Navigacija
Lista poslednjih: 16, 32, 64, 128 poruka.

Potrebna mi je hitno pomoč kako da očistm kompjuter od virusa

[es] :: Zaštita :: Potrebna mi je hitno pomoč kako da očistm kompjuter od virusa

[ Pregleda: 3575 | Odgovora: 2 ] > FB > Twit

Postavi temu Odgovori

Autor

Pretraga teme: Traži
Markiranje Štampanje RSS

s.makic

Član broj: 137518
Poruke: 123
*.vdial.verat.net.



Profil

icon Potrebna mi je hitno pomoč kako da očistm kompjuter od virusa06.05.2009. u 20:41 - pre 2051 dana i 5h

Potrebna mi je hitno pomoč kako da očistm kompjuter od virusa koji se raširio u kompjuteru. Imao sam instalisanu Windos Vistu međutim najpre mi je virus napao konekciju na iternet i više nisam mogo da napravim nikakvu vezu sa internet, zatim mi DVD nije očitavao nijedan CD pokazivao je kao da su prazni. Deinstalisao sam vistu obrisao particiju, ponovo je kreirao i ponovo formatirao na njoj sam instalisao Windows XP i sve programe međutim odmah mi je ativirusni program (Kaspersky) pronašo mnogo virusa na obe particije, obrisao sam ih ali mi DVD neke CD pokazuje kao da su prazni, ISOBuster program kad pokrenem samo bljesne i neotvara se, deinstaliso sam gha i instalisao ponovo ali isto pokazuje. Program PartitionMagic sam deinstalisao je je pokazivao da je inficiran, ponovo ga instalisao ka se pokrene pokazuje da je inficiran i zatvori se.
Kasperski je detektovao virus Type_Win 32 (modification) i virus Heur.Invader (modification), koji se raširio u kompjuteru i koji mi uništava programe i internet vezu, i ako ga obrišem on se ponovo pojavi čak i posle formatiranja paricije na kojo se nalazi Windows XP.
Skinuo sam ComboFix međutim neće da se instališe pokazuje sledeču grešku
!!ALERT !! Is NOT SAFE to continue!
The contents of the ComboFix package has been compromised.
Note: You may be infeced with a file patching virus (Virut).
Kad pritisnem OK izbriše se ComboFix.exe koji sam skinuo. Dva puta sam skidao i pokušavao da ga instališem isto se ponavlja.
HitackThis mi je pokazao sledeće:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:25:21, on 6.5.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\WINDOWS\ATKKBService.exe
C:\Program Files\GetRight\getright.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\128.tmp
E:\Programs\nu2menu\nu2menu.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\HP\Smart Web Printing\hpswp_clipbook.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dvdcopyrip.com
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKLM\..\Run: [FineReader7NewsReaderPro] C:\Program Files\ABBYY FineReader 7.0 Professional Edition\AbbyyNewsReader.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 7236 bytes
Probao sam da ponovnim deinstalacijom i ponovnom instalacijo Windowsa XP da rešim problem. Nakon instaliranja Windowsa XP instalisao sam ComboFix i pokazao mi je sledeći log
ComboFix 09-05-05.04 - Lazar 06.05.2009 20:02.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.381.1033.18.511.371 [GMT 2:00]
Running from: F:\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2009-04-06 to 2009-05-06 )))))))))))))))))))))))))))))))
.

No new files created in this timespan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-06 17:55 . 2009-05-06 17:55 -------- d-----w c:\program files\microsoft frontpage
2009-05-06 17:54 . 2001-08-23 12:00 67 --sha-w c:\windows\Fonts\desktop.ini
2009-05-06 17:54 . 2009-05-06 17:54 86327 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-05-06 17:50 . 2009-05-06 17:50 21640 ----a-w c:\windows\system32\emptyregdb.dat
2009-05-06 17:50 . 2009-05-06 17:50 -------- d-----w c:\program files\Windows Media Connect 2
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" - c:\windows\system32\hdashcut.exe [2006-08-15 61952]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=


--- Other Services/Drivers In Memory ---

*NewlyCreated* - BROWSER
*NewlyCreated* - FASTUSERSWITCHINGCOMPATIBILITY
*NewlyCreated* - FLTMGR
*NewlyCreated* - HELPSVC
*NewlyCreated* - IMAPISERVICE
*NewlyCreated* - LANMANSERVER
*NewlyCreated* - MSISERVER
*NewlyCreated* - NDISUIO
*NewlyCreated* - PCIIDE
*NewlyCreated* - POLICYAGENT
*NewlyCreated* - RASACD
*NewlyCreated* - RASMAN
*NewlyCreated* - RDPCDD
*NewlyCreated* - RDPNP
*NewlyCreated* - SCHEDULE
*NewlyCreated* - SENS
*NewlyCreated* - SHELLHWDETECTION
*NewlyCreated* - SR
*NewlyCreated* - SRSERVICE
*NewlyCreated* - SRV
*NewlyCreated* - SSDPSRV
*NewlyCreated* - TERMSERVICE
*NewlyCreated* - THEMES
*NewlyCreated* - WUAUSERV
*NewlyCreated* - WZCSVC
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-06 20:03
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-05-06 20:04
ComboFix-quarantined-files.txt 2009-05-06 18:04

Pre-Run: 45.722.374.144 bytes free
Post-Run: 45.715.918.848 bytes free

73
Instalisao sam PartitionMagic i pokušao sam da ga pokrenem izbaci da je inficiran i isključi se. Kako da se oslobnodim ovog virusa i očistim kompjuter.


 
Odgovor na temu

Dashkes
Dr.Web Staff, CVD Laboratory
Belgrade

Moderator
Član broj: 90973
Poruke: 844

Jabber: dashke@jabber.org
ICQ: 66363565
Sajt: www.FakeAVs.com


Profil

icon Re: Potrebna mi je hitno pomoč kako da očistm kompjuter od virusa06.05.2009. u 20:50 - pre 2051 dana i 4h
C:\WINDOWS\system32\128.tmp - aktivan proces(virus)

HijackThis log je cist.

Preuzmite program Dr.Web CureIt!.

• Posle preuzimanja restartujte racunar u Safe Mode(dok se pali racunar pritiskajte F8 pa kada se pojavi meni odaberite Safe Mode - prva stavka).
• Kada se ucita Safe Mode pokrenite Dr.Web CureIt! pokretanjem fajla launch.exe.
• Kad se upali odaberite Start. On ce automatski poceti da skenira racunar. Pustiti da skenira(to je brzo skeniranje).
• Kada zavrsi sa skeniranjem odaberite kompletno skeniranje - Complete scan i sa desne strane pritisnite dugme Start Scanning(izgleda kao Play dugme).

Moram da vas upozorim da kompletno skeniranje moze da potraje nekoliko sati!
FakeAVs - blog posvećen najnovijim virusima
 
Odgovor na temu

predrag88
Predrag Jovanovski

Član broj: 116744
Poruke: 8
80.93.254.*



Profil

icon Re: Potrebna mi je hitno pomoč kako da očistm kompjuter od virusa07.05.2009. u 14:47 - pre 2050 dana i 10h
Laptopovi

Da li moze virus da puno zauzme RAM memoriju

hvala
 
Odgovor na temu

[es] :: Zaštita :: Potrebna mi je hitno pomoč kako da očistm kompjuter od virusa

[ Pregleda: 3575 | Odgovora: 2 ] > FB > Twit

Postavi temu Odgovori

Navigacija
Lista poslednjih: 16, 32, 64, 128 poruka.