MyCity » Ambulanta -> Arhiva Ambulante » Opet trojanac

Opet trojanac

Napisano na dan: 25.4.2007

Opet trojanac
Sledeća strana Pagination

Idi na vrh

Poslao: 25 Apr 2007 12:55
Idi na vrh
offline
  • Pridružio: 14 Avg 2006
  • Poruke: 108

Da li neko moze da mi pomogne (ponovo) da skinem trojance i kako da se zastitim od napada istih ubuduce. Koristim KAV 6.0.2.614 i AVG Anti-Spyware 7.5.

Trojan program Trojan-Proxy.Win32.Horst.ww File: C:\System Volume Information\_restore{8E0C20BE-B862-434F-AFEC-9D942E1A8128}\RP366\A0044182.exe

Trojan program Trojan-Downloader.Win32.Horst.al File: C:\System Volume Information\_restore{8E0C20BE-B862-434F-AFEC-9D942E1A8128}\RP355\A0043534.exe//UPX


Logfile of HijackThis v1.99.1
Scan saved at 12:51:56, on 4/25/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\msiexec.exe
C:\Documents and Settings\Misa\Desktop\HT.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareBlock Class - {0A87E45F-537A-40B4-B812-E2544C21A09F} - D:\Programi\SpyCatcher 2006\SCActiveBlock.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: &Google Search - [Link mogu videti samo ulogovani korisnici]\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - [Link mogu videti samo ulogovani korisnici]\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - [Link mogu videti samo ulogovani korisnici]\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - [Link mogu videti samo ulogovani korisnici]\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - [Link mogu videti samo ulogovani korisnici]\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - [Link mogu videti samo ulogovani korisnici]\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - [Link mogu videti samo ulogovani korisnici]\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted IP range: [Link mogu videti samo ulogovani korisnici]
O17 - HKLM\System\CCS\Services\Tcpip\..\{5552D92D-932E-44F0-9725-163F2D0F2AAD}: NameServer = 194.247.192.33,194.247.192.1
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: InCD Helper (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe



Poslao: 25 Apr 2007 13:09
Idi na vrh
offline
  • Pridružio: 06 Apr 2005
  • Poruke: 1023

ona dva trojanca su u sistem restore i trenutno ne predstavljaju nikakvu pretnju.

pregledacu log pa cu ti se javiti sa rezultatima



Poslao: 25 Apr 2007 13:11
Idi na vrh
offline
  • Pridružio: 14 Avg 2006
  • Poruke: 108

Hvala ti unapred, ali me i dalje interesuje kako da sprecim ceste upade istih?

Poslao: 25 Apr 2007 15:16
Idi na vrh
offline
  • Pridružio: 06 Apr 2005
  • Poruke: 1023

log je cist. ono sto ti je anti virus pronasao je infekcija koju si ocistila sa sistema ali je ona ostala u sistem restore-u.

to ces resiti tako sto:

kliknes na my computer desnim dugmetom i izaberes opciju properties
otvorice ti se prozor i u njemu izaberes tab system restore
cekiras box Turn off system restore
sacekas da se iskljucivanje zavrsi (obrisace sve prethodne pozicije)
odcekiras box Turn off system restore (napravice novu poziciju)

Poslao: 25 Apr 2007 16:46
Idi na vrh
offline
  • Pridružio: 14 Avg 2006
  • Poruke: 108

Hvala na pomoci!

Poslao: 25 Apr 2007 17:12
Idi na vrh
offline
  • Pridružio: 06 Apr 2005
  • Poruke: 1023

sto se tice ovoga:

milena1402 ::ali me i dalje interesuje kako da sprecim ceste upade istih?


mogla bi da instaliras i neki firewall i redovno da update-ujes KAV i AVG.
dosta toga zavisi i od navika na netu (koje sajtove posecujes, sta skidas...)

ovde imas dosta tema o firewall-ovima [Link mogu videti samo ulogovani korisnici] pa ako te zanima procitaj i izaberi sta ti odgovara.

Poslao: 25 Apr 2007 21:32
Idi na vrh
offline
  • Pridružio: 14 Avg 2006
  • Poruke: 108

Sto se tice updatea, to radim redovno, ali definitivno moram da postavim i neki firewall program. Sajtovi koje posecujem su uglavnom vezani za grafiku i tehniku.

U svakom slucaju, hvala ti jos jednom na pomoci.

MyCity » Ambulanta -> Arhiva Ambulante » Opet trojanac

Ko je trenutno na forumu
 

Ukupno su 1215 korisnika na forumu :: 120 registrovanih, 16 sakrivenih i 1079 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 20624 - dana 04 Apr 2026 04:18

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: 16.mabr, 357magnum, AleksSE, asdfjklc, Atomski čoban, Avalon015, berste23, bestguarder, Bojan85, celt, ceman, cenejac111, Chainsaw, CHARLIE JA., chichabg, cifra, cikadeda, Ciri1994, Cirkon, comi, darcaud, deki1001, Denaya, djboj, Djota1, DJUNTA, dmarx1, draganl, Duk011, Dusko_Dugousko, Electron, ElGenius, Feller, Fliper, Fructo, GazdaDjoka, Gogi_avio, Gosha101980, Heavy Jerk, Hitri, ibssa, ikan, Jeremiah, Još malo pa deda, kinderpingvin, KizJ, Kolimator, komenski, komsija1, kuntalo, Laluvr, lcc, lord sir giga, Lubenica303, LUDI, luja, Mae, Manjane, marsi, Medojed, mercedesamg, Mickey91, Milenko1980., Miler88, milos97, mishkooo, Mićko, mkukoleca, moldway, monomah, mrm, mrzimregistraciju, Naj-Turs, Nebojsa81, Neutral, nevjerna beba, Nobunaga, ognjentrm, orah, Orc, partyzan, perko91, Phaeton, PlayerOne, precan, Prečanin30, proljece, Radgost, Radoslava, RajkoB, Ray1973, rikirubio, royst33, ruma, S2M, S94, Scarecrow994, Semberija, sistem22, skok, Slobodan Filipović, Smor, stegonosa, styg, taomaster, Tas011, theNedjeljko, trutcina, tubular, Velizar Laro, vladetije, VPV, Wehicle, YugoSlav, zdrebac, zil10, Zmaj Tolak, zokizemun, zule2, |_MeD_|