MyCity » Ambulanta -> Arhiva Ambulante » Tikovnica na laptopu podivljala

Tikovnica na laptopu podivljala

Napisano na dan: 9.6.2010
2

Tikovnica na laptopu podivljala
Pagination Prethodna strana
Sledeća strana Pagination

Idi na vrh

Poslao: 11 Jun 2010 10:24
Idi na vrh
offline
  • Pridružio: 28 Maj 2010
  • Poruke: 46

argus ::

Imas na flashu fajl AutoRun.exe

Uploaduj ga preko ovog linka [Link mogu videti samo ulogovani korisnici]

Da li si nekada kreirao neki autorun meni na tom flashu

Jel mozes malo preciznije objasniti ovo sa ovim AutoRun fajlom?
Nije mi baš jasno na šta misliš i gdje...kakav flash?
Izvini ako sam dosadan..



Poslao: 11 Jun 2010 11:56
Idi na vrh
rip
  • argus  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 27 Apr 2008
  • Poruke: 9160
  • Gde živiš: Prokuplje

Nisi dosadan Smile
Taj USB flash drive koji sad citimo (stick), je zarazen. na njemu imas fajl Autorun.exe, znaci njega treba da posaljes na upload da ga proverimo. Da li sam sada precizniji?



Poslao: 11 Jun 2010 12:30
Idi na vrh
offline
  • Pridružio: 28 Maj 2010
  • Poruke: 46

Sve jasno...
Napravljeno...

Taj Autorun.exe je od instalacije of Officea 2003 ...ta instalacija se nalazi na stiku

Inače nisam ja tu nikad radio nikakve autoran menije...






USBNoRisk 2.5 (26 July 2009) by bobby

Started at 11.6.2010 12:11:31

Searching for connected USB Mass storage...
----------------------------------------
========================================

Searching for other storage...
----------------------------------------
D: {dc2f4e56-5318-11df-b60e-806d6172696f}
C: {dc2f4e58-5318-11df-b60e-806d6172696f}
========================================


Scanning fixed storage...
----------------------------------------

No blocked files found on C:
No Autorun.inf files found on C:
No mountpoint found for C:
No mountpoint found for dc2f4e58-5318-11df-b60e-806d6172696f
No Desktop.ini files found on C:
----------------------------------------

No blocked files found on D:
No Autorun.inf files found on D:
No mountpoint found for D:
No mountpoint found for dc2f4e56-5318-11df-b60e-806d6172696f
No Desktop.ini files found on D:
----------------------------------------

autorun.inf found in Qoobox
----------------------------------------
Content of C:\QooBox\Quarantine\C\WINDOWS\system32\autorun.inf.vir
----------------------------------------
;kaXywQYUGXtWQZFKUXdQDHkQNRbBSDPSiPSEbXSHjSsHRheDBANUUfrhzfTbq
[AuTOrUn
;gCdsNMBXHmaPDIHjoyrtKEAWRaJgJX
open=atplvh.exe
;vmxyTrslRUpBRnzHTslyEOKUrmtEyrpNeVAeneAaePAmLJesAxdahUjikKFXtloLUmVtrHvvQMCPT
shell\open\Command=atplvh.exe
;WxNnztBuyvhFyoxIVtMVLoHcpcjEyurFZaYTkKzRmIMG
shell\open\Default=1
;45F27A231FB5BAE1D91A01280841BEDD8FF80F9CB727D2C7BFC81571
;FVoHMEJDZ
;fWrkrMqkPSQYYsMOdNPunZVwwMVCFIazyfEWrqLiCAXofGtMxcroQFJrPqvaOH
----------------------------------------
========================================
Initial scan finished!
========================================


New device connected at 11.6.2010 12:12:42

Scanning for connected USB mass storage...
----------------------------------------
F: {c6c07b2a-5c45-11df-b7f0-001a4b6afc58}
Added F:
========================================

Scanning USB mass storage for files...
----------------------------------------
Blocked file found: F:\autorun.inf.blocked
----------------------------------------
Content of F:\autorun.inf.blocked
----------------------------------------
;QoVHakcXV
[AutoRun]
;qtcjyLhYZFtlmusfaCgjokHpWSBlRDvQsqFHnwaOZvSwgmwLR
open=dmfguh.exe
;ilDkltnhqfqxIUimPQDUEiWElmMbavvUCJQJlSWIgSaZaUh
shell\open\Command=dmfguh.exe
;oUehGCGQLlKDRcGChguMhEvPUMVTpLchhqiAonUJJnPcYqrtQhssyWftBzEjzRMXgwNO
shell\open\Default=1
;45F27A231FB5BAE1D91D005A0B3CBEA98F820F9CB727D2C7BFC81571
;JEWmfBZcLDRaUmZOUbsLFkPjsiVRaipoqsrPARoCvFaiNlVT
shell\explore\Command=dmfguh.exe
;AEKwSpyZciSbhsWaJRmWJeP
----------------------------------------

Files referenced from F:\autorun.inf.blocked
----------------------------------------
None
----------------------------------------

----------------------------------------
No Autorun.inf files found on F:
No mountpoint found for c6c07b2a-5c45-11df-b7f0-001a4b6afc58
----------------------------------------

No Desktop.ini files found on F:
----------------------------------------

No mimics found on drive F:
========================================


Processing script
----------------------------------------
c6c07b2a-5c45-11df-b7f0-001a4b6afc58
Drive letter for GUID: F:
SectionStart = 0
SectionEnd = 14
f_delete: F:\dmfguh.exe > File does not exist!
f_delete:
file "F:\Extras.exe" deleted successfully
f_delete:
file "F:\OFFICE~1.EXE" deleted successfully
f_delete:
file "F:\OFFICE~2.EXE" deleted successfully
f_delete:
file "F:\OFFICE~3.EXE" deleted successfully
f_delete:
file "F:\OFFICE~4.EXE" deleted successfully
f_delete:
file "F:\OF9CB6~1.EXE" deleted successfully
f_delete: F:\FrontPage.exe > File does not exist!
f_delete: F:\Professional.exe > File does not exist!
f_delete: F:\Project.exe > File does not exist!
f_delete: F:\Visio.exe > File does not exist!
f_delete: F:\OneNote.exe > File does not exist!
----------------------------------------
Deleting blocked files:
----------------------------------------
Delete: F:\autorun.inf.blocked > Done!
----------------------------------------

Poslao: 11 Jun 2010 12:44
Idi na vrh
rip
  • argus  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 27 Apr 2008
  • Poruke: 9160
  • Gde živiš: Prokuplje

Imas jos jedan fajl koji nismo uspeli da obrisemo. Ponovi jos jednom proceduru sa ovom skriptom i postavi mi log fajl.

{c6c07b2a-5c45-11df-b7f0-001a4b6afc58}
f_delete: %DRIVE%dmfguh.exe
delete_blocked:

Poslao: 11 Jun 2010 15:32
Idi na vrh
offline
  • Pridružio: 28 Maj 2010
  • Poruke: 46

Evo ga...

Inače samo da ti kažem, tipkovnica i danas radi normalno...





USBNoRisk 2.5 (26 July 2009) by bobby

Started at 11.6.2010 15:27:41

Searching for connected USB Mass storage...
----------------------------------------
========================================

Searching for other storage...
----------------------------------------
D: {dc2f4e56-5318-11df-b60e-806d6172696f}
C: {dc2f4e58-5318-11df-b60e-806d6172696f}
========================================


Scanning fixed storage...
----------------------------------------

No blocked files found on C:
No Autorun.inf files found on C:
No mountpoint found for C:
No mountpoint found for dc2f4e58-5318-11df-b60e-806d6172696f
No Desktop.ini files found on C:
----------------------------------------

No blocked files found on D:
No Autorun.inf files found on D:
No mountpoint found for D:
No mountpoint found for dc2f4e56-5318-11df-b60e-806d6172696f
No Desktop.ini files found on D:
----------------------------------------

autorun.inf found in Qoobox
----------------------------------------
Content of C:\QooBox\Quarantine\C\WINDOWS\system32\autorun.inf.vir
----------------------------------------
;kaXywQYUGXtWQZFKUXdQDHkQNRbBSDPSiPSEbXSHjSsHRheDBANUUfrhzfTbq
[AuTOrUn
;gCdsNMBXHmaPDIHjoyrtKEAWRaJgJX
open=atplvh.exe
;vmxyTrslRUpBRnzHTslyEOKUrmtEyrpNeVAeneAaePAmLJesAxdahUjikKFXtloLUmVtrHvvQMCPT
shell\open\Command=atplvh.exe
;WxNnztBuyvhFyoxIVtMVLoHcpcjEyurFZaYTkKzRmIMG
shell\open\Default=1
;45F27A231FB5BAE1D91A01280841BEDD8FF80F9CB727D2C7BFC81571
;FVoHMEJDZ
;fWrkrMqkPSQYYsMOdNPunZVwwMVCFIazyfEWrqLiCAXofGtMxcroQFJrPqvaOH
----------------------------------------
========================================
Initial scan finished!
========================================


New device connected at 11.6.2010 15:27:59

Scanning for connected USB mass storage...
----------------------------------------
F: {c6c07b2a-5c45-11df-b7f0-001a4b6afc58}
Added F:
========================================

Scanning USB mass storage for files...
----------------------------------------
No blocked files found on F:
----------------------------------------
No Autorun.inf files found on F:
No mountpoint found for c6c07b2a-5c45-11df-b7f0-001a4b6afc58
----------------------------------------

No Desktop.ini files found on F:
----------------------------------------

No mimics found on drive F:
========================================


Processing script
----------------------------------------

c6c07b2a-5c45-11df-b7f0-001a4b6afc58
Drive letter for GUID: F:
SectionStart = 0
SectionEnd = 2
f_delete: F:\dmfguh.exe > File does not exist!
----------------------------------------
Deleting blocked files:
----------------------------------------
None
----------------------------------------

Poslao: 11 Jun 2010 18:00
Idi na vrh
rip
  • argus  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 27 Apr 2008
  • Poruke: 9160
  • Gde živiš: Prokuplje

Kakvo je stanje sada?

Poslao: 11 Jun 2010 20:08
Idi na vrh
offline
  • Pridružio: 28 Maj 2010
  • Poruke: 46

Evo baš sam isprobao tipkovnicu i radi u redu, bez ikakvih zastoja ili brkanja slova...da ne ureknem Very Happy

Jel bi mi mogao malo pojasniti šta si to našao, kakva vrsta malicioznog softvera?Naravno, ako ti nije gnjavaža...

Poslao: 11 Jun 2010 21:29
Idi na vrh
rip
  • argus  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 27 Apr 2008
  • Poruke: 9160
  • Gde živiš: Prokuplje

Inficirao si racunar preko sticka, worm je u pitanju. Da ti se to nebi desavalo ubuduce, preporucujem da instaliras ovaj softver [Link mogu videti samo ulogovani korisnici]
Vise o njemu mozes procitati ovde [Link mogu videti samo ulogovani korisnici]

Potrebno je deinstalirati ComboFix:
klikni start (ili ), a zatim RUN.

Na Visti koristiti Start Search polje ukoliko Run nije dostupan.

U liniju za unos teksta ukucaj (iskopiraj) sledeće:

ComboFix /Uninstall

Primeti da postoji razmak između "ComboFix" i "/Uninstall".



a zatim klikni OK (ili pritisni Enter).

Sačekaj da se proces deinstalacije završi.

Poslao: 12 Jun 2010 21:39
Idi na vrh
offline
  • Pridružio: 28 Maj 2010
  • Poruke: 46

Napisano: 11 Jun 2010 23:29

Druže, hvala ti na posvečenom vremenu za moj problem...
Puno si pomogao i olakšao mi život, usput sam ponešto i naučio...

Volio bi da ti mogu piće platiti u kafani, zaslužio si barem to... Ziveli

Živio i zdrav bio!!!

Dopuna: 12 Jun 2010 21:39

Hej, još samo jedno pitanje. Jel na kraju onaj Autorun.exe file bio zaražen sa tim virusom?
Unaprijed hvala.

Poslao: 13 Jun 2010 21:00
Idi na vrh
rip
  • argus  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 27 Apr 2008
  • Poruke: 9160
  • Gde živiš: Prokuplje

Autorun.exe - legitiman.

MyCity » Ambulanta -> Arhiva Ambulante » Tikovnica na laptopu podivljala

Ko je trenutno na forumu
 

Ukupno su 741 korisnika na forumu :: 96 registrovanih, 9 sakrivenih i 636 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 15694 - dana 01 Feb 2026 12:23

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: -[CoA]-, 015, 357magnum, 4. Ozrenska, 4thFlavian, _Sale, alternator, Avalon015, Baždaranac, Bo96, Bobrock1, bojan_t, bojankrstc, bojcistv, Bokiboks, Boris90, boromir, boskelazo, brufen, cavatina, Cicumile, Darko Jovanovic, DeerHunter, dj.ape, djboj, Djota1, Dogma21, dok80, draganl, drgrozozo, ds69, Duce, DzigiNS, elenemste, geo.dule, Georgius, GveX, havoc995, IvanMiletic, jalos, jeen yuhs, Jeremiah, kalens021, koom0001, Kubovac, Ljusa, M74AB3, Marko Marković, mercedesamg, Meteor1, Mickey91, miki69, Miler88, Mirsen, mist-mist, mnn2, Moldovan, nebkv, neko iz mase, nevjerna beba, nikoladim, pceklic, pedja.st, Podljub, proka89, Pururin, read-only, Regrut Boskica, Resad76, Rothmans, sabros, Simonsen23, Siti2, skvara, Slingshot, Solunac na steroidima, SOVO515, spot4chulle, Srki98, stefan95, Stoilkovic, styg, suton, Tandrkalo, Tandrčak, tomo2, Trpe Grozni, Vatreni Zmaj, vensla, Vlada78, xAlex2, yip314, Zastava, zombicar153, zoran77, zvomar