Pomoc u vezi Malware

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Uloguj se preko Facebooka da bi skinuo fajl:

Napisano: 20 Nov 2011 12:31

Ne bih da dosadjuem ali sumnjam da je i pored reinstalacije XP SP3 ostao neki malware. Neznam da li preko memorije ili neta. Prilazem sledece textualne dokumente:

Dopuna: 20 Nov 2011 12:33

mycity.rs/must-login.png

Dopuna: 20 Nov 2011 12:34

mycity.rs/must-login.png

Dopuna: 20 Nov 2011 12:35
.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702
Run by bojan at 20:11:16 on 2011-11-18
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.575 [GMT 1:00]
.
AV: avast! Internet Security *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: avast! Internet Security *Enabled*
.
============== Running Processes ===============
.
C:\WINXP\system32\svchost -k DcomLaunch
svchost.exe
C:\WINXP\system32\svchost.exe -k netsvcs
svchost.exe
C:\Program Files\AVAST Software\Avast\afwServ.exe
C:\WINXP\Explorer.EXE
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINXP\AGRSMMSG.exe
C:\WINXP\system32\nvraidservice.exe
C:\Program Files\Uniblue\SpeedUpMyPC\spmonitor.exe
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\Program Files\Uniblue\RegistryBooster\rbmonitor.exe
C:\Program Files\KWorld Multimedia\PVR Plus\TVR\Scheduled.exe
C:\WINXP\system32\RUNDLL32.EXE
C:\Program Files\Uniblue\DriverScanner\dsmonitor.exe
C:\WINXP\RTHDCPL.EXE
C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Uniblue\RegistryBooster\registrybooster.exe
C:\PROGRA~1\Uniblue\DRIVER~1\driverscanner.exe
C:\Program Files\KWorld Multimedia\PVR-TV 7131 Utilities\P3XRCtl.exe
C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe
C:\WINXP\system32\wbem\unsecapp.exe
C:\PROGRA~1\Uniblue\SPEEDU~1\sump.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINXP\system32\svchost.exe -k imgsvc
C:\WINXP\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows NT\Accessories\wordpad.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINXP\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://google.com/
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.7.7018.1622\swg.dll
TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
uRun: [ctfmon.exe] c:\winxp\system32\ctfmon.exe
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [SpeedUpMyPC] "c:\progra~1\uniblue\speedu~1\launcher.exe" -d 20000
uRun: [RegistryBooster] "c:\program files\uniblue\registrybooster\launcher.exe" delay 20000
uRun: [DriverScanner] "c:\progra~1\uniblue\driver~1\launcher.exe" delay 20000
mRun: [AGRSMMSG] AGRSMMSG.exe
mRun: [NVRaidService] c:\winxp\system32\nvraidservice.exe
mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui
mRun: [PVR Agent] c:\program files\kworld multimedia\pvr plus\tvr\Scheduled.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\winxp\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\winxp\system32\NvMcTray.dll,NvTaskbarInit
mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /installquiet
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\remote~1.lnk - c:\program files\kworld multimedia\pvr-tv 7131 utilities\P3XRCtl.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} - hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{F115C857-F71D-4B6F-B946-2D4B48692630} : DhcpNameServer = 192.168.1.1
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\winxp\system32\wpdshserviceobj.dll
.
============= SERVICES / DRIVERS ===============
.
R0 aswNdis;avast! Firewall NDIS Filter Service;c:\winxp\system32\drivers\aswNdis.sys [2011-11-9 12112]
R0 aswNdis2;avast! Firewall Core Firewall Service;c:\winxp\system32\drivers\aswNdis2.sys [2011-11-9 195416]
R1 aswFW;avast! TDI Firewall driver;c:\winxp\system32\drivers\aswFW.sys [2011-11-9 111320]
R1 aswSnx;aswSnx;c:\winxp\system32\drivers\aswSnx.sys [2011-11-9 442200]
R1 aswSP;aswSP;c:\winxp\system32\drivers\aswSP.sys [2011-11-9 320856]
R2 aswFsBlk;aswFsBlk;c:\winxp\system32\drivers\aswFsBlk.sys [2011-11-9 20568]
R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2011-11-9 44768]
R2 avast! Firewall;avast! Firewall;c:\program files\avast software\avast\afwServ.exe [2011-11-9 127192]
R2 PAVDRV;Panda anti-virus driver;c:\winxp\system32\drivers\Pavdrv51.sys [2011-11-10 58624]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\tuneup utilities 2011\TuneUpUtilitiesService32.exe [2011-9-27 1526080]
R3 Cap713x;Philips Cap713x Video Capture;c:\winxp\system32\drivers\Cap713x.sys [2011-11-10 672128]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\tuneup utilities 2011\TuneUpUtilitiesDriver32.sys [2010-11-30 10064]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-11-11 136176]
S3 DrvAgent32;DrvAgent32;c:\winxp\system32\drivers\DrvAgent32.sys [2011-11-13 23456]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-11-11 136176]
S3 Revoflt;Revoflt;c:\winxp\system32\drivers\revoflt.sys [2011-11-10 27064]
.
=============== Created Last 30 ================
.
2011-11-15 23:55:37 943872 ----a-r- c:\winxp\system32\drivers\NVNRM.SYS
2011-11-15 23:55:37 50304 ----a-r- c:\winxp\system32\drivers\nvefd2k.sys
2011-11-15 22:43:34 2560 ----a-w- c:\documents and settings\all users\application data\microsoft\usmt\iconlib.dll
2011-11-14 22:26:16 -------- d-----w- c:\documents and settings\bojan\application data\MSNInstaller
2011-11-13 13:51:57 -------- d-----w- c:\winxp\system32\Lang
2011-11-13 13:49:43 -------- d-----w- c:\winxp\system32\RTCOM
2011-11-13 13:02:23 23456 ----a-w- c:\winxp\system32\drivers\DrvAgent32.sys
2011-11-13 13:02:23 -------- d-----w- c:\documents and settings\bojan\local settings\application data\eSupport.com
2011-11-13 12:54:07 -------- d-----w- c:\program files\common files\Symantec Shared
2011-11-13 12:53:54 -------- d-----w- c:\documents and settings\all users\application data\Norton
2011-11-13 12:53:50 -------- d-----w- c:\documents and settings\all users\application data\NortonInstaller
2011-11-13 11:58:52 528384 ------r- c:\winxp\RtlExUpd.dll
2011-11-13 11:58:50 69715 ----a-w- c:\program files\common files\installshield\professional\runtime\11\50\intel32\ctor.dll
2011-11-13 11:58:50 5632 ----a-w- c:\program files\common files\installshield\professional\runtime\11\50\intel32\DotNetInstaller.exe
2011-11-13 11:58:50 274432 ----a-w- c:\program files\common files\installshield\professional\runtime\11\50\intel32\iscript.dll
2011-11-13 11:58:50 204800 ----a-w- c:\program files\common files\installshield\professional\runtime\11\50\intel32\iuser.dll
2011-11-13 11:58:49 757760 ----a-w- c:\program files\common files\installshield\professional\runtime\11\50\intel32\iKernel.dll
2011-11-13 11:58:48 200836 ----a-w- c:\program files\common files\installshield\professional\runtime\11\50\intel32\iGdi.dll
2011-11-13 11:58:47 331908 ----a-w- c:\program files\common files\installshield\professional\runtime\11\50\intel32\setup.dll
2011-11-13 11:57:42 -------- d-----w- c:\program files\Gigabyte
2011-11-13 11:24:43 -------- d-----w- c:\program files\FDRLab
2011-11-13 10:53:24 -------- d-----w- c:\program files\GRETECH
2011-11-13 10:52:10 -------- d-----w- c:\winxp\system32\Adobe
2011-11-13 10:50:42 -------- d-----w- c:\program files\The KMPlayer
2011-11-13 10:49:59 175616 ----a-w- c:\winxp\system32\unrar.dll
2011-11-13 10:49:50 839680 ----a-w- c:\winxp\system32\lameACM.acm
2011-11-13 10:49:50 74752 ----a-w- c:\winxp\system32\ff_vfw.dll
2011-11-13 10:49:50 650752 ----a-w- c:\winxp\system32\xvidcore.dll
2011-11-13 10:49:50 243200 ----a-w- c:\winxp\system32\xvidvfw.dll
2011-11-13 10:49:50 151552 ----a-w- c:\winxp\system32\ac3acm.acm
2011-11-13 10:49:42 -------- d-----w- c:\program files\K-Lite Codec Pack
2011-11-13 10:39:26 -------- d-----w- c:\program files\Real Alternative
2011-11-12 23:03:28 -------- d-----w- c:\winxp\system32\XPSViewer
2011-11-12 23:01:58 89088 -c----w- c:\winxp\system32\dllcache\filterpipelineprintproc.dll
2011-11-12 23:01:58 597504 -c----w- c:\winxp\system32\dllcache\printfilterpipelinesvc.exe
2011-11-12 23:01:58 597504 ------w- c:\winxp\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2011-11-12 23:01:58 575488 -c----w- c:\winxp\system32\dllcache\xpsshhdr.dll
2011-11-12 23:01:58 575488 ------w- c:\winxp\system32\xpsshhdr.dll
2011-11-12 23:01:58 117760 ------w- c:\winxp\system32\prntvpt.dll
2011-11-12 23:01:57 1676288 -c----w- c:\winxp\system32\dllcache\xpssvcs.dll
2011-11-12 23:01:57 1676288 ------w- c:\winxp\system32\xpssvcs.dll
2011-11-12 22:41:51 -------- d-----w- c:\documents and settings\all users\Uniblue
2011-11-12 22:27:27 -------- d-----w- c:\program files\Uniblue
2011-11-12 20:02:14 -------- d-----w- C:\Downloads
2011-11-12 13:36:50 -------- dc-h--w- c:\documents and settings\all users\application data\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42}
2011-11-12 13:07:20 -------- d-----w- c:\documents and settings\bojan\application data\Uniblue
2011-11-11 22:55:41 -------- dc-h--w- c:\documents and settings\all users\application data\~2
2011-11-11 21:16:23 -------- dc-h--w- c:\documents and settings\all users\application data\~1
2011-11-11 20:34:47 -------- dc-h--w- c:\documents and settings\all users\application data\~0
2011-11-11 15:03:47 414368 ----a-w- c:\winxp\system32\FlashPlayerCPLApp.cpl
2011-11-11 00:32:24 -------- d-----w- c:\program files\VideoLAN
2011-11-11 00:17:54 -------- d-----w- c:\documents and settings\all users\application data\FileCure
2011-11-11 00:05:24 4106912 ----a-w- c:\winxp\system32\FlashPlayerInstaller.exe
2011-11-10 23:53:03 -------- d-----w- c:\documents and settings\bojan\local settings\application data\Google
2011-11-10 22:23:43 -------- d-----w- c:\documents and settings\bojan\local settings\application data\Temp
2011-11-10 22:23:43 -------- d-----w- c:\documents and settings\bojan\local settings\application data\Adobe
2011-11-10 21:58:39 -------- d-----w- c:\documents and settings\bojan\local settings\application data\PackageAware
2011-11-10 20:19:53 -------- d-----w- c:\documents and settings\bojan\local settings\application data\Identities
2011-11-10 19:28:20 29504 ----a-w- c:\winxp\system32\uxtuneup.dll
2011-11-10 19:23:47 31552 ----a-w- c:\winxp\system32\TURegOpt.exe
2011-11-10 19:23:24 -------- d-----w- c:\documents and settings\bojan\application data\TuneUp Software
2011-11-10 19:23:01 -------- d-----w- c:\program files\TuneUp Utilities 2011
2011-11-10 19:22:43 -------- d-----w- c:\documents and settings\all users\application data\TuneUp Software
2011-11-10 19:22:16 -------- d-sh--w- c:\documents and settings\all users\application data\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
2011-11-10 19:16:19 27064 ----a-w- c:\winxp\system32\drivers\revoflt.sys
2011-11-10 19:16:17 -------- d-----w- c:\program files\VS Revo Group
2011-11-10 05:54:56 453152 ----a-w- c:\winxp\system32\NVUNINST.EXE
2011-11-10 05:54:19 16608 ----a-w- c:\winxp\gdrv.sys
2011-11-10 05:48:33 85456 ----a-w- c:\winxp\system32\drivers\Teefer.sys
2011-11-10 05:48:33 8023 ----a-w- c:\winxp\system32\drivers\wg3n.sys
2011-11-10 05:48:32 15360 ----a-w- c:\winxp\system32\drivers\wpsdrvnt.sys
2011-11-10 05:44:25 -------- d-----w- c:\program files\UIU
2011-11-10 05:42:37 64512 ------w- c:\winxp\system32\agrsmdel.exe
2011-11-10 05:42:24 -------- d-----w- c:\winxp\system32\ReinstallBackups
2011-11-10 05:39:30 58624 ----a-w- c:\winxp\system32\drivers\Pavdrv51.sys
2011-11-10 05:39:29 -------- d-----w- c:\winxp\system32\PAV
2011-11-10 05:39:28 9488 ----a-w- c:\winxp\system32\sporder.dll
2011-11-10 05:39:20 -------- d-----w- c:\program files\Panda Software
2011-11-10 05:26:28 16128 -c--a-w- c:\winxp\system32\dllcache\modemcsa.sys
2011-11-10 05:26:28 16128 ----a-w- c:\winxp\system32\drivers\MODEMCSA.sys
2011-11-10 05:26:16 88363 ----a-w- c:\winxp\AGRSMMSG.exe
2011-11-10 05:26:16 64512 ----a-w- c:\winxp\agrsmdel.exe
2011-11-10 05:26:15 1268204 ----a-w- c:\winxp\system32\drivers\AGRSM.sys
2011-11-10 05:22:20 10968 ----a-w- c:\winxp\system\amdmp.sys
2011-11-10 05:18:43 -------- d-----w- c:\program files\directx
2011-11-10 05:18:34 -------- d-----w- c:\program files\VGA USB Camera
2011-11-10 05:18:33 -------- d-----w- c:\winxp\Options
2011-11-10 05:09:37 7296 ------r- c:\winxp\system32\drivers\EIO.sys
2011-11-10 05:05:23 212992 ------w- c:\program files\common files\installshield\engine\6\intel 32\ILog.dll
2011-11-10 05:00:04 77824 ----a-w- c:\program files\common files\installshield\engine\6\intel 32\ctor.dll
2011-11-10 05:00:04 32768 ----a-w- c:\program files\common files\installshield\engine\6\intel 32\objectps.dll
2011-11-10 05:00:04 225280 ----a-w- c:\program files\common files\installshield\iscript\iscript.dll
2011-11-10 05:00:04 176128 ----a-w- c:\program files\common files\installshield\engine\6\intel 32\iuser.dll
2011-11-10 05:00:03 614532 ------w- c:\program files\common files\installshield\engine\6\intel 32\IKernel.exe
.
==================== Find3M ====================
.
2011-11-15 22:13:43 199168 ----a-w- c:\winxp\system32\fdco1ins.dll
2011-11-10 22:45:40 252080 ----a-w- c:\winxp\system32\nvdrsdb0.bin
2011-11-10 22:45:40 1 ----a-w- c:\winxp\system32\nvdrssel.bin
2011-11-10 22:45:36 252080 ----a-w- c:\winxp\system32\nvdrsdb1.bin
2011-10-10 14:21:17 692736 ----a-w- c:\winxp\system32\inetcomm.dll
2011-09-28 07:06:50 599040 ----a-w- c:\winxp\system32\SET17.tmp
2011-09-28 07:06:50 599040 ----a-w- c:\winxp\system32\crypt32.dll
2011-09-26 19:41:20 611328 ----a-w- c:\winxp\system32\uiautomationcore.dll
2011-09-26 19:41:20 220160 ----a-w- c:\winxp\system32\oleacc.dll
2011-09-26 19:41:14 20480 ----a-w- c:\winxp\system32\oleaccrc.dll
2011-09-06 21:45:29 41184 ----a-w- c:\winxp\avastSS.scr
2011-09-06 21:38:54 111320 ----a-w- c:\winxp\system32\drivers\aswFW.sys
2011-09-06 21:38:05 442200 ----a-w- c:\winxp\system32\drivers\aswSnx.sys
2011-09-06 21:37:39 195416 ----a-w- c:\winxp\system32\drivers\aswNdis2.sys
2011-09-06 21:10:01 12112 ----a-w- c:\winxp\system32\drivers\aswNdis.sys
2011-09-06 13:25:11 1867904 ----a-w- c:\winxp\system32\win32k.sys
2011-08-22 23:47:42 919552 ----a-w- c:\winxp\system32\wininet.dll
2011-08-22 23:47:42 43520 ----a-w- c:\winxp\system32\licmgr10.dll
2011-08-22 23:47:42 1469440 ----a-w- c:\winxp\system32\inetcpl.cpl
2011-08-22 11:52:07 385024 ----a-w- c:\winxp\system32\html.iec
.
============= FINISH: 20:14:26.37 ===============

mycity.rs/must-login.png

Dopuna: 20 Nov 2011 12:35

mycity.rs/must-login.png

Dopuna: 20 Nov 2011 12:37

Koji je najbolji nacin resavanja problema Malware?

• 2Ovo se svidja korisnicima: ThePhilosopher, NIx Car
  
  Registruj se da bi pohvalio/la poruku!

Pozdrav...




U izvještajima koje si postavio nema tragova aktivne infekcije i tvoj problem nije uzrokovan istim.
Međutim, imaš ostatke Panda i Norton AV programa kao i piratsku verziju Avast IS.






Deinstaliraj Avast IS iz Add / Remove Programs apleta.
Start -> Control Panel -> Add / Remove Programs

Skini Norton Removal Tool, pokreni i isprati upustva na ekranu.

Nakon toga skini Panda Uninstaller, pokreni i isprati upustva na ekranu.

Takođe deinstaliraj Uniblue RegistryBooster, Uniblue SpeedUpMyPC i Uniblue DriverScanner.






Antivirusne programe deinstaliraj isključivo pomoću njihovih programa za uklanjanje u Control Panel Add / Remove Programs i nikako nemoj korsititi third-party alata poput Revo Uninstaller za uklanjanje istih.

Nemoj korisiti piratske verzije AV programa. Ukoliko nemaš novca za neki komercijalni AV program ili nemaš namjeru da isti kupiš, imaš na raspolaganju kvalitetna besplatna rješenja poput: Avast Free, Avira Free, AVG Free, Microsoft Security Essentials, Panda Cloud, COMODO IS,...

Antivirusne programe skidaj isključivo sa njihovih matičnih sajtova i sa provjerenih download lokacija poput Softpedia, CNet, FileHippo, ...

Instaliraj neki AV program o tvom izboru.






- Preporučujem da za zaštitu USB memorijskih uređaja koristiš MCShield. Nema nikakve veze sa antivirus-om tj. neće ometati njegov rad, a pokazao se kao jedan od najboljih vida zaštite od malware-a koji se prenosi putem USB mem. uređaja.

Skineš, instaliraš, ubodeš USB mem. uređaj, izvrši se skeniranje nakon čega dobiješ obavještenje da je uređaj čist (ukoliko je stvarno tako); ili dobiješ log u kome vidiš informacije o malware-u koji je nađen i obrisan.


Home Page MCShield-a: http://amf.mycity.rs/programs/mc/mcshield/

Više o MCShield-u možeš saznati u ovoj temi: http://www.mycity.rs/Antispyware-programi/MCShield.html






Nakon što instaliraš MCShield ubacuj USB memorijske uređaje redom i postavi izvještaje koje ćeš dobiti. Takođe, postavi svjež DDS izvještaj.




Citat:Koji je najbolji nacin resavanja problema Malware?

Ambulanta MyCity foruma.





Sass Drake, MyCity AMF tim