MyCity » Ambulanta -> Arhiva Ambulante » virus-kako ga obrisati

virus-kako ga obrisati

Napisano na dan: 24.7.2009
6

virus-kako ga obrisati
Pagination Prethodna strana
Sledeća strana Pagination

Idi na vrh

Poslao: 02 Avg 2009 23:49
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Skini ga opet i isprati uputstvo.



Poslao: 03 Avg 2009 00:06
Idi na vrh
offline
  • Pridružio: 24 Jul 2009
  • Poruke: 204

Napisano: 03 Avg 2009 0:05

ComboFix 09-08-01.09 - Administrator 08/02/2009 23:59.3.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1791.1087 [GMT 2:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt
AV: ESET NOD32 antivirus system 2.70 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
* Resident AV is active


FILE ::
"c:\documents and settings\Administrator\Start Menu\Programs\Startup\ikowin32.exe"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Administrator\Start Menu\Programs\Startup\ikowin32.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_soqwx32


((((((((((((((((((((((((( Files Created from 2009-07-02 to 2009-08-02 )))))))))))))))))))))))))))))))
.

2009-08-02 16:16 . 2009-08-02 17:12 -------- d-----w- C:\USBNoRisk
2009-07-28 13:20 . 2009-07-28 13:22 83568 ----a-w- c:\windows\system\knps.dll
2009-07-28 13:20 . 2009-07-28 13:22 5792 ----a-w- c:\windows\system\ibmjoy.drv
2009-07-28 13:20 . 2009-07-28 13:22 54976 ----a-w- c:\windows\system\knpg.dll
2009-07-28 13:20 . 2009-07-28 13:22 30544 ----a-w- c:\windows\system\dib.drv
2009-07-28 13:20 . 2009-07-28 13:20 -------- d-----w- c:\windows\GAMES
2009-07-25 15:01 . 2009-07-25 15:01 -------- d-----w- c:\windows\system32\wbem\Repository
2009-07-25 10:56 . 2009-07-25 15:00 -------- d-----w- c:\windows\ERDNT(2)
2009-07-20 19:27 . 2009-07-20 19:50 -------- d-----w- c:\documents and settings\Administrator\Application Data\MSNInstaller
2009-07-20 19:15 . 2009-07-20 19:21 -------- d-----w- c:\documents and settings\Administrator\Application Data\Yahoo!
2009-07-20 19:15 . 2009-07-20 19:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-07-20 19:10 . 2009-07-20 19:22 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
2009-07-20 19:10 . 2009-07-20 19:22 -------- d-----w- c:\program files\Yahoo!

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-02 22:02 . 2008-12-30 18:21 -------- d-----w- c:\documents and settings\Administrator\Application Data\Skype
2009-08-02 22:01 . 2008-12-30 18:52 -------- d-----w- c:\documents and settings\Administrator\Application Data\skypePM
2009-07-27 19:26 . 2009-03-19 17:50 -------- d-----w- c:\program files\Opera
2009-07-01 18:08 . 2008-12-30 14:25 71096 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-01 18:04 . 2009-07-01 12:06 -------- d-----w- c:\program files\Common Files\Real
2009-07-01 17:30 . 2009-02-09 19:32 -------- d-----w- c:\program files\YouTube Downloader
2009-07-01 17:26 . 2009-07-01 17:01 -------- d-----w- c:\documents and settings\Administrator\Application Data\GetRightToGo
2009-07-01 17:24 . 2009-07-01 14:15 -------- d-----w- c:\program files\KeepV Converter
2009-07-01 12:06 . 2009-07-01 12:06 -------- d-----w- c:\program files\Common Files\xing shared
2009-07-01 12:06 . 2009-07-01 12:06 -------- d-----w- c:\program files\Real
2009-07-01 12:05 . 2008-12-30 18:20 -------- d-----w- c:\program files\Google
2009-06-12 11:49 . 2009-06-12 11:49 -------- d-----w- c:\program files\Common Files\SWF Studio
2009-06-02 15:00 . 2009-06-02 14:50 2516 --sha-w- c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2009-06-02 15:00 . 2009-06-02 14:50 2516 --sha-w- c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2009-06-02 14:50 . 2009-06-02 14:50 8 --sh--r- c:\documents and settings\All Users\Application Data\E2E70C80C3.sys
2009-06-02 14:50 . 2009-06-02 14:50 8 --sh--r- c:\documents and settings\All Users\Application Data\E2E70C80C3.sys
2009-06-01 08:56 . 2009-06-01 08:56 7680 ----a-w- c:\documents and settings\Administrator\Application Data\Thinstall\Jasc Paint Shop Pro 9\4000007400002i\agent.exe
2009-06-01 08:56 . 2009-06-01 08:56 7680 ----a-w- c:\documents and settings\Administrator\Application Data\Thinstall\Jasc Paint Shop Pro 9\4000003000002i\JascUpdate.exe
2009-06-01 08:56 . 2009-06-01 08:56 7680 ----a-w- c:\documents and settings\Administrator\Application Data\Thinstall\Jasc Paint Shop Pro 9\1000000600002i\svchost.exe
2009-07-24 20:28 . 2009-01-11 19:56 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-08-12 21741864]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-11-27 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2008-12-30 949376]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 57344]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 159744]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-07-01 198160]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2008-04-10 16861184]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2008-11-27 99840]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"HideFastUserSwitching"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)

[HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=c:\documents and settings\Administrator\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=c:\windows\pss\LimeWire On Startup.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\AntiVirusDisableNotify!=dword:0]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\ftp.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [3/9/2009 11:17 PM 13696]
R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [12/30/2008 4:29 PM 15424]
S2 gupdate1c9fa4440203a06;Google Update Service (gupdate1c9fa4440203a06);c:\program files\Google\Update\GoogleUpdate.exe [7/1/2009 2:05 PM 133104]
S3 k510bus;Sony Ericsson K510 Driver driver (WDM);c:\windows\system32\drivers\k510bus.sys [3/19/2009 3:58 PM 58288]
S3 k510mdfl;Sony Ericsson K510 USB WMC Modem Filter;c:\windows\system32\drivers\k510mdfl.sys [3/19/2009 3:58 PM 8336]
S3 k510mdm;Sony Ericsson K510 USB WMC Modem Driver;c:\windows\system32\drivers\k510mdm.sys [3/19/2009 3:58 PM 94064]
S3 k510mgmt;Sony Ericsson K510 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\k510mgmt.sys [3/19/2009 3:58 PM 85408]
S3 k510obex;Sony Ericsson K510 USB WMC OBEX Interface;c:\windows\system32\drivers\k510obex.sys [3/19/2009 3:58 PM 83344]
.
Contents of the 'Scheduled Tasks' folder

2009-08-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-01 12:05]

2009-08-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-01 12:05]
.
.
------- Supplementary Scan -------
.
uStart Page = [Link mogu videti samo ulogovani korisnici]
uDefault_Search_URL = [Link mogu videti samo ulogovani korisnici]
mStart Page = [Link mogu videti samo ulogovani korisnici]
mSearch Bar = [Link mogu videti samo ulogovani korisnici]*http://www.yahoo.com/ext/search/search.html
uSearchURL,(Default) = [Link mogu videti samo ulogovani korisnici]*http://www.yahoo.com
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm
LSP: c:\windows\system32\imon.dll
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ct7awr84.default\
FF - prefs.js: browser.search.defaulturl - [Link mogu videti samo ulogovani korisnici]
FF - prefs.js: browser.startup.homepage - [Link mogu videti samo ulogovani korisnici]
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2009-08-03 00:02
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(720)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(776)
c:\windows\system32\imon.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\Common Files\Teleca Shared\CapabilityManager.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\ESET\nod32krn.exe
c:\program files\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\program files\Common Files\Teleca Shared\Generic.exe
c:\program files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\control.exe
c:\windows\system32\control.exe
c:\windows\system32\rundll32.exe
.
**************************************************************************
.
Completion time: 2009-08-02 0:04 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-02 22:04
ComboFix2.txt 2009-08-02 21:35

Pre-Run: 30,092,402,688 bytes free
Post-Run: 30,017,531,904 bytes free

174

Dopuna: 03 Avg 2009 0:06

jel sada da ga deinstaliram



Poslao: 03 Avg 2009 00:13
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Citat:jel sada da ga deinstaliram

Zašto bi to uradila?



Privremeno deaktiviraj NOD i ponovi postupak sa programom USBNoRisk (prethodni put je AV zasmetao, zato treba ponoviti).

Poslao: 03 Avg 2009 08:50
Idi na vrh
offline
  • Pridružio: 24 Jul 2009
  • Poruke: 204

Napisano: 03 Avg 2009 0:23

uh sutra cu onda....sada sam sprecena zbog deteta

Dopuna: 03 Avg 2009 8:50

USBNoRisk 2.5 (26 July 2009) by bobby

Started at 8/3/2009 8:49:06 AM

Searching for connected USB Mass storage...
----------------------------------------
F: {0df2cba4-0a78-11de-9eae-00e04d9d35ae}
========================================

Searching for other storage...
----------------------------------------
C: {d33e72bd-d6b0-11dd-8707-806d6172696f}
E: {d33e72be-d6b0-11dd-8707-806d6172696f}
========================================

Scanning removable storage...
----------------------------------------

No blocked files found on F:
No Autorun.inf files found on F:
No mountpoint found for 0df2cba4-0a78-11de-9eae-00e04d9d35ae
No Desktop.ini files found on F:
No mimics found on drive F:
----------------------------------------

Poslao: 03 Avg 2009 10:26
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Ako je sada sve u redu... Obriši USBNoRisk i deinstaliraj ComboFix.

Poslao: 03 Avg 2009 10:49
Idi na vrh
offline
  • Pridružio: 24 Jul 2009
  • Poruke: 204

Napisano: 03 Avg 2009 10:43

provericu posle...sada sam ubacila pandu av on line...neke silne inficirane fajlove izbacuje...da li je pouzdano takvo skeniranje?

Dopuna: 03 Avg 2009 10:49

e svaka ti cast...sada je sve ok

Poslao: 03 Avg 2009 10:51
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Online skeneri su dobar način za vršenje dodatnih provera...

Poslao: 03 Avg 2009 11:03
Idi na vrh
offline
  • Pridružio: 24 Jul 2009
  • Poruke: 204

a recimi jesu pouzdaniji od noda obzirom da mi panda pronasao 27 inficiranih fajlova:0

Poslao: 03 Avg 2009 11:08
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Online skeneri ne nude stalnu zaštitu i ne mogu se koristiti kao zamena za (klasičan) antivirus.

Poslao: 04 Avg 2009 21:04
Idi na vrh
offline
  • Pridružio: 24 Jul 2009
  • Poruke: 204

Napisano: 03 Avg 2009 11:11

uh qqqq pa sto mi nadje toliko inficiranih fajlova...nis' mi nije jasno:)

Dopuna: 04 Avg 2009 15:55

[Link mogu videti samo ulogovani korisnici] koliko je bezbedno(zbog v irusa) odavde skidati igrice

Dopuna: 04 Avg 2009 21:04

pomooooooooooooooc ....skidali smo igrice i nod se sam iskljucio...ikonica je crvena i ne mogu da stikliram file system monitor amon.....
file system monitor not started mi pokazuje u statusu

MyCity » Ambulanta -> Arhiva Ambulante » virus-kako ga obrisati

Ko je trenutno na forumu
 

Ukupno su 1140 korisnika na forumu :: 99 registrovanih, 11 sakrivenih i 1030 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 20624 - dana 04 Apr 2026 04:18

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: 04bokibole, _Rade, Aleksa-, Alojzije, alzir86, Antoni S, Apis Dr, Apok, Armadillo, ArmFPGA, asdfjklc, avalon, bobo85, bojank, Boroš, borya90, bozzo27, BSD, bukefal, calvi, carinko, coaa, cuvarkuca, cyprus, darkor848, dendrit86, dmrdc, draganl, dragoljub11987, DrNeoCortex, Electron, feanor, Flanker-G, FOX, GazdaDjoka, Georgius, goran.vvv, iceburn, In_hero, istina, ivan1973, Joint Chief, Jose, Jovan.D, K2, Kalem, karevski, kenny74, Khalid ibn al-Walid, kolle.the.kid, Komentator, kovinacc, ljuba.b, Magarac, marsi, mean_machine, mercedesamg, metallac777, Metanoja, Miki 24pbr, milenko crazy north, milos.cbr, Mitraljeta, mkukoleca, nebojsag, nesa1962, nikolapetkovic, nobutado, Pantaaa, Prečanin30, raf87, rajkoplje, raptorsi, Sale0501, sales, savuni, shlauf, sifogiannis, siwoti, Sićko, Skakac7, skroba84, sluga, Snorks, Sone0883, ssekir75, Stevan2026, tamno.nebo, Vanderx, vathra, vensla, vjetar, vojnik švejk, Volkhov-M, vuksa72, x011, zexon, zixmix, Zjmc