MyCity » Ambulanta -> Arhiva Ambulante » Paranoja ili ???

Paranoja ili ???

Napisano na dan: 31.10.2007
3

Paranoja ili ???
Pagination Prethodna strana

Idi na vrh

Poslao: 01 Nov 2007 00:56
Idi na vrh
offline
  • Pridružio: 31 Okt 2007
  • Poruke: 115
  • Gde živiš: Black Hole

oprosti molim te ja sam mislio da to neko moze da zloupotrijebi od slucajnih prolaznika posto su to karakteristike mog racunara

Zaista se izvinjavam nisam znao!!!

Stvarno nisam znao! Mozda ipak vide ta glupa paranoja-lose iskustvo!

Izvinjavam se milion puta



Poslao: 01 Nov 2007 01:10
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Ok... Sad je gotovo. Crying or Very sad


Odgovori na tvoja pitanja:

1. Safe mode je tamo gde treba, no tvoja ploča/BIOS izgleda reaguje na F8 taster i nudi izbor boot uređaja. Znači, samo treba pritisnuti F8 u pravom trenutku (ili, ako se već pojavi pitanje za boot uređaj, onda nakon što se izabere hard disk pritiskivati F8 ).

2. Ništa sumnjivo.

3. Postojali su tragovi bar dve različite infekcije (Zlob i Swizzor trojan)

4. Ne.

5. Drži se podalje od sajtova sa ilegalnim i sadržajima za odrasle, koristi anti-virusni softver, itd.

Procesi... Pa, to jeste relativno mnogo, no nije ništa nenormalno.
Sve zavisi od instaliranog softvera i podešavanja.

Poz...



Poslao: 01 Nov 2007 20:33
Idi na vrh
offline
  • Pridružio: 31 Okt 2007
  • Poruke: 115
  • Gde živiš: Black Hole

Ma krivo mi sad,stvarno! Ne mogu ti napisati koliko mi je zao,ali jos jednom veliko izvinjenje,zaista nisam znao to za brisanje,ako ikako mogu popraviti nesto ja sam tu!?

Hvala ti jos jednom za sve veceras i danas,svaka ti cast!

Jos uvijek stoji poziv na pice,he he !?

Izvini jos jednom molim te!!!

Hvala!!!

Dopuna: 01 Nov 2007 20:33

Pozdrav doktore Boro,novi momenat:

danas sam pustio Nod da skenira cijeli sistem

i nasao je dva virusa od njih jedan je i Smid koji smo koristili jucer?

Sta dalje sad?

Hvala

Poslao: 01 Nov 2007 20:59
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Verovatno su u pitanju bezazleni delovi programa koje smo koristili (za koje sam rekao da trebaju biti obrisani).

1. Napiši mi tačne nazive file-ova koji su detektovani.
2. Da li je NOD32 uspeo da ukloni sve što je detektovao?
Ako nije, postavi i novi HT log.

Poslao: 01 Nov 2007 21:29
Idi na vrh
offline
  • Pridružio: 31 Okt 2007
  • Poruke: 115
  • Gde živiš: Black Hole

Neke je obrisao,jedan nije uspio

evo ponovo sam ga pustio da skenira,posto su se nakon sto ih je obrisao bili preselili u Sistem Volume,pa sam isao na iskljucivanje sistem restora i sad sa mpustio da ponovo skenira,cim zavrsi saljem ti tacne nazive virusa koje je nasao i obrisao i ovoga sto nije obrisao i saljem novi HT

Hvala

Dopuna: 01 Nov 2007 21:22

Boro,evo virusa koje je Nod nasao:

C:\Program Files\Mozilla Firefox\SmitfraudFix\Process.exe - Win32/PrcView aplikacija - obrisano

C:\System Volume Information\_restore{5FED904E-6E1E-4B49-8681-D5C017BB5784}\RP1\A0000250.exe - Win32/PrcView aplikacija - obrisano

C:\WINDOWS\system32\Process.exe - Win32/PrcView aplikacija - obrisano

D:\PROGRAMI\SmitfraudFix.exe »RAR »SmitfraudFix\Process.exe - Win32/PrcView aplikacija - nije obrisano,samo ponudio opciju OSTAVI

C:\System Volume Information\_restore{5FED904E-6E1E-4B49-8681-D5C017BB5784}\RP1\A0000032.exe - Win32/PrcView aplikacija - obrisano

Dopuna: 01 Nov 2007 21:24

ovaj na D: sto nije obrisao,ja sam ga nasao u folderu i obrisao,pa se preselio u sistem volume!

Dopuna: 01 Nov 2007 21:26

Evo i trenutni HT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:25:21, on 1/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Apps\Softex\OmniPass\Omniserv.exe
C:\Program Files\Packard Bell\SrvCDEject.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
C:\Apps\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Realtek\Card Reader Software\DriveIcon\DriveIcon.exe
C:\WINDOWS\mHotkey.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe
C:\Apps\Softex\OmniPass\scureapp.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe
C:\WINDOWS\system32\ctfmon.exe
C:\APPS\SMP\SmpSys.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Eset\nod32.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [Link mogu videti samo ulogovani korisnici]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [Link mogu videti samo ulogovani korisnici]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [Link mogu videti samo ulogovani korisnici]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [Link mogu videti samo ulogovani korisnici]
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AOL Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Windows Live OneCare Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [DriveIcons] "C:\Program Files\Realtek\Card Reader Software\DriveIcon\DriveIcon.exe"
O4 - HKLM\..\Run: [NECHotkey] mHotkey.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [DetectorApp] C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe
O4 - HKLM\..\Run: [OmniPass] C:\Apps\Softex\OmniPass\scureapp.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunServer] C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [AWMON] "C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SmpcSys] C:\APPS\SMP\SmpSys.exe
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: msnmsgr.lnk = C:\Program Files\Windows Live\Messenger\msnmsgr.exe
O4 - Startup: zlclient.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - [Link mogu videti samo ulogovani korisnici]\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\beuk.htm
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - [Link mogu videti samo ulogovani korisnici]
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - [Link mogu videti samo ulogovani korisnici]
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - [Link mogu videti samo ulogovani korisnici]
O17 - HKLM\System\CCS\Services\Tcpip\..\{905279FD-2B8E-4217-B9A4-43034847B80A}: NameServer = 194.154.192.101,194.154.192.102
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Softex Inc. - C:\Apps\Softex\OmniPass\Omniserv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: SrvCDEject - Unknown owner - C:\Program Files\Packard Bell\SrvCDEject.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: USBDeviceService - Unknown owner - C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

--
End of file - 10639 bytes

Dopuna: 01 Nov 2007 21:29

Ovaj je u sistem volume se preselio i ne daje mogucnost brisanja

D:\System Volume Information\_restore{5FED904E-6E1E-4B49-8681-D5C017BB5784}\RP1\A0000047.exe »RAR »SmitfraudFix\Process.exe - Win32/PrcView aplikacija - nije obrisan

Poslao: 01 Nov 2007 21:37
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Ovde je sve u redu. U pitanju je jedan program koji je deo SmitFraudFix-a koga pojedini AV programi prepoznaju kao potencijalno opasnog.
No, program je legitiman.

Log je takođe čist.

Treba da ispratiš moja uputstva za isključivanje i ponovno uključivanje System Restore-a. Nakon toga neće biti bilo kakvih detekcija.

Poslao: 01 Nov 2007 23:03
Idi na vrh
offline
  • Pridružio: 31 Okt 2007
  • Poruke: 115
  • Gde živiš: Black Hole

Ok

uradicu sad ponovo restore iskljucivanje
pa restart
pa ukljuciti opet

pa javim sta ima u Nodu sad

Hvala

Dopuna: 01 Nov 2007 23:03

doktore,
evo Nod je zavrsio skeniranje,nista nije nasao,uspjelo je sve sto si mi preporucio!

Hvala jos jednom puno na svemu!

Sretan rad!

MyCity » Ambulanta -> Arhiva Ambulante » Paranoja ili ???

Ko je trenutno na forumu
 

Ukupno su 1951 korisnika na forumu :: 126 registrovanih, 8 sakrivenih i 1817 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 13297 - dana 20 Jan 2026 17:42

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: 10x10.9, 33 bren, Agape, aleksmajstor, alex71, alternator, amaterSRB, amonsrb, Avalon015, Ba4e, babaroga, Ben Roj, Botovac, BSD, Bubimir, bunker, BZ, Camposam, Chainsaw, Cicumile, dane007, darkojbn, dejanbenkovic, deki1001, Despot Đurađ, dj.ape, djboj, DonerEbal, DonRumataEstorski, Dragon Order, DrMrPr, Drugard72, Duh sa sekirom, Dukelander, Duschi, DzigiNS, Electron, Enigma Nobody, Fliper, Geodezist58, Giskard, Gitzherai, goran.vvv, GveX, havoc995, helen1, istina, Ivan Campo, Jaz, jmsk, jodzula, Jozo74, Kanader, kaput21, Karapan, kokodakalo, Krusarac, kybonacci, Laluvr, Macalone, Marko00, Medojed, metallac777, mikki jons, milimoj, Misirac, MK10, mkukoleca, mnn2, moldway, Mzee, nebidrag, nebkv, Nele79, nenad81, Neutral-M, nevjerna beba, nikolabb, oblivion, Pero Petković, pobeda, Profesor_018, Ray1973, renvoi, Roksi, S-lash, sap, saputnik plavetnila, shota91, Srna, stegonosa, styg, SympathyForTheDevil, Tandrčak, taomaster, TheDictator, theNedjeljko, tritonus, Tumansky, Tunguska55, umpah-pah, Underdog9, Utd4ce, VanZan, varda, vargas, VaRvArI 85, vathra, vazduh, veljkovicdani, virked, vladom6, vobo, vrag81, Vrač, Vujkeu, vukdra, Wrangler, xAlex2, YugoSlav, ZetaMan, zil10, ZlatniRez, Zoran1959, Zukov, 79693