zarazheni svchost.exe

Ovako. Imam win 2000 sp4 + autopetcher i NOD32 anti virus. Stalno mi nod izbacuje viruse koje pravi svchost.exe (C:/WINNT/system32/svchost.exe) koje mogu da ochistim, ali mi se s vremena na vreme svchost.exe ugasi pa nemam ikonice u folderu "WINNT", program files- u... i tako dok ne restartujem rachunar. I da, u task menadzeru, u procesima, su mi ukljuchena 2 svchost- a, ne mogu da iskljuchim ni jedan dok mi se sam ne iskljuchi jedan i desi ovo gore navedeno sa ikonicama. Zna li neko kako mogu da ochistim svchost.exe BEZ REINSTALACIJE ili neko drugo reshenje? Inache, imam CPU Intel 500 mhz- a, 128 mb- a ram mem., g force 2 na 16 mb- a. <== razlog shto ne stavim XP... Hvala u napred!
Izvinite ako sam omashio mesto na forumu za post, prvi put sam ovde pa se ne snalazim bash najbolje...

Potpis

Roll that shit, light that shit, smoke it!

Nije vazhno koliko imash aktivnih svchost.exe-a.Upravlja dll-s i nekim drugim procesima.Kod mene ih je trenutno 5 aktivnih.
Neka gamad se koriste istim nazivom kao npr. W32/Jeefo,pa bi tu trebalo trazhiti reshenje.
Standardna procedura,update-uj NOD,iskljuchi system restore,startuj komp u safe mod-u,skeniraj i chisti.
SHta ti tachno javlja NOD?

Potpis

.

Nod32 kazhe ovako, npr.:
Time Module Object Name Threat Action User Information
2/3/2007 5:46:42 AM AMON file C:\WINNT\system32\mmwpzfxn.exe Win32/Poebot trojan quarantined - deleted NT AUTHORITY\SYSTEM Event occurred on a new file created by the application: C:\WINNT\system32\svchost.exe. The file was moved to quarantine. You may close this window.

ili

Time Module Object Name Threat Action User Information
2/3/2007 5:23:17 AM AMON file C:\WINNT\system32\cvgimfk.exe a variant of Win32/Poebot trojan quarantined - deleted NT AUTHORITY\SYSTEM Event occurred on a new file created by the application: C:\WINNT\system32\svchost.exe. The file was moved to quarantine. You may close this window.
ili ovaj rusvi (ili shta je vec)

Time Module Object Name Threat Action User Information
2/2/2007 20:11:05 PM AMON file C:\WINNT\system32\explorer.exe a variant of Win32/Poebot trojan quarantined - deleted Event occurred on a new file created by the application: C:\WINNT\system32\bvzuyg.exe. The file was moved to quarantine. You may close this window.

i josh dosta njih... (:
Poshto sam panglu za rachunare, gde se iskljuchuje system restore? Negde u msconfig- u (kol'ko se ja secam) al' gde? (Sry shto smaram al' necu ponovo da reinstaliram sistem a koliko vidim iz drugih sluchajeva ni to ne pomazhe uvek...) Kada se iskljuchi svchost.exe izbacuje onu standardnu greshku "Error, bla bla (ne secam se tachno shta pishe) u may need to restart program (ili tkao neshto) i pishe samo "Cancel". Nod32 se uredno update- uje svaki dan...
Da dodam josh samo neshto, kad se konektujem na net, sve cheshce ne mogu da se diskonektujem (imam 56k dial- up), jednostavno ne radi "Disconnect" a i ne mogu da udjem u "Status", pa po zavrshetku korishcenja neta restartujem rachunar. O_o

Potpis

Roll that shit, light that shit, smoke it!

Win32/Poebot je problem.
Sa novim definicijama NOD-a,startuj komp u safe mod-u i skeniraj.

Evo ti link pa mozhesh da vidish kako se to radi i procheshljaj registry.
http://www.symantec.com/securi...005-052109-2651-99&tabid=3

Ovo shto cu napisati uzmi sa rezervom jer pishem po secanju-mrzi me da google-am,to ostavljam tebi:)
Neki od tih (Poe)bot-ova omogucavaju upad preko IRC kanala,kradju password-a i sl.,pa ako naletish na slichan info,svakako promeni vazhnije pass-ove.

I da,ne diraj svchost

Potpis

.

Procheshljao sam registry i nema ni jednog od onih datih fajlova. Uradio sam kao shto ste mi rekli, ushao u safe mod i uradio scan sa nodom ali mi nishta nije nashao... Ima li josh neko reshenje? ):

Potpis

Roll that shit, light that shit, smoke it!

Znachi,NOD vishe ne nalazi trojance!?!??
Pa,rekao bih da ti je problem time reshen:)

Potpis

.

E da je tako lako... O_o Ne nalazi ih offline, dok sam na netu i dalje nalazi, evo danashnjih nekoliko! (:

Time Module Object Name Threat Action User Information
2/3/2007 23:03:08 PM AMON file C:\WINNT\system32\host.exe Win32/Rbot trojan deleted (after the next restart) NT AUTHORITY\SYSTEM Event occurred at an attempt to access the file by the application: C:\WINNT\system32\svchost.exe.

pa onda

Time Module Object Name Threat Action User Information
2/3/2007 22:56:57 PM AMON file C:\WINNT\system32\TFTP1412 Win32/Rbot trojan quarantined - deleted Event occurred on a new file created by the application: C:\WINNT\system32\tftp.exe. The file was moved to quarantine. You may close this window.

ili

Time Module Object Name Threat Action User Information
2/3/2007 22:33:03 PM AMON file C:\WINNT\system32\logon.exe a variant of Win32/Poebot trojan quarantined - deleted Event occurred on a new file created by the application: C:\WINNT\system32\rltflnb.exe. The file was moved to quarantine. You may close this window.

da nastavim?

Time Module Object Name Threat Action User Information
2/3/2007 22:21:56 PM AMON file C:\WINNT\system32\winamp.exe a variant of Win32/Poebot trojan quarantined - deleted Event occurred on a new file created by the application: C:\WINNT\system32\cqyuemyr.exe. The file was moved to quarantine. You may close this window.


itd...

Potpis

Roll that shit, light that shit, smoke it!

OK,ako sam dobro razumeo,tebi treba ovako neshto:
REMOVAL TOOL
ovde imash listu gamadi za koju je zaduzhen(release information)
Nadam se da ce ti ovo pomoci:)

Potpis

.

E pa YOwitza,po meni ostaje ti josh jedino da probash scan na nekom drugom rachunaru i probaj sa nekim od boot antivirusa.

Potpis

.

boot antivirus? kao npr.? i josh jedno pitanje, poshto cu verovatno da udarim format, shta bi mogao da bude uzrochnik ovoga, da to u buduce izbegavam? Hvala josh jednom!

Potpis

Roll that shit, light that shit, smoke it!

Batali NOD32! Ja se tri godine kleo u njega dok me nije snaslo to sto i tebe. Jedino je Kaspersky 6 uspeo da ga ocisti

Stavio sam XP i formatirao HDD... Nisam mogao vishe da se cimam oko budjavog win2000... Hvala josh jednom i slobodno zakljuchajte topic... Peace!

Potpis

Roll that shit, light that shit, smoke it!

da li si sad stavio i firewall?
AV danas ne znači puno ako mu "leđa ne drži" i neki FW. Ćaletu je tako preko kasperskog ušao virus, ali od kad sam mu stavio i firewall sve je čisto, a za matorog znam da nije išao na "one sajtove".

Probaj Kerio FW čini mi se da je ok

Potpis

"There are only 10 types of people in the world:
Those who understand binary, and those who don't"