MyCity » Ambulanta -> Arhiva Ambulante » NewDotNet & Aureate adware

NewDotNet & Aureate adware

Napisano na dan: 16.3.2007
2

NewDotNet & Aureate adware
Pagination Prethodna strana

Idi na vrh

Poslao: 17 Mar 2007 15:07
Idi na vrh
offline
  • Alics  Male
  • Ugledni građanin
  • Pridružio: 02 Apr 2006
  • Poruke: 353
  • Gde živiš: Šabac

Nisam uspeo da nađem folder C:\Program Files\NewDotNet (uključeni su mi hidden files and folders).

Poslao: 17 Mar 2007 15:16
Idi na vrh
offline
  • DEMIAN  Male
  • Legendarni građanin
  • IT Manager
  • Pridružio: 25 Mar 2005
  • Poruke: 3706
  • Gde živiš: The darkest place on earth..

Izgleda da je otklonjen preko Add/Remove Programs.. a TeaTimer samo vratio neke reg ključeve koje kreira ovaj adware. Odatle ti i start up poruka pri startu Windowsa.

Jesi li odradio ostalo ? Čekirao i sredio linje itd.. ?
Postavi log ako jesi i napiši mi da li je ti je komp još uvek usporen.

Poslao: 17 Mar 2007 17:03
Idi na vrh
offline
  • Alics  Male
  • Ugledni građanin
  • Pridružio: 02 Apr 2006
  • Poruke: 353
  • Gde živiš: Šabac

Evo, završio sam sve Smile
Ewido mi je našao "samo" 22000 infekcija koje je uspešno pročistio (između ostalog bilo je i NewDotNet-a). Ako treba postaviću log.



HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 16:56:42, on 17.03.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Kerio\Personal Firewall\persfw.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\UpsPilot\Winpower.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\VM_STI.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\UpsPilot\hello21.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Documents and Settings\Bosko\Desktop\alics\alics.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: QUICKfind BHO Object - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - C:\PROGRA~1\TEXTware\QUICKF~1\PlugIns\IEHelp.dll (file missing)
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE ZSMC USB PC Camera
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\RunServices: [Winpower] C:\Program Files\UpsPilot\Winpower.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Download All by FlashGet - C:\PROGRA~1\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\PROGRA~1\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{22CB8D0C-2371-416D-B061-04105FA5F099}: NameServer = 10.5.0.100
O17 - HKLM\System\CCS\Services\Tcpip\..\{412C2E43-CF0B-48E4-A6B0-96419BB9CE9C}: NameServer = 10.5.0.100
O17 - HKLM\System\CS1\Services\Tcpip\..\{22CB8D0C-2371-416D-B061-04105FA5F099}: NameServer = 10.5.0.100
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: MySql - Unknown owner - C:/xampp-win32-1.5.5/xampp/mysql/bin/mysqld-nt.exe (file missing)
O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall\persfw.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Winpower - Zero G - C:\PROGRA~1\UpsPilot\Winpower.exe

Btw, računar mi se vratio u normalu (više nije spor).

Poslao: 17 Mar 2007 18:56
Idi na vrh
offline
  • DEMIAN  Male
  • Legendarni građanin
  • IT Manager
  • Pridružio: 25 Mar 2005
  • Poruke: 3706
  • Gde živiš: The darkest place on earth..

Možeš slobodno da mi pustiš taj Ewido log u sledeći post ako nije puno velik ili iskoristi upload koji imaš za post.

Reci mi još nešto:
Da li si na lokalnoj mreži ili imaš ruter ili switch koji izigrava lokalni DNS.
Zanima me samo zašto imaš DNS adresu iz opsega 10.x.x.x.

Poslao: 17 Mar 2007 20:07
Idi na vrh
offline
  • Alics  Male
  • Ugledni građanin
  • Pridružio: 02 Apr 2006
  • Poruke: 353
  • Gde živiš: Šabac

Morao sam da ZIPujem log, zato što je težak 4.82MB Shocked
[url=https://www.mycity.rs/must-login.png log[/url]


DeM14n ::Da li si na lokalnoj mreži ili imaš ruter ili switch koji izigrava lokalni DNS.
Zanima me samo zašto imaš DNS adresu iz opsega 10.x.x.x.
Nemam ni ruter, ni switch.

Inače, hvala na strpljenju Very Happy

Poslao: 17 Mar 2007 23:05
Idi na vrh
offline
  • DEMIAN  Male
  • Legendarni građanin
  • IT Manager
  • Pridružio: 25 Mar 2005
  • Poruke: 3706
  • Gde živiš: The darkest place on earth..

Prema onome što mogu da vidim računar ti je sada čist. Ostaje ti samo da isprazniš Nortonovu korpu. Ide se desno dugme na Recycle Bin, pa tu postoji opcija "Empty Norton Protected Recycle Bin" ili tako nesto, u svakom slucaju se pominje Norton. Nisam siguran za tačan naziv jer ne koristim taj software odavno.

Što se ove teme tiče promeniću ti naslov (da bude smisleniji i direktiniji problemu koji si imao) i ostaviti je otvorenu par dana u slučaju da se simptomi na koje si se žalio povrate.. Uostalom ako nešto neočekivano iskrsne možeš da se javiš i na PP.

Alics ::Inače, hvala na strpljenju Very Happy

Nema na čemu.. Pozz Very Happy

21 Mar 2007 14:20 DEMIAN Zaključavanje topica Razlog: Javiti se na PP ukoliko je potrebno otključati temu  

MyCity » Ambulanta -> Arhiva Ambulante » NewDotNet & Aureate adware

Ko je trenutno na forumu
 

Ukupno su 951 korisnika na forumu :: 53 registrovanih, 10 sakrivenih i 888 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: _Petar, A.R.Chafee.Jr., anta, babaroga, Bluper, Boris90, Brana01, Bubimir, ccoogg123, Dannyboy, dekan.m, Dimitrise93, djboj, Djokislav, doktor123, Dorcolac, DPera, esx66, Fog of War, goxin, havoc995, hawkeye, HrcAk47, ikan, ILGromovnik, ivan1973, kobaja77, Koridor, Kubovac, kubura91, KUZMAR, Luka Blažević, mercedesamg, Mercury, Metanoja, milenko crazy north, MILICAT, MiroslavD, mrav pesadinac, nemkea71, pera bager, Petarvu, randja26, ruma, Srki94, t84dar, Tas011, theNedjeljko, tmanda323, Tvrtko I, vathra, voja64, |_MeD_|