Data Execution Prevention problem

Problem je sto mi izlazi taj prozorcic na svakih 10 minuta.U prozorcicu pise da je zaustavio program Windows Exlporer zato sto je neki vuris ili maligni code pokusao da pristupi Exploreru.Skenirao sam sistem sa Kasperskim nije nasao nista.Taj tzv DEP mogu da iskljucim u opcijama u propertisu my computera/advance tab/performance/settings, ali onda se isto desava samo sto ne izbacuje prozorcic.Kad izbaci prozorcic i ja kliknem close message onda mi refreshuje ekran(nestanu sve ikonice i taskbar za trenutak i onda se vrate)

Prilikom pojavljivanja doticnih problema kao preliminarno resenje preporucujemo vam da skenirate vas racunar sa azuriranim Anti-Virus i Anti-Spyware programima. Posetite ovu temu za vise informacija, kao i ovu temu za spisak i test najboljih Anti-Virus programa.
Ukoliko se Vas problem i dalje pojavljuje, preporucujemo Vam da skenirate Vas racunar sa HiJackThis software-om koji je besplatan i mozete ga download-ovati na ovoj adresi, nakon cega zakacite ovde Vas tekstualni HiJackThis log.

Kao sto BG rece!
Sigurno je neka azdaja!

Ok niste me razumeli
1. Azuriranim Anti virusom(kasperskim) sam skenirao sistem i nista nije pokazao
2.Okacio sam hijack log i Belgrade mi je rekao sta da fixujem i to sam i uradio
Problem i dalje stoji i veoma je dosadan

Evo hijack loga ponovo

Logfile of HijackThis v1.99.1
Scan saved at 9:03:18 PM, on 12/14/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\ASUS\Probe\AsusProb.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Soulseek-Test\slsk.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Soulseek-Test\slsk.exe
C:\Program Files\Soulseek-Test\slsk.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijack this\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/*http://www.yahoo.com/ext/search/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://as.starware.com/dp/search?x=wKX1ILEOi+Vh7AfA98Gm4Me69ZMbubcD+LDHhd+DajHPxIZwoErPWzVYo7poLHCfJS/vqmE//DoH/MTP2c9pszLK7+v5Fi0GbdmvB2kPjc6an5yNKf3peVJY8Ov/FuHW1qxhrezFzWYmU9Yj5BQXmC8L1+jwRt5B
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr7/*http://www.yahoo.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Anonymizer Proxy - {0DB66BA8-5E1F-4963-93D1-E1D6B78FE9A2} - C:\Program Files\Hide Real IP\ProxyNew.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Metacafe.lnk = C:\Program Files\Metacafe\MetacafeAgent.exe
O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Metacafe.lnk = C:\Program Files\Metacafe\MetacafeAgent.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNxmk754YYYU
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll (file missing)
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

pogledaj ovo da bi video sta te zeza a mnogo mnogo vise ces naci u googlu za one koji ne znaju (google.com)

Several OSs have no-execute or execute protection. Microsoft has added this as well in SP2 with data execution prevention (DEP). This precents code execution in memory regions already marked as storage. This is a powerful tool against buffer overrun exploits.

If a program is failing and you want to disable DEP to see if that is the cause. Here are the steps. (Just disable DEP for the program in question... don't disable it for your whole system.)



1. Click Start
2. Select Control Panel
3. Select System
4. Click the Advanced tab
5. In the Performance region select Settings
6. Click the Data Execute tab in the dialog box that opens
7. Select Turn on DEP for all programs and services except for those I select
8. Click Add.
9. The open dialog box will open. Browse and select your application.
10. Click Open
11. Click Apply
12. Click Ok
13. Reboot

fix
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/*http://www.yahoo.com/ext/ search/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://as.starware.com/dp/search?x=wKX1ILEOi+Vh7AfA98Gm4Me69ZMbubcD+LDHhd+DajHPx IZwoErPWzVYo7poLHCfJS/vqmE//DoH/MTP2c9pszLK7+v5Fi0GbdmvB2kPjc6an5yNKf3peVJY8Ov/F uHW1qxhrezFzWYmU9Yj5BQXmC8L1+jwRt5B
O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE      -   ovo ne znam shta ce ti, ali ako bash zelish da ga imash onda ok, mada moja preporuka je da ga ubijesh
O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNxmk754YYYU
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll (file missing)
23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

dakle safe mode
hijack this pa fix
pa spybot search&destroy skeniraj pa brishi shta nadje
restart , normal mode
ochisti registry sa nekim registry alatom, - ovo je pod obavezno, da bi sredio shta ostane posle ciscenja svih tih silnih helpera i barova. Ja koristim Advanced uninstaler pro, ima opciju ciscenja registry baze i cisti sistem od svega nepotrebnog - imash opciju quick scan.

I moja preporuka za kraj - promeni browser ... Opera, Firefox, K-Meleon ... bilo shta, samo ne IE  

Ako ti se problem bude pojavljivao i nakon sto sredis komp,
jednostavno iskljuci DEP za windows explorer

Ok sredio sam kopm.Sve onako kako si ti rekla zemunko
Ali problem je i dalje tu,jedino da poslusam pakiman-a
Uzgred hvala svima sto ste mi pomogli

Jel ima neko ideju sta bi mogao jos da probam
Iskljucio sam DEP za windows exlporer ali sad vise ne izbacuje ono poruke nego kad otvaram neke foldere(npr hocu da proverim sta imam od pesama i kliknem jedno tri cetiri puta da udjem u neki folder) on mi skine sve sto ima na ekranu i onda vrati sve kako je bilo.
Imam problem sto se tice sa tim kad pokrenem Soulseek,kad se desi to i kad on vrati sve kako je bilo soulseek se izgubi sa icon tray i kad ga pokrenem ponovo on kaze da je moj account koriscen da se pristupi sa nekog drugog kompa i jos mi kaze da trenutni port ne moze da se koristi nego mi on dodeli sledeci slobodan port

Studio 9 pravi takve probleme, brisanje programa rešava problem.