Log ti je cist.

pa cekaj brate ja ti nisam rekao da diras i pokreces ccleaner..Sto si to radio ..Kazi mi jel rogueremover ocistio nesto?

Cekaj @munkaze hoces da kazes da je ovo
O4 - HKCU\..\Run: [SpyClean] C:\Program Files\Netcom3 Cleaner\SpyClean.exe

legitiman program

ma ne bre...Rekao mi je goran 988 da uzmem CCleaner i da procistim nesto..e,sad ja sam uzeo da uninstaliram neke nepotrebne stvari,i onda...jebiga...al radi sad...
nego da restartujem komp da vidim jel su mi nestale ova dva prozora

Pa brate nisam ti rekao da uzmes CCleaner i da odes da unistaliras sve programe koje nadjes..Jebote ne verujem...
Mislio sam da sredis registry sa CCleanerom i procistis komp od nepotrebnih fajlova..To su ti prva i druga opcija..

ma znam to sam ja i uradio...ali nesto sam ranije igrao dungeon siege,pa ga nisam uninstalirao tada,pa  se sad setio i izbrisao ga...pa se zaneo...nisi ti kriv,ne kazem ja o tebi nista...i fala ti za ccleaner,pomogao mi je...


ovako...restartovao sam komp..
i sad ona prvi prozorcic(savedump.exe) me i dalje jebe...
a ovog drugog nema

a evo log za svaki slucaj

i diarno,onaj rogue remover je nasao dve stvari i ocistio








Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:16:04, on 18.5.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\COMMON~1\Stardock\SDMCP.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Safari\Safari.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - (no file)
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/haphazard/raptisoftgameloader.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {29D73455-3ADA-49BB-9067-44822F6728F5} - http://www.joga.com/activex/uploadactx.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{D0BF09E0-8F6F-4352-A60B-F2159044D0C0}: NameServer = 77.105.0.19 77.105.0.18
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NetCom3 Service (Netcom3) - Unknown owner - C:\Program Files\Netcom3 Cleaner\PSCMonitor.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe

--
End of file - 5358 bytes

Kolko vidim ovo O4 - HKCU\..\Run: [SpyClean] C:\Program Files\Netcom3 Cleaner\SpyClean.exe
je fixovao izgleda RR...Ako imas log od njega okaci...POtrazi ovaj dbghelp.dll fajl u windows/system32..Ali samo pogledaj dal ima nista ne diraj molim te...

A jel si sredio programe koji se startuju sa winom posto si imao brdo programa...???

da samo sam ostavio antivirus i jedan moj program...rocket dock

I jel ga ima?

Sad samo jos treba to srediti i ubiti ovaj servis jer je on

http://www.bleepingcomputer.com/startups/PscMonitor.exe-22290.html

Zatim idi u add/remove i pogledaj jel ima program sa sledecim nazivom Netcom3 Cleaner 1.0..deinstaliraj ga ako ga ima...

sad sam jos jednom pokrenuo rogue cleaner ili kako god nasao je oko 7-8 stvari....videcu jel i dalje radi ono....
ups...
sad sam restartovao ali mi se i dalje pokazuje drugi prozor

 ja sam pogresno rekao ,misiio sam da je ovo prvi,sorry



evo mi ga prvi Rogue cleaner log
Malwarebytes' RogueRemover
Malwarebytes ©2007 http://www.malwarebytes.org
6213 total fingerprints loaded.

Loading database ...
Expanding environmental variables ...

Scanning files ... [ 100% ].
Scanning folders ... [ 100% ].
Scanning registry keys ... [ 100% ].
Scanning registry values ... [ 100% ].

RogueRemover has detected rogue antispyware components! Results below...

Type: Folder
Vendor: Spyware Striker Pro
Location: C:\Documents and Settings\All Users\Start Menu\Programs\Ascentive
Selected for removal: Yes

Type: Folder
Vendor: Netcome3 Cleaner
Location: C:\Program Files\Netcom3 Cleaner
Selected for removal: Yes

Type: Registry Key
Vendor: Spyware Striker Pro
Location: HKEY_CURRENT_USER\Software\Ascentive
Selected for removal: Yes

Type: Registry Key
Vendor: Spyware Striker Pro
Location: HKEY_LOCAL_MACHINE\SOFTWARE\Ascentive
Selected for removal: Yes

Type: Registry Key
Vendor: Netcome3 Cleaner
Location: HKEY_CURRENT_USER\Software\SpyClean
Selected for removal: Yes

Type: Registry Key
Vendor: Netcome3 Cleaner
Location: HKEY_CURRENT_USER\Software\Netcom3 Cleaner
Selected for removal: Yes

Type: Registry Key
Vendor: Netcome3 Cleaner
Location: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netcom3
Selected for removal: Yes

RogueRemover has found the objects above.
























a evo mi ga drugi

Malwarebytes' RogueRemover
Malwarebytes ©2007 http://www.malwarebytes.org
6213 total fingerprints loaded.

Loading database ...
Expanding environmental variables ...

Scanning files ... [ 100% ].
Scanning folders ... [ 100% ].
Scanning registry keys ... [ 100% ].
Scanning registry values ... [ 100% ].

RogueRemover has detected rogue antispyware components! Results below...

Type: Folder
Vendor: Spyware Striker Pro
Location: C:\Documents and Settings\All Users\Start Menu\Programs\Ascentive
Selected for removal: Yes

Type: Folder
Vendor: Netcome3 Cleaner
Location: C:\Program Files\Netcom3 Cleaner
Selected for removal: Yes

Type: Folder
Vendor: Netcome3 Cleaner
Location: C:\Documents and Settings\All Users\Start Menu\Programs\Netcom3 Cleaner
Selected for removal: Yes

Type: Registry Key
Vendor: Spyware Striker Pro
Location: HKEY_CURRENT_USER\Software\Ascentive
Selected for removal: Yes

Type: Registry Key
Vendor: Spyware Striker Pro
Location: HKEY_LOCAL_MACHINE\SOFTWARE\Ascentive
Selected for removal: Yes

Type: Registry Key
Vendor: Netcome3 Cleaner
Location: HKEY_CURRENT_USER\Software\SpyClean
Selected for removal: Yes

Type: Registry Key
Vendor: Netcome3 Cleaner
Location: HKEY_CURRENT_USER\Software\Netcom3 Cleaner
Selected for removal: Yes

Type: Registry Key
Vendor: Netcome3 Cleaner
Location: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netcom3
Selected for removal: Yes

Type: Registry Key
Vendor: Netcome3 Cleaner
Location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Netcom3 Cleaner_is1
Selected for removal: Yes

RogueRemover has found the objects above.