Tema za korisnike koji imaju zaražen računar

[Bg8333]

Evo vec sam 5 X uradio onako kako ste mi rekli. Aktivirao 3 programa u safe modu da probam da pobrisem viruse, trojasne i ostale napasti.

Sada kucam iz safe mode with networking iz razloga sto mi obican mod ne radi. A razlog je to sto kad udjem u obicnom modu posle minut dva mi od jednom nestanu sve ikonice sa ekrana, nestane i start meni bukvalno sve nestane.

Ako doviljno brzo pritisnem ctrl_alt_del mogu da vidim 2 napasti DRWATSN32 i jos jednu.

 

[gost 13024]

Spojio sam teme... Jos ne zelim da procitam gore postavljene linkove vezane za tebe.. Zasto si u situaciji u kojoj si..

I jos jednom.. DRWATSN32 nije virus... i koju to jos jednu...????

Iscimaj opet HijakThis Log.

 

[nikodim]

Verovano drwatson... ako je windows, kao sto jeste, u pitanju...

 

[Bg8333]

Spojio sam teme... Jos ne zelim da procitam gore postavljene linkove vezane za tebe.. Zasto si u situaciji u kojoj si..

I jos jednom.. DRWATSN32 nije virus... i koju to jos jednu...????

Iscimaj opet HijakThis Log.

Kazem ti ne mogu da iscima HijakThis u obicnom modu, posto mi posle 30 sec sve nestane sa ekrana i moram da restartujem racunar.

Ne znam koliko znaci u safe modu?

 

[gost 13024]

Znanci u Safe Modu..

Mozda sam ti napisao da HijakThis preimenujes recimo u HJT1 i skeniras u SafeMode i postavis log ovde..

 

[Bg8333]

Logfile of HijackThis v1.99.1
Scan saved at 12:44:44 PM, on 1/8/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\winlogon.exe
d:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
D:\PROGRA~1\MOZILL~1\FIREFOX.EXE
D:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Aware.exe
C:\Documents and Settings\Aca\Desktop\hjt1.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe,userinit.exe
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - d:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQToolbar\toolbaru.dll
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [svchctrl] c:\windows\system\svchctrl.exe
O4 - HKLM\..\Run: [WindowsUpdateR] C:\WINDOWS\System\regserv.exe /s
O4 - HKLM\..\Run: [AVP] "d:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "d:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [windows_startup] c:\windows\system32\winupdate.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] d:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - d:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: klogon - C:\WINDOWS\System32\klogon.dll
O21 - SSODL: ferrateen - {27321538-5739-4aa1-b84c-7d18e4383f1f} - (no file)
O21 - SSODL: cussers - {ff170564-36c8-43f7-9100-559e166405cf} - (no file)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - d:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - d:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - d:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - d:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - d:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - d:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)

 

[zokky]

Kao prvo ukloni jedan AntiVirusni program ( AVAST se brise sa programcicem " avast removal" ili uninstal Kaspersky) pa vidi .

 

[snejks]

Auuu pa tu nisu dva već tri antivirusna programa , Avast , AVG i Kasperski , dva obavezno ukloni i dva aktivna antispywera jedan ugasi ili AVG ili Spyboatov "tea timer" obavezno.

 

[Bg8333]

mako sam ih
nazalost Kaspersky sam morao da ostavim a AVAST i AVG da maknem. Kaspersky nece da se makne u safe modu.

 

[snejks]

Nažalost možda ti taj isti Kasperski i sada i kolje kompjuter

 

[Bg8333]

Uspeo sam. Radi ko sat. E sada koliko ce jos da radi to je pitanje

U svakom slucaju hvala mnogo svima na pomoci.

 

[mmmile]

Skini nove definicije pa sve ponovo skeniraj.
Ako ne rusi sistem

Ne mogu da skinem, istekao mi license key, a sistem necu da rusim

 

[snejks]

A zašto sada radi ? Objasni?

 

[snejks]

Ne mogu da skinem, istekao mi license key, a sistem necu da rusim

Ovo je najgore što možeš da uradiš, bolje je imati i neki free antivirus updatiran nego Najbolji koji nije updejtovan ko zna koliko

 

[Bg8333]

A zašto sada radi ? Objasni?

Uspeo sam da skinem kasperski

 

[Silent_Bob]

Ovo je problem koji ne mogu da reshim i koji me dovodi do ludila:

U traganju za nekim crackom, sa neta sam skinuo i neshto shto nisam trebao. Bilo kako bilo od tog momenta imam iritirajucu pop-up poruku (system alert) u trayu koja me non-stop obaveshtava da mi je komp verovatno zarazhen virusom. Kad kliknem na tu poruku, otvara mi se sajt sa nekim antispyware alatom koji je (naravno) neophodan za uklanjanje tog virusa ili shta god da je. Taj program na koji sam upucen, naravno, ne vredi ni pola lule duvana.

Nakon toga bacih se na posao da otrebim gamad koju sam zapatio. Par puta sam imao slichne sluchajeve, i relativno brzo sam to regulisao. Ali, avaj! Ovog puta sam bespomocan. Pokushao sam sa: AD-Aware SE Personal, Spybot search&destroy, Counter Spy, a-squared security center, Spyware Begone, Windows KB, i mozhda josh par alata na koje sam natrchao na netu. DZABA! Svaki od njih pronadje po neshto, to pobrishe, ali problem ostaje. Imam i Kaspersky antivirus, koji ga nije detektovao. Skenirao sam ceo sistem i Kaspersku on-line skenerom bez uspeha.

Na kraju sam skinuo Spy Hunter v.2.8 koji je detektovao izvor problema, ali sa njim ne mogu da taj problem i reshim (potrebna je full verzija koja se placa :-) ) Dakle, detektovao je fajl koji se nalazi u C/windows/system32 folderu, i chije ime je cthkpcv.dll. Krenuh da ruchno obrishem taj fajl, ali dozhiveo sam novi neuspeh. Dotichni se ne mozhe obrisati! Da ne zaboravim, SpyHunter mi je dao i sledeci opis ovog Spyware programa:

"AntiVermins is a fake anti-spyware program from Russia that is often downloaded and installed by a Trojan or through browser security holes. This malware is similar to SpySheriff. It launches on Windows startup and may generate excessive popup advertisements. It will also display notifications of imaginary security risks in its attempts to get the user to purchase the full version. This program can be extremely difficult to remove manually, and will continue to try to recreate itself."

Shta da radim? Moram napomenuti da svi alati koje sam koristio imaju najsvezhije definicije. Kada skeniram samo taj fajl (cthkpcv.dll) niko od navedenih programa ga ne registruje kao problem.

Svaka pomoc - savet iskusnijih kolega - forumasha bi mi dobro doshla. Unapred hvala!

 

[bojan p]

Ako ovo http://www.bleepingcomputer.com/forums/topic69886.html odgovara opisu onoga što se dešava, onda samo sledi datu proceduru.

 

[snejks]

Virus Bursters - trojanac
http://www.bleepingcomputer.com/sta....dll-16358.html
rešenje je smit fraud i vbs remover
http://www.bleepingcomputer.com/forums/topic70074.html

 

[gost 13024]

A to sve ima ovde
http://forum.krstarica.com/threads/116707

 

[zokky]

Kaspersky i AVAST se kolje pri startu i dolazi do non stop restartovanja .AVG se nesto i ne mesa, ova dva ga "preduhitre" pa dok se osvesti........sistem podignut.
Uspeo si da skines Kaspersky ,hmmm, . A sta si ostavio ???? Posto si prethodno skinuo AVAST i AVG ?

 

[Silent_Bob]

Postupicu po Vashim uputstvima. nadam se da cu mu doci glave.

Ukoliko bude problema, javicu se ponovo.

Hvala svima. :-D

 

[zokky]

AVAST je odlican free antivir program. Skini ga ,instaliraj, dopuni sa novim definicijama,skeniraj. U slucaju da nije u mogucnosti da ocisti virus,idi na GOOGLE i potrazi removaltool za tu gamad.

 

[snejks]

sada bi mogao da vrati Avasta

 

[zokky]

Pa sad , kakve su zavrzlame sa Kasperskym i sa KEY u poslednje vreme, AVAST je najbolje resenje.

 

[mmmile]

Narode, neko mi rece da probam sa HijackThis-om. Evo sta je nasao:

Logfile of HijackThis v1.99.1
Scan saved at 16:59:32, on 9.1.2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\WINDOWS\System32\msasvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Program Files\Winamp\winamp.exe
C:\Documents and Settings\Bokic\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [IHTWINCINEMAMGR] "C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe"
O4 - HKLM\..\Run: [Home Theater SchSvr] "C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe"
O4 - HKLM\..\Run: [KAVPersonal50] C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe /minimize
O4 - HKLM\..\Run: [AutoSys] C:\WINDOWS\System32\autosys.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &WordWeb... - res://C:\WINDOWS\wweb32.dll/lookup.html
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O20 - Winlogon Notify: winbfi32 - winbfi32.dll (file missing)
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINDOWS\System32\msasvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe