:\Windows\System32\nvsvc64.dll
2011-08-04 03:00:09 117864 ----a-w- C:\Windows\System32\nvmctray.dll
2011-08-04 03:00:09 1016936 ----a-w- C:\Windows\System32\nvvsvc.exe
2011-08-04 03:00:06 -------- d-----w- C:\ProgramData\NVIDIA Corporation
2011-08-04 02:54:47 995328 ----a-w- C:\Program Files\Common Files\Microsoft Shared\VGX\VGX.dll
.
==================== Find3M ====================
.
2011-08-04 15:42:11 175616 ----a-w- C:\Windows\System32\msclmd.dll
2011-08-04 15:42:11 152576 ----a-w- C:\Windows\SysWow64\msclmd.dll
2011-06-11 03:07:25 3137536 ----a-w- C:\Windows\System32\win32k.sys
2011-06-03 06:57:45 362496 ----a-w- C:\Windows\System32\wow64win.dll
2011-06-03 06:57:45 243200 ----a-w- C:\Windows\System32\wow64.dll
2011-06-03 06:57:45 13312 ----a-w- C:\Windows\System32\wow64cpu.dll
2011-06-03 06:57:44 214528 ----a-w- C:\Windows\System32\winsrv.dll
2011-06-03 06:57:38 16384 ----a-w- C:\Windows\System32\ntvdm64.dll
2011-06-03 06:56:38 421888 ----a-w- C:\Windows\System32\KernelBase.dll
2011-06-03 06:53:33 338944 ----a-w- C:\Windows\System32\conhost.exe
2011-06-03 06:00:53 14336 ----a-w- C:\Windows\SysWow64\ntvdm64.dll
2011-06-03 05:57:52 44032 ----a-w- C:\Windows\apppatch\acwow64.dll
2011-06-03 05:57:33 25600 ----a-w- C:\Windows\SysWow64\setup16.exe
2011-06-03 05:56:12 5120 ----a-w- C:\Windows\SysWow64\wow32.dll
2011-06-03 05:56:11 272384 ----a-w- C:\Windows\SysWow64\KernelBase.dll
2011-06-03 03:53:31 7680 ----a-w- C:\Windows\SysWow64\instnm.exe
2011-06-03 03:53:31 2048 ----a-w- C:\Windows\SysWow64\user.exe
2011-06-03 03:48:32 3584 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
2011-06-03 03:48:31 6144 ---ha-w- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
2011-06-03 03:48:31 4608 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
2011-06-03 03:48:31 3072 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
2011-05-24 11:42:55 404480 ----a-w- C:\Windows\System32\umpnpmgr.dll
2011-05-24 10:40:05 64512 ----a-w- C:\Windows\SysWow64\devobj.dll
2011-05-24 10:40:05 44544 ----a-w- C:\Windows\SysWow64\devrtl.dll
2011-05-24 10:39:38 145920 ----a-w- C:\Windows\SysWow64\cfgmgr32.dll
2011-05-24 10:37:54 252928 ----a-w- C:\Windows\SysWow64\drvinst.exe

samo me interesuje sta je ovo sto mi je hitman pronasao


<?xml version="1.0"?>
-<Log filesProcessed="10877" timeSpentInSecs="58" reboot="yes" date="2011-08-06T05:09:33" version="3.5.9.127" scan="EWS" computer="LAKI-PC">-<
Item status="None" score="-93.0" type="EWS"><
File hash="D7B34B6C2C5BD3C8141895AC21BB637EA5E3C4F7A85EEF4C4C36E6BB2045A3D9" path="C:\Windows\system32\DRIVERS\usbehci.sys"/>-<Startup><
Key path="HKLM\SYSTEM\CurrentControlSet\Services\usbehci\"/></Startup></Item>-<Item status="PendingDelete" score="7.0" type="EWS"><File hash="776D86A032DCA2842EF7AADB35473193CA80547223EFAA7F110F296C377077B0" path="C:\Windows\system32\drivers\usbohci.sys"/>-<Startup>
<Key path="HKLM\SYSTEM\CurrentControlSet\Services\usbohci\"/>
</Startup>
</Item>-
<Item status="None" score="-93.0" type="EWS">
<File hash="C58E21424718729324B285BEE1C96551540FCC3FD650B2D10895EBA48D981E25" path="C:\Windows\system32\DRIVERS\usbuhci.sys"/>-<Startup>
<Key path="HKLM\SYSTEM\CurrentControlSet\Services\usbuhci\"/>
</Startup>
</Item>
</Log>
je li ovo isto neki virus?
ovaj hitman je bas cudan jedini on mi nalazi sve i svasta

Nije virus http://www.bleepingcomputer.com/filedb/usbehci.sys-2937.html

Obrisi taj program sta ce ti to.

@hejejj,
Hitman Pro ti je stvarno bespotreban, deinstaliraj ga. To je pre svega komercijalan program, ujedno mi se i ne cini preterano pouzdanim. Pretpostavljam da vec koristis neki antivirus, gledaj da bude legalan: ili licenciran, placen ili besplatna verzija tipa Avast, Avira, AVG, MSE...
Uz antivirus koristi dodatak u vidu antispyware/antimalware programa (Malwarebytes' Anti-Malware, SuperAntiSpyware) i povremeno skeniraj kompletan hard disk.

---

ovaj...pa ne bi toliko da napadam hitmanpro jer meni nije brljavio pa ga koristim.elem...ovaj a ta tvoja kopija windowsa je isto doshla preko torrenta?
odradi i ovo:
Idi u Start meni>AlL Programs>Accessories>Command Prompt(desni kilk Run as Administrator)
onda kucaj ovu komandu:

SFC /SCANNOW

(onda lupi ENTER)
Onda sačekaj da završi pa javi šta kaže

_{[Ovu poruku je menjao Vodomar dana 06.08.2011. u 14:47 GMT+1]}

---

Nisam imao nameru da pljujem po programu, koristio sam ga odredjeno vreme. Ne zameri.
Jednostavno mi nije po meri. Neverujem mu preterano.

---

ma ok ne vezujem se emotivno za programe haha

---

odradio sam SFC /SCANNOW
windows resource protection did not find any integrity violations.
ok nema nista.. :P

Da li vas dvojica primecujete razliku izmedju usbuhci, usbohci i usbehci? Sve tri reci se pojavljuju na citiranim slikama i logovima?!

i sta bi to trebalo da znaci? :-)

Sve je to legalno "Microsoft USB Universal Host Controller Miniport Driver"

pa ako nema nekih problema to je to.ili ga deinstaliraj ili prijavi lažno pozitivan nalaz(što bi ja uradio) klikom na Ignore gore desno.Bitno je da skeniraš komp redovno legalnim softverom-da li će to biti besplatan softver ili neka poklon licenca nebitno je samo nemoj da koristiš softver koji dolazi sa sumnjivih sajtova-obrati pažnju na WOT rang ili da koristiš licence čije je poreklo takođe sumnjivo.Kasperski ili ESET to provale.A na skidanje sigurnosnih programa preko torrenta naprosto zaboravi.

_{[Ovu poruku je menjao Vodomar dana 06.08.2011. u 23:34 GMT+1]}

---

pa nista, cudno mi je da jedan drajver ima tri imena :)

hahaha pa ima i on nadimak :-)