MyCity » Ambulanta -> Arhiva Ambulante » Mala arhiva antivirusa

Mala arhiva antivirusa

Napisano na dan: 19.1.2009

Mala arhiva antivirusa
Sledeća strana Pagination

Idi na vrh

Poslao: 19 Jan 2009 10:10
Idi na vrh
offline
  • Pridružio: 15 Jan 2009
  • Poruke: 31

Molim za pomoc.
AVG mi je nasao potencijalno stetan program RemoteAdmin.BX, ali ne moze da ga ukloni jer mu je mala arhiva, pa me zanima da li je bezbedno da ga normalno izbrisem?



Poslao: 19 Jan 2009 11:18
Idi na vrh
offline
  • Pridružio: 15 Jan 2009
  • Poruke: 31

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:11:23, on 19.1.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ATKKBService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgfws8.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
C:\Program Files\ASUS\ASUS Remote\RemoteControlAppl.exe
C:\Program Files\CyberLink\PowerCinema\PCMService.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\EXPERTool\TBPanel.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Winamp\winamp.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Zorica\Desktop\pomoc\TR3.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [Link mogu videti samo ulogovani korisnici]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [Link mogu videti samo ulogovani korisnici]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [Link mogu videti samo ulogovani korisnici]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [Link mogu videti samo ulogovani korisnici]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [Link mogu videti samo ulogovani korisnici]
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = [Link mogu videti samo ulogovani korisnici]*http://www.yahoo.com
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [RemoteControl] C:\Program Files\ASUS\ASUS Remote\RemoteControlAppl.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\CyberLink\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [GAINWARD] C:\Program Files\EXPERTool\TBPanel.exe /A
O4 - Startup: Yahoo! Widgets.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
O4 - Global Startup: BlueSoleil.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - [Link mogu videti samo ulogovani korisnici]\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - [Link mogu videti samo ulogovani korisnici]
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: AVG8 Firewall (avgfws8-) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgfws8.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 7152 bytes



Poslao: 19 Jan 2009 14:09
Idi na vrh
offline
  • diarno  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 15 Jun 2007
  • Poruke: 5572

Kazi mi lokaciju tog fajla i njegovo puno ime(znaci ime fajl).

Poslao: 19 Jan 2009 14:50
Idi na vrh
offline
  • Pridružio: 15 Jan 2009
  • Poruke: 31

Izbrisala sam fajl posto mi niko nije odgovorio, a antivirus mi je posle tog programa prijavio i jednog Trojanca.

Obrisani fajl je bio na D:/Programi/CryptLoad/CryptLoad_1.1.6.rar (nisam ga raspakovala). A Trojanski konj Downloader.Banload.AHMF je pronaden na C:/System Volume Information_restore(1D8FA1CD-C536-425F-8A36-C1C94740102C)/RP111/A0045807.exe

Pre koji dan sam cistila komp (tema: Worm /Autoit.MCJ), ali mi se i nakon toga pojavio trojanac u fajlu csrcs.exe koji ne postoji. Stvarno ne znam sta da radim. Sto se tice fajla Cryptload, skinula sam ga danas.

Poslao: 19 Jan 2009 15:22
Idi na vrh
offline
  • diarno  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 15 Jun 2007
  • Poruke: 5572

1.Sto se tice Cryptloada, u pitanju je lazna uzbuna.

2Sto se tice Downloader.Banload.AHMF on je potencijalna opasnost..Tj. moze ti naskoditi samo ako budes koristila system restore.

Da bismo to sprecili uradi sledece :

[Link mogu videti samo ulogovani korisnici]

Sto se tice trojanca csrcs.exe on je resen u prethodnom tvom slucaju.

3.Jel ti se opet pojavljuje ta poruka kako ne postoji?

Jer log je cist i ne vidim zasto bi se opet pojavljavivala ta greska, niti da te mucim sa nekim ozbiljnijim alatima.

Poslao: 19 Jan 2009 20:32
Idi na vrh
offline
  • Pridružio: 15 Jan 2009
  • Poruke: 31

Ne pojavljuje mi se vise poruka i sve je ok sada.
Sto se tice cryptload-a i ja sam posumnjala da je
lazna uzbuna, ali sam ipak htela da proverim.
Znaci nema vise SR za mene.
Hvala puno na pomoci.

Poslao: 19 Jan 2009 20:38
Idi na vrh
offline
  • diarno  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 15 Jun 2007
  • Poruke: 5572

Uh... Izvini nesto si pogresno shvatila jer ti ja nisam lepo objasnio....

Kada ugasis SR... Taj malware ce nestati... Sad mozes slobodno da ga ukljucis (SR) i u njemu se nece nalaziti problematican fajl....

Poslao: 19 Jan 2009 21:02
Idi na vrh
offline
  • Pridružio: 15 Jan 2009
  • Poruke: 31

To si izostavio da mi kazes.Sad mi je lakse posto me SR spasava.
Hvala.

MyCity » Ambulanta -> Arhiva Ambulante » Mala arhiva antivirusa

Ko je trenutno na forumu
 

Ukupno su 1335 korisnika na forumu :: 107 registrovanih, 5 sakrivenih i 1223 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 13297 - dana 20 Jan 2026 17:42

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: 100ka, 4thFlavian, A.R.Chafee.Jr., alzir86, amstel, Andrija357, Ares12356, babaroga, bambulic, bankulen, bavar357, Betta, blejač, Bobrock1, Bojan198527, bokicacar, Boris90, bpop, Burovnyak, BZ, Cavendish, ccoogg123, Cicumile, Citalac, Comyymoc, Crazzer, delrey, Dimitrije Paunovic, Dorcolac, draganca, draganl, dragoljub11987, DrMrPr, dunavzed, dusan.l, Electron, Fliper, foka106, g_g, Georgius, GH69, Gogi_avio, Hardenberg, iceburn, ILGromovnik, Insan, Ir, ivan1973, Jaz, kaput21, Kenanjoz, king111, Kubovac, Kupresko polje, kybonacci, Lance Guest, Lester Freamon, Litostroton, littlebunny, MaschinenPistole, mercedesamg, milenko crazy north, Milometer, Milos1389, Miškić, Moldovan, monomah, Mrav Obrad, nebidrag, nelezele, nightwish, niksa517, Paklenica, Papadubi, pein, Pero Petković, Petrusci, Pilence, PO1974, pobeda, Povratak1912, predragc, proka89, radoznao, redstar72, rovac, S-lash, sap, Sirius, Sićko, skvara, Solunac na steroidima, srđan, StD, StefanNS, svnedelja, t84dar, Tumansky, Vica1958, VJ, Vrač, vuksa72, Yekaterinburg, YugoSlav, Zastava, zexon, zivojin32