MyCity » Ambulanta -> Arhiva Ambulante » windows script host

windows script host

Napisano na dan: 22.6.2009

Strana:
1
2
3
4

windows script host

Pagination

Prethodna strana

Sledeća strana

Pagination

Odgovori

Strana:
1
2
3
4

Blaske Poslao: 22 Jun 2009 23:35 Idi na vrh
offline Blaske Građanin Pridružio: 04 Sep 2007 Poruke: 130	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! USBNoRisk 2.4 (1 June 2009) by bobby Started at 6/22/2009 11:33:44 PM Searching for connected USB Mass storage... ---------------------------------------- I: {710e41e0-46fc-11de-802b-00508d59a11d} H: {fe21aa0e-3e36-11de-8025-00508d59a11d} ======================================== Searching for other storage... ---------------------------------------- C: {0c44db79-3db6-11de-b67a-806d6172696f} D: {0c44db7a-3db6-11de-b67a-806d6172696f} F: {8245a7d2-3daa-11de-8022-806d6172696f} G: {8245a7d3-3daa-11de-8022-806d6172696f} ======================================== Scanning removable storage... ---------------------------------------- No blocked files found on H: No Autorun.inf files found on H: No mountpoint found for fe21aa0e-3e36-11de-8025-00508d59a11d No Desktop.ini files found on H: No mimics found on drive H: ---------------------------------------- No blocked files found on I: No Autorun.inf files found on I: No mountpoint found for 710e41e0-46fc-11de-802b-00508d59a11d ---------------------------------------- Desktop.ini found at I:\Recycled\ contains interesting CLSID string ---------------------------------------- [.ShellClassInfo] CLSID={645FF040-5081-101B-9F08-00AA002F954E} ---------------------------------------- HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E},InfoTip = @%SystemRoot%\system32\SHELL32.dll,-22915 HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E},IntroText = @%SystemRoot%\system32\SHELL32.dll,-31748 HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E},LocalizedString = @%SystemRoot%\system32\SHELL32.dll,-8964 HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon,@ = %SystemRoot%\System32\shell32.dll,31 HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon,Empty = %SystemRoot%\System32\shell32.dll,31 HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon,Full = %SystemRoot%\System32\shell32.dll,32 HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\InProcServer32,@ = shell32.dll HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E},InfoTip = @%SystemRoot%\system32\SHELL32.dll,-22915 HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E},IntroText = @%SystemRoot%\system32\SHELL32.dll,-31748 HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E},LocalizedString = @%SystemRoot%\system32\SHELL32.dll,-8964 HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon,@ = %SystemRoot%\System32\shell32.dll,31 HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon,Empty = %SystemRoot%\System32\shell32.dll,31 HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon,Full = %SystemRoot%\System32\shell32.dll,32 HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\InProcServer32,@ = shell32.dll No mimics found on drive I: ---------------------------------------- Scanning fixed storage... ---------------------------------------- No blocked files found on C: No Autorun.inf files found on C: No mountpoint found for C: No mountpoint found for 0c44db79-3db6-11de-b67a-806d6172696f No Desktop.ini files found on C: ---------------------------------------- No blocked files found on D: No Autorun.inf files found on D: No mountpoint found for D: No mountpoint found for 0c44db7a-3db6-11de-b67a-806d6172696f No Desktop.ini files found on D: ---------------------------------------- No blocked files found on F: No Autorun.inf files found on F: No mountpoint found for F: No mountpoint found for 8245a7d2-3daa-11de-8022-806d6172696f No Desktop.ini files found on F: ---------------------------------------- No blocked files found on G: No Autorun.inf files found on G: No mountpoint found for G: No mountpoint found for 8245a7d3-3daa-11de-8022-806d6172696f No Desktop.ini files found on G: ---------------------------------------- autorun.inf found in Qoobox ---------------------------------------- Content of C:\QooBox\Quarantine\C\WINDOWS\system32\autorun.inf.vir ---------------------------------------- [autorun] Open= shell\Open=I LOVE MY PEANUT shell\Open\Command=WScript.exe .\24233.vbs shell\Open\Default=1 shell\Explore=Explore shell\Explore\Command=WScript.exe .\24233.vbs ---------------------------------------- ======================================== Initial scan finished! ======================================== Processing script ---------------------------------------- 710e41e0-46fc-11de-802b-00508d59a11d Drive letter for GUID: I: SectionStart = 9 SectionEnd = 12 f_delete: file "I:\explorer.exe" deleted successfully ---------------------------------------- Delete folder tree I:\RECYCLED: ---------------------------------------- Delete: I:\RECYCLED\desktop.ini > Done! Delete: I:\RECYCLED\INFO2 > Done! Delete: I:\RECYCLED > Done! ---------------------------------------- Folder list for I:\: ---------------------------------------- d---- 0 I:\GRACEJ~1 I:\GRACE JONES d---- 0 I:\pdf I:\pdf d---- 0 I:\ELECTR~1.2 I:\Electro house 2008 vol.2 dr-hs 0 I:\RECYCLER I:\RECYCLER d---- 0 I:\HARD_M~1 I:\Hard_Mix-Brazilian_House-WEB-(MPM0003)-2009-CopyCAT d---- 0 I:\HED_KA~1 I:\Hed_Kandi_The_Mix_Spring_2009-3_CD-2009 d---- 0 I:\JOHNNY~1._LE I:\Johnny_Fiasco-Groove_On_(Incl._Lego_Remix)-(KFD010)-WEB-2009-SOULFUL d---- 0 I:\JUSTIN~1._MA I:\Justin_Michael_and_Born_to_Funk_Ft._Maya-Change_is_on_the_Way-_PM067_-WEB-2009-BSiDE d---- 0 I:\LA_VID~1.2 I:\La_Vida_Loca_-_The_Latin_House_Party_Vol.2 d---- 0 I:\VA-BUD~1 I:\VA - Buddha Bar - Sunlounger (2009) d---- 0 I:\VA_-_H~1 I:\VA_-_House_this_(Mixed_by_Kneedeep)-2009-MST d---- 0 I:\VA_-_M~1 I:\VA_-_Music_For_Cocktails_(Elite_Edition)-2CD-2009-LiR d---- 0 I:\VA-BAR~1 I:\VA-Bar_Vista-Latino-2CD-2009 d---- 0 I:\VA-CHI~1 I:\VA-Chill Jazz Sessions (2009) d---- 0 I:\VONMON~1 I:\Von Mondo - House Jazz Masters (2006) d---- 0 I:\BORN_T~1 I:\Born_To_Funk-Get_Funky-(GKF061)-WEB-2008-IMT dr-hs 0 I:\RESTORE I:\RESTORE ---------------------------------------- 0c44db79-3db6-11de-b67a-806d6172696f Drive letter for GUID: C: SectionStart = 0 SectionEnd = 4 Windows folder protection is off f_delete: file "C:\windows\system32\24233.vbs" deleted successfully f_delete: file "C:\windows\system32\101207.cmd" deleted successfully ---------------------------------------- 8245a7d3-3daa-11de-8022-806d6172696f Drive letter for GUID: G: SectionStart = 5 SectionEnd = 8 f_delete: file "G:\101207.cmd" deleted successfully ---------------------------------------- Folder list for G:\: ---------------------------------------- `dr--- 0 G:\Dacha G:\Dacha dr--- 0 G:\DRUM G:\DRUM d--hs 0 G:\found.000 G:\found.000 dr--- 0 G:\HIPHOP~1 G:\hip hop dr--- 0 G:\HOUSE G:\HOUSE -rahs 0 G:\kht G:\kht dr--- 0 G:\LONGE G:\LONGE dr--- 0 G:\obuka G:\obuka d---- 0 G:\podaci G:\podaci d--hs 0 G:\RECYCLER G:\RECYCLER dr--- 0 G:\REGGAE G:\REGGAE d--hs 0 G:\SYSTEM~1 G:\System Volume Information` ----------------------------------------

Profil

bobby Poslao: 22 Jun 2009 23:39 Idi na vrh
offline bobby Administrator Pridružio: 04 Sep 2003 Poruke: 24135 Gde živiš: Wien	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! Zadnji skript: `{8245a7d3-3daa-11de-8022-806d6172696f} f_delete: %DRIVE%kht folder_list: %DRIVE%`

Profil

Blaske Poslao: 22 Jun 2009 23:43 Idi na vrh
offline Blaske Građanin Pridružio: 04 Sep 2007 Poruke: 130	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! USBNoRisk 2.4 (1 June 2009) by bobby Started at 6/22/2009 11:41:45 PM Searching for connected USB Mass storage... ---------------------------------------- I: {710e41e0-46fc-11de-802b-00508d59a11d} H: {fe21aa0e-3e36-11de-8025-00508d59a11d} ======================================== Searching for other storage... ---------------------------------------- C: {0c44db79-3db6-11de-b67a-806d6172696f} D: {0c44db7a-3db6-11de-b67a-806d6172696f} F: {8245a7d2-3daa-11de-8022-806d6172696f} G: {8245a7d3-3daa-11de-8022-806d6172696f} ======================================== Scanning removable storage... ---------------------------------------- No blocked files found on H: No Autorun.inf files found on H: No mountpoint found for fe21aa0e-3e36-11de-8025-00508d59a11d No Desktop.ini files found on H: No mimics found on drive H: ---------------------------------------- No blocked files found on I: No Autorun.inf files found on I: No mountpoint found for 710e41e0-46fc-11de-802b-00508d59a11d No Desktop.ini files found on I: No mimics found on drive I: ---------------------------------------- Scanning fixed storage... ---------------------------------------- No blocked files found on C: No Autorun.inf files found on C: No mountpoint found for C: No mountpoint found for 0c44db79-3db6-11de-b67a-806d6172696f No Desktop.ini files found on C: ---------------------------------------- No blocked files found on D: No Autorun.inf files found on D: No mountpoint found for D: No mountpoint found for 0c44db7a-3db6-11de-b67a-806d6172696f No Desktop.ini files found on D: ---------------------------------------- No blocked files found on F: No Autorun.inf files found on F: No mountpoint found for F: No mountpoint found for 8245a7d2-3daa-11de-8022-806d6172696f No Desktop.ini files found on F: ---------------------------------------- No blocked files found on G: No Autorun.inf files found on G: No mountpoint found for G: No mountpoint found for 8245a7d3-3daa-11de-8022-806d6172696f No Desktop.ini files found on G: ---------------------------------------- autorun.inf found in Qoobox ---------------------------------------- Content of C:\QooBox\Quarantine\C\WINDOWS\system32\autorun.inf.vir ---------------------------------------- [autorun] Open= shell\Open=I LOVE MY PEANUT shell\Open\Command=WScript.exe .\24233.vbs shell\Open\Default=1 shell\Explore=Explore shell\Explore\Command=WScript.exe .\24233.vbs ---------------------------------------- ======================================== Initial scan finished! ======================================== Processing script ---------------------------------------- 8245a7d3-3daa-11de-8022-806d6172696f Drive letter for GUID: G: SectionStart = 0 SectionEnd = 2 f_delete: file "G:\kht" deleted successfully ---------------------------------------- Folder list for G:\: ---------------------------------------- `dr--- 0 G:\Dacha G:\Dacha dr--- 0 G:\DRUM G:\DRUM d--hs 0 G:\found.000 G:\found.000 dr--- 0 G:\HIPHOP~1 G:\hip hop dr--- 0 G:\HOUSE G:\HOUSE dr--- 0 G:\LONGE G:\LONGE dr--- 0 G:\obuka G:\obuka d---- 0 G:\podaci G:\podaci d--hs 0 G:\RECYCLER G:\RECYCLER dr--- 0 G:\REGGAE G:\REGGAE d--hs 0 G:\SYSTEM~1 G:\System Volume Information` ----------------------------------------

Profil

bobby Poslao: 22 Jun 2009 23:49 Idi na vrh
offline bobby Administrator Pridružio: 04 Sep 2003 Poruke: 24135 Gde živiš: Wien	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! Ima li jos kakvih problema? Ukoliko nema, ostaje nam samo da deinstaliramo ComboFix i USBNoRisk: klikni start (ili ), a zatim RUN. Na Visti koristiti Start Search polje ukoliko Run nije dostupan. U liniju za unos teksta ukucaj (iskopiraj) sledeće: combofix /u Primeti da postoji razmak između "ComboFix" i "/u". a zatim klikni OK (ili pritisni Enter). Sačekaj da se proces deinstalacije završi. USBNoRisk se deinstalira tako sto u samom programu kliknes na dugme Uninstall, sto ce izbrisati folder c:\USBNoRisk i fajlove u njemu. Sam EXE fajl USBNoRiska mozes obrisati rucno ukoliko ti nije vise potreban. USBNoRisk mozes koristiti i kasnije - pokrenes ga pre nego sto prikljucis neki USB uredjaj i USBNoRisk ce spreciti svako automatsko pokretanje programa (samim tim i malwarea) sa USB uredjaja. Time sprecavas da ti malware zarazi komp.

Profil

Blaske Poslao: 22 Jun 2009 23:56 Idi na vrh
offline Blaske Građanin Pridružio: 04 Sep 2007 Poruke: 130	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! Ok,jel mozes da mi kazes u cemu je bio problem?

Profil

bobby Poslao: 23 Jun 2009 00:01 Idi na vrh
offline bobby Administrator Pridružio: 04 Sep 2003 Poruke: 24135 Gde živiš: Wien	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! Pa sve particije + USB stick + plejer su ti bili inficirani nekim crvom. Taj crv se siri tako sto na svaku particiju ubacuje Autorun fajlove koji bi trebali automatski da se pokrenu kada otvoris particiju i zato umesto da otvoris particiju ti si ustvari pokretao tog crva. To smo otklonili bili u samom startu. Ostatak naseg ciscenja ovde smo proveli u nalazenju fajlova koje je taj crv kreirao na tvom kompu, i brisanju istih. Oni nisu vise bili aktivni, ali je uvek postojala mogucnost da ti slucajno naletis na njih i pokrenes ih, pa je zato bilo pametno da i njih nadjemo i obrisemo. Pride toga, nasli smo i ostatke 4 infekcija koje si ranije imao na USB sticku i na plejeru.

Profil

Blaske Poslao: 23 Jun 2009 00:05 Idi na vrh
offline Blaske Građanin Pridružio: 04 Sep 2007 Poruke: 130	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! Hvala mnogo,kazi mi samo jos ovaj program sto si mi dao usbnorisk,jel sa njim moze da se uklanjaju virusi sa usb-a ili samo sprecava da ti predje virus ili sta god sa usb-a na komp?

Profil

bobby Poslao: 23 Jun 2009 00:08 Idi na vrh
offline bobby Administrator Pridružio: 04 Sep 2003 Poruke: 24135 Gde živiš: Wien	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! On automatski samo sprecava prelazak, a za brisanje je potrebno znati protumaciti log i napisati skript za ciscenje. Taj sam program napisao bas za koriscenje u Ambulanti, i to pisanje skriptova uce samo clanovi AMF ekipe koja ovde resava slucajeve u Ambulanti.

Profil

Blaske Poslao: 23 Jun 2009 00:13 Idi na vrh
offline Blaske Građanin Pridružio: 04 Sep 2007 Poruke: 130	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! Kako anti virus nije reagovao?

Profil

bobby Poslao: 23 Jun 2009 00:15 Idi na vrh
offline bobby Administrator Pridružio: 04 Sep 2003 Poruke: 24135 Gde živiš: Wien	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! Ne postoji AV koji prepoznaje sve viruse/crve/trojance/itd. Tvoj nije prepoznao ovog crva, prosto.

Profil

MyCity » Ambulanta -> Arhiva Ambulante » windows script host

Ko je trenutno na forumu

Ukupno su 1076 korisnika na forumu :: 49 registrovanih, 9 sakrivenih i 1018 gosta :: [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:: Korisnici trenutno na forumu: 357magnum, A.R.Chafee.Jr., babaroga, BlekMen, Bobrock1, BraneS, Bubimir, cavatina, Denaya, Dimitrise93, Dorcolac, dragoljub11987, FOX, goxin, ivica976, kalens021, Karla, kunktator, Leonov, Luka Blažević, MiG-29M2, naki011, Nemanja.M, nikoladim, nuke92, operniki, ozzy, pacika, panzerwaffe, Petar35, procesor, raptorsi, RJ, Rogan33, Sančo, sasa76, slonic_tonic, Smiljke, solic, stegonosa, Sumadija34, torivoje, Tvrtko I, VJ, vobo, Webb, YugoSlav, zodiac94, 125

Svaki korisnik ovog sajta je odgovoran za sadržaj svoje poruke koju objavi na sajtu. Sajt se odriče svake odgovornosti za sadržaj tih poruka.
Postavljanjem vaše poruke ili vašeg autorskog dela na ovaj sajt, saglasni ste da ovaj sajt postaje distributer vašeg dela, i odričete se mogućnosti njegovog povlačenja ili brisanja, bez saglasnosti uprave sajta.
Distribucija sadržaja sa ovog sajta je dozvoljena samo u nekomercijalne svrhe, uz obaveznu napomenu da je sadržaj preuzet sa ovog sajta, i uz obavezno navođenje adrese MyCity sajta. Za sve ostale vidove distribucije obavezni ste da prethodno zatražite odobrenje od vlasnika MyCity sajta.
MyCity pokrenuo, administrira i razvija Predrag Damnjanović, a o uređenju sajta se brine MyCity Tim.
Ukoliko želite da nas kontaktirate kliknite ovde.
Naši sajtovi:
Vesti, Vojni forum, Zaštita od virusa, TekstPesme.rs

This content is licensed under a Creative Commons License.
Based on phpBB 2, translated by Simke, designed by