Šta je novo?
Od:
Filteri

Proces koji ubija kopiranje

Pichu

Pichu

Banned
Banovan
Učlanjen(a)
07.08.2008
Poruke
307
Poena
169
Desava mi se da kad hocu da kopiram nesto nebitne velicine 500mb ili 5gb, dok traje kopiranje npr. cim stisnem nesto ili ne daj boze udjem u neki program, kopiranje stane, zapuca se Win. i jedino task manager resava stvar, sto znaci da ako hocu nesto da kopiram moram da ostavim komp da miruje. Ovo je do Viste tj. neki njen proces verovatno ometa pa ako neko zna kako da resim bio bih mu zahvalan. Do harda nije sigurno jer imao sam pre i Maxtora i isto je bilo, npr. na XP-u toga nije bilo, tako da bedna Vista X64 ultimate nesto *****.
 
najverovatnije da je neki virus...pa da on blokira kopiranje

Skini HijackThis program
http://www.trendsecure.com/portal/en-US/_download/HiJackThis.exe
sacuvaj ga na Desktopu u nekom Folderu
promeni naziv hijackthis.exe u system.exe

dvoklikom pokreni program,idi na "do a system scan and safe the logfile"
program ce sistem skenirati za manje od minut i napraviti log
taj log kopiraj ovde na forumu
 
Poslednja izmena:
Vista X64

hm nisi rekao sa koje na koju destinaciju zelis da kopiras
posto vista zavisno kako je podesena pre samog kopiranja recino na systemsku particiju trazi dozvolu od administratora da to uradi ne samo za kopiranje vec za mnoge druge stvari

:d
 
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:14:08 AM, on 4/3/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
C:\Program Files (x86)\Orbitdownloader\orbitdm.exe
C:\Program Files (x86)\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files (x86)\RivaTuner v2.20\Tools\D3DOverrider\D3DOverrider.exe
C:\Program Files (x86)\Orbitdownloader\orbitnet.exe
C:\Users\Aca\Desktop\H\system.exe.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O1 - Hosts: ::1 localhost
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files (x86)\Orbitdownloader\orbitcth.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~3\Office12\GRA8E1~1.DLL
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [D3DOverrider] "C:\Program Files (x86)\RivaTuner v2.20\Tools\D3DOverrider\D3DOverrider.exe" /s
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: Orbit.lnk = C:\Program Files (x86)\Orbitdownloader\orbitdm.exe
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MICROS~3\Office12\GR99D3~1.DLL
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files (x86)\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati External Event Utility - Unknown owner - C:\Windows\system32\Ati2evxx.exe (file missing)
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NMIndexingService - Nero AG - C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - Unknown owner - C:\Windows\System32\TuneUpDefragService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 7949 bytes
 
cifra je napisao(la):
Vista X64

hm nisi rekao sa koje na koju destinaciju zelis da kopiras
posto vista zavisno kako je podesena pre samog kopiranja recino na systemsku particiju trazi dozvolu od administratora da to uradi ne samo za kopiranje vec za mnoge druge stvari

:d
Kliknite za proširenje...

Nema veze gde kopiram bilo to C,D ili E particija svejedno je.
 
Start / Run kopiraj ovo
Kod: 
C:\WINDOWS\NOTEPAD.EXE C:\WINDOWS\SYSTEM32\DRIVERS\etc\HOSTS
pa Enter
pojavice ti se notepad

sve tamo obrisi i napisi ovo (copy / paste )

Kod: 
127.0.0.1       localhost
sacuvaj promene
(mozda budes morao sve to da radis iz safe moda)

..restart kompa...

sada pokreni HijackThis, idi na "do a system scan" stikliraj sledece linije:
Kod: 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = [url]http://go.microsoft.com/fwlink/?LinkId=54896[/url]
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [url]http://go.microsoft.com/fwlink/?LinkId=69157[/url]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [url]http://go.microsoft.com/fwlink/?LinkId=69157[/url]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [url]http://go.microsoft.com/fwlink/?LinkId=54896[/url]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [url]http://go.microsoft.com/fwlink/?LinkId=54896[/url]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [url]http://go.microsoft.com/fwlink/?LinkId=69157[/url]
O13 - Gopher Prefix:

idi na Fix restartuj komp
javi ima li promena hm
 
Poslednja izmena:
Shaman je napisao(la):
Start / Run kopiraj ovo
Kod: 
C:\WINDOWS\NOTEPAD.EXE C:\WINDOWS\SYSTEM32\DRIVERS\etc\HOSTS
pa Enter
pojavice ti se notepad

sve tamo obrisi i napisi ovo (copy / paste )

Kod: 
127.0.0.1       localhost
sacuvaj promene
(mozda budes morao sve to da radis iz safe moda)

..restart kompa...

sada pokreni HijackThis, idi na "do a system scan" stikliraj sledece linije:
Kod: 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = [url]http://go.microsoft.com/fwlink/?LinkId=54896[/url]
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [url]http://go.microsoft.com/fwlink/?LinkId=69157[/url]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [url]http://go.microsoft.com/fwlink/?LinkId=69157[/url]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [url]http://go.microsoft.com/fwlink/?LinkId=54896[/url]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [url]http://go.microsoft.com/fwlink/?LinkId=54896[/url]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [url]http://go.microsoft.com/fwlink/?LinkId=69157[/url]
O13 - Gopher Prefix:

idi na Fix restartuj komp
javi ima li promena hm
Kliknite za proširenje...

moze objasnjenje sta dobija sad promenom localhost IP, ovim samo na neki nacin stopira update tih programa sto mu rade u pozadini
 
Shaman je napisao(la):
Start / Run kopiraj ovo
Kod: 
C:\WINDOWS\NOTEPAD.EXE C:\WINDOWS\SYSTEM32\DRIVERS\etc\HOSTS
pa Enter
pojavice ti se notepad

sve tamo obrisi i napisi ovo (copy / paste )

Kod: 
127.0.0.1       localhost
sacuvaj promene
(mozda budes morao sve to da radis iz safe moda)

..restart kompa...

sada pokreni HijackThis, idi na "do a system scan" stikliraj sledece linije:
Kod: 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = [url]http://go.microsoft.com/fwlink/?LinkId=54896[/url]
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [url]http://go.microsoft.com/fwlink/?LinkId=69157[/url]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [url]http://go.microsoft.com/fwlink/?LinkId=69157[/url]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [url]http://go.microsoft.com/fwlink/?LinkId=54896[/url]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [url]http://go.microsoft.com/fwlink/?LinkId=54896[/url]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [url]http://go.microsoft.com/fwlink/?LinkId=69157[/url]
O13 - Gopher Prefix:

idi na Fix restartuj komp
javi ima li promena hm
Kliknite za proširenje...


Hvala sto si se potrudio da pomognes, ali isprobao sam ovo sto si napisao i nazalost je isto:(
 
moze objasnjenje sta dobija sad promenom localhost IP,
ovim samo na neki nacin stopira update tih programa sto mu rade u pozadini
Kliknite za proširenje...

(koliko ja znam) to nije tacno... ;)
ako malware podesi neka svoja podesavanja u host fajlu moze spreciti update nekog AV programa,
skidanje nekog AV programa koji za njega predstavlja "pretnju"
ili prebacivanje na neki treci sajt ili onemogucavanje odlaska ... itd...itd
U praksi se ovaj problem srece kada na inficiranom racunaru hoces
da posetis recimo www.facebook.com ili na kasperskyjev sajt i da skinets antvirus
a on ce te pomocu host fajla redirektovati na sajt
koji je autor host fajla programirao!

ovim samo resetujemo hostfajl na default
ako u HJT logu vidis neku hosts liniju..Fixuj je jer nisu standarda podesavanja
mada najbolje je resetovati host
to mozes i programom HostsXpert ...
probaj sam...
Ispod
127.0.0.1 localhost
upisi

127.0.0.2 www.facebook.com

verovatno da neces moci da odes na facebook


............................


@Pichu
ovaj log nepokazuje tragove malicioznih programa
..sto daje predpostavku da je ovaj komjuter cist...
ako hoces da dublje istrazimo reci ,nije problem...a nemamo sta da izgubimo
mada..negarantujem ti resenje tvog problema...mozda ipak ovo nema veze sa virusima..mozda :)
 
Poslednja izmena:
Ne verujem da su virusi, redovno updejtujem Aviru i vrsim skeniranje sa Ad Aware, nijendom nije pokazao da mi neki virus preti, takodje registre cistim preko CCleanera sve je uredno, jedino mozda neki program sto je instaliran ili nesto stvarno nemam pojma ali glupo mi skroz ovo ****** sa kopiranjem:S:
 
Malo sam istrazivao i dok npr. kad se zabaguje kod kopiranja kad idem na X prikaze WindowS Explorer error. Sad sta mu dodje to Widnow Explorer?
 
Morate se prijaviti ili registrovati da odgovorite ovde.
Nazad
Vrh Dno