Da li mi je računar zaražen (sfc_os.dll)?Od tada, a nikada ranije, stalno mi se prikazuje ova greška, uvek na istom fajlu: sfc_os.dll (menja se samo aplikacija koja poziva, u poslednjem redu):
Posle skena svih drajvova, NOD32 u Full Scan modu prijavljuje samo ovaj fajl kao problematičan, ništa sem toga. Fajl je deo OS-a, ne sme/ne može da se obriše. Poludeću od njega, stalno se pojavljuje NOD32 prozor. Mogu da isključim NOD32 alerts, ali to baš loše rešenje.
Međutim, fajl nije modifikovan (ni binarno, ni datum i vreme). Iz Win instalacije, iz CAB arhive otpakovao sam isti fajl i binarno uporedio da li su isti:
NOD32 i svežeotpakovani fajl vidi kao trojanca, iako ovu instalaciju imam dve godine i isti NOD i do maločas nikad se nije javio. Fake Trojan?
Evo šta kaže McAfee za ovaj moj Patched SFC_os.dll:
Citat:
This software is not a virus or a Trojan. The "PatchedSFC" is intended to disable Windows File Protection (WFP).
Moja instalacija ima disejblovan WFP, pogledao sam u Registry. Ovaj fajl deluje ok, možda me virus samo navodi da se bavim ovim fajlom, dok on "rovari" negde drugde?
Čitam dalje, kapiram da je samo loš savet:
Citat:
When your antivirus program detects your sfc_os.dll system file as being a Trojan you should be concerned. Unlike most infected files, if you delete or move this file, your system may become unbootable or at the very least revert to the blue error screen with every boot. It is very nice that most antivirus programs make it especially easy to delete needed system files. This is a serious problem, and chances are that if you are reading this, then you've already deleted the sfc_os.dll from your system or are thinking about doing it in the interest of ridding your computer of yet another rogue trojan.
The Solutions:
- Download a clean copy of sfc_os.dll and copy it over the existing file or empty space (if you deleted it already) in Windows/System32 With the new file in place you should be fine.
- If your computer is already unbootable or has the error screen. Download the sfc_os.dll file to a jump drive via another computer, then use Knoppix Linux to boot and access your computer. When you are inside, copy the clean sfc_os.dll to the directory of Windows/System32 on the system and reboot. Windows should be able to start and run now.
After you are done, or perhaps before, you may want to disable Windows File Protection, which sfc_os.dll happens to be a part of, to give yourself a slight increase in performance and stop those annoying messages from appearing.
The Solutions:
- Download a clean copy of sfc_os.dll and copy it over the existing file or empty space (if you deleted it already) in Windows/System32 With the new file in place you should be fine.
- If your computer is already unbootable or has the error screen. Download the sfc_os.dll file to a jump drive via another computer, then use Knoppix Linux to boot and access your computer. When you are inside, copy the clean sfc_os.dll to the directory of Windows/System32 on the system and reboot. Windows should be able to start and run now.
After you are done, or perhaps before, you may want to disable Windows File Protection, which sfc_os.dll happens to be a part of, to give yourself a slight increase in performance and stop those annoying messages from appearing.
Meni je WFP već disejblovan! Nisam obrisao fajl jer je isti kao iz CAB Win install arhive. Da bih ga obrisao i zamenio moram da butujem drugi OS koji nemam na laptopu.
Drugi programi -- sad testirao
Anti-spyware:
Lava Ad-Aware samo Tracking Coockies
AVG Antispyware 7.5 takođe samo Tracking Coockies
Antivirus:
F-Secure online scan -- isto Tracking Coockies
AVG Free Edition -- sve čisto.
A meni ovakvi prozori samo iskaču:
U \Temp\ folderu je svežeotpakovani DLL iz CAB arhive. Isti NOD32 nikad ranije tokom full scan-a nije nalazio ovog "uljeza" iz \System32\ foldera. Odjednom mi ne da mira. Any hints?
[Ovu poruku je menjao owim dana 28.06.2011. u 07:31 GMT+1]
Re: Da li mi je računar zaražen (sfc_os.dll)?
Re: Da li mi je računar zaražen (sfc_os.dll)?
