Virus biohazard desktop :: Pc Klinika ~ Doktori za vas kompjuter

Toolbar

Pravilnik foruma

Burek marketing

Najčešća pitanja

Posetite Burek Prodavnicu

Zatvori

BUREK marketing

Burek :: Forumi :: > Tehnicki deo foruma > Pc Klinika ~ Doktori za vas kompjuter

Tema: Virus biohazard desktop (Moderatori: enaB, chelavi1)

Trenutno vreme je: 27. Apr 2024, 14:00:36

Korisnici koji su trenutno na forumu 0 članova i 1 gost pregledaju ovu temu.

Napomena: Za sva pitanja u vezi kupovine novog hardware-a ili procene vrednosti i preporuke koristite - ovu temu!

Spyware,sta je,kako radi,kako se zastititi? :: Kako rade mreze :: Burek Anti-virus software review :: Index tema koje ne treba propustiti

Stranice:

2 Sve

Tema: Virus biohazard desktop (Pročitano 4794 puta)

sh0rty86

07. Avg 2008, 23:22:19

Poznata licnost

Zodijak
Pol
Poruke	2600
Zastava

	Windows XP
	Opera 9.51
	Samsung Galaxy S+

Uleteo mi virus, otvara milion programa za anti spyware, antimalware.. itd...
Trenutno skeniram komp sa avastom, anti malware-om i spy-bot s&d
Evo HiJack log

Logfile of HijackThis v1.99.1
Scan saved at 23:21: VIRUS ALERT!, on 8/7/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\GIGABYTE\Gigabyte Super Wireless LAN Card\GNConfig.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Conexant\Adsl\dslstat.exe
C:\Program Files\Conexant\Adsl\dslagent.exe
C:\WINDOWS\System32\Rundll32.exe
C:\Program Files\VAV\vav.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Alwil Software\Avast4\ashAvast.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Opera\opera.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
c:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=33171&LegitCheckError=10
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [GNConfig] "C:\Program Files\GIGABYTE\Gigabyte Super Wireless LAN Card\GNConfig.exe" -nogui
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\Conexant\Adsl\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\Conexant\Adsl\dslagent.exe
O4 - HKLM\..\Run: [\Win2FD.exe] C:\Windows\system32\Win2FD.exe
O4 - HKLM\..\Run: [\Win2FF.exe] C:\Windows\system32\Win2FF.exe
O4 - HKLM\..\Run: [\Win300.exe] C:\Windows\system32\Win300.exe
O4 - HKLM\..\Run: [\Win301.exe] C:\Windows\system32\Win301.exe
O4 - HKLM\..\Run: [\Win302.exe] C:\Windows\system32\Win302.exe
O4 - HKLM\..\Run: [Antivirus] C:\Program Files\VAV\vav.exe
O4 - HKLM\..\Run: [{0469d393-045d-3a1c-cb4c-4ced9a9ea98b}] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\swdklatqzdi.dll" DllStart
O4 - HKLM\..\Run: [BM83e237e1] Rundll32.exe "C:\WINDOWS\system32\jwoelgrs.dll",s
O4 - HKLM\..\Run: [80d1047d] rundll32.exe "C:\WINDOWS\system32\mrleexbn.dll",b
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [\Win2FD.exe] C:\Windows\system32\Win2FD.exe
O4 - HKCU\..\Run: [\Win2FF.exe] C:\Windows\system32\Win2FF.exe
O4 - HKCU\..\Run: [\Win300.exe] C:\Windows\system32\Win300.exe
O4 - HKCU\..\Run: [\Win301.exe] C:\Windows\system32\Win301.exe
O4 - HKCU\..\Run: [\Win302.exe] C:\Windows\system32\Win302.exe
O4 - HKCU\..\Run: [Antivirus] C:\Program Files\VAV\vav.exe
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Global Startup: Kaspersky Anti-Hacker.lnk = C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{786A3BC1-3BE9-4F5F-B6D4-87BCDDAD13B5}: NameServer = 77.105.0.19 77.105.0.18
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: tfnslopk - {895B4393-C0FD-4C52-B260-8E3E89B888F8} - C:\WINDOWS\tfnslopk.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Atheros Configuration Service (ACS) - Atheros - C:\WINDOWS\system32\acs.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

Fajlovi prikačeni uz poruku (kliknite na slike za punu veličinu)

(75.6 KB, 1440x900)

IP sačuvana

Zatvori

chelavi1

Poruka #1

07. Avg 2008, 23:42:17

Moderator

Svedok stvaranja istorije

necu da ti kazem, chelavi...

Zodijak
Pol
Poruke	21969
Zastava

	Linux
	Mozilla
	Apple iPhone 12, S21

pfffffffffffffffffffffff.........lepo...lepo...
posto ne smem da ti gledam i dajem savete sta da fixujes u logu, ajd ovako...obavezno skini kasperskisa neta,(makar trial-da odradi posao), i malwarebites rogueremover, idi u safe mode i pusti ih da odrade posao...

http://www.malwarebytes.org/products.php

kada zavrsis javi Smile

IP sačuvana

- A robot may not injure a human being or, through inaction, allow a human being to come to harm
- A robot must obey the orders given to it by human beings, except where such orders would conflict with the First Law
- A robot must protect its own existence as long as such protection does not conflict with the First or Second Laws

Zatvori

sh0rty86

Poruka #2

08. Avg 2008, 00:18:23

Poznata licnost

Zodijak
Pol
Poruke	2600
Zastava

	Windows XP
	Opera 9.51
	Samsung Galaxy S+

Do sada sam sve skenirao, izbrisao je kilo stvari preko spybot s&d i Malwarebytes' Anti-Malware...
Nestao je onaj biohazard sa desktopa ali se pojavio drugi problem...
Desktop je beo i kada kliknem desni klik pojavi mi se sledece-> pogledaj sliku
I kada kliknem na start menu nema mi pola ikonica, za control panel itd...
Takodje ne mogu da pristupim safe mode-u, i nestale su mi particije c i d kada idem preko my computer-a(u total comanderu ih vidi...)

Fajlovi prikačeni uz poruku (kliknite na slike za punu veličinu)

(56.77 KB, 1440x900)

(61.85 KB, 1440x900)

IP sačuvana

Zatvori

chelavi1

Poruka #3

08. Avg 2008, 00:55:12

Moderator

Svedok stvaranja istorije

necu da ti kazem, chelavi...

Zodijak
Pol
Poruke	21969
Zastava

	Linux
	Mozilla
	Apple iPhone 12, S21

O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

pokreni hjt i daj mu ovo da ti fixuje...(iako ne smem....bilo bi dobro da stavis novi log)

« Poslednja izmena: 08. Avg 2008, 00:55:59 od chelavi1 »

IP sačuvana

Zatvori

sh0rty86

Poruka #4

08. Avg 2008, 00:58:37

Poznata licnost

Zodijak
Pol
Poruke	2600
Zastava

	Windows XP
	Opera 9.51
	Samsung Galaxy S+

Izvini to je log pre scan-a.
Evo ga novi u njemu nema ta stavka...

Logfile of HijackThis v1.99.1
Scan saved at 00:56: VIRUS ALERT!, on 8/8/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\GIGABYTE\Gigabyte Super Wireless LAN Card\GNConfig.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Conexant\Adsl\dslstat.exe
C:\Program Files\Conexant\Adsl\dslagent.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
C:\Program Files\Opera\opera.exe
C:\WINDOWS\system32\mspaint.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashQuick.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Achilles-Script 4.5 White\Mirc.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
c:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=33171&LegitCheckError=10
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [GNConfig] "C:\Program Files\GIGABYTE\Gigabyte Super Wireless LAN Card\GNConfig.exe" -nogui
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\Conexant\Adsl\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\Conexant\Adsl\dslagent.exe
O4 - HKLM\..\Run: [\Win2FD.exe] C:\Windows\system32\Win2FD.exe
O4 - HKLM\..\Run: [\Win2FF.exe] C:\Windows\system32\Win2FF.exe
O4 - HKLM\..\Run: [\Win300.exe] C:\Windows\system32\Win300.exe
O4 - HKLM\..\Run: [\Win301.exe] C:\Windows\system32\Win301.exe
O4 - HKLM\..\Run: [\Win302.exe] C:\Windows\system32\Win302.exe
O4 - HKLM\..\Run: [Antivirus] C:\Program Files\VAV\vav.exe
O4 - HKLM\..\Run: [80d1047d] rundll32.exe "C:\WINDOWS\system32\mrleexbn.dll",b
O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [\Win2FD.exe] C:\Windows\system32\Win2FD.exe
O4 - HKCU\..\Run: [\Win2FF.exe] C:\Windows\system32\Win2FF.exe
O4 - HKCU\..\Run: [\Win300.exe] C:\Windows\system32\Win300.exe
O4 - HKCU\..\Run: [\Win301.exe] C:\Windows\system32\Win301.exe
O4 - HKCU\..\Run: [\Win302.exe] C:\Windows\system32\Win302.exe
O4 - HKCU\..\Run: [Antivirus] C:\Program Files\VAV\vav.exe
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Global Startup: Kaspersky Anti-Hacker.lnk = C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{786A3BC1-3BE9-4F5F-B6D4-87BCDDAD13B5}: NameServer = 77.105.0.18 77.105.0.19
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: tfnslopk - {895B4393-C0FD-4C52-B260-8E3E89B888F8} - C:\WINDOWS\tfnslopk.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Atheros Configuration Service (ACS) - Atheros - C:\WINDOWS\system32\acs.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

« Poslednja izmena: 08. Avg 2008, 00:59:46 od sh0rty86 »

IP sačuvana

Zatvori

Crowz

Poruka #5

08. Avg 2008, 01:03:35

Supervizor foruma

Legenda foruma

Violence solves everything

Zodijak
Pol
Poruke	33826
Zastava

	Windows XP
	Mozilla Firefox 3.0.1
	LG Nexus 5

Ajmo redom...

VAV.exe pokretac vistinog antivirusa. Posto je tvoj OS Xp i posto imas avasta, vav.exe se jos pojavljuje kao malware iz porodice: Rogue, mada je moguc i sinkin trojan.

Sve uradi iz Safe Mode-a

Iz startapa izbaci ovo:

C:\Program Files\VAV\vav.exe

Fixuj sledece:

Moja preporuka je da tulbarove pobijes ali kako hoces, od njih nista dobro nije doslo...

O4 - HKLM\..\Run: [\Win2FD.exe] C:\Windows\system32\Win2FD.exe
O4 - HKLM\..\Run: [\Win2FF.exe] C:\Windows\system32\Win2FF.exe
O4 - HKLM\..\Run: [\Win300.exe] C:\Windows\system32\Win300.exe
O4 - HKLM\..\Run: [\Win301.exe] C:\Windows\system32\Win301.exe
O4 - HKLM\..\Run: [\Win302.exe] C:\Windows\system32\Win302.exe
O4 - HKLM\..\Run: [Antivirus] C:\Program Files\VAV\vav.exe
O4 - HKLM\..\Run: [{0469d393-045d-3a1c-cb4c-4ced9a9ea98b}] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\swdklatqzdi.dll" DllStart
O4 - HKLM\..\Run: [BM83e237e1] Rundll32.exe "C:\WINDOWS\system32\jwoelgrs.dll",s
O4 - HKLM\..\Run: [80d1047d] rundll32.exe "C:\WINDOWS\system32\mrleexbn.dll",b
O4 - HKCU\..\Run: [\Win2FD.exe] C:\Windows\system32\Win2FD.exe
O4 - HKCU\..\Run: [\Win2FF.exe] C:\Windows\system32\Win2FF.exe
O4 - HKCU\..\Run: [\Win300.exe] C:\Windows\system32\Win300.exe
O4 - HKCU\..\Run: [\Win301.exe] C:\Windows\system32\Win301.exe
O4 - HKCU\..\Run: [\Win302.exe] C:\Windows\system32\Win302.exe
O4 - HKCU\..\Run: [Antivirus] C:\Program Files\VAV\vav.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O21 - SSODL: tfnslopk - {895B4393-C0FD-4C52-B260-8E3E89B888F8} - C:\WINDOWS\tfnslopk.dll
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

E sad, u neku ruku, ti si sampion burek foruma, ovo je jedan od najlosijih logova. Mnogo malwarea i trojanaca, posle ovih fixeva, pokreni antivirus (safe mode), skeniraj ceo racunar i opet postavi hijackthis log. U zavisnosti od ostecenja sistemskih fajlova + mogucnoscu da avast obrise i neku neophodnu dll za rad usled zarazenosti iste, pripremi se i za mogucnost reinstalacije OS-a.

Skini i ovo sto celavi predlaze, pa procesljaj sistem i sa tom alatkom.

Edit: Fuck, kasnim...

Edit2: Uradi kako ti je receno, pa cemo videti kako i sta dalje. Drugi log je 98% prvog, znaci nista nije odradjeno.

« Poslednja izmena: 08. Avg 2008, 01:07:17 od Crowz »

IP sačuvana

Pain is inevitable, suffering is optional.

Plex Server~Plex Home Theater~Plex App~Mediji na svim uredjajima

Chromecast ~ Sta je, kako radi, kome treba i da li se isplati?

Zatvori

sh0rty86

Poruka #6

08. Avg 2008, 01:10:40

Poznata licnost

Zodijak
Pol
Poruke	2600
Zastava

	Windows XP
	Opera 9.51
	Samsung Galaxy S+

Ne mogu da udjem u startup posto u startmenu-u nemam run prikazan, pogledaj sliku.
Takodje ne mogu da udjem u safemode... Sta mi je ciniti? Smile

IP sačuvana

Zatvori

chelavi1

Poruka #7

08. Avg 2008, 01:24:43

Moderator

Svedok stvaranja istorije

necu da ti kazem, chelavi...

Zodijak
Pol
Poruke	21969
Zastava

	Linux
	Mozilla
	Apple iPhone 12, S21

kako ne mozes u safe mod? kada restartujes racunar dok ti dize sistem stiskaj f8 i idi na opciju safe mode pa enter...

IP sačuvana

Zatvori

sh0rty86

Poruka #8

08. Avg 2008, 01:33:21

Poznata licnost

Zodijak
Pol
Poruke	2600
Zastava

	Windows XP
	Opera 9.51
	Samsung Galaxy S+

Znam ceo proces... Nego kada pocinje da se loguje u safe mode, prikaze text safemode-a u sva cetiri coska i tu zakuca... Nego fixovao sam ovo iz Win-a evo novi log...

Logfile of HijackThis v1.99.1
Scan saved at 01:32: VIRUS ALERT!, on 8/8/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\GIGABYTE\Gigabyte Super Wireless LAN Card\GNConfig.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Conexant\Adsl\dslstat.exe
C:\Program Files\Conexant\Adsl\dslagent.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
C:\Program Files\Opera\opera.exe
C:\WINDOWS\system32\mspaint.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Achilles-Script 4.5 White\Mirc.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\totalcmd\TOTALCMD.EXE
c:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=33171&LegitCheckError=10
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [GNConfig] "C:\Program Files\GIGABYTE\Gigabyte Super Wireless LAN Card\GNConfig.exe" -nogui
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\Conexant\Adsl\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\Conexant\Adsl\dslagent.exe
O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Global Startup: Kaspersky Anti-Hacker.lnk = C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{786A3BC1-3BE9-4F5F-B6D4-87BCDDAD13B5}: NameServer = 77.105.0.18 77.105.0.19
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Atheros Configuration Service (ACS) - Atheros - C:\WINDOWS\system32\acs.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Edit:Evo log iz malware-a, u pitanju je izgleda neki Vundo trojanac...

Malwarebytes' Anti-Malware 1.24
Database version: 1030
Windows 5.1.2600 Service Pack 2

1:34:42 AM 8/8/2008
mbam-log-8-8-2008 (01-34-42).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 90679
Time elapsed: 42 minute(s), 24 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 2
Registry Keys Infected: 3
Registry Values Infected: 1
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 11

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\WINDOWS\system32\mrleexbn.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\opnkjHBr.dll (Trojan.Vundo) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a839d90e-3c78-474e-be8b-7fa3401798e3} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{a839d90e-3c78-474e-be8b-7fa3401798e3} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mxlivemedia (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\80d1047d (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo) -> Data: c:\windows\system32\opnkjhbr -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\opnkjhbr -> Delete on reboot.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\opnkjHBr.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\rBHjknpo.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\rBHjknpo.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mrleexbn.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\nbxeelrm.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Shone\Local Settings\Temporary Internet Files\Content.IE5\TRYB31H9\kb456456[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\edsa.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\tdsslog.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\xdxfhxwnlvnqelyz.exe (Malware.Trace) -> Quarantined and deleted successfully.
D:\download\tools\Utills\screensaver\3D Waterfall\patch.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\download\tools\Utills\screensaver\Aquarium screensavers\Dream Aquarium\patch.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

« Poslednja izmena: 08. Avg 2008, 01:36:45 od sh0rty86 »

IP sačuvana

Zatvori

Crowz

Poruka #9

08. Avg 2008, 01:41:49

Supervizor foruma

Legenda foruma

Violence solves everything

Zodijak
Pol
Poruke	33826
Zastava

	Windows XP
	Mozilla Firefox 3.0.1
	LG Nexus 5

Ok, log je bolji. Kakvi su sada problemi?

Jel mozes sada u safe mode?

IP sačuvana

Pain is inevitable, suffering is optional.

Plex Server~Plex Home Theater~Plex App~Mediji na svim uredjajima

Chromecast ~ Sta je, kako radi, kome treba i da li se isplati?

Zatvori

Stranice:

2 Sve

Burek :: Forumi :: > Tehnicki deo foruma > Pc Klinika ~ Doktori za vas kompjuter

Tema: Virus biohazard desktop (Moderatori: enaB, chelavi1)

Trenutno vreme je: 27. Apr 2024, 14:00:36

Prebaci se na:

Oznake: proces waterfall exe start customize menu problemas nestao all alert
remove infected totalcmd hkcu Virus aawservice manager ashwebsv biohazard world

Poslednji odgovor u temi napisan je pre više od 6 meseci.

Temu ne bi trebalo "iskopavati" osim u slučaju da imate nešto važno da dodate. Ako ipak želite napisati komentar, kliknite na dugme "Odgovori" u meniju iznad ove poruke. Postoje teme kod kojih su odgovori dobrodošli bez obzira na to koliko je vremena od prošlog prošlo. Npr. teme o određenom piscu, knjizi, muzičaru, glumcu i sl. Nemojte da vas ovaj spisak ograničava, ali nemojte ni pisati na teme koje su završena priča.

Forum Info: Banneri Foruma :: Burek Toolbar :: Burek Prodavnica :: Burek Quiz :: Najcesca pitanja :: Tim Foruma :: Prijava zloupotrebe

Izvori vesti: Blic :: Wikipedia :: Mondo :: Press :: Naša mreža :: Sportska Centrala :: Glas Javnosti :: Kurir :: Mikro :: B92 Sport :: RTS :: Danas

Prijatelji foruma: Triviador :: Domaci :: Morazzia :: TotalCar :: FTW.rs :: MojaPijaca :: Pojacalo :: 011info :: Burgos :: Alfaprevod

Pravne Informacije: Pravilnik Foruma :: Politika privatnosti :: Uslovi koriscenja :: O nama :: Marketing :: Kontakt :: Sitemap

All content on this website is property of "Burek.com" and, as such, they may not be used on other websites without written permission.