Vundo virus :: Pc Klinika ~ Doktori za vas kompjuter

Toolbar

Pravilnik foruma

Burek marketing

Najčešća pitanja

Posetite Burek Prodavnicu

Zatvori

BUREK marketing

Burek :: Forumi :: > Tehnicki deo foruma > Pc Klinika ~ Doktori za vas kompjuter

Tema: Vundo virus (Moderatori: enaB, chelavi1)

Trenutno vreme je: 25. Apr 2024, 14:06:02

Korisnici koji su trenutno na forumu 0 članova i 1 gost pregledaju ovu temu.

Napomena: Za sva pitanja u vezi kupovine novog hardware-a ili procene vrednosti i preporuke koristite - ovu temu!

Spyware,sta je,kako radi,kako se zastititi? :: Kako rade mreze :: Burek Anti-virus software review :: Index tema koje ne treba propustiti

Stranice:

2 Sve

Tema: Vundo virus (Pročitano 1937 puta)

aleksxx

21. Maj 2008, 00:13:10

Svakodnevni prolaznik

Zodijak
Pol
Poruke	262
Zastava

	Windows Vista
	Mozilla Firefox 2.0.0.14
	Samsung

Stvarno nisam nasao nista na forumu o ovom virusu.Ako neko zna gde ima tema neka postavi link.
Nemogu da se resim ove gamadi .Skeniram Avastom profesional nadje ga ali nemoze da ga obrise.
Vundo FIx ga nemoze ni naci. Smile

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:09:10 PM, on 5/21/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16386)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\rundll32.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Windows\system32\taskeng.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {362FBE10-8FFB-4165-9A4A-1DAC1617B88B} - (no file)
O2 - BHO: (no name) - {4D1277E3-AD9F-4677-A977-725C7E20602D} - C:\Windows\system32\xxyvtuSk.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {DA29E3F3-293C-46D6-B452-20E8CEBA5D0D} - C:\Windows\system32\efCuTJbc.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvSvc] "RUNDLL32.EXE" C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\xxyvtuSk.dll,#1
O4 - HKLM\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
O4 - HKLM\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O13 - Gopher Prefix:
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Autodata Limited License Service - Autodata Limited - C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

--
End of file - 3867 bytes

zahvaljujem unapred

IP sačuvana

Zatvori

Crowz

Poruka #1

21. Maj 2008, 00:30:45

Supervizor foruma

Legenda foruma

Violence solves everything

Zodijak
Pol
Poruke	33826
Zastava

	Linux
	Mozilla Firefox 3.0b5
	LG Nexus 5

Fixuj ovo:

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {362FBE10-8FFB-4165-9A4A-1DAC1617B88B} - (no file)
O2 - BHO: (no name) - {4D1277E3-AD9F-4677-A977-725C7E20602D} - C:\Windows\system32\xxyvtuSk.dll
O2 - BHO: (no name) - {DA29E3F3-293C-46D6-B452-20E8CEBA5D0D} - C:\Windows\system32\efCuTJbc.dll (file missing)
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\xxyvtuSk.dll,#1
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O13 - Gopher Prefix:

Kad fixujes, postavi novi i javi da li se problem ponovo desava.

IP sačuvana

Pain is inevitable, suffering is optional.

Plex Server~Plex Home Theater~Plex App~Mediji na svim uredjajima

Chromecast ~ Sta je, kako radi, kome treba i da li se isplati?

Zatvori

genije1

Poruka #2

21. Maj 2008, 00:33:11

Jet set burekdzija

Zodijak
Pol
Poruke	7657

	Windows XP
	Mozilla Firefox 2.0.0.14

baci pogled Smile

vundoFIX

IP sačuvana

Zatvori

aleksxx

Poruka #3

21. Maj 2008, 01:17:09

Svakodnevni prolaznik

Zodijak
Pol
Poruke	262
Zastava

	Windows Vista
	Mozilla Firefox 2.0.0.14
	Samsung

Ok.Videcu sta se desava.postavicu novi log kasnije.

Citat: genije1 21. Maj 2008, 00:33:11

baci pogled Smile

vundoFIX

Probao sam sa tim Vundo fix-om ali mi on nista ne nalazi. neznam shto.

IP sačuvana

Zatvori

chelavi1

Poruka #4

21. Maj 2008, 03:01:09

Moderator

Svedok stvaranja istorije

necu da ti kazem, chelavi...

Zodijak
Pol
Poruke	21969
Zastava

	Windows XP
	Mozilla Firefox 2.0.0.14
	Apple iPhone 12, S21

skini odavde superantyspyware. On ti pomze 100%. Mnogo mocan program.

IP sačuvana

- A robot may not injure a human being or, through inaction, allow a human being to come to harm
- A robot must obey the orders given to it by human beings, except where such orders would conflict with the First Law
- A robot must protect its own existence as long as such protection does not conflict with the First or Second Laws

Zatvori

aleksxx

Poruka #5

21. Maj 2008, 09:25:58

Svakodnevni prolaznik

Zodijak
Pol
Poruke	262
Zastava

	Windows Vista
	Mozilla Firefox 2.0.0.14
	Samsung

Hmmmm. Javlja se opet.Evo kako to Avast vidi.

5/20/2008 11:53:02 AM   SYSTEM   1700   Sign of "Win32:Vundo@dll [Trj]" has been found in "C:\Windows\System32\hceepqhp.dll" file.
5/20/2008 11:53:15 AM   SYSTEM   1700   Sign of "Win32:Vundo@dll [Trj]" has been found in "C:\Windows\System32\hceepqhp.dll" file.
5/20/2008 11:53:17 AM   SYSTEM   1700   Sign of "Win32:Vundo@dll [Trj]" has been found in "C:\Windows\System32\hceepqhp.dll" file.
5/20/2008 11:53:23 AM   SYSTEM   1700   Sign of "Win32:Vundo@dll [Trj]" has been found in "C:\Windows\System32\hceepqhp.dll" file.
5/20/2008 11:53:49 AM   SYSTEM   1700   Sign of "Win32:Vundo@dll [Trj]" has been found in "C:\Windows\System32\hceepqhp.dll" file.
5/20/2008 11:56:06 AM   SYSTEM   1700   Sign of "Win32:Vundo@dll [Trj]" has been found in "C:\Windows\System32\hceepqhp.dll" file.
5/20/2008 11:57:08 AM   SYSTEM   1700   Sign of "Win32:Vundo@dll [Trj]" has been found in "C:\Windows\System32\ghjhjfgj.dll" file.
5/20/2008 12:45:10 PM   SYSTEM   1736   Sign of "Win32:Vundo@dll [Trj]" has been found in "C:\Windows\System32\xxyvttRj.dll" file.
5/20/2008 1:45:12 PM   SYSTEM   1736   Sign of "Win32:Vundo@dll [Trj]" has been found in "C:\Windows\System32\opnmJaAs.dll" file.
5/21/2008 12:58:23 AM   SYSTEM   1620   Sign of "Win32:Vundo@dll [Trj]" has been found in "C:\Windows\System32\efCuTJbc.dll" file.
5/21/2008 1:08:59 AM   SYSTEM   1748   Sign of "Win32:Vundo@dll [Trj]" has been found in "C:\Windows\System32\khfGywVL.dll" file.
5/21/2008 1:37:36 AM   SYSTEM   1748   Sign of "Win32:Vundo@dll [Trj]" has been found in "C:\Windows\System32\efCuTJbc.dll" file.
5/21/2008 1:37:45 AM   SYSTEM   1748   Sign of "Win32:Vundo@dll [Trj]" has been found in "C:\Windows\System32\efCuTJbc.dll" file.
5/21/2008 1:40:02 AM   SYSTEM   1748   Sign of "Win32:Vundo@dll [Trj]" has been found in "C:\Windows\System32\efCuTJbc.dll" file.
5/21/2008 2:30:20 AM   SYSTEM   1600   Sign of "Win32:Vundo@dll [Trj]" has been found in "C:\Windows\System32\ljJbaXop.dll" file.
5/21/2008 5:03:29 AM   SYSTEM   1728   Sign of "Win32:Vundo@dll [Trj]" has been found in "C:\Windows\System32\khfDsRjG.dll" file.
5/21/2008 6:03:30 AM   SYSTEM   1728   Sign of "Win32:Vundo@dll [Trj]" has been found in "C:\Windows\System32\ljjHaATJ.dll" file.
5/21/2008 7:03:29 AM   SYSTEM   1728   Sign of "Win32:Vundo@dll [Trj]" has been found in "C:\Windows\System32\rqRJYoOI.dll" file.
5/21/2008 8:03:32 AM   SYSTEM   1728   Sign of "Win32:Vundo@dll [Trj]" has been found in "C:\Windows\System32\rqRJDspO.dll" file.
5/21/2008 9:03:35 AM   SYSTEM   1728   Sign of "Win32:Vundo@dll [Trj]" has been found in "C:\Windows\System32\tuvSMeCt.dll" file.
5/21/2008 10:24:08 AM   SYSTEM   1672   Sign of "Win32:Vundo@dll [Trj]" has been found in "C:\Windows\System32\opnnonOI.dll" file.
5/21/2008 11:24:09 AM   SYSTEM   1672   Sign of "Win32:Vundo@dll [Trj]" has been found in "C:\Windows\System32\nnNGWQgg.dll" file.
5/21/2008 12:24:09 PM   SYSTEM   1672   Sign of "Win32:Vundo@dll [Trj]" has been found in "C:\Windows\System32\cbXqNfFU.dll" file.
5/21/2008 1:24:12 PM   SYSTEM   1672   Sign of "Win32:Vundo@dll [Trj]" has been found in "C:\Windows\System32\efcASlIC.dll" file.
5/21/2008 2:24:14 PM   SYSTEM   1672   Sign of "Win32:Vundo@dll [Trj]" has been found in "C:\Windows\System32\awtsPFYO.dll" file.
5/21/2008 11:17:09 PM   SYSTEM   1616   Sign of "Win32:Vundo@dll [Trj]" has been found in "C:\Windows\System32\qoMdEWOH.dll" file.

Stalno je drugi naziv dll-a i avast ga prepozna i kad niko nije za kompom >Samo se pojavi .
A evo ga i novi LOG

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:17:41 PM, on 5/21/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16386)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\rundll32.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Windows\system32\taskeng.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvSvc] "RUNDLL32.EXE" C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\mlJBSiGA.dll,#1
O4 - HKLM\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'NETWORK SERVICE')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Autodata Limited License Service - Autodata Limited - C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

Citat: chelavi1 21. Maj 2008, 03:01:09

skini odavde superantyspyware. On ti pomze 100%. Mnogo mocan program.

Probacu i to Ustvari probacu sve sto kazete.

Skenirao sam i sa superantispyware on pronadje ja ih izbrisem reset ponovo skeniram i opet pronadje razne varijante Vundo virus.

Jos jedno pitanje. Sta ustvari radi taj Vundo cini mi se da ima neke veze sa popup reklemama Javom ili sta vec.

« Poslednja izmena: 21. Maj 2008, 11:10:03 od aleksxx »

IP sačuvana

Zatvori

goran988

Poruka #6

21. Maj 2008, 12:32:18

Zvezda u usponu

Zodijak
Pol
Poruke	1454

	Windows XP
	Mozilla Firefox 3.0b5
	HTC Diamond

Ne znam da li znas,ali sve sto radis u vezi brisanja je najbolje da radis iz safe moda?
Znaci sa Hijack This fixujes iz safe moda,skeniras antivirusom iz safe moda..Jedino tako mogu da se izbrisu virusi..
Jel si sve radio iz safe moda?

IP sačuvana

Zatvori

Filip93

Poruka #7

21. Maj 2008, 12:41:09

Moderator

Legenda foruma

Zodijak
Pol
Poruke	31625
Zastava

	UNIX
	Opera 9.27
	Nokia 6120

Skeniraj komp sa ovim.

IP sačuvana

Zatvori

aleksxx

Poruka #8

21. Maj 2008, 14:28:53

Svakodnevni prolaznik

Zodijak
Pol
Poruke	262
Zastava

	Windows Vista
	Mozilla Firefox 2.0.0.14
	Samsung

Citat: goran988 21. Maj 2008, 12:32:18

Pa naravno sve iz safe moda.

Citat: filip93 21. Maj 2008, 12:41:09

Skeniraj komp sa ovim.

A naravno probacu i sa tim pa cu javiti jel naso sta.

IP sačuvana

Zatvori

wanado

Poruka #9

21. Maj 2008, 16:32:05

Ucesnik diskusija

Zodijak
Pol
Poruke	51

	Windows XP
	Internet Explorer 6.0

he ako ti neuspje,probaj sa:Eset Smart Security 3.0.551.0 Final...napravi sliku sa:Acronis True Image 8.0 i nece nijedan virus imati sanse he!!!! Smile

IP sačuvana

Zatvori

Stranice:

2 Sve

Burek :: Forumi :: > Tehnicki deo foruma > Pc Klinika ~ Doktori za vas kompjuter

Tema: Vundo virus (Moderatori: enaB, chelavi1)

Trenutno vreme je: 25. Apr 2024, 14:06:02

Prebaci se na:

Oznake: autodata brisanje Vundo esetusername coinminer dll virus licence

Poslednji odgovor u temi napisan je pre više od 6 meseci.

Temu ne bi trebalo "iskopavati" osim u slučaju da imate nešto važno da dodate. Ako ipak želite napisati komentar, kliknite na dugme "Odgovori" u meniju iznad ove poruke. Postoje teme kod kojih su odgovori dobrodošli bez obzira na to koliko je vremena od prošlog prošlo. Npr. teme o određenom piscu, knjizi, muzičaru, glumcu i sl. Nemojte da vas ovaj spisak ograničava, ali nemojte ni pisati na teme koje su završena priča.

Forum Info: Banneri Foruma :: Burek Toolbar :: Burek Prodavnica :: Burek Quiz :: Najcesca pitanja :: Tim Foruma :: Prijava zloupotrebe

Izvori vesti: Blic :: Wikipedia :: Mondo :: Press :: Naša mreža :: Sportska Centrala :: Glas Javnosti :: Kurir :: Mikro :: B92 Sport :: RTS :: Danas

Prijatelji foruma: Triviador :: Domaci :: Morazzia :: TotalCar :: FTW.rs :: MojaPijaca :: Pojacalo :: 011info :: Burgos :: Alfaprevod

Pravne Informacije: Pravilnik Foruma :: Politika privatnosti :: Uslovi koriscenja :: O nama :: Marketing :: Kontakt :: Sitemap

All content on this website is property of "Burek.com" and, as such, they may not be used on other websites without written permission.