Vec neko vreme PC mi odjednom podivlja, cpu radi sa 100% bez ikakvog razloga. Lutajuci task menadzerom nasao sam da mi je stalno prisutan proces csrss.exe i da ga nije moguce obrisati ili zaustaviti.

Na stranici http://www.pcpowerguide.com/processes/exe/csrss-exe-removal/  sam nasao objasnjenje, ali engleski bas ne poznajem kako treba pa molim za pomoc.

Napomenjem da imam samo jedan profil na pc a koliko kontam on ovdje prdlaze brisanje profila kao konacno resenje.

Ako je neko imao slican problem, pomogao bi mi svaki savjet.

Preuzmi program Malwarebytes' Anti-Malware
Dvoklikom pokreni instalaciju
Na samom pocetku proveri da li su stiklirane ove opcije
Update Malwarebytes' Anti-Malware
Launch Malwarebytes Anti-Malware

Zatim klikni Finish.

Izaberi opciju Perform Quick Scan i klikni Scan.
Po završetku procesa klikni OK, Show Results: u listi detektovanog malware-a proveri da li su obelezene sve stavke i klikni Remove Selected.

*Po zavrsetku ciscenja zakaci MBAM log na forum.

..........


Preuzmi DDS Program na Desktop
http://download.bleepingcomputer.com/sUBs/dds.com

Dvoklikom pokreni dds.scr

Kad zavrsi, DDS ce otvoriti dva loga:
         1. DDS.txt
         2. Attach.txt

Oba izvestaja sacuvaj na Desktop.
*Kopiraj mi DDS.txt

MBAM log

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verzija baze podataka: 4422

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

11/6/2010 2:34:44 PM
mbam-log-2010-11-06 (14-34-44).txt

Tip provjere: Brza provjera
Provjereni objekti: 129432
Vrijeme trajanja: 6 minuta, 33 sekundi

Zaraženi procesi u memoriji: 0
Zaraženi moduli u memoriji: 0
Zaraženi kljuèevi u registru: 2
Zaražene vrijednosti u registru: 0
Zaraženi podaci u registru: 3
Zaraženi direktoriji: 1
Zaražene datoteke: 4

Zaraženi procesi u memoriji:
(Zloæudne stavke nisu otkrivene)

Zaraženi moduli u memoriji:
(Zloæudne stavke nisu otkrivene)

Zaraženi kljuèevi u registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DRM\amty (Worm.Autorun) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831} (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.

Zaražene vrijednosti u registru:
(Zloæudne stavke nisu otkrivene)

Zaraženi podaci u registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Zaraženi direktoriji:
C:\Program Files\RelevantKnowledge (Spyware.MarketScore) -> Quarantined and deleted successfully.

Zaražene datoteke:
C:\WINDOWS\RegGenieOnUninstall.exe (Spyware.Passwords) -> Quarantined and deleted successfully.
C:\Program Files\RelevantKnowledge\MSVCP71.DLL (Spyware.MarketScore) -> Quarantined and deleted successfully.
C:\Program Files\RelevantKnowledge\MSVCR71.DLL (Spyware.MarketScore) -> Quarantined and deleted successfully.
C:\Program Files\RelevantKnowledge\rlservice.exe (Spyware.MarketScore) -> Quarantined and deleted successfully.




DDS



DDS (Ver_10-11-05.01) - NTFSx86 
Run by samir at 14:37:33.37 on Sat 11/06/2010
Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_21
Microsoft Windows XP Professional  5.1.2600.3.1252.1.1033.18.1535.969 [GMT 1:00]

AV: Lavasoft Ad-Watch Live! Anti-Virus *On-access scanning disabled* (Updated)   {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\tsnpstd3.exe
C:\WINDOWS\vsnpstd3.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Documents and Settings\samir\Desktop\dds.com

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [RegGenie v2.0 - Trial Expired] "c:\program files\reggenie\RegGenieOnRebootExpired.exe"
uRun: [RegGenie v2.0] "c:\program files\reggenie\RegGenieOnReboot.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
mRun: [TrayServer] c:\program files\magix\movies_on_dvd_7_terratec_edition\TrayServer.exe
mRun: [tsnpstd3] c:\windows\tsnpstd3.exe
mRun: [snpstd3] c:\windows\vsnpstd3.exe
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1281615552093
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: {6A16AE7D-F5B3-4057-93A4-2F7402B5AD46} = 195.66.189.137 195.66.189.138
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\samir\applic~1\mozilla\firefox\profiles\tixgsfjp.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - component: c:\program files\mozilla firefox\extensions\{ab2ce124-6272-4b12-94a9-7303c7397bd1}\components\SkypeFfComponent.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqz9s", true); // Traditional
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqs8s", true); // Simplified
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--j6w193g", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4a87g", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7c0a67fbc", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7cvafr", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kpry57d", true);  // Traditional
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kprw13d", true);  // Simplified

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-10-30 64288]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2010-8-12 304464]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2010-8-12 20952]
S0 TfFsMon;TfFsMon;c:\windows\system32\drivers\tffsmon.sys --> c:\windows\system32\drivers\TfFsMon.sys [?]
S0 TfSysMon;TfSysMon;c:\windows\system32\drivers\tfsysmon.sys --> c:\windows\system32\drivers\TfSysMon.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 denemz;Boot Security;c:\windows\system32\svchost.exe -k netsvcs [2008-4-14 14336]
S2 hjsnph;jfkpgidk;c:\windows\system32\svchost.exe -k netsvcs [2008-4-14 14336]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-9-8 1357464]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\magix\common\database\bin\fbserver.exe [2010-8-25 1527900]
S3 TfNetMon;TfNetMon;\??\c:\windows\system32\drivers\tfnetmon.sys --> c:\windows\system32\drivers\TfNetMon.sys [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

=============== Created Last 30 ================

2010-11-06 13:35:02   54016   ----a-w-   c:\windows\system32\drivers\jyrc.sys
2010-11-06 12:11:18   --------   d-----w-   c:\docume~1\alluse~1\applic~1\PC Tools
2010-11-06 12:05:58   --------   d-----w-   c:\docume~1\samir\applic~1\GetRightToGo
2010-11-06 11:47:40   --------   d-----w-   c:\program files\GustoSoft
2010-11-06 11:03:44   --------   d-----w-   c:\program files\Video Capture Master
2010-11-06 10:35:40   --------   d-----w-   c:\program files\RegGenie
2010-11-06 09:35:41   --------   d-----w-   C:\tmp99
2010-11-03 13:20:28   --------   d-----w-   c:\program files\Enigma Software Group
2010-11-03 13:20:07   --------   d-----w-   c:\windows\4FC9DA9DF608454E8191D7EFFDCC5726.TMP
2010-11-03 13:20:05   --------   d-----w-   c:\program files\common files\Wise Installation Wizard
2010-11-02 15:33:45   --------   d--h--w-   C:\$AVG
2010-10-30 10:21:44   15880   ----a-w-   c:\windows\system32\lsdelete.exe
2010-10-30 09:24:39   95024   ----a-w-   c:\windows\system32\drivers\SBREDrv.sys
2010-10-30 09:12:34   64288   ----a-w-   c:\windows\system32\drivers\Lbd.sys
2010-10-30 09:11:34   --------   dc-h--w-   c:\docume~1\alluse~1\applic~1\{437292BE-95BD-4B12-B699-6D217A03ACAF}
2010-10-30 09:11:17   --------   d-----w-   c:\program files\Lavasoft
2010-10-24 09:04:50   --------   d-----w-   c:\program files\Photo Story 3 for Windows
2010-10-24 08:59:18   221184   ----a-w-   c:\windows\system32\wmpns.dll
2010-10-24 08:59:13   --------   d-----w-   c:\program files\Windows Media Connect 2
2010-10-23 12:20:22   --------   d-----r-   c:\program files\Skype
2010-10-20 11:51:45   --------   d-----w-   c:\docume~1\samir\applic~1\Canneverbe Limited
2010-10-20 11:51:44   --------   d-----w-   c:\docume~1\alluse~1\applic~1\Canneverbe Limited
2010-10-20 11:51:33   7168   ----a-w-   c:\windows\system32\drivers\StarOpen.sys
2010-10-20 11:17:52   --------   d-----w-   c:\docume~1\samir\applic~1\AVI ReComp
2010-10-20 11:17:35   --------   d-----w-   c:\program files\Xvid
2010-10-20 11:17:24   --------   d-----w-   c:\program files\AviSynth 2.5
2010-10-20 11:17:16   --------   d-----w-   c:\program files\AVI ReComp
2010-10-11 11:03:45   28672   ----a-w-   c:\windows\system32\AVEQT.dll
2010-10-11 11:03:45   129024   ----a-w-   c:\windows\system32\AVERM.dll
2010-10-11 11:03:43   --------   d-----w-   c:\program files\Ultra Video Joiner
2010-10-11 07:31:14   --------   d-----w-   c:\docume~1\samir\locals~1\applic~1\OpenCandy
2010-10-11 07:31:13   --------   d-----w-   c:\docume~1\samir\applic~1\OpenCandy
2010-10-11 07:25:10   --------   d-----w-   c:\docume~1\samir\applic~1\AnvSoft
2010-10-11 07:25:06   --------   d-----w-   c:\program files\AnvSoft
2010-10-08 13:35:14   94208   ------w-   c:\windows\amcap.exe
2010-10-08 13:35:09   94208   ------w-   c:\windows\tsnpstd3.exe
2010-10-08 13:35:09   339968   ----a-w-   c:\windows\vsnpstd3.exe
2010-10-08 13:35:08   8718848   ----a-w-   c:\windows\system32\drivers\snpstd3.sys
2010-10-08 13:35:06   61440   ----a-w-   c:\windows\system32\csnpstd3.dll
2010-10-08 13:35:06   61440   ------w-   c:\windows\system32\rsnpstd3.dll
2010-10-08 13:35:06   53248   ----a-w-   c:\windows\vsnpstd3.dll
2010-10-08 13:35:06   53248   ------w-   c:\windows\system32\vsnpstd3.dll
2010-10-08 13:35:05   20480   ------w-   c:\windows\usnpstd3.exe
2010-10-08 13:35:05   --------   d-----w-   c:\program files\common files\snpstd3
2010-10-08 13:34:53   696320   ----a-w-   c:\program files\common files\installshield\professional\runtime\0701\intel32\iKernel.dll
2010-10-08 13:34:53   57344   ----a-w-   c:\program files\common files\installshield\professional\runtime\0701\intel32\ctor.dll
2010-10-08 13:34:53   5632   ----a-w-   c:\program files\common files\installshield\professional\runtime\0701\intel32\DotNetInstaller.exe
2010-10-08 13:34:53   32768   ----a-w-   c:\program files\common files\installshield\professional\runtime\Objectps.dll
2010-10-08 13:34:53   237568   ----a-w-   c:\program files\common files\installshield\professional\runtime\0701\intel32\iscript.dll
2010-10-08 13:34:53   155648   ----a-w-   c:\program files\common files\installshield\professional\runtime\0701\intel32\iuser.dll
2010-10-08 13:34:52   282756   ----a-w-   c:\program files\common files\installshield\professional\runtime\0701\intel32\setup.dll
2010-10-08 13:34:52   163972   ----a-w-   c:\program files\common files\installshield\professional\runtime\0701\intel32\iGdi.dll
2010-10-08 08:37:15   73728   ----a-w-   c:\windows\system32\javacpl.cpl
2010-10-08 08:37:15   423656   ----a-w-   c:\windows\system32\deployJava1.dll
2010-10-08 08:37:15   423656   ----a-w-   c:\program files\mozilla firefox\plugins\npdeployJava1.dll

==================== Find3M  ====================

2010-09-18 10:48:12   234576   ----a-w-   c:\windows\system32\PnkBstrB.xtr
2010-09-18 10:48:12   234576   ----a-w-   c:\windows\system32\PnkBstrB.exe
2010-09-18 10:33:14   75064   ----a-w-   c:\windows\system32\PnkBstrA.exe
2010-08-10 15:16:25   246   ----a-w-   c:\documents and settings\samir\dl.exe
2010-08-10 15:00:44   189584   ----a-w-   c:\windows\system32\WISPTIS.EXE
2010-08-10 15:00:36   44216   ----a-w-   c:\windows\system32\tscupgrd.exe

============= FINISH: 14:37:56.21 ===============





Attach




UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-11-05.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 8/12/2010 11:31:24 AM
System Uptime: 11/6/2010 2:18:05 PM (0 hours ago)

Motherboard: ASUSTeK Computer Inc. |  | P5PE-VM
Processor:               Intel(R) Celeron(R) D CPU 3.20GHz | Socket 775 | 3201/133mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 39 GiB total, 8.97 GiB free.
D: is FIXED (NTFS) - 39 GiB total, 7.97 GiB free.
E: is FIXED (NTFS) - 35 GiB total, 5.213 GiB free.
F: is FIXED (NTFS) - 35 GiB total, 6.055 GiB free.
G: is CDROM ()
H: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP37: 10/7/2010 3:55:56 PM - System Checkpoint
RP38: 10/8/2010 10:36:59 AM - Installed Java(TM) 6 Update 20
RP39: 10/8/2010 3:35:04 PM - Installed MSI Star Cam 370i
RP40: 10/8/2010 3:35:57 PM - Unsigned driver install
RP41: 10/8/2010 5:15:58 PM - Installed Java(TM) 6 Update 21
RP42: 10/11/2010 7:55:02 AM - System Checkpoint
RP43: 10/11/2010 9:33:08 AM - Installed Registry Reviver.
RP44: 10/13/2010 7:31:05 AM - System Checkpoint
RP45: 10/14/2010 1:45:32 PM - System Checkpoint
RP46: 10/15/2010 2:10:53 PM - System Checkpoint
RP47: 10/19/2010 9:02:13 AM - System Checkpoint
RP48: 10/20/2010 3:10:17 PM - System Checkpoint
RP49: 10/22/2010 10:55:45 AM - System Checkpoint
RP50: 10/23/2010 11:26:50 AM - System Checkpoint
RP51: 10/24/2010 10:57:40 AM - Installed Windows Media Player 11
RP52: 10/24/2010 10:58:01 AM - Installed Windows XP Wudf01000.
RP53: 10/24/2010 10:59:32 AM - Installed Windows XP MSCompPackV1.
RP54: 10/24/2010 11:04:48 AM - Installed Photo Story 3 for Windows
RP55: 10/25/2010 1:36:09 PM - System Checkpoint
RP56: 10/27/2010 10:10:45 AM - System Checkpoint
RP57: 10/30/2010 1:14:36 PM - System Checkpoint
RP58: 11/1/2010 8:38:23 AM - System Checkpoint
RP59: 11/2/2010 3:27:17 PM - System Checkpoint
RP60: 11/3/2010 2:20:27 PM - Installed SpyHunter
RP61: 11/3/2010 4:22:50 PM - Removed SpyHunter
RP62: 11/5/2010 11:26:48 AM - System Checkpoint
RP63: 11/6/2010 11:38:58 AM - RegGenie Safe Scan Backup
RP64: 11/6/2010 11:41:08 AM - RegGenie Safe Scan Backup

==== Installed Programs ======================

ACDSee 10 Photo Manager
Ace DivX Player v2.1
Ad-Aware
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.4.0
Any Audio Converter 3.0.7
Any Video Converter 3.0.7
Apple Application Support
Apple Software Update
ATI - Software Uninstall Utility
ATI Display Driver
AVI ReComp 1.5.1
AviSynth 2.5
CDBurnerXP
COWON Media Center - jetAudio Basic VX
Driver Genius Professional Edition
Firebird SQL Server - MAGIX Edition
HijackThis 2.0.2
Hotfix for Windows XP (KB942288-v3)
Java Auto Updater
Java(TM) 6 Update 21
K-Lite Codec Pack 6.2.0 (Full)
MAGIX Movies on DVD TerraTec Edition 7.0.3.6 (UK)
MAGIX Screenshare 4.3.6.1987 (UK)
Malwarebytes' Anti-Malware
Microsoft .NET Framework 2.0
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Extended
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office Professional Edition 2003
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Mozilla Firefox (3.6.12)
MSI Star Cam 370i
MSVCRT
OpenGL Extensions Viewer 3.0
PCI SoftV92 Modem
Photo Story 3 for Windows
QuickTime
RegGenie v2.0
Segoe UI
Skype Toolbars
Skype™ 5.0
Subtitle Workshop 2.51
Trillian
Ultra Video Joiner 5.2.0210
Update for Windows XP (KB898461)
Video Capture Master 8.1.0.8
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
VobSub 2.23
WebFldrs XP
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Live Upload Tool
Windows Media Format 11 runtime
Windows Media Player 11
WinRAR archiver
Wolfenstein - Enemy Territory
Xvid 1.2.2

==== Event Viewer Messages From Past Week ========

11/6/2010 2:19:56 PM, error: Service Control Manager [7026]  - The following boot-start or system-start driver(s) failed to load:  TfFsMon TfSysMon
11/6/2010 1:29:39 PM, error: DCOM [10005]  - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
11/6/2010 1:29:20 PM, error: DCOM [10005]  - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
11/6/2010 1:29:04 PM, error: Service Control Manager [7026]  - The following boot-start or system-start driver(s) failed to load:  AFD Fips intelppm IPSec MRxSmb NetBIOS NetBT pctgntdi RasAcd Rdbss Tcpip WS2IFSL
11/6/2010 1:29:04 PM, error: Service Control Manager [7001]  - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error:  A device attached to the system is not functioning.
11/6/2010 1:29:04 PM, error: Service Control Manager [7001]  - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error:  A device attached to the system is not functioning.
11/6/2010 1:29:04 PM, error: Service Control Manager [7001]  - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error:  A device attached to the system is not functioning.
11/6/2010 1:29:04 PM, error: Service Control Manager [7001]  - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error:  A device attached to the system is not functioning.
11/6/2010 1:26:15 PM, error: Service Control Manager [7034]  - The PC Tools Security Service service terminated unexpectedly.  It has done this 1 time(s).
11/3/2010 8:13:22 AM, error: SideBySide [59]  - Resolve Partial Assembly failed for Microsoft.VC80.MFCLOC. Reference error message: The referenced assembly is not installed on your system. .
11/3/2010 8:13:22 AM, error: SideBySide [59]  - Generate Activation Context failed for C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\MFC80.DLL. Reference error message: The operation completed successfully. .
11/3/2010 8:13:22 AM, error: SideBySide [32]  - Dependent Assembly Microsoft.VC80.MFCLOC could not be found and Last Error was The referenced assembly is not installed on your system.
11/3/2010 7:44:08 AM, error: DCOM [10005]  - DCOM got error "%1058" attempting to start the service BITS with arguments "" in order to run the server: {4991D34B-80A1-4291-83B6-3328366B9097}
11/2/2010 5:24:41 PM, error: Service Control Manager [7023]  - The jfkpgidk service terminated with the following error:  A dynamic link library (DLL) initialization routine failed.

==== End Of File ===========================

U redu...idemo dalje:
Start >> Control Panel >> Security Centar
dole levo nadji Change the way Security Center alerts me
Uncekiraj Firewall, Automatic Updates, i Virus Protection


Sledeci put ove tri stvari iz MBAM-a stavi pod ignore da ti ne dira vise:



...............

--> Napravi novu system restore tacku:
http://www.online-tech-tips.com/windows-xp/create-a-restore-point-manually-in-xp/

.............

Zatvori sve pokrenute programe.

Start >> Run >> cmd  Enter

Otvorice ti se konzola. Tamo kucaj sledece:

Enter.

*Restartuj Racunar.

*Ponovo startuj konzolu (cmd)

Tamo kucaj sad ovo:

Enter

*Restartuj Racunar.

*Ponovo pokreni DDS program i kopiraj mi DDS.txt log

DDS.txt log


DDS (Ver_10-11-05.01) - NTFSx86 
Run by samir at 15:39:54.79 on Sat 11/06/2010
Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_21
Microsoft Windows XP Professional  5.1.2600.3.1252.1.1033.18.1535.1197 [GMT 1:00]

AV: Lavasoft Ad-Watch Live! Anti-Virus *On-access scanning disabled* (Updated)   {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\tsnpstd3.exe
C:\WINDOWS\vsnpstd3.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Documents and Settings\samir\Desktop\dds.com

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [RegGenie v2.0 - Trial Expired] "c:\program files\reggenie\RegGenieOnRebootExpired.exe"
uRun: [RegGenie v2.0] "c:\program files\reggenie\RegGenieOnReboot.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
mRun: [TrayServer] c:\program files\magix\movies_on_dvd_7_terratec_edition\TrayServer.exe
mRun: [tsnpstd3] c:\windows\tsnpstd3.exe
mRun: [snpstd3] c:\windows\vsnpstd3.exe
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1281615552093
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\samir\applic~1\mozilla\firefox\profiles\tixgsfjp.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - component: c:\program files\mozilla firefox\extensions\{ab2ce124-6272-4b12-94a9-7303c7397bd1}\components\SkypeFfComponent.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqz9s", true); // Traditional
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqs8s", true); // Simplified
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--j6w193g", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4a87g", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7c0a67fbc", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7cvafr", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kpry57d", true);  // Traditional
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kprw13d", true);  // Simplified

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-10-30 64288]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-9-8 1357464]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2010-8-12 304464]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2010-8-12 20952]
S0 TfFsMon;TfFsMon;c:\windows\system32\drivers\tffsmon.sys --> c:\windows\system32\drivers\TfFsMon.sys [?]
S0 TfSysMon;TfSysMon;c:\windows\system32\drivers\tfsysmon.sys --> c:\windows\system32\drivers\TfSysMon.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\magix\common\database\bin\fbserver.exe [2010-8-25 1527900]
S3 TfNetMon;TfNetMon;\??\c:\windows\system32\drivers\tfnetmon.sys --> c:\windows\system32\drivers\TfNetMon.sys [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

=============== Created Last 30 ================

2010-11-06 12:11:18   --------   d-----w-   c:\docume~1\alluse~1\applic~1\PC Tools
2010-11-06 12:05:58   --------   d-----w-   c:\docume~1\samir\applic~1\GetRightToGo
2010-11-06 11:47:40   --------   d-----w-   c:\program files\GustoSoft
2010-11-06 11:03:44   --------   d-----w-   c:\program files\Video Capture Master
2010-11-06 10:35:40   --------   d-----w-   c:\program files\RegGenie
2010-11-03 13:20:28   --------   d-----w-   c:\program files\Enigma Software Group
2010-11-03 13:20:07   --------   d-----w-   c:\windows\4FC9DA9DF608454E8191D7EFFDCC5726.TMP
2010-11-03 13:20:05   --------   d-----w-   c:\program files\common files\Wise Installation Wizard
2010-11-02 15:33:45   --------   d--h--w-   C:\$AVG
2010-10-30 10:21:44   15880   ----a-w-   c:\windows\system32\lsdelete.exe
2010-10-30 09:24:39   95024   ----a-w-   c:\windows\system32\drivers\SBREDrv.sys
2010-10-30 09:12:34   64288   ----a-w-   c:\windows\system32\drivers\Lbd.sys
2010-10-30 09:11:34   --------   dc-h--w-   c:\docume~1\alluse~1\applic~1\{437292BE-95BD-4B12-B699-6D217A03ACAF}
2010-10-30 09:11:17   --------   d-----w-   c:\program files\Lavasoft
2010-10-24 09:04:50   --------   d-----w-   c:\program files\Photo Story 3 for Windows
2010-10-24 08:59:18   221184   ----a-w-   c:\windows\system32\wmpns.dll
2010-10-24 08:59:13   --------   d-----w-   c:\program files\Windows Media Connect 2
2010-10-23 12:20:22   --------   d-----r-   c:\program files\Skype
2010-10-20 11:51:45   --------   d-----w-   c:\docume~1\samir\applic~1\Canneverbe Limited
2010-10-20 11:51:44   --------   d-----w-   c:\docume~1\alluse~1\applic~1\Canneverbe Limited
2010-10-20 11:51:33   7168   ----a-w-   c:\windows\system32\drivers\StarOpen.sys
2010-10-20 11:17:52   --------   d-----w-   c:\docume~1\samir\applic~1\AVI ReComp
2010-10-20 11:17:35   --------   d-----w-   c:\program files\Xvid
2010-10-20 11:17:24   --------   d-----w-   c:\program files\AviSynth 2.5
2010-10-20 11:17:16   --------   d-----w-   c:\program files\AVI ReComp
2010-10-11 11:03:45   28672   ----a-w-   c:\windows\system32\AVEQT.dll
2010-10-11 11:03:45   129024   ----a-w-   c:\windows\system32\AVERM.dll
2010-10-11 11:03:43   --------   d-----w-   c:\program files\Ultra Video Joiner
2010-10-11 07:31:14   --------   d-----w-   c:\docume~1\samir\locals~1\applic~1\OpenCandy
2010-10-11 07:31:13   --------   d-----w-   c:\docume~1\samir\applic~1\OpenCandy
2010-10-11 07:25:10   --------   d-----w-   c:\docume~1\samir\applic~1\AnvSoft
2010-10-11 07:25:06   --------   d-----w-   c:\program files\AnvSoft
2010-10-08 13:35:14   94208   ------w-   c:\windows\amcap.exe
2010-10-08 13:35:09   94208   ------w-   c:\windows\tsnpstd3.exe
2010-10-08 13:35:09   339968   ----a-w-   c:\windows\vsnpstd3.exe
2010-10-08 13:35:08   8718848   ----a-w-   c:\windows\system32\drivers\snpstd3.sys
2010-10-08 13:35:06   61440   ----a-w-   c:\windows\system32\csnpstd3.dll
2010-10-08 13:35:06   61440   ------w-   c:\windows\system32\rsnpstd3.dll
2010-10-08 13:35:06   53248   ----a-w-   c:\windows\vsnpstd3.dll
2010-10-08 13:35:06   53248   ------w-   c:\windows\system32\vsnpstd3.dll
2010-10-08 13:35:05   20480   ------w-   c:\windows\usnpstd3.exe
2010-10-08 13:35:05   --------   d-----w-   c:\program files\common files\snpstd3
2010-10-08 13:34:53   696320   ----a-w-   c:\program files\common files\installshield\professional\runtime\0701\intel32\iKernel.dll
2010-10-08 13:34:53   57344   ----a-w-   c:\program files\common files\installshield\professional\runtime\0701\intel32\ctor.dll
2010-10-08 13:34:53   5632   ----a-w-   c:\program files\common files\installshield\professional\runtime\0701\intel32\DotNetInstaller.exe
2010-10-08 13:34:53   32768   ----a-w-   c:\program files\common files\installshield\professional\runtime\Objectps.dll
2010-10-08 13:34:53   237568   ----a-w-   c:\program files\common files\installshield\professional\runtime\0701\intel32\iscript.dll
2010-10-08 13:34:53   155648   ----a-w-   c:\program files\common files\installshield\professional\runtime\0701\intel32\iuser.dll
2010-10-08 13:34:52   282756   ----a-w-   c:\program files\common files\installshield\professional\runtime\0701\intel32\setup.dll
2010-10-08 13:34:52   163972   ----a-w-   c:\program files\common files\installshield\professional\runtime\0701\intel32\iGdi.dll
2010-10-08 08:37:15   73728   ----a-w-   c:\windows\system32\javacpl.cpl
2010-10-08 08:37:15   423656   ----a-w-   c:\windows\system32\deployJava1.dll
2010-10-08 08:37:15   423656   ----a-w-   c:\program files\mozilla firefox\plugins\npdeployJava1.dll

==================== Find3M  ====================

2010-09-18 10:48:12   234576   ----a-w-   c:\windows\system32\PnkBstrB.xtr
2010-09-18 10:48:12   234576   ----a-w-   c:\windows\system32\PnkBstrB.exe
2010-09-18 10:33:14   75064   ----a-w-   c:\windows\system32\PnkBstrA.exe
2010-08-10 15:16:25   246   ----a-w-   c:\documents and settings\samir\dl.exe
2010-08-10 15:00:44   189584   ----a-w-   c:\windows\system32\WISPTIS.EXE
2010-08-10 15:00:36   44216   ----a-w-   c:\windows\system32\tscupgrd.exe

============= FINISH: 15:40:47.95 ===============

U redu...to je to.
...logovi deluju cisto.
 

*Uz poruku sam ti okacio jedan program. Pokreni ga i pomocu njega izprazni Temp Folder.

*Preuzmi Wise Registry Cleaner i dopusti mu da ti "sredi" registry
http://www.wisecleaner.com/wiseregistrycleanerfree.html

*Resetuj System Restore ( Turn Off pa Turn On )

* Reci mi kakvo je sad stanje.

Uradio sve.

PC radi normalno, ali csrss.exe se i dalje nalazi u tesk menadzeru i radi,

csrss.exe i treba da se nalazi u TM i da radi 
To je Windowsov legitiman file.
Potpisan je kao "Client Server Runtime process"

Originalna lokacija je u c:\windows\system32 folderu.

Za vise informacija use google.


Ovo je bitno. PozZ 

OK, procitao sam isto, ali nisam shvatio, zato lupam 
U svakom slucaju, hvala .. bilo je edukativno 

 

...i drugi put