Navigacija
Lista poslednjih: 16, 32, 64, 128 poruka.

Problem Windows script host-pomazite

[es] :: Zaštita :: Problem Windows script host-pomazite

[ Pregleda: 3436 | Odgovora: 10 ] > FB > Twit

Postavi temu Odgovori

Autor

Pretraga teme: Traži
Markiranje Štampanje RSS

multipleksor
Alen Pelinkovic
Student
Bar

Član broj: 195063
Poruke: 44
85.94.113.*



Profil

icon Problem Windows script host-pomazite09.11.2008. u 00:21 - pre 167 meseci
Od jednom mi racunar kad ga palim ispisuje : "Can not find file: "C:\WINDOWS\sistem32\boot.vbs"
A nakon toga mi ispisuje : "Can not find script file: C:\Documents and Settings \Alen\boot.vbs"
St6a da radim? jeli to opasno ? kako da saniram to ?
 
Odgovor na temu

Goran Mijailovic

Član broj: 12684
Poruke: 6907



+437 Profil

icon Re: Problem Windows script host-pomazite09.11.2008. u 01:28 - pre 167 meseci
pa neki program (malware) je bio instaliran ali su ostali njegovi tragovi u registry u run sekciji, ako imas iskustva sa regeditom obrisi tragove, tako sto ces pretraziti registry a u polje za pretragu upisi: boot.vbs
 
Odgovor na temu

magna86
Anti Malware Fighter

Član broj: 189287
Poruke: 557

Sajt: www.mycity.rs/Ambulanta


+16 Profil

icon Re: Problem Windows script host-pomazite09.11.2008. u 02:41 - pre 167 meseci
ja bi to ovako...
uzmes i skines HiJackThis program sa ovog linka
http://www.majorgeeks.com/download5554.html
ubacis ga u folder na desktopu
Promenis naziv foldera i programa u bilo sta drugo (npr. elite.exe, ili icE.the.gAd.exe..kako god)
pokrenes program,izaberes opciju "Do a system scan and save the logfile"
na kraju skeniranja program ce izbaciti tekstualni log,ti taj log kopiraj ovde (copy / paste)
 
Odgovor na temu

multipleksor
Alen Pelinkovic
Student
Bar

Član broj: 195063
Poruke: 44
85.94.123.*



Profil

icon Re: Problem Windows script host-pomazite09.11.2008. u 10:54 - pre 167 meseci
Instalirao sam ovaj program HijackThis i pokrenem ga i on mi izbaci spisak u text fajlu, sta da radim sa tim ?
 
Odgovor na temu

kristi1

Član broj: 151211
Poruke: 2012
*.ptt.rs.

Sajt: www.mycity.rs/Ambulanta


+88 Profil

icon Re: Problem Windows script host-pomazite09.11.2008. u 11:11 - pre 167 meseci
Iskopiraj ga copy/paste ovde na forumu (text fajl)
 
Odgovor na temu

Goran Mijailovic

Član broj: 12684
Poruke: 6907



+437 Profil

icon Re: Problem Windows script host-pomazite09.11.2008. u 11:55 - pre 167 meseci
Citat:
multipleksor: Instalirao sam ovaj program HijackThis i pokrenem ga i on mi izbaci spisak u text fajlu, sta da radim sa tim ?


jesi li mu promenio ime?
 
Odgovor na temu

multipleksor
Alen Pelinkovic
Student
Bar

Član broj: 195063
Poruke: 44
85.94.113.*



Profil

icon Re: Problem Windows script host-pomazite10.11.2008. u 21:01 - pre 167 meseci
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:00:19 PM, on 11/10/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\dxdlg.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\MATLAB6p5\webserver\bin\win32\matlabserver.exe
C:\WINDOWS\system32\wscript.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Alen\Desktop\ljubav\elite.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 121.12.249.207:3128
F2 - REG:system.ini: Shell=explorer.exe wproxp.exe
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 9\SnagItBHO.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {3B7AAEB1-9F3D-4491-9C06-C7165CA8D058} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 9\SnagItIEAddin.dll
O3 - Toolbar: (no name) - {144A6B24-0EBC-4D89-BF09-A06A718E57B5} - (no file)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKLM\..\Policies\Explorer\Run: [imapd] "C:\WINDOWS\system32\imapd.exe" -at
O4 - HKUS\S-1-5-18\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.onlyiesettings.com/redirect.php (file missing)
O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.onlyiesettings.com/redirect.php (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.co...t/wuweb_site.cab?1222292063421
O17 - HKLM\System\CCS\Services\Tcpip\..\{405B95DE-AD0B-465D-A883-EDB4641A29F6}: NameServer = 195.66.160.1,195.66.160.2
O17 - HKLM\System\CS1\Services\Tcpip\..\{405B95DE-AD0B-465D-A883-EDB4641A29F6}: NameServer = 195.66.160.1,195.66.160.2
O17 - HKLM\System\CS2\Services\Tcpip\..\{405B95DE-AD0B-465D-A883-EDB4641A29F6}: NameServer = 195.66.160.1,195.66.160.2
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\MATLAB6p5\webserver\bin\win32\matlabserver.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

--
End of file - 6842 bytes
 
Odgovor na temu

kristi1

Član broj: 151211
Poruke: 2012
*.ptt.rs.

Sajt: www.mycity.rs/Ambulanta


+88 Profil

icon Re: Problem Windows script host-pomazite10.11.2008. u 21:22 - pre 167 meseci
Skini SmitFraudFix i stavi ga na desktop.
Restartuj racunar u Safe Mode, restart pa F8
Pokreni SF i kad ti se pojavi plavi prozor klikni bilo koji taster za nastavak
Kad se pojavi sledeci prozor upisi broj 2 pa enter
Posle ciscenja pojavice se windows Disk Cleanup.
Pitace te Registry cleaning - Do you want to clean the registry klik na yes pa enter
ponovo ce pitati Replace infected file klik na yes pa enter

Postavi posle SF log C:\rapport.txt i svež HJT log
 
Odgovor na temu

zadrugarka
Mirko Marton
elektronicar, ED Sombor
Sombor

Član broj: 159894
Poruke: 57
*.com
Via: [es] mailing liste

Sajt: www.somborcycling.marton...


+1 Profil

icon Re: Problem Windows script host-pomazite10.11.2008. u 22:46 - pre 167 meseci
ali moj eset smart security(legalan, kupljen od "extreme") tretira ga :
C:DownloadsSmitfraudFix.exe » RAR » SmitfraudFixrestart.exe -
Win32/Restarter.NAA trojan
po naški "zlonameran kod" to mi je omiljena rečenica kad idem da "lečim"
računare.
>
tako da nisam ni probao da ga @[email protected]

> __________ Information from ESET Smart Security, version of virus
> signature database 3600 (20081110) __________
>
> The message was checked by ESET Smart Security.
>
> http://www.eset.com
>
>
Somborac
 
Odgovor na temu

magna86
Anti Malware Fighter

Član broj: 189287
Poruke: 557

Sajt: www.mycity.rs/Ambulanta


+16 Profil

icon Re: Problem Windows script host-pomazite11.11.2008. u 02:04 - pre 167 meseci
to je zato sto SmritFraduFix u sebi ima neke kodove nekih virusa...
zato ga svaki AV detektuje kao opasan,nebrini ovo su proverene skripte
iskljuci svoj AV privremeno pa odradi ovo sto ti je predlozio kristi1
 
Odgovor na temu

kristi1

Član broj: 151211
Poruke: 2012
*.ptt.rs.

Sajt: www.mycity.rs/Ambulanta


+88 Profil

icon Re: Problem Windows script host-pomazite11.11.2008. u 07:15 - pre 167 meseci
Isto tako bi tretirao i ComboFix koji je alat broj 1, to mora tako, zato ne brini i odradi kao sto sam ti rekao.
 
Odgovor na temu

[es] :: Zaštita :: Problem Windows script host-pomazite

[ Pregleda: 3436 | Odgovora: 10 ] > FB > Twit

Postavi temu Odgovori

Navigacija
Lista poslednjih: 16, 32, 64, 128 poruka.