[es] - trojanac prorat. 19 pomoc

Goran Mijailovic

Član broj: 12684
Poruke: 6907

+437 Profil

^{16.12.2005. u 22:04 - pre 223 meseci}

Probaj da odradis full computer scan iz safe moda valjda ce mnogohvaljeni NOD32 uspeti da ga ocisti.

http://vil.mcafeesecurity.com/vil/content/v_103064.htm

http://www.sophos.com/virusinfo/analyses/trojprorat19.html

http://secunia.com/virus_information/19288/prorat-19/

_{[Ovu poruku je menjao Goran Mijailovic dana 16.12.2005. u 23:12 GMT+1]}

Odgovor na temu

Goran Mijailovic

Član broj: 12684
Poruke: 6907

+437 Profil

Re: trojanac prorat. 19 pomoc

^{16.12.2005. u 22:15 - pre 223 meseci}

Eh da pre ciscenja iskljuci sistem restore.

Odgovor na temu

delalt

Član broj: 68360
Poruke: 198
81.93.74.*

Profil

Re: trojanac prorat. 19 pomoc

^{16.12.2005. u 23:07 - pre 223 meseci}

Nezgodan trojanac, pogledaj instrukcije za uklanjanje, moraćeš ručno i
strogo pazi da ne preskočiš koji korak:
http://securityresponse.symant...venc/data/backdoor.prorat.html

Ja sam jednom samo tako uspio da ga se riješim bez kompletne reinstalacije.
Ne znam da li je to bila ista verzija koju ti pominješ, pa potraži i druga uputstva
ali se fokusiraj na ručno uklanjanje.

Odgovor na temu

Goran Mijailovic

Član broj: 12684
Poruke: 6907

+437 Profil

Re: trojanac prorat. 19 pomoc

^{16.12.2005. u 23:18 - pre 223 meseci}

Ma sta ima da bude neugodno, ode u safe mod i rucno obrises sledece fajlove:

Citat:

# %Windows%\services.exe
# %Windows%\system\sservice.exe
# %Windows%\system32\fservice.exe
# %Windows%\system32\reginv.dll (Hides the Trojan process from the process list)
# %Windows%\system32\winkey.dll (Logs keystrokes belonging to application windows)
# %Windows%\ktd32.atm (Stores recorded keystrokes)

Takodje u registry bazi pobrises sledece kljuceve:

Citat:

# HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell"
Explorer.exe %Windir%\system32\fservice.exe
# HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y} "StubPath"
%Windir%\system\sservice.exe
# HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\
policies\Explorer\Run "DirectX For Microsoft® Windows"
%Windir%\system32\fservice.exe

Onda uzmes Kaspersky i preskeniras ceo kompjuter, a i a² antitrojan ga prepoznaje.
Naravno najpre iskljucis System Restore.

Odgovor na temu

Goran Mijailovic

Član broj: 12684
Poruke: 6907

+437 Profil

Re: trojanac prorat. 19 pomoc

^{16.12.2005. u 23:27 - pre 223 meseci}

Svakako proveri i ovo uputstvo sa symantecovog sajta.
znaci ako nadjes bilo sta od ovoga brisi:

Citat:

# %System%\Main.exe
# %System%\Loader.exe
# %System%\Msmsg.exe
# %System%\Winserv.dll
# %System%\Fservice.exe
# %System%\Sservice.exe
# %Windir%\Winlogon.exe

Citat:

# %System%\wininv.dll
# %System%\winkey.dll

Popravi izmene u registry bazi:

Citat:

# Adds a value at one or more of the following locations in the Windows registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
Policies\Explorer\Run

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

The following values have been seen added:

"MSNMESENGER"="%System%\Main.exe"

"DirectX for Microsoft Windows"="%System%\Fservice.exe"

"DirectX for Microsoft Windows"="%System%\Sservice.exe"

"StubPath"="C:\Windows\system\Sservice.exe"

# Modifies the value data of:

Shell

in the registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

from:

"explorer.exe"

to:

"explorer.exe %System%\Fservice.exe"

I na kraju osim izmena u registry bazi moze i ovako:

Citat:

1. Disable System Restore (Windows Me/XP).
2. Update the virus definitions.
3. Restart the computer in Safe mode (Windows 95/98/Me) or Safe mode with Command Prompt (Windows 2000/XP).
4. Reverse the changes made to the registry.
5. Restart the computer in Safe mode or VGA mode (Windows Me/XP).
6. Run a full system scan and delete all the files detected as Backdoor.Prorat.

For specific details on each of these steps, read the following instructions.

_{[Ovu poruku je menjao Goran Mijailovic dana 17.12.2005. u 00:37 GMT+1]}

Odgovor na temu