problem-01longamok

[Miki696969]

Pitanje za bilo koga ako zna,odakle potice ovaj program-citaj file?"01longamok"
Naime,stalno se pokrece sa Win,a nemam pojma ko stoji iza njega i nikako da ga onemogucim,kad kliknem na internet,nikad mi nista neizadje u googlu da bilo ko bilo sta zna o njemu.Verovtno je prosta neka stvar,samo sam ja neinformisan.Negova lokacija u mom kompjuteru je:C:\DOCUME~1\Miki\APPLIC~1\PHONED~1,a pored njega tu su jos nuckgimkw,baitanergry i neki sistem file od 2kb.Recite mi ljudi sta je ovo,pa da ga ubijem zauvek.Verovatno ce jos nekom pomoci ako ima slican problem.
napomena:adware profesional i nod ga nevide,sve ocistim a on me stalno kolje:mad:

 

[Rothschild]

1. http://spywarefiles.prevx.com/RRGEJD38732334/VJOSATVZ.EXE.html

2. http://info.prevx.com/downloadcsi.asp

 

[Miki696969]

VJOSATVZ.EXE,ja nemam taj fajl u kompjuteru.Verovatno ne povlaci on longamoka vec neko drugi,a i sta mi vredi da instaliram taj djavo sa tog sajta kad moram da ga platim da bi bilo sta pametno uradio,to je sto se tice onog prvog linka,a sad idem na drugi da vidim sta ima tamo

 

[Miki696969]

sad vidim da se i ovo drugo placa,ajd skinucu to da bar izvrsim scan

 

[Miki696969]

i konacno ni ovaj drugi program sa ovog drugog linka nije detektovao nista

 

[Rothschild]

Ako mozes da nadjes te fajlove raruj ih, a zatim ih uploaduj na Rapidshare, a meni posalji na PP link od njih.
Ne bi bilo na odmet i da postavis HijackThis log ovde.

Pozdrav...

 

[Miki696969]

1:49 Dozvoljeno (based on user decision) value "SpybotDeletingA865" (new data: "command /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome.manifest"") dodato in System Startup global entry!
2.3.2008 19:01:52 Dozvoljeno (based on user decision) value "SpybotDeletingC1742" (new data: "cmd /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome.manifest"") dodato in System Startup global entry!
2.3.2008 19:01:53 Dozvoljeno (based on user decision) value "SpybotDeletingA634" (new data: "command /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\install.js"") dodato in System Startup global entry!
2.3.2008 19:01:58 Dozvoljeno (based on user decision) value "SpybotDeletingC6444" (new data: "cmd /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\install.js"") dodato in System Startup global entry!
2.3.2008 19:01:59 Dozvoljeno (based on user decision) value "SpybotDeletingA9868" (new data: "command /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\install.rdf"") dodato in System Startup global entry!
2.3.2008 19:02:08 Dozvoljeno (based on user decision) value "SpybotDeletingC5177" (new data: "cmd /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\install.rdf"") dodato in System Startup global entry!
2.3.2008 19:02:10 Dozvoljeno (based on user decision) value "SpybotDeletingA3206" (new data: "command /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\vssver2.scc"") dodato in System Startup global entry!
2.3.2008 19:02:12 Dozvoljeno (based on user decision) value "SpybotDeletingC4249" (new data: "cmd /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\vssver2.scc"") dodato in System Startup global entry!
2.3.2008 19:02:15 Dozvoljeno (based on user decision) value "SpybotDeletingB2468" (new data: "command /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\install.js"") dodato in System Startup user entry!
2.3.2008 19:02:17 Dozvoljeno (based on user decision) value "SpybotDeletingD9714" (new data: "cmd /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\install.js"") dodato in System Startup user entry!
2.3.2008 19:02:21 Dozvoljeno (based on user decision) value "SpybotDeletingB7005" (new data: "command /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\install.rdf"") dodato in System Startup user entry!
2.3.2008 19:02:23 Dozvoljeno (based on user decision) value "SpybotDeletingD9670" (new data: "cmd /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\install.rdf"") dodato in System Startup user entry!
2.3.2008 19:02:25 Dozvoljeno (based on user decision) value "SpybotDeletingB3442" (new data: "command /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\vssver2.scc"") dodato in System Startup user entry!
2.3.2008 19:02:26 Dozvoljeno (based on user decision) value "SpybotDeletingD7724" (new data: "cmd /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\vssver2.scc"") dodato in System Startup user entry!
2.3.2008 19:02:27 Dozvoljeno (based on user decision) value "SpybotDeletingB3823" (new data: "command /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\components\IMeMedia_FF.xpt"") dodato in System Startup user entry!
2.3.2008 19:02:29 Dozvoljeno (based on user decision) value "SpybotDeletingD2688" (new data: "cmd /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\components\IMeMedia_FF.xpt"") dodato in System Startup user entry!
2.3.2008 19:02:31 Dozvoljeno (based on user decision) value "SpybotDeletingA2714" (new data: "command /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\components\IMeMedia_FF.xpt"") dodato in System Startup global entry!
2.3.2008 19:02:33 Dozvoljeno (based on user decision) value "SpybotDeletingC1584" (new data: "cmd /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\components\IMeMedia_FF.xpt"") dodato in System Startup global entry!
2.3.2008 19:03:04 Dozvoljeno (based on user decision) value "SpybotDeletingB4950" (new data: "command /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\components\MeMedia_FF.dll"") dodato in System Startup user entry!
2.3.2008 19:03:28 Dozvoljeno (based on user decision) value "SpybotDeletingD9194" (new data: "cmd /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\components\MeMedia_FF.dll"") dodato in System Startup user entry!
2.3.2008 19:03:30 Dozvoljeno (based on user decision) value "SpybotDeletingA1049" (new data: "command /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\components\MeMedia_FF.dll"") dodato in System Startup global entry!
2.3.2008 19:03:32 Dozvoljeno (based on user decision) value "SpybotDeletingC1022" (new data: "cmd /c del "C:\Program Files\Mozilla Firefox\extensions\{A89AED22-9133-424c-88E7-C8235C5FF302}\components\MeMedia_FF.dll"") dodato in System Startup global entry!
2.3.2008 19:11:44 Dozvoljeno (based on user decision) value "SpybotDeletingB1136" (new data: "") uklonjeno in System Startup user entry!
2.3.2008 19:11:47 Dozvoljeno (based on user decision) value "SpybotDeletingD5430" (new data: "") uklonjeno in System Startup user entry!

 

[Miki696969]

Located: HK_CU:Run, Windowflag (DISABLED)
where: S-1-5-21-1220945662-2052111302-1801674531-1003...
command: C:\DOCUME~1\Miki\APPLIC~1\PHONED~1\01longamok.exe
file: C:\DOCUME~1\Miki\APPLIC~1\PHONED~1\01longamok.exe
size: 398336
MD5: DE59A6D3700DB042397EC434A6BD3ABA

 

[Miki696969]

windowflag,taj djavo me muci,u njemu je i taj longamok,pitam se koji ga je antihrist poslao u moj kompjuter,zaustavio sam ga,ali i dalje je tu,nista ne dobijem da ga obrisem iz memorije,a neznam ni dali smem da ga brisem kad neznam cemu sluzi,spyboot javlja da se ovaj povremeno pali,kad njemu dune,pa ga ovaj blokira,kako sam mu ja naredio

 

[Miki696969]

Ako mozes da nadjes te fajlove raruj ih, a zatim ih uploaduj na Rapidshare, a meni posalji na PP link od njih.
Ne bi bilo na odmet i da postavis HijackThis log ovde.

Pozdrav...

svasta sam ja napisao ovde,dodao log fajlove,al nista nije objavljeno

 

[Rothschild]

Na Virus Totalu za 01longamok.exe dobijeni su sledeci rezultati:

AntiVir - TR/Dldr.Swizzor.Gen
Authentium - Possibly a new variant of W32/Swizzor-based!Maximus
CAT-QuickHeal - (Suspicious) - DNAScan
F-Prot - W32/Swizzor-based!Maximus
Webwasher-Gateway - Trojan.Dldr.Swizzor.Gen

A za baitamengrey.exe:

Authentium Possibly a new variant of W32/Swizzor-based!Maximus
F-Prot W32/Swizzor-based!Maximus
Ikarus Trojan-Downloader.Swizzor
VirusBuster Trojan.DL.Swizzor.Gen!Pac.2

Rezultati su mi bili malo sumljivi pa sam poslao takodje ova dva fajla u Dr.Web labaratoriji i za sada ih online Dr.Web skener ne prepoznaje kao bad guys tako da je najverovatnije rec o laznjacima.

 

[Miki696969]

Na Virus Totalu za 01longamok.exe dobijeni su sledeci rezultati:

AntiVir - TR/Dldr.Swizzor.Gen
Authentium - Possibly a new variant of W32/Swizzor-based!Maximus
CAT-QuickHeal - (Suspicious) - DNAScan
F-Prot - W32/Swizzor-based!Maximus
Webwasher-Gateway - Trojan.Dldr.Swizzor.Gen

A za baitamengrey.exe:

Authentium Possibly a new variant of W32/Swizzor-based!Maximus
F-Prot W32/Swizzor-based!Maximus
Ikarus Trojan-Downloader.Swizzor
VirusBuster Trojan.DL.Swizzor.Gen!Pac.2

Rezultati su mi bili malo sumljivi pa sam poslao takodje ova dva fajla u Dr.Web labaratoriji i za sada ih online Dr.Web skener ne prepoznaje kao bad guys tako da je najverovatnije rec o laznjacima.

najverovatnije su laznjaci,ali da li i najsigurnije,sad cu da vidim u regedit,gde su sve usli,ako mogu da ukapiram cemu sluze ili ako su virusi,koju stetu nanose,soim toga i CiD je poceo da mi izbacuje reklame za sajtove friend finder i neke smajlove,kao i neke nekulturne sajtove i ako imam dobru zastitu i poubijam sve cookie,do sad sam se dobro stitio,ovo je vec presvrsilo svaku meru

 

[Miki696969]

da,ima ga po celom registru,ali samo u putanji koju sam naveo,pod programom windowflag,ali tog programa kad ga trazim,nigde nema u kompjuteru,jedino u folderu phonedelate su pomenuti fajlovi,dali neko zna sta radi taj windowflag,uskoro cu morati da odlucim da krenem da brisem to rucno i iz registra i iz wina,jer sumnivo mi je da je tako javan u registru pod istim imenom ako je neki virus i da mu je tako cista putanja da moze lako da se obrise