MyCity » Ambulanta -> Arhiva Ambulante » Vundo infekcija

Vundo infekcija

Napisano na dan: 20.9.2007
1

Vundo infekcija
Sledeća strana Pagination

Idi na vrh

Poslao: 20 Sep 2007 12:50
Idi na vrh
offline
  • Pridružio: 08 Nov 2006
  • Poruke: 167

Internet explorer se otvori sam od sebe i pri tom reklamira winantivirus .

JGOSsys.dll , probao sam da ga izbrisem u safe modu i za cudo ne moze .

tmpA60.tmp.dll (file missing) sam izbrisao sa shift + delete i sad se ponovo popjavljuje ali pise file mising .

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\cFosSpeed\spd.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\cFosSpeed\cFosSpeed.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Innovative Solutions\Taskbar Button Manager\tbm.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
D:\wincmd\WINCMD32.EXE
C:\WINDOWS\system32\wuauclt.exe
D:\Backup\Programi\HiJackThis_v2.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = [Link mogu videti samo ulogovani korisnici]
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {ae4b3803-b9bd-4f7a-bf2d-30d1429fd97f} - C:\WINDOWS\system32\JGOSsys.dll
O2 - BHO: (no name) - {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} - C:\WINDOWS\system32\tmpA60.tmp.dll (file missing)
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [cFosSpeed] C:\Program Files\cFosSpeed\cFosSpeed.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Taskbar Button Manager] C:\Program Files\Innovative Solutions\Taskbar Button Manager\tbm.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O8 - Extra context menu item: &Clean Traces - D:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - D:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - D:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - [Link mogu videti samo ulogovani korisnici]\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{F972F7CE-423B-4991-BF42-B2CFC7462B4A}: NameServer = 91.150.80.1 91.150.80.2
O17 - HKLM\System\CS1\Services\Tcpip\..\{BDD4193F-EAC3-4263-88E7-9413119539B3}: NameServer = 192.168.1.1,194.247.192.180
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: c:\windows\system32\ssqrroo.dll
O20 - Winlogon Notify: devsvr - devsvr.dll (file missing)
O20 - Winlogon Notify: JGOSsys - C:\WINDOWS\SYSTEM32\JGOSsys.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: cFosSpeed System Service (cFosSpeedS) - cFos Software GmbH - C:\Program Files\cFosSpeed\spd.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: RemoteShutDown Service (RemShutDownSvc) - Unknown owner - C:\WINDOWS\System32\remsdnsv.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe



Poslao: 20 Sep 2007 13:27
Idi na vrh
offline
  • Pridružio: 06 Apr 2005
  • Poruke: 1023

zipuj i uploaduj nam sledece fajlove na [Link mogu videti samo ulogovani korisnici]

c:\windows\system32\ssqrroo.dll
C:\WINDOWS\SYSTEM32\JGOSsys.dll
devsvr.dll

posle toga uradi sledece:

VundoFix:
[Link mogu videti samo ulogovani korisnici]

* Dvoklikom se startuje fajl VundoFix.exe.
* Izabere opcija Scan for Vundo.
* Posle završenog skeniranja i pojave poruke Done Searching for files klikne se na OK.
* Sada, kada je skeniranje obavljeno potrebno je kliknuti na opciju Remove Vundo.
* Po pojavljivanju upita o uklanjaju Vundo fajlova klikne se na Yes.
* Pokretanje ove opcije učiniće Desktop privremeno praznim u cilju pripreme sistema za uklanjanje Vundo-a.
* Po završetku, pojaviće se obaveštenje o gašnjenju računara, klikne se OK.
* Uključi se računar i podigne sistem iznova.
* Iskopira se sadržaj loga sa putanje C:\vundofix.txt i novi HiJackThis log u poruku na forumu.



Poslao: 20 Sep 2007 19:13
Idi na vrh
offline
  • Pridružio: 08 Nov 2006
  • Poruke: 167

Pre nego sto si postovao uputstvo ja sam porenuo ccleaner i restartovao komp i sad ne mogu da nadjem devsvr.dll , a ni ssqrroo.dll . JGOSsys.dll sam uploudovao .

Vundo fix kaze da nema vunda , ja sam za svaki slucaj kliknuo remove i naravno nista se nije desilo ( vise puta sam pokrenuo i internet explorer i reklama se nije pojavila ) :


VundoFix V6.5.8

Checking Java version...

Java version is 1.5.0.3
Old versions of java are exploitable and should be removed.

Scan started at 2:21:49 PM 9/20/2007

Listing files found while scanning....

No infected files were found.


Beginning removal...

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\cFosSpeed\spd.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\cFosSpeed\cFosSpeed.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Innovative Solutions\Taskbar Button Manager\tbm.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
D:\wincmd\WINCMD32.EXE
C:\Program Files\Opera\Opera.exe
D:\Backup\Programi\HiJackThis_v2.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = [Link mogu videti samo ulogovani korisnici]
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {ae4b3803-b9bd-4f7a-bf2d-30d1429fd97f} - C:\WINDOWS\system32\JGOSsys.dll
O2 - BHO: (no name) - {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} - (no file)
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [cFosSpeed] C:\Program Files\cFosSpeed\cFosSpeed.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Taskbar Button Manager] C:\Program Files\Innovative Solutions\Taskbar Button Manager\tbm.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O8 - Extra context menu item: &Clean Traces - D:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - D:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - D:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - [Link mogu videti samo ulogovani korisnici]\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{F972F7CE-423B-4991-BF42-B2CFC7462B4A}: NameServer = 91.150.80.1 91.150.80.2
O17 - HKLM\System\CS1\Services\Tcpip\..\{BDD4193F-EAC3-4263-88E7-9413119539B3}: NameServer = 192.168.1.1,194.247.192.180
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: c:\windows\system32\ssqrroo.dll
O20 - Winlogon Notify: devsvr - devsvr.dll (file missing)
O20 - Winlogon Notify: JGOSsys - C:\WINDOWS\SYSTEM32\JGOSsys.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: cFosSpeed System Service (cFosSpeedS) - cFos Software GmbH - C:\Program Files\cFosSpeed\spd.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: RemoteShutDown Service (RemShutDownSvc) - Unknown owner - C:\WINDOWS\System32\remsdnsv.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe

Dopuna: 20 Sep 2007 19:13

Pogledao sam za ovaj JGOSsys.dll da li je microsoftov fajl i vidim da nije ( onako kako me je bobby naucio , pogledao sam da li pise ono microsoft corporation ) .

Poslao: 20 Sep 2007 20:51
Idi na vrh
offline
  • Pridružio: 06 Apr 2005
  • Poruke: 1023

Isprati proceduru za VundoFix opisanu gore. Razlika ce samo biti u sledecem:

Kada pokrenes VundoFix, u (belom) prozoru programa napravi desni klik misem i izaberi opciju "Add more files?". Kada ti se otvori sledeci prozor copy/paste sledece putanje fajlova - svaku u razlicit box.

c:\windows\system32\ssqrroo.dll
C:\WINDOWS\SYSTEM32\JGOSsys.dll
C:\WINDOWS\system32\tmpA60.tmp.dll

Stisni "Remove Vundo".

Ovo ti je ostatak gorenjeg uputstva koje ce da te saceka posle ove procedure sa dodavanjem fajlova.
Citat:* Pokretanje ove opcije učiniće Desktop privremeno praznim u cilju pripreme sistema za uklanjanje Vundo-a.
* Po završetku, pojaviće se obaveštenje o gašnjenju računara, klikne se OK.
* Uključi se računar i podigne sistem iznova.

Kad sve zavrsis postavi novi HJT log i VundoFix log.

Poslao: 20 Sep 2007 21:48
Idi na vrh
offline
  • Pridružio: 08 Nov 2006
  • Poruke: 167

Posto sam ih pobio restartovao sam komp i uradio hijack i izgleda da ih nema

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 9:55:07 PM, on 9/20/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\cFosSpeed\spd.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\cFosSpeed\cFosSpeed.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Innovative Solutions\Taskbar Button Manager\tbm.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
D:\wincmd\WINCMD32.EXE
C:\Program Files\Opera\Opera.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\IceChat7\IceChat7.exe
C:\Program Files\VideoLAN\VLC\vlc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\Backup\Programi\HiJackThis_v2.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = [Link mogu videti samo ulogovani korisnici]
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [cFosSpeed] C:\Program Files\cFosSpeed\cFosSpeed.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Taskbar Button Manager] C:\Program Files\Innovative Solutions\Taskbar Button Manager\tbm.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O8 - Extra context menu item: &Clean Traces - D:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - D:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - D:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - [Link mogu videti samo ulogovani korisnici]\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{F972F7CE-423B-4991-BF42-B2CFC7462B4A}: NameServer = 91.150.80.1 91.150.80.2
O17 - HKLM\System\CS1\Services\Tcpip\..\{BDD4193F-EAC3-4263-88E7-9413119539B3}: NameServer = 192.168.1.1,194.247.192.180
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: cFosSpeed System Service (cFosSpeedS) - cFos Software GmbH - C:\Program Files\cFosSpeed\spd.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: RemoteShutDown Service (RemShutDownSvc) - Unknown owner - C:\WINDOWS\System32\remsdnsv.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe

Poslao: 21 Sep 2007 13:07
Idi na vrh
offline
  • Pridružio: 06 Apr 2005
  • Poruke: 1023

jel si koristio vundo fix sa onim dodacima ili si ih pobio nekako drugacije (nisi postavio log pa nemam pojma)

vidim da je nestao i devsvr.dll a nismo ga brisali (mozda je bio povezan sa necim)

deluje mi kako da je sve ok i da smo se resili gamadi.

Poslao: 21 Sep 2007 15:42
Idi na vrh
offline
  • Pridružio: 08 Nov 2006
  • Poruke: 167

Nazalost pre nego sto si mi posalo drugu poruku sa novim uputstvom ja sam ih zbog nestrpljenja pobio rucno.
One koji su mogli da se izbrisu rucno sam izbrisao rucno iz safe moda Jgossys.dll nije mogao da se obrise ni iz safe moda pa sam za njega skinuo PocketKillBox . Kad sam to uradio oni su u HijackThis bili i dalje prisutni , ali je pisalo missing file onda sam ih obelezio i otisao isao na opciju fix .

Izkljucen mi je system restore tak oda se nadam da se ni jedan nije sakrio tamo . Sve na kompjuteru normalno radi tak oda se nadam da ni jedan ni je bo povezan sa necim bitnim . Naravno vundo se zasad vise ne pojavljuje .

Poslao: 21 Sep 2007 15:52
Idi na vrh
offline
  • Pridružio: 04 Sep 2003
  • Poruke: 24135
  • Gde živiš: Wien

Posalji sledeci fajl na proveru:
c:\windows\system32\nwprovau.dll
Za upload iskoristi sledecu formu:
[Link mogu videti samo ulogovani korisnici]

E_F ce nastaviti da ti asistira u ciscenju racunara, ja sam upao samo da zatrazim ovaj fajl.

Poslao: 21 Sep 2007 19:56
Idi na vrh
offline
  • Pridružio: 08 Nov 2006
  • Poruke: 167

Fajl poslat .

Poslao: 23 Sep 2007 18:26
Idi na vrh
offline
  • Pridružio: 06 Apr 2005
  • Poruke: 1023

imamo malih problema sa pristupom fajlovima zbog premestanja na novi server pa ne mogu da proverim onaj fajl. Moraces malo da pricekas dok dobijes odgovor.

Dopuna: 23 Sep 2007 18:26

nwprovau.dll fajl je ok.

vidim da koristis verziju HJ koja ima neke bagove pa bi te zamolio da skines verziju iz ove teme [Link mogu videti samo ulogovani korisnici]


- promeni ime hijackthis.exe u nesto drugo (npr hd.exe) i napravi novi log.

MyCity » Ambulanta -> Arhiva Ambulante » Vundo infekcija

Ko je trenutno na forumu
 

Ukupno su 2163 korisnika na forumu :: 89 registrovanih, 6 sakrivenih i 2068 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 6018 - dana 19 Dec 2025 13:41

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: 252., A.R.Chafee.Jr., alberto, ALEXV, Arsenije, bankulen, Baždaranac, Belac91, belov, Betty25, bojanM84, bojcistv, Ciri1994, Colt D, d.arsenal321, DaliborVukadinovic, Darkoniii_94, DavidA, dejno, Despot Đurađ, Despot1, djuradj, Dusko Nikolin, Electron, Fliper, gobrad, Gogi_avio, gorantrojka, iceburn, Ilija Cvorovic, Ilija Grubor, ivan979, Jan, jodzula, Joksss, K2, Kajzer Soze, king011, kovinacc, Kubovac, Lieutenant, LUDI, MarkoD, mercedesamg, Mickey91, Milan Miscevic, milenko crazy north, Milometer, milutin134, mist-mist, Mldo, MrNo, neutrino, Nikoletina Bursac, niksa517, Paklenica, Pale2025, Papadubi, pera bager, Petrusci, powSrb, Promising0, RajkoB, savaskytec, Sir Budimir, Sirius, Sićko, SlaKoj, Srle993, Srpska zauvjek, stegonosa, Stoilkovic, strelac07, Tajpan, Tastatura ratnik, The Boss, Tribal, tritonus, Vaske8990, VBoss, Velizar Laro, vensla, vidra1, Vrač, xAlex2, Zemunikola, Zrcalo, Đurđevdan, 79693