Problem sa windows parameters

Prvo zelim da pozdravim sve clanove Elite Security Communitya...

Eh ovako... Nedavno su mi se poceli javljati cudni problemi sa xpom. Naime nakon sto sam pokrenuo FireFox nedavno javio mi se kao neki update Advanced cleaner tako nesto i ja sam naravno pokusao da updatujem ali je avast antivirus prepoznao taj program kao adware i naravno izbrisao sam ga. Eh sad nakon toga mi se javljaju problemi...

Vise puta mi racunar jednostavno zablokira kao da je pun virusa... Full skeniranje sa avastom je otkrilo oko 8 virusa koji se po obicaju kriju u User/local settings... Nakon toga problem nije nestao nego je ostalo isto. Skinuo sam Ad-Aware 2007 i procesljao komp... Jedan malware program je nasao i nista vise.

Takodje mi se javlja neki problem sa Windows Parameters ?! Ne kontam stvarno u cemu je problem pa ako moze mala pomoc... Evo SS:

http://img223.imageshack.us/img223/5213/problemvw7.jpg


Hvala unaprijed :)

Pa tako ti je to kada puštaš da ti se sve i svašta instalira na PC-u i kada imaš puno virusu. Uzmi ti lepo pa uradi jednu novu instalaciju XP-a i nećeš imati problema, naravnod dok se opet ne nepuni virusima.

Uopste nemam instalirano dosta stvari i prije nego sto instaliram nesto po pravilu skeniram da provjerim viruse. Trenutno imam 2 igre, par downloadera i ostatak su fileovi koji su bili u kompu i prije ovog problema. Napravio sam skeniranje sa 3 antivirusa tacnije avastom, ad aware2007 i NOD32 i opet imam taj problem ? Je li postoji nego drugo rjesenje osim format diska ?

Okaci ovdje hijackthis! log pa da pregledamo.

---

Evo izvolite:


Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 13:00:48, on 8.3.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Documents and Settings\user\Desktop\HiJackThis_v2.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {23D44BCF-AA7A-41D6-8905-E808F16322EF} - C:\WINDOWS\system32\ssqqooo.dll (file missing)
O2 - BHO: {9d0bccde-c620-5a68-28f4-436325273fa6} - {6af37252-3634-4f82-86a5-026cedccb0d9} - C:\WINDOWS\system32\koekavgi.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {837B45D6-BF85-457D-AABF-6D2E7815F791} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {C2CC8651-F5E9-40C8-9BA4-2B125678AFA0} - C:\WINDOWS\system32\sstqp.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [7C51400E63720B515F51] Rundll32.exe "C:\WINDOWS\system32\vtiwlfrv.dll",s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AdVantage] "C:\Program Files\AdVantage\AdVantage.exe"
O4 - HKCU\..\Run: [Windows update loader] C:\Windows\xpupdate.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.co...t/wuweb_site.cab?1204878560765
O17 - HKLM\System\CCS\Services\Tcpip\..\{BBCE660D-2E33-4E9D-AF51-B9B495D12F15}: NameServer = 195.222.32.10 195.222.32.20
O20 - Winlogon Notify: jkkigfg - jkkigfg.dll (file missing)
O20 - Winlogon Notify: ssqqooo - ssqqooo.dll (file missing)
O20 - Winlogon Notify: winxzq32 - C:\WINDOWS\SYSTEM32\winxzq32.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 5316 bytes


Eh sad ja da ovo kontam ja bi nesto mozda i znao :).. Inace rijesio sam se virusa sa NOD32 Antivirusom. Avast je definitivno preslab antivirus jer je NoD32 za kratko virjeme otkrio preko 1000 zarazenih fileova..

Slijedece unose trebas popraviti s hijackthis-om

O2 - BHO: {9d0bccde-c620-5a68-28f4-436325273fa6} - {6af37252-3634-4f82-86a5-026cedccb0d9} - C:\WINDOWS\system32\koekavgi.dll
O2 - BHO: (no name) - {C2CC8651-F5E9-40C8-9BA4-2B125678AFA0} - C:\WINDOWS\system32\sstqp.dll
O4 - HKLM\..\Run: [7C51400E63720B515F51] Rundll32.exe "C:\WINDOWS\system32\vtiwlfrv.dll",s
O4 - HKCU\..\Run: [AdVantage] "C:\Program Files\AdVantage\AdVantage.exe"
O4 - HKCU\..\Run: [Windows update loader] C:\Windows\xpupdate.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{BBCE660D-2E33-4E9D-AF51-B9B495D12F15}: NameServer = 195.222.32.10 195.222.32.20
O20 - Winlogon Notify: jkkigfg - jkkigfg.dll (file missing)
O20 - Winlogon Notify: ssqqooo - ssqqooo.dll (file missing)
O20 - Winlogon Notify: winxzq32 - C:\WINDOWS\SYSTEM32\winxzq32.dll
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

---

Zavrseno i hvala na pomoci bilo je uspjesno... Sada sam zezno maticnu pa moram cijeli windows brisati i format diska uraditi. Probao clockati modem i sprzio maticnu :( :)

??????????????????????????????

---

Ma mislio sam na procesor, nesto ekperimentisao pa otisla maticna. Juce sam nabavio novu i opet imam mali problem pa da ne otvaram novu temu bezveze. Kad sam dobio ovu novu maticnu morao sam ponovo dignuti windows radi drivera. Eh sad sve je to proslo ok ali imam jako cudan problem. Imam HDD od 250 GB no medjutim od slobodnog prostora imam samo 132 GB. Negdje mi je otislo 100 GB... Je li moram ponovo reinstall i format diska ili ima neki drugi nacin... Hvala


EDIT... Evo SS sa kojim sam provjerio HDD i sve je OK ali opet imam isti problem

http://img136.imageshack.us/im...hdtunefolderusagewdcwd2mv9.png

http://img210.imageshack.us/im...hdtunehealthwdcwd2500jsym5.png



_{[Ovu poruku je menjao bajaBiH dana 12.03.2008. u 10:53 GMT+1]}

Ovo sad svakako nema veze sa zaštitom, al' 'ajde... Možda ti ovo dole pomogne.

Bolje daj sliku iz Computer Managementa, sekcija Disk Management, da vidimo da li Windows vidi svih 250GB. Ovo izgleda kao da si instalirao Windows XP bez SP. Za konkretno rešenje treba više informacija. Pre no što se ponovo javiš pogledaj malo po Hardware forumu (Storage) i potrudi se da saznaš pravu veličinu foldera System Volume Information (sigurno nije 0). Sve to možeš saznati Pretragom (http://www.elitesecurity.org/pretraga).

Ako se tema razvije iseći ćemo je i ovaj deo prebaciti u odgovarajući forum.