MyCity » Ambulanta -> Arhiva Ambulante » Antichrist malware

Antichrist malware

Napisano na dan: 20.8.2008

Antichrist malware

Sledeća strana

Pagination

Odgovori

goca002 Poslao: 20 Avg 2008 13:43 Idi na vrh
offline goca002 Novi MyCity građanin Pridružio: 20 Avg 2008 Poruke: 16	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! Cao! I ja imam problem sa Antihristom. Citala sam kako bi otprilike trebalo da se ukloni, ali posto ne preporucujete da sama pokusavam, obracam vam se za pomocc. Inace, ne znam da li Antihrist utice na nestajanje nekih podataka, ali meni je ne-znam-kako nestao 'Folder Options', nema ga ni u Control Panelu , ni u My Computer/Tools, jednostavno ga nema... Evo HJ logfile-a: Logfile of HijackThis v1.99.1 Scan saved at 1:28:28 PM, on 8/20/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\bgsvcgen.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\UAService7.exe C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe C:\Program Files\Softwin\BitDefender9\vsserv.exe C:\WINDOWS\system32\sys.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\VDOTool\TBPanel.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\RTHDCPL.EXE C:\Program Files\QuickTime\qttask.exe C:\Program Files\Softwin\BitDefender9\bdoesrv.exe C:\Program Files\Softwin\BitDefender9\bdnagent.exe C:\Program Files\Softwin\BitDefender9\bdswitch.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Goca\Desktop\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = C:\WINDOWS\system32\blank.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = C:\WINDOWS\system32\blank.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer [Day of judgment] F2 - REG:system.ini: Shell=Explorer.exe shell.exe F3 - REG:win.ini: load=C:\WINDOWS\media\wma.exe F2 - REG:system.ini: UserInit=userinit.exe,sys.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O4 - HKLM\..\Run: [blank] C:\WINDOWS\system32\blank.htm O4 - HKLM\..\Run: [vxds] C:\WINDOWS\vxds.exe O4 - HKLM\..\Run: [Gainward] C:\Program Files\VDOTool\TBPanel.exe /A O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe O4 - HKLM\..\Run: [BDOESRV] "C:\Program Files\Softwin\BitDefender9\bdoesrv.exe" O4 - HKLM\..\Run: [BDNewsAgent] "C:\Program Files\Softwin\BitDefender9\bdnagent.exe" O4 - HKLM\..\Run: [BDSwitchAgent] "C:\Program Files\Softwin\BitDefender9\bdswitch.exe" O4 - HKCU\..\Run: [blank] C:\WINDOWS\system32\blank.htm O4 - HKCU\..\Run: [hlps] C:\WINDOWS\Help\hlps.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - Global Startup: Picture Package Menu.lnk = ? O4 - Global Startup: Picture Package VCD Maker.lnk = ? O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{0604F8D1-1133-4AD1-9897-16C91D2E9074}: NameServer = 194.247.192.33 194.247.192.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{0604F8D1-1133-4AD1-9897-16C91D2E9074}: NameServer = 194.247.192.33 194.247.192.1 O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing) O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender9\vsserv.exe" /service (file missing) O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing) Da li neko moze da pomogne? Pozdrav

Profil

dr_Bora Poslao: 20 Avg 2008 16:37 Idi na vrh
offline dr_Bora Anti Malware Fighter Rank 2 Pridružio: 24 Jul 2007 Poruke: 12280 Gde živiš: Höganäs, SE	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! Pozdrav... Citat:Inace, ne znam da li Antihrist utice na nestajanje nekih podataka, ali meni je ne-znam-kako nestao 'Folder Options', nema ga ni u Control Panelu , ni u My Computer/Tools, jednostavno ga nema... To je jedna od posledica infekcije... Sredićemo. Preuzmi program Antichrist Fix na Desktop. Dvoklikom pokrenuti AC-FIX.EXE Pojaviće se upit o nastavku procesa - kliknuti OK Priključiti sve USB memorijske uređaje kako bi bili dezinfikovani (Uređaji koje treba priključiti: USB flash drive, telefon, fotoaparat...) Kliknuti OK kako bi proces čišćenja započeo Kompjuter će se restartovati Nakon ponovog pokretanja sistema, pojaviće se obaveštenje o završetku procesa - kliknuti OK Izveštaj o izvršenom postupku (C:\AC-FIX\AC-FIX Log.txt) će se otvoriti u Notepad-u Iskopiraj dobijeni izveštaj u temu na forumu. Nakon svega, postavi i svež HijackThis logfile.

Profil

goca002 Poslao: 20 Avg 2008 17:15 Idi na vrh
offline goca002 Novi MyCity građanin Pridružio: 20 Avg 2008 Poruke: 16	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! Evo izvestaja: > > > ANTICHRIST FIX < < < Fix started @ 5:06:19 PM, 8/20/2008 Running on Microsoft Windows XP 5.1.2600 Service Pack 2 ------------------------------------------------------- \|»»» Cleaning registry... Done! \|»»» Preparing for reboot... Done! \|»»» Rebooting... \|»»» Continuing fix @ 5:08:05 PM \|»»» Scanning for malicious files: Found C:\WINDOWS\shell.exe »»» Deleted! Found C:\WINDOWS\vxds.exe »»» Deleted! Found C:\WINDOWS\Help\hlps.exe »»» Deleted! Found C:\WINDOWS\Media\wma.exe »»» Deleted! Found C:\WINDOWS\system32\sys.exe »»» Deleted! Found C:\WINDOWS\system32\oeminfo.ini »»» Deleted! Found C:\WINDOWS\system32\oemlogo.bmp »»» Deleted! Found C:\WINDOWS\system32\blank.htm »»» Deleted! \|»»» Checking root directories... Found C:\Recycler.{645FF040-5081-101B-9F08-00AA002F954E} Files: »»»»»» C.exe . . . 73216 bytes »»» Deleting Recycler.{645FF040-5081-101B-9F08-00AA002F954E} »»» Deleted! Found D:\Recycler.{645FF040-5081-101B-9F08-00AA002F954E} Files: »»»»»» D.exe . . . 73216 bytes »»»»»» E.exe . . . 73216 bytes »»» Deleting Recycler.{645FF040-5081-101B-9F08-00AA002F954E} »»» Deleted! Found F:\Recycler.{645FF040-5081-101B-9F08-00AA002F954E} Files: »»»»»» F.exe . . . 73216 bytes »»» Deleting Recycler.{645FF040-5081-101B-9F08-00AA002F954E} »»» Deleted! ------------------------------------------------------- »»»»»» Finished! »»»»»» Antichrist Fix v1.0 by dr_Bora I novi HJ logfile: Logfile of HijackThis v1.99.1 Scan saved at 5:11:51 PM, on 8/20/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\bgsvcgen.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\UAService7.exe C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe C:\Program Files\Softwin\BitDefender9\vsserv.exe C:\Program Files\VDOTool\TBPanel.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\RTHDCPL.EXE C:\Program Files\QuickTime\qttask.exe C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe C:\Program Files\Softwin\BitDefender9\bdoesrv.exe C:\PROGRA~1\Softwin\BITDEF~1\bdnagent.exe C:\PROGRA~1\Softwin\BITDEF~1\bdswitch.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Goca\Desktop\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = [Link mogu videti samo ulogovani korisnici] R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [Link mogu videti samo ulogovani korisnici] O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O4 - HKLM\..\Run: [Gainward] C:\Program Files\VDOTool\TBPanel.exe /A O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe O4 - HKLM\..\Run: [BDOESRV] "C:\Program Files\Softwin\BitDefender9\bdoesrv.exe" O4 - HKLM\..\Run: [BDNewsAgent] "C:\PROGRA~1\Softwin\BITDEF~1\bdnagent.exe" O4 - HKLM\..\Run: [BDSwitchAgent] "C:\PROGRA~1\Softwin\BITDEF~1\bdswitch.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - Global Startup: Picture Package Menu.lnk = ? O4 - Global Startup: Picture Package VCD Maker.lnk = ? O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{0604F8D1-1133-4AD1-9897-16C91D2E9074}: NameServer = 194.247.192.33 194.247.192.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{0604F8D1-1133-4AD1-9897-16C91D2E9074}: NameServer = 194.247.192.33 194.247.192.1 O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing) O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender9\vsserv.exe" /service (file missing) O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

Profil

dr_Bora Poslao: 20 Avg 2008 18:19 Idi na vrh
offline dr_Bora Anti Malware Fighter Rank 2 Pridružio: 24 Jul 2007 Poruke: 12280 Gde živiš: Höganäs, SE	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! Ovo izgleda OK. Primećuješ li sada neki problem? Možda neki zaostali (vizuelni) trag infekcije? Ako je sve OK, potrebno je da isključiš a zatim ponovo uključiš System Restore: [Link mogu videti samo ulogovani korisnici]

Profil

goca002 Poslao: 20 Avg 2008 18:42 Idi na vrh
offline goca002 Novi MyCity građanin Pridružio: 20 Avg 2008 Poruke: 16	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! Pa za sad i meni sve izgleda ok Nema nikakvih poruka, ni onog oka. Hvala puno na pomoci! Pozdrav

Profil

MyCity » Ambulanta -> Arhiva Ambulante » Antichrist malware

Ko je trenutno na forumu

Ukupno su 3852 korisnika na forumu :: 37 registrovanih, 4 sakrivenih i 3811 gosta :: [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 20624 - dana 04 Apr 2026 04:18

Korisnici koji su trenutno na forumu:: Korisnici trenutno na forumu: AC-DC, Aleksa 3215, Bojan198527, BUDDAR70, Colt D, dane007, doragan, Dorcolac, draganl, Electron, hyla, icemilos, Ilija Cvorovic, Istman, ivan979, jarovitt, Jeremiah, Man1ac021, mikhailo, mixa99, Moldovan, N.e.m.a.nj.a., nelezele, Nobunaga, Pekman, royst33, S.Palestinac, samoborac, Simonsen23, skok, Sky diver 29, SlaKoj, slono, synergia, troki1971, vuksa72, zeka013

Svaki korisnik ovog sajta je odgovoran za sadržaj svoje poruke koju objavi na sajtu. Sajt se odriče svake odgovornosti za sadržaj tih poruka.
Postavljanjem vaše poruke ili vašeg autorskog dela na ovaj sajt, saglasni ste da ovaj sajt postaje distributer vašeg dela, i odričete se mogućnosti njegovog povlačenja ili brisanja, bez saglasnosti uprave sajta.
Distribucija sadržaja sa ovog sajta je dozvoljena samo u nekomercijalne svrhe, uz obaveznu napomenu da je sadržaj preuzet sa ovog sajta, i uz obavezno navođenje adrese MyCity sajta. Za sve ostale vidove distribucije obavezni ste da prethodno zatražite odobrenje od vlasnika MyCity sajta.
MyCity pokrenuo, administrira i razvija Predrag Damnjanović, a o uređenju sajta se brine MyCity Tim.
Ukoliko želite da nas kontaktirate kliknite ovde.
Naši sajtovi:
Vesti, Vojni forum, Zaštita od virusa, TekstPesme.rs

This content is licensed under a Creative Commons License.
Based on phpBB 2, translated by Simke, designed by