MyCity » Ambulanta -> Arhiva Ambulante » NewDotNet & Aureate adware

NewDotNet & Aureate adware

Napisano na dan: 16.3.2007
1

NewDotNet & Aureate adware
Sledeća strana Pagination

Idi na vrh

Poslao: 16 Mar 2007 22:18
Idi na vrh
offline
  • Alics  Male
  • Ugledni građanin
  • Pridružio: 02 Apr 2006
  • Poruke: 353
  • Gde živiš: Šabac

Iako sam se nadao da mi ambulanta neće trebati, evo me.
Računar mi je do danas popodne radio normalno, i onda se odjednom katastrofalno usporio. Evo HijackThis loga:



Logfile of HijackThis v1.99.1
Scan saved at 22:19:51, on 16.03.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Kerio\Personal Firewall\persfw.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\UpsPilot\Winpower.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\VM_STI.EXE
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\PROGRA~1\UpsPilot\hello21.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZENG09.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\AntiVir PersonalEdition Classic\avscan.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Bosko\Desktop\alics\alics.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet7_48.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: QUICKfind BHO Object - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - C:\PROGRA~1\TEXTware\QUICKF~1\PlugIns\IEHelp.dll
O2 - BHO: (no name) - {CD4C3CF0-4B15-11D1-ABED-709549C10000} - (no file)
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE ZSMC USB PC Camera
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,ClientStartup -s
O4 - HKLM\..\RunServices: [Winpower] C:\Program Files\UpsPilot\Winpower.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Download All by FlashGet - C:\PROGRA~1\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\PROGRA~1\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{22CB8D0C-2371-416D-B061-04105FA5F099}: NameServer = 10.5.0.100
O17 - HKLM\System\CCS\Services\Tcpip\..\{412C2E43-CF0B-48E4-A6B0-96419BB9CE9C}: NameServer = 10.5.0.100
O17 - HKLM\System\CS1\Services\Tcpip\..\{22CB8D0C-2371-416D-B061-04105FA5F099}: NameServer = 10.5.0.100
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: MySql - Unknown owner - C:/xampp-win32-1.5.5/xampp/mysql/bin/mysqld-nt.exe (file missing)
O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall\persfw.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Winpower - Zero G - C:\PROGRA~1\UpsPilot\Winpower.exe

[edit by DeM14n]Promenjen naslov teme[/edit]

Poslao: 16 Mar 2007 22:46
Idi na vrh
offline
  • DEMIAN  Male
  • Legendarni građanin
  • IT Manager
  • Pridružio: 25 Mar 2005
  • Poruke: 3706
  • Gde živiš: The darkest place on earth..

Potvrđujem da imaš malware na računaru ali nije strašno rešiće se..
Treba mi još malo vremena da pregledam ovo kako treba pa ti se javim sa uputstvom za otlanjanje.
Reci mi samo pre toga da li si na dial up-u ?

Poslao: 16 Mar 2007 22:54
Idi na vrh
offline
  • Alics  Male
  • Ugledni građanin
  • Pridružio: 02 Apr 2006
  • Poruke: 353
  • Gde živiš: Šabac

Ne, nisam na dial up-u, imam wireless, tako da nije problem ako treba nešto veliko da se downloaduje.

Poslao: 17 Mar 2007 00:26
Idi na vrh
offline
  • DEMIAN  Male
  • Legendarni građanin
  • IT Manager
  • Pridružio: 25 Mar 2005
  • Poruke: 3706
  • Gde živiš: The darkest place on earth..

Uputiću te na par pripremljenih uputstava da bi se lakše snašao pri otklanjanju ove gamadi. Može da se sredi i preko AS programa tipa Spybot S&D ili Ad-aware ali tako postoji mogućnost da ostaneš bez internet veze ako program ne očisti to kako treba. Idemo polako ručno nekako mi je sigurnije.. Smile

Prvo primeni ovo uputstvo:

Spybot S&D's Teatimer

Pokrenite Spybot S&D
Kliknite Mode stavku u meniju
Odaberite Advance Mode
Na traci levo kliknite na Tools
Kliknite na Resident
Destiklirajte Resident Tea-Timer
Zatvorite Spybot S&D
Restartujte kompjuter.
Nemojte zaboraviti da ponovo ukljucite ove opcije kada zavrsimo ciscenje.


Zatim preuzmi program LSP-Fix i sačuvaj ga na Dektop-u npr.
http://www.bleepingcomputer.com/files/lspfix.php

Da bi uklonio New.net adware uradi sledeće:
Ideš na Control panel > Add/Remove Programs.

Potraži na listi instaliranih programa naziv New.Net ili NewDotNet.
Takođe pogledaj da li imaš tu i neki od Go!Zilla spyware programa sa ovog linka:
http://www.oit.duke.edu/ats/support/spyware/gozilla.html
Deinstaliraj ih.

Za slučaj New.Net-a da ne postoji uninstall program izlistan u Add/Remove programs uradićeš sledeće:
Ukoliko ga nije moguce naci u Add/Remove programs, onda idi na sledeci link i sledi uputstvo za deinstalaciju iz Procedure 4 koja se nalazi na dnu stranice.
Kada to završiš restartuj kompjuter.

Pokreni HijackThis i skeniraj sistem njime. Pronađi ove linije, označi ih i klikni "Fix Checked".


O2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet7_48.dll
O2 - BHO: (no name) - {CD4C3CF0-4B15-11D1-ABED-709549C10000} - (no file)
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,ClientStartup -s

Opet restartuj računar, pronađi i obriši folder C:\Program Files\NewDotNet\
Sada bi trebalo da ti je računar čist ali možeš i da preskeniraš sistem Spybot S&D-om za svaki slučaj. (dopuni definicije naravno)

Ako ne možeš da se konektuješ na Internet posle deinstalacije New.net-a, pokreni LSP-Fix program koji si preuzeo ranije i kada završi sa radom klikni na Finish. Restartuj računar i konektuj se na Internet.

Postavi mi ovde nov, preimenovan HijackThis log kao u tvom prvom postu.

Poslao: 17 Mar 2007 08:33
Idi na vrh
offline
  • Alics  Male
  • Ugledni građanin
  • Pridružio: 02 Apr 2006
  • Poruke: 353
  • Gde živiš: Šabac

Uklonio sam New.Net preko Add/Remove programs. Kada sam hteo da sređujem to što ima da se radi u HijackThis-u, posle skeniranja nisam mogao da nađem dve od te tri linije:

O2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet7_48.dll

i

O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,ClientStartup -s



Logfile of HijackThis v1.99.1
Scan saved at 08:30:57, on 17.03.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Kerio\Personal Firewall\persfw.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\UpsPilot\Winpower.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\UpsPilot\hello21.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\VM_STI.EXE
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\Bosko\Desktop\alics\alics.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: QUICKfind BHO Object - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - C:\PROGRA~1\TEXTware\QUICKF~1\PlugIns\IEHelp.dll
O2 - BHO: (no name) - {CD4C3CF0-4B15-11D1-ABED-709549C10000} - (no file)
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE ZSMC USB PC Camera
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\RunServices: [Winpower] C:\Program Files\UpsPilot\Winpower.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Download All by FlashGet - C:\PROGRA~1\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\PROGRA~1\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{22CB8D0C-2371-416D-B061-04105FA5F099}: NameServer = 10.5.0.100
O17 - HKLM\System\CCS\Services\Tcpip\..\{412C2E43-CF0B-48E4-A6B0-96419BB9CE9C}: NameServer = 10.5.0.100
O17 - HKLM\System\CS1\Services\Tcpip\..\{22CB8D0C-2371-416D-B061-04105FA5F099}: NameServer = 10.5.0.100
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: MySql - Unknown owner - C:/xampp-win32-1.5.5/xampp/mysql/bin/mysqld-nt.exe (file missing)
O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall\persfw.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Winpower - Zero G - C:\PROGRA~1\UpsPilot\Winpower.exe

Poslao: 17 Mar 2007 11:50
Idi na vrh
offline
  • DEMIAN  Male
  • Legendarni građanin
  • IT Manager
  • Pridružio: 25 Mar 2005
  • Poruke: 3706
  • Gde živiš: The darkest place on earth..

Alics ::Uklonio sam New.Net preko Add/Remove programs. Kada sam hteo da sređujem to što ima da se radi u HijackThis-u, posle skeniranja nisam mogao da nađem dve od te tri linije:

O2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet7_48.dll
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,ClientStartup -s
Ok je to. Nestale su jer se New.net dobro deinstalirao i Add/Remove Programs. To je rešeno koliko vidim iz loga.

Jesi li brisao posle toga ovu liniju kao što sam ti napisao bio ili ne ?
O2 - BHO: (no name) - {CD4C3CF0-4B15-11D1-ABED-709549C10000} - (no file)

Da li si preskenirao računar nekim od Anti Spyware programa posle deinstalacije New.Net-a ?

Poslao: 17 Mar 2007 13:09
Idi na vrh
offline
  • Alics  Male
  • Ugledni građanin
  • Pridružio: 02 Apr 2006
  • Poruke: 353
  • Gde živiš: Šabac

Poslao: 17 Mar 2007 13:31
Idi na vrh
offline
  • DEMIAN  Male
  • Legendarni građanin
  • IT Manager
  • Pridružio: 25 Mar 2005
  • Poruke: 3706
  • Gde živiš: The darkest place on earth..

Alics ::Posle toga sam restartovao računar i (pod pretpostavkom da to mogu da uradim) uključio TeaTimer. Odmah se pojavila poruka vezana za izmene u Registry bazi kod NewDotNet-a, ali pošto su dva ponuđena dugmeta bila zaklonjena tako da nisam mogao da vidim šta piše, samo sam zatvorio prozor.
Vratio si New.Net.. jer ti je Tea Timer blokirao izmenu registry baze i time poništio sve ovo što smo do sada radili.
Pre nego što ti pojasnim neke stvari koje su ovde bitne uradi sledeće:

Pokreni HijackThis, klikni na "Config" pa na "Misc Tools"
Klik na "Open Uninstall Manager"
Klik na "Refresh" pa na "Save List"

Sačuvaj fajl uninstall_list.txt i iskopiraj mi listu instaliranih programa ovde..

Poslao: 17 Mar 2007 13:40
Idi na vrh
offline
  • Alics  Male
  • Ugledni građanin
  • Pridružio: 02 Apr 2006
  • Poruke: 353
  • Gde živiš: Šabac

Izvinjavam se zbog zbrlja koji sam napravio Embarassed

AC3Filter (remove only)
Adobe Photoshop Elements 2.0
Adobe Reader 6.0
Aldo's Text-to-WAVE
AusLogics Disk Defrag
Autodesk MapGuide(R) Viewer Plug-In Release 6.5
Avira AntiVir PersonalEdition Classic
BOINC
BookWorm Deluxe 1.02
CCleaner (remove only)
CorelDRAW Graphics Suite 12
CuteFTP 8 Home
DebugMode Wink
Digital Camera Driver
DNA
ffdshow (remove only)
FlashGet(JetCar)
Gigabyte GN-WP01GS SoftAP
Google Earth
Google Toolbar for Internet Explorer
HijackThis 1.99.1
HM NIS Edit 2.0.3
HP Image Zone 3.5
HP PSC & OfficeJet 3.5
HP Software Update
HSFormular 1.0
Icy Tower v1.3.1
igLoader 2,0,0,2
IncrediMail Xe
iTunes
J2SE Runtime Environment 5.0 Update 6
Kerio Personal Firewall 2.1.5
LiveReg (Symantec Corporation)
LiveUpdate 1.80 (Symantec Corporation)
Macromedia Dreamweaver MX 2004
Macromedia Extension Manager
Macromedia Flash MX 2004
Macromedia Shockwave Player
Micro DVD Player
Microsoft .NET Framework 1.1
Microsoft .NET Framework 2.0
Microsoft Device Emulator version 1.0 - ENU
Microsoft Document Explorer 2005
Microsoft Document Explorer 2005
Microsoft Office FrontPage 2003
Microsoft Office Professional Edition 2003
Microsoft Office Visio Professional 2003
Microsoft SQL Server 2005
Microsoft SQL Server 2005 Express Edition (SQLEXPRESS)
Microsoft SQL Server 2005 Mobile [ENU] Developer Tools
Microsoft SQL Server 2005 Tools Express Edition
Microsoft SQL Server Native Client
Microsoft SQL Server Setup Support Files (English)
Microsoft SQL Server VSS Writer
Microsoft Visual Studio 2005 Tools for Office Runtime
Microsoft Visual Studio 2005 Tools for Office Runtime
Microsoft Visual Studio 6.0 Enterprise Edition
Microsoft VM for Java
Microsoft Web Publishing Wizard 1.53
Mozilla Firefox (2.0.0.2)
MSI MSIDVD
MSXML 4.0 SP2 (KB927978-)
MSXML 6.0 Parser (KB927977)
MV2Player (remove only)
Nav Subscription year 2002 - 2003 for Win95 to XP
Ne ljuti se covece
Nero 6 Enterprise Edition
Nullsoft Install System
Numericon
Opera
Oxford Advanced Genie
Paint.NET v3.0
PHP 4.4.4
PowerDVD
QuickTime
RealPlayer
S3 S3Display
S3 S3Gamma2
S3 S3Info2
S3 S3Overlay
Security Update for Microsoft .NET Framework 2.0 (KB917283)
Security Update for Microsoft .NET Framework 2.0 (KB922770)
Security Update for Windows Media Player 6.4 (KB925398-)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358-)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428-)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388-)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398-)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB925454)
Security Update for Windows XP (KB925486)
Security Update for Windows XP (KB926255)
Sierra Utilities
Skype 2.5
Snail Mail
SoundMAX
SPSS for Windows 10.0
Spybot - Search & Destroy 1.4
SQLVB6
Tefter
UniChrome IGP Driver and Utilities
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Winamp (remove only)
Windows Installer 3.1 (KB893803)
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB885884
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
Windows XP Service Pack 2
Winpower
WinRAR archiver
WinZip
XviD Video Codec 05042003-1 (Koepi's developer build)
ZSMC USB PC Camera

Poslao: 17 Mar 2007 14:43
Idi na vrh
offline
  • DEMIAN  Male
  • Legendarni građanin
  • IT Manager
  • Pridružio: 25 Mar 2005
  • Poruke: 3706
  • Gde živiš: The darkest place on earth..

Alics ::Izvinjavam se zbog zbrlja koji sam napravio Embarassed Nemaš razloga za izvinjenjem jer nisi namerno to uradio Wink

Vidim da imaš nekoliko programa i sitnih igrica uz koje dolazi adware. New.Net kada se instalira zna da veoma uspori računar. To su potencijalno neželjeni programi i zato ih otklanjamo. New.Net je "žilav igrač" i moraš da pratiš uputstva ako želiš da ga ukloniš kako treba. Kao što sam ti rekao već ranije, nepravilnom deinstalacijom mogu da ti se poremete bitna mrežna podešavanja sistema i da ne možeš da se konektuješ na net.
Sam proces deinstalicije ne bi trebao da bude komplikovan ali moraš da pratiš uputstva.

Evo ti info o New.Net-u. Proces instalacije i deinstalacije.
http://www.spywarewarrior.com/adw2005/adw2005_2.htm#inst_new-net
Takođe pročitaj ovaj članak prvenstveno zbog pojma "Bundling softver installer". Taj info može da ti pomogne da ne dođeš u ovakvu situaciju sledeći put.

Ovo je bilo informativno a sada ćemo da rešimo problem polako i kako treba.. Wink

Skini Ewido micro (150kb + 8Mb kod prvog startovanja) ne pokreći ga sada.
http://downloads.ewido.net/ewido_micro.exe

Pretpostavljam i da si preuzeo program LSP-Fix za koji sam ti napisao uputstvo gore za šta služi i kada će se eventualno primeniti. Ako nisi to uradio uradi sada..

Isključi TeaTimer kako je gore opisano i ne uključuj ga dok ti ja ne napišem da to uradiš.

Pokreni sistem pa program HijackThis i preskenira njime računar. Pronađi ove linije, označi ih i klikni "Fix Checked".

O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,ClientStartup -s

O2 - BHO: (no name) - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - (no file)

O2 - BHO: (no name) - {CD4C3CF0-4B15-11D1-ABED-709549C10000} - (no file)

Opet restartuj računar, pronađi i obriši folder C:\Program Files\NewDotNet\

Pokreni program Ewido, dopuni definicije i pročisti računar njime.

Postavi novi HJT log.

Uzgred.. Šta god ti nije jasno u vezi uputstva ili nekog postupka vezanog za to - slobodno me pitaj, pojasniću..

21 Mar 2007 14:20 DEMIAN Zaključavanje topica Razlog: Javiti se na PP ukoliko je potrebno otključati temu  

MyCity » Ambulanta -> Arhiva Ambulante » NewDotNet & Aureate adware

Ko je trenutno na forumu
 

Ukupno su 714 korisnika na forumu :: 8 registrovanih, 1 sakriven i 705 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: Dannyboy, havoc995, kybonacci, M1los, MilosKop, nemkea71, simazr, slonic_tonic