Trojanac otporan na antiviruse...

Preko flasha mi je usao u komp neki trojanac koji stvara na svim particijama fajlove auto.exe i autorun.inf... Obrisem ih ali se odmah vrate. Znam da postoji vec dosta slicnih tema ali nisam resio problem... Problem nije resio ni kaspersky, ni bit defender, ni stinger.. Stinger i Kaspersky prijavljuju trojanca, izbrisu ga ali se vraca. Sta da radim? Nasao sam neki program FixDrive koji je uradio da mogu normalono da otvaram particije ali trojanac je tu i dalje i svaki put kad otvorim neku particiju Kaspersky pokazuje trojanca.

P.S. Cak mi se sada desava da ne mogu da stavim ni show hidden files.


_{[Ovu poruku je menjao dobrota dana 03.11.2008. u 16:27 GMT+1]}

---

ja sam dobijao tog trojanca/sta-li-je-vec (valjda je taj, auto.exe + skriveni autorun.inf) bezbroj puta na usb flashovima koje mi donose ortaci i avg free je svaki put uspeo uspesno da ih ubije (mada par puta sam morao autorun.inf rucno da uklanjam, ali sve maliciozne izvrsne fajlove je uspesno uklanjao)

_{[Ovu poruku je menjao Aleksandar Ružičić dana 03.11.2008. u 03:06 GMT+1]}

---

trtojanac !!! ROTL...

---

Skini HiJackThis program sa sledeceg linka:
http://www.majorgeeks.com/download5554.html
Stavi ga u zaseban folder na Desktop
-Promeni naziv foldera i programa (opcija Rename) u bilo sta drugo npr.elite.exe

* Pokreni HijackThis
* Izaberi opciju "Do a system scan and save the logfile"
* Na kraju skeniranja program ce izbaciti tekstualni log.
* taj log kopiraj ovde ( opcije copy / paste)

---

Evo loga.

_{[Ovu poruku je menjao dobrota dana 03.11.2008. u 16:28 GMT+1]}

---

ok..aj ovako...

1. isprati ovo uputstvo
http://xtra.co.nz/help/0,,4155-1916458,00.html

2.
Restartuj kompjuter i pritiskaj F8 taster.
Pojavice se menu
U boot menu-iju izaberi Safe Mode


* Pokreni HijackThis
* Izaberi opciju "Do a system scan only"
* Stikliraj sledece linije:




* Idi na "Fix Checked"
* Zatvori Hijack This

*Rucno izbrisi sledece file-ove
(Shift+Delete pa Enter)



3. pokreni ovaj program
Wise Registry Cleaner 3 Free
http://www.wisecleaner.com/download.html

pa postavi svez HjT log

srecno

---

Problem je resio ovaj program http://www.malwarebytes.org/mbam.php .

Hvala na pomoci.

---

cek..cek..
pa nemoj me drzati u neznanju..
jsi li ti prvo odradio ovo sto sam ti rekao ili si samo skenirao sa MBAM-om?

aj daj mi da vidim malwarebues anti malware log please

---

Samo sam skenirao tim programom. Evo tu je i log.

Sad se ne desava onaj problem i sve izgleda uredu, ali kaspersky i dalje prijavljuje trojanca u fajlu C:\WINDOWS\Fonts\n1225836749k.exe . Ne moze mu nista samo rollback. A sto je najzanimljivije taj fajl ne postoji.

---

brate..ja sam sokiran
tebi se virus varijanta adware prosilrio na hiljade mesta u kompjuteru
tu je bio i neki spaware ..i jos par virusa
aj ako hoces da nastavmo..napravi pa postavi svez HjT log

---

Sveze.

---

Ponovo sam skenirao MBAM-om i opet je prijavio inficirane fajlove...
Kaspersky i dalje prijavljuje nekog tojanca u windows\fonts....

Tu su i novi MBAM i HjT logovi.

---

ok,prati redom uputstva!
i uradi sledece:


* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Click Yes to confirm.
* Click OK.

................................


Restartuj kompjuter i pritiskaj F8 taster.
Pojavice se menu
U boot menu-iju izaberi Safe Mode


* Pokreni HijackThis
* Izaberi opciju "Do a system scan only"
* Stikliraj sledece linije:




* Idi na "Fix Checked"
* Zatvori Hijack This

*Rucno izbrisi sledece file-ove
(Shift+Delete pa Enter)



.....................................................

digni racunar u normalnom modu,pa seniraj sa Spybot s&d

http://www.safer-networking.org/en/download/

....................................................


da bismo proverili jel sve uklonjeno postavi svez HjT log


PS: imas istu TV karicu kao ja :)
Cyclone TV

---

Uradio sam sve ono sto si rekao.. Fajl koji si rekao da izbrisem nije postojao.
Spybot je nasao 71 problems... sve je resio osim jednog foldera, to sam rucno izbrisao.
Izgleda da je sad sve uredu. MBAM, Kaspersky i Spybot ne prijavljuju vise nista. Evo i novog log-a.

Hvala puno na pomoci!

---

verovatno je HjT uspeo automacki da ubije i file,jer je radjeno iz safe moda....
ovaj log je cist,a ti nemas probleme..znaci to je to..uspeli smo

---

Pozdrav svima,

Pokupio sam sa usb stickom trojanca na jednom komp-u.Smjestio se u G:\RECYCLER i antivirus stalno prijavljuje njegovo postojanje.Probao sam formatirati stick,al ne daje rezultate.Sadrzaju sticka se jedino moze pristupiti preko opcije "explore".Stavljam i hijackthis fajl,jer nisam siguran da mi se nije ubacio i na komp.

Logfile of HijackThis v1.99.1
Scan saved at 15:11:59, on 22.11.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ULI5289\ALi5289.exe
C:\Program Files\ULI5289\JMAP5289.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\xampp\mysql\bin\mysqld-nt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\xampp\xampp-control.exe
c:\xampp\apache\bin\apache.exe
C:\xampp\apache\bin\apache.exe
C:\Documents and Settings\Minja\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [ALi5289] C:\Program Files\ULI5289\ALi5289.exe
O4 - HKLM\..\Run: [JMAP5289] C:\Program Files\ULI5289\JMAP5289.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [NodLogin] C:\Program Files\ESET\ESET Smart Security\nodlogin.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - Startup: WinMySQLadmin.lnk = C:\xampp\mysql\bin\winmysqladmin.exe
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: MySql - Unknown owner - C:/xampp/mysql/bin/mysqld-nt.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Zna li neko kako spasiti stick?

hvala

Ovako, ti nemas AV, imas Zone Alarm ali ne i Antivirus. Skini sa neta Avast i instaliraj ga. Pitace te da prilikom podizanje sistema pregleda sve lokalne diskove, dozvoli mu i restartuj.
On ce ocistiti taj malware sa racunara. Zatim iskljuci Autoplay na racunaru na sledeci nacin:
Start->Run i otkucaj gpedit.msc
Computer Configuration\Administrative Templates\System\"Turn off Autoplay (Enabled) all drivers
Onda ubaci Flash i formatiraj ga (nece se pokrenuti i preneti na racunar malware).

Imam instalisan NOD32 3.0.672.0,on mi je i prijavljivao ovog trojanca.

Izvini nisam primetio, na brzinu sam pogledao log, onda iskljuci autoplay i formatiraj flash.

Disable-ovo sam autorun na preko gpedit.msc,ali nista,cim ubacim stick pocne da me obavjestava o virusu,pa i poslije formatiranja nastavi.U isto vrijeme mi stick prikazuje kao folder!