Poslao: 21 Avg 2008 18:58
|
offline
- Pridružio: 25 Nov 2007
- Poruke: 296
|
Imam Avast Home Edition i prikazuje mi da se pojavio jedan Trojanac-gen ,Rookit-gen, i malwere-gen pomocu Avasta i SpyBoot-a otkrijem lokaciju virusa zatim ih licno obrisem u kantu pa iz kante zauvijek al nakon novog paljenja kompa mi se pojavljuju isti virusi
Dopuna: 21 Avg 2008 18:51
Mozel mi ko reci koji mi je Antivirus poreban za birsanje tog smeca
Dopuna: 21 Avg 2008 18:58
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:53:20, on 21.8.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe
C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe
C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
C:\Program Files\Lexmark 1200 Series\lxczbmon.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\nedzad\Desktop\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LVCOMSX] "C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe"
O4 - HKLM\..\Run: [Lexmark 1200 Series] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Uniblue SpeedUpMyPC] C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe -s
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{59B11DD1-5FD1-49D9-834E-440E71D4525F}: NameServer = 77.78.192.10 77.78.192.20
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\Logitech\SrvLnch\SrvLnch.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
--
End of file - 5995 bytes
|
|
|
|
Poslao: 21 Avg 2008 19:04
|
offline
- dr_Bora
- Anti Malware Fighter
Rank 2
- Pridružio: 24 Jul 2007
- Poruke: 12280
- Gde živiš: Höganäs, SE
|
Poz...
Da li bi mogao da napišeš nazive detektovanih file-ova?
|
|
|
|
Poslao: 22 Avg 2008 13:41
|
offline
- Pridružio: 25 Nov 2007
- Poruke: 296
|
C:\WINDOWS\system32\sysrest.sys,Hidden driver file
C:\WINDOWS\system32\sysrest32.exe,Hidden application file
C:\WINDOWS\$NtServicePackUninstall$\sysrestore.chm,Hidden File
C:\WINDOWS\Help\sysrestore.chm,Hidden File
C:\WINDOWS\Help\sysrestore.hlp,Hidden File
C:\WINDOWS\ServicePackFiles\i386\sysrestw.chm,Hidden File
C:\WINDOWS\system32\sysrest.sys,Hidden File
C:\WINDOWS\system32\sysrest32.exe,Hidden File
OVO SU ROOTKITS TU SU TACNE LOKACIJE I NAZIVI FAJLOVA AL NAKON STO IH JA IZBRISEM ONI SE POJAVE DALI IH TREBEM IZBRISATI U SAFE MODE I SMIJEMLI BRISATI DA NE OSTETIM SISTEMSKE FAJLOVE
Dopuna: 22 Avg 2008 13:41
Nasao sam ih AVG anti rootkits i sad bi ih izbrisao al neznam smijemli da sat ne ostetim
|
|
|
|
|
Poslao: 22 Avg 2008 17:21
|
offline
- Pridružio: 25 Nov 2007
- Poruke: 296
|
Meni je Avast na srpskom jeziku evo pokusat cu da na eng.prebacim
Dopuna: 22 Avg 2008 17:21
Ne moze mozetl mi to molim vas reci na srpskom jeziku za avast?
|
|
|
|
Poslao: 22 Avg 2008 18:33
|
offline
- dr_Bora
- Anti Malware Fighter
Rank 2
- Pridružio: 24 Jul 2007
- Poruke: 12280
- Gde živiš: Höganäs, SE
|
Samo isprati ostatak uputstva.
|
|
|
|
Poslao: 22 Avg 2008 19:35
|
offline
- Pridružio: 25 Nov 2007
- Poruke: 296
|
I nije mi se pojavio (C:\ComboFix.txt)
Dopuna: 22 Avg 2008 18:37
ComboFix 08-08-21.02 - nedzad 2008-08-22 18:24:45.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.625 [GMT 2:00]
Running from: C:\Documents and Settings\nedzad\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
EVO I OVO
Dopuna: 22 Avg 2008 19:35
Snimio sam file1.txt. a ovo Autostart Tab-om ne kontam kako da to uradim
https://www.mycity.rs/must-login.png
|
|
|
|
Poslao: 23 Avg 2008 08:58
|
offline
- dr_Bora
- Anti Malware Fighter
Rank 2
- Pridružio: 24 Jul 2007
- Poruke: 12280
- Gde živiš: Höganäs, SE
|
ComboFix nije završio rad, tako da je potrebno da ga ponovo pokreneš.
Pre toga ipak isključi avast! Ne znam tačno kako su određene stavke prevedene na srpski, no pokušaću da pojasnim.
Klikni desnim tasterom miša na avast! ikonicu u donjem, desnom uglu ekrana i izaberi Podešavanja Programa....
U prozoru koji se otvori, pod Rešavanje problema (opcija se nalazi skroz na dnu, sa leve strane) čekiraj opciju Isključi (ili onemogući) avast! self-defence (Samo-Zaštita) i klikni OK.
Takođe, klikni desnim tasterom miša na avast! ikonicu u donjem, desnom uglu ekrana i izaberi Zaustavi aktivnu zaštitu (opcija se nalazi skroz u dnu menija).
Nakon toga pokreni ComboFix...
|
|
|
|
Poslao: 23 Avg 2008 15:09
|
offline
- Pridružio: 25 Nov 2007
- Poruke: 296
|
Uradio sam to s avastom al kad pokrenem ComboFix stane mi na Complete stage32 ili na 40 i pokusavao sam dva-tri puta sam Combom
Dopuna: 23 Avg 2008 15:09
Na kraju mi blokira comp i moram restartovat postojili koji drugi program?
|
|
|
|
|