Fraud.XP Antivirus.Pomagaj te
Prikazujem rezultate 1 do 14 od 14

Tema: Fraud.XP Antivirus.Pomagaj te

  1. #1
    Obećava j.vlada (avatar)
    Učlanjen
    14.05.2007.
    Pol
    muški
    Poruke
    60
    Reputaciona moć
    39

    Podrazumevano Fraud.XP Antivirus.Pomagaj te

    Komp. je skroz poludeo . Sva podesavanja su se poremetila cak i slova na tasraturi su izmesana. Stisnes A on kuca Q. itd
    Spy boot nalazi Fraud.XP Antivirus ali ne moze sve da obrise.
    Evo log
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 20:43:17, on 11/02/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16762)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\userinit.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
    C:\WINDOWS\system32\frmwrk32.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\system32\TASMGRZ.EXE
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\DOCUME~1\JANACI~1\LOCALS~1\Temp\Rar$EX01.734\Hi jackThis.exe
    C:\WINDOWS\system32\ntdll64.exe
    C:\WINDOWS\system32\init32.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.01net.com/telecharger/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.01net.com/telecharger/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.01net.com/telecharger/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (file missing)
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\sw g.dll
    O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll (file missing)
    O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (file missing)
    O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Windows UDP Control Center] fxstaller.exe
    O4 - HKLM\..\Run: [Framework Windows] frmwrk32.exe
    O4 - HKLM\..\Run: [WinDLL (tmp.exe)] rundll32.exe C:\WINDOWS\system32\tmp.exe,start
    O4 - HKLM\..\Run: [Microsoft Update] TASMGRZ.EXE
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\RunOnce: [Microsoft Update] TASMGRZ.EXE
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
    O10 - Unknown file in Winsock LSP: c:\windows\temp\ntdll64.dll
    O10 - Unknown file in Winsock LSP: c:\windows\temp\ntdll64.dll
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1219183740328
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
    O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

    --
    End of file - 7305 bytes
    Hitno mi je please.



  2. #2
    Legenda
    Učlanjen
    02.09.2008.
    Pol
    muški
    Lokacija
    Malo Orašje
    Poruke
    60.269
    Reputaciona moć
    0

    Podrazumevano Re: Fraud.XP Antivirus.Pomagaj te

    Ako Avira ne pomaze, instaliraj neki drugi av

  3. #3
    Elita Boki (avatar)
    Učlanjen
    22.02.2008.
    Pol
    muški
    Lokacija
    Zürich
    Poruke
    24.778
    Tekstova u blogu
    7
    Reputaciona moć
    3503

    Podrazumevano Re: Fraud.XP Antivirus.Pomagaj te

    Ovo bi mogli biti stetni procesi :

    [X] - C:\WINDOWS\system32\frmwrk32.exe
    [?] - C:\WINDOWS\system32\TASMGRZ.EXE
    [N] - O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll (file missing)
    [X] - O4 - HKLM\..\Run: [Windows UDP Control Center] fxstaller.exe
    [X] - O4 - HKLM\..\Run: [Framework Windows] frmwrk32.exe
    [?] - O4 - HKLM\..\Run: [WinDLL (tmp.exe)] rundll32.exe C:\WINDOWS\system32\tmp.exe,start
    [?] - O4 - HKLM\..\Run: [Microsoft Update] TASMGRZ.EXE
    [?] - O4 - HKCU\..\RunOnce: [Microsoft Update] TASMGRZ.EXE
    [X] - O10 - Unknown file in Winsock LSP: c:\windows\temp\ntdll64.dll
    [X] - O10 - Unknown file in Winsock LSP: c:\windows\temp\ntdll64.dll
    Људску глупост треба кажњавати најстрожом казном - Јован Дучић

  4. #4
    Ističe se
    Učlanjen
    09.06.2007.
    Pol
    muški
    Poruke
    2.540
    Reputaciona moć
    0

    Podrazumevano Re: Fraud.XP Antivirus.Pomagaj te

    @j.vlada

    Restartuj komp u Safe Mode-u, pokreni HijackThis (ali ga prethodno preimenuj u nešto kao vlada.exe) i čekiraj sledeće stavke:
    C:\WINDOWS\system32\frmwrk32.exe
    C:\WINDOWS\system32\TASMGRZ.EXE
    C:\WINDOWS\system32\ntdll64.exe
    C:\WINDOWS\system32\init32.exe
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (file missing)
    O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll (file missing)
    O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (file missing)
    O4 - HKLM\..\Run: [Windows UDP Control Center] fxstaller.exe
    O4 - HKLM\..\Run: [Framework Windows] frmwrk32.exe
    O4 - HKLM\..\Run: [WinDLL (tmp.exe)] rundll32.exe C:\WINDOWS\system32\tmp.exe,start
    O4 - HKLM\..\Run: [Microsoft Update] TASMGRZ.EXE
    O4 - HKCU\..\RunOnce: [Microsoft Update] TASMGRZ.EXE
    O10 - Unknown file in Winsock LSP: c:\windows\temp\ntdll64.dll
    O10 - Unknown file in Winsock LSP: c:\windows\temp\ntdll64.dll
    i idi na Fix checked. Restartuj komp pa postuj log file opet da vidimo ima li promena. Inače, zakačio si onaj lažni XP Antivirus program!

  5. #5
    Aktivan član
    Učlanjen
    16.02.2006.
    Pol
    muški
    Lokacija
    NS
    Poruke
    1.553
    Tekstova u blogu
    6
    Reputaciona moć
    59

    Podrazumevano Re: Fraud.XP Antivirus.Pomagaj te

    NeČe to baš tako laHko iČi, ima tu podosta svega i svačega,
    i za ComboFix i za LSPFix i .....

    Ako ne lažu, možda da probaš prvo sas ovi PREvx!!

  6. #6
    Obećava j.vlada (avatar)
    Učlanjen
    14.05.2007.
    Pol
    muški
    Poruke
    60
    Reputaciona moć
    39

    Podrazumevano Re: Fraud.XP Antivirus.Pomagaj te

    Evo novi log. Neke sam stvari obrisao i malo je bolje ali jos uvek nije ok.
    Logfile of HijackThis v1.99.1
    Scan saved at 21:57:05, on 12/02/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16791)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
    C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\Windows Live\Contacts\wlcomm.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\DOCUME~1\JANACI~1\LOCALS~1\Temp\Rar$EX00.453\Hi jackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\sw g.dll
    O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

  7. #7
    Ističe se
    Učlanjen
    09.06.2007.
    Pol
    muški
    Poruke
    2.540
    Reputaciona moć
    0

    Podrazumevano Re: Fraud.XP Antivirus.Pomagaj te

    @j.vlada

    Ja više ne vidim nikakve maliciozne stavke u ovom logu. Rekao bih da je sve ok. Primećuješ li ti kakve promene, na bolje ili...

  8. #8
    Obećava j.vlada (avatar)
    Učlanjen
    14.05.2007.
    Pol
    muški
    Poruke
    60
    Reputaciona moć
    39

    Podrazumevano Re: Fraud.XP Antivirus.Pomagaj te

    Puno je bolje. proveri cu sutra malo detaljnije pa se javljam

  9. #9
    Ističe se
    Učlanjen
    09.06.2007.
    Pol
    muški
    Poruke
    2.540
    Reputaciona moć
    0

    Podrazumevano Re: Fraud.XP Antivirus.Pomagaj te

    Skini program ComboFix, startuj ga, potvrdi sve ako te nešto pita, pusti da odradi posao do kraja i ništa ne klikći u radnom prozoru. On će te obavestiti kad završi. Pa postavi njegov log file ovde.

  10. #10
    Obećava j.vlada (avatar)
    Učlanjen
    14.05.2007.
    Pol
    muški
    Poruke
    60
    Reputaciona moć
    39

    Podrazumevano Re: Fraud.XP Antivirus.Pomagaj te

    Nisam mogao da posaljem od jednom pa cu ovako iz 2 dela.
    ComboFix 09-02-12.03 - J.Vlada 2009-02-13 0:46:38.2 - NTFSx86
    Microsoft Windows XP Edition familiale 5.1.2600.3.1253.30.1036.18.382.149 [GMT 1:00]
    Running from: c:\documents and settings\J.Vlada\Mes documents\ComboFixe.exe
    AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated)
    * Created a new restore point
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\windows\system32\tmp.reg

    .
    ((((((((((((((((((((((((( Files Created from 2009-01-12 to 2009-02-12 )))))))))))))))))))))))))))))))
    .

    2009-02-12 21:05 . 2009-02-12 21:05 <REP> d-------- c:\program files\Spybot - Search & Destroy
    2009-02-12 21:05 . 2009-02-12 21:05 <REP> d-------- c:\documents and settings\All Users\Menu Demarrer
    2009-02-12 05:44 . 2008-10-16 14:06 208,744 --a------ c:\windows\system32\muweb.dll
    2009-02-11 22:50 . 2009-02-11 22:50 364 --a------ c:\windows\system32\MRT.INI
    2009-02-08 20:15 . 2009-02-08 20:15 <REP> d--h----- c:\documents and settings\All Users\Application Data\CanonBJ
    2009-02-08 20:15 . 2005-11-29 21:00 140,288 --a------ c:\windows\system32\CNMLM47.DLL
    2009-02-08 20:15 . 2005-03-08 10:17 90,112 --a------ c:\windows\system32\CNMCP47.exe
    2009-02-08 20:15 . 2005-11-29 21:00 8,704 --a------ c:\windows\system32\CNMVS47.DLL
    2009-02-08 17:46 . 2009-02-08 17:46 <REP> d-------- c:\windows\system32\VirtualExpander

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
    .
    2009-02-12 23:14 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2009-02-12 18:32 --------- d--h--w c:\program files\InstallShield Installation Information
    2009-02-12 18:32 --------- d-----w c:\program files\Hewlett-Packard
    2009-02-12 18:13 6,232 ----a-w c:\documents and settings\J.Vlada\Application Data\wklnhst.dat
    2009-02-07 19:25 --------- d-----w c:\documents and settings\J.Vlada\Application Data\skypePM
    2009-02-07 19:25 --------- d-----w c:\documents and settings\J.Vlada\Application Data\Skype
    2009-02-06 12:03 --------- d-----w c:\program files\Google
    2009-02-01 13:09 --------- d-----w c:\program files\eMule
    2009-01-16 20:15 3,594,752 ----a-w c:\windows\system32\dllcache\mshtml.dll
    2009-01-10 19:29 --------- d-----w c:\documents and settings\J.Vlada\Application Data\TeamViewer
    2008-12-27 17:20 --------- d-----w c:\documents and settings\J.Vlada\Application Data\Template
    2008-12-22 00:52 --------- d-----w c:\documents and settings\J.Vlada\Application Data\OpenOffice.org
    2008-12-22 00:43 --------- d-----w c:\program files\OpenOffice.org 3
    2008-12-22 00:43 --------- d-----w c:\program files\JRE
    2008-12-22 00:42 --------- d-----w c:\program files\OpenOffice.org 2.4
    2008-12-22 00:37 --------- d-----w c:\documents and settings\J.Vlada\Application Data\OpenOffice.org2
    2008-12-20 22:47 826,368 ----a-w c:\windows\system32\wininet.dll
    2008-12-20 22:47 826,368 ----a-w c:\windows\system32\dllcache\wininet.dll
    2008-12-20 22:47 671,232 ------w c:\windows\system32\dllcache\mstime.dll
    2008-12-20 22:47 477,696 ------w c:\windows\system32\dllcache\mshtmled.dll
    2008-12-20 22:47 44,544 ------w c:\windows\system32\dllcache\pngfilt.dll
    2008-12-20 22:47 233,472 ------w c:\windows\system32\dllcache\webcheck.dll
    2008-12-20 22:47 193,024 ------w c:\windows\system32\dllcache\msrating.dll
    2008-12-20 22:47 105,984 ------w c:\windows\system32\dllcache\url.dll
    2008-12-20 22:47 102,912 ------w c:\windows\system32\dllcache\occache.dll
    2008-12-20 22:47 1,160,192 ----a-w c:\windows\system32\dllcache\urlmon.dll
    2008-12-19 09:11 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe
    2008-12-19 09:10 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe
    2008-12-19 05:25 634,024 ------w c:\windows\system32\dllcache\iexplore.exe
    2008-12-19 05:23 161,792 ------w c:\windows\system32\dllcache\ieakui.dll
    2008-12-18 19:03 --------- d-----w c:\program files\Microsoft
    2008-12-17 18:18 --------- d-----w c:\documents and settings\J.Vlada\Application Data\Image Zone Express
    2008-12-11 10:57 333,952 ------w c:\windows\system32\dllcache\srv.sys
    2008-12-05 19:19 155,995 ----a-w c:\windows\java\Packages\J17HBHJ3.ZIP
    2008-12-02 21:37 49,480 ----a-w c:\windows\system32\sirenacm.dll
    .

  11. #11
    Obećava j.vlada (avatar)
    Učlanjen
    14.05.2007.
    Pol
    muški
    Poruke
    60
    Reputaciona moć
    39

    Podrazumevano Re: Fraud.XP Antivirus.Pomagaj te

    Evo i drugog dela:
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
    "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2008-12-02 3882312]
    "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
    "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-11-10 344064]
    "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
    "HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]

    [HKEY_USERS\.default\software\microsoft\windows\cur rentversion\policies\explorer]
    "NoSetActiveDesktop"= 1 (0x1)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "vidc.iv41"= ir41_32.dll

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Demarrer^Programmes^Demarrage^HP Digital Imaging Monitor.lnk]
    path=c:\documents and settings\All Users\Menu Demarrer\Programmes\Demarrage\HP Digital Imaging Monitor.lnk
    backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Demarrer^Programmes^Demarrage^Lancement rapide d'Adobe Reader.lnk]
    path=c:\documents and settings\All Users\Menu Demarrer\Programmes\Demarrage\Lancement rapide d'Adobe Reader.lnk
    backup=c:\windows\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^J.Vlada^Menu Demarrer^Programmes^Demarrage^OpenOffice.org 2.4.lnk]
    path=c:\documents and settings\Janacievski\Menu Demarrer\Programmes\Demarrage\OpenOffice.org 2.4.lnk
    backup=c:\windows\pss\OpenOffice.org 2.4.lnkStartup

    [HKLM\~\startupfolder\C:^Documents and Settings^J.Vlada^Menu Demarrer^Programmes^Demarrage^WkCalRem.LNK]
    path=c:\documents and settings\Janacievski\Menu Demarrer\Programmes\Demarrage\WkCalRem.LNK
    backup=c:\windows\pss\WkCalRem.LNKStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cpqset]
    --a------ 2005-08-01 13:26 233534 c:\program files\HPQ\Default Settings\Cpqset.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
    --a------ 2008-04-14 03:33 15360 c:\windows\system32\ctfmon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
    --a------ 2007-05-08 16:24 54840 c:\program files\HP\HP Software Update\hpwuSchd2.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpWirelessAssistant]
    --a------ 2005-12-13 16:45 507904 c:\program files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
    --a------ 2008-04-16 11:53 1079808 c:\program files\Nokia\Nokia PC Suite 6\PCSuite.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync]
    --a------ 2008-03-26 17:41 1232896 c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QPService]
    --a------ 2005-12-12 10:39 94208 c:\program files\HP\QuickPlay\QPService.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    --a------ 2008-05-27 09:50 413696 c:\program files\QuickTime\QTTask.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RecGuard]
    --a------ 2005-10-11 09:23 1187840 c:\windows\SMINST\Recguard.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
    -ra------ 2008-11-18 16:31 21633320 c:\program files\Skype\Phone\Skype.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snp2std]
    --a------ 2006-05-15 15:52 675840 c:\windows\vsnp2std.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
    -rahs---- 2009-01-26 15:31 2144088 c:\program files\Spybot - Search & Destroy\TeaTimer.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
    --a------ 2008-06-10 03:27 144784 c:\program files\Java\jre1.6.0_07\bin\jusched.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
    --a------ 2007-11-18 12:38 68856 c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
    --a------ 2005-06-19 21:50 729178 c:\program files\Synaptics\SynTP\SynTPEnh.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
    --a------ 2007-11-29 11:43 185896 c:\program files\Fichiers communs\Real\Update_OB\realsched.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tsnp2std]
    --a------ 2006-05-22 10:37 262144 c:\windows\tsnp2std.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
    --a------ 2006-09-07 18:19 15872 c:\program files\Unlocker\UnlockerAssistant.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VoipStunt]
    --a------ 2007-12-16 14:01 8824112 c:\program files\VoipStunt.com\VoipStunt\voipstunt.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "usnjsvc"=3 (0x3)
    "TeamViewer"=2 (0x2)
    "LightScribeService"=2 (0x2)

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
    "c:\\Program Files\\TeamViewer3\\TeamViewer.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
    "c:\\WINDOWS\\system32\\sessmgr.exe"=
    "c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\eMule\\emule.exe"=
    "c:\\Program Files\\Skype\\Phone\\Skype.exe"=
    "c:\\WINDOWS\\amcap.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\VoipStunt.com\\VoipStunt\\voipstunt.exe"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\GloballyOpenPorts\List]
    "3389:TCP"= 3389:TCP: * : Disabled:@xpsp2res.dll,-22009

    R2 NwSapAgent;Agent SAP;c:\windows\system32\svchost.exe -k netsvcs [2004-08-05 14336]
    R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFH WATI.sys [2005-08-22 231424]
    S3 MemStPCI;Controleur Sony Memory Stick (PCI);c:\windows\system32\drivers\MemStPCI.SYS [2008-07-21 26112]
    S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [2008-07-07 138112]
    S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [2008-07-07 8320]
    S4 TeamViewer;TeamViewer 3;c:\program files\TeamViewer3\TeamViewer_Service.exe [2008-09-25 181544]
    .
    Contents of the 'Scheduled Tasks' folder

    2009-02-09 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.fr/
    DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
    .

    ************************************************** ************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-02-13 00:48:41
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    ************************************************** ************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(868)
    c:\windows\system32\Ati2evxx.dll
    .
    Completion time: 2009-02-13 0:50:11
    ComboFix-quarantined-files.txt 2009-02-12 23:50:05
    ComboFix2.txt 2009-02-11 22:35:45

    Pre-Run: 16 975 216 640 octets libres
    Post-Run: 16,972,226,560 octets libres

    194 --- E O F --- 2009-02-11 21:50:52

  12. #12
    Ističe se
    Učlanjen
    09.06.2007.
    Pol
    muški
    Poruke
    2.540
    Reputaciona moć
    0

    Podrazumevano Re: Fraud.XP Antivirus.Pomagaj te

    Pošto je i ComboFix odradio svoje, uradi sledeće:
    Start > Run > kucaj combofix /u (pazi postoji razmak između 'x' i '/') > Enter i sačekaj da se deinstalira. Ova komanda će:
    • Obrisati:

    ComboFix i njegove file-ove i foldere
    VundoFix backup folder, ako postoji
    C:\Deckard folder, ako postoji
    C:\OtMoveIt folder, ako postoji
    • Resetovati podešavanja sata na kompjuteru
    • Sakriti ekstenzije file-ova, ako je potrebno
    • Sakriti sistemske/skrivene file-ove, ako je potrebno
    • Resetovati System Restore


    Skini i ovaj program MalwareBytes' AntiMalware, update-uj mu bazu definicija i njime preskeniraj komp, ako i on nađe nešto, obriši i to je to.

    Jel ti se čini da je sutuacija sa kompom bolja nego na početku?

  13. #13
    Obećava j.vlada (avatar)
    Učlanjen
    14.05.2007.
    Pol
    muški
    Poruke
    60
    Reputaciona moć
    39

    Podrazumevano Re: Fraud.XP Antivirus.Pomagaj te

    Resetovati System Restore ? Ovo ne umem da uradim! Kako?
    Mislim da je sada ok. Ima drivera koje cu morati da obrisem i instaliram ponovo zato sto ih je ovo cudo unistilo ali ostalo mi se cini u redu.
    U medjuvremenu sam skenirao (u S. Mode) Spy boot-om i jos nekim programima ali nisam imao vremena da to opisem na temi.
    Puno hvala svima
    Poslednji put ažurirao/la j.vlada : 13.02.2009. u 12:56

  14. #14
    Ističe se
    Učlanjen
    09.06.2007.
    Pol
    muški
    Poruke
    2.540
    Reputaciona moć
    0

    Podrazumevano Re: Fraud.XP Antivirus.Pomagaj te

    Citat Original postavio j.vlada Pogledaj poruku
    Resetovati System Restore ? Ovo ne umem da uradim! Kako?...
    Nije bitno, ComboFix je to uradio za tebe.
    Ok, pozzz i tebi.





Slične teme

  1. Smit Fraud G
    Autor Mirko_Vucinic88 u forumu Sigurnost i zaštita
    Odgovora: 47
    Poslednja poruka: 06.09.2007., 11:31
  2. POMAGAJ
    Autor bluboki u forumu Web dizajn
    Odgovora: 6
    Poslednja poruka: 12.07.2007., 00:32
  3. Colonia POMAGAJ
    Autor neko kome nesto treba u forumu Muzika
    Odgovora: 22
    Poslednja poruka: 03.04.2006., 16:49
  4. pomagaj
    Autor juco u forumu Hardver
    Odgovora: 14
    Poslednja poruka: 05.05.2005., 19:48

Pravila za slanje poruka

  • Ne možete kreirati novu temu
  • Ne možete poslati odgovor
  • Ne možete dodati priloge
  • Ne možete prepraviti svoju poruku
  •