Virusi - cazuri si necazuri

Katthya a scris:

Am doua partitii pe acel HDD... voi incerca sa instalez tot acolo si windowsul. Voi deconecta celelalte HDD si-l voi lasa doar pe asta... , dar il voi folosi tot pe asta insa cu HDD-ul ala(...) ! incerc...

Da, e o idee bună.

lupini a scris:

Da, e o idee bună.

Sper ca am reusit, nimic semne ca ar mai fi probleme pana acum....

Am conectat HDD-ul respectiv dupa restart pc. si am intrat prin self admin., iam resetat toate drepturile din sys.security si l-am scanat. 308 trojani, rezultatul... si am reusit sai sterg pe toti !

Am salvat tot ce imi trebuia de acolo, pe un HDD FAT32/ si am formatat HDD-ul respectiv.

Sa vezi cata stricaciune iti poate face un "baiat bun", care... pana la urma ce rezolva ?!? ... as fi spus eo mai multe,. simt sa le si fac ceva... dar... asta e...! fiecare cu "tara" lui !!

Salve si numai bine

Mda...se pare ca zburda si necheaza de zor "caii" prin it!

Si eu m-am pricopsit cu vreo citiva.Intre timp am scanat si schimbat niscai antivirusi laudati si "orbi". Si cine crezi ca m-a ajutat sa scap de juma' de necaz? Amaritul si blamatul de "Avira personal" moka.Si totusi mai e ceva "ramasita" cavallina ... ori i-am capiat eu setarile saracu' pc. bijbaind ca sunt novice,pacatili meli!

Adevarat,laudatul "VIPER" ca si ESENTIAL-ul ala nou de la Windows e o porcarie!

M-a dezamagit si suita completa de la PcTools. ;)

Cu ce ai reusit sa cureti pina la urma? :roll:

Bagherra a scris:

Mda...se pare ca zburda si necheaza de zor "caii" prin it!

Si eu m-am pricopsit cu vreo citiva.Intre timp am scanat si schimbat niscai antivirusi laudati si "orbi". Si cine crezi ca m-a ajutat sa scap de juma' de necaz? Amaritul si blamatul de "Avira personal" moka.Si totusi mai e ceva "ramasita" cavallina ... ori i-am capiat eu setarile saracu' pc. bijbaind ca sunt novice,pacatili meli!

Adevarat,laudatul "VIPER" ca si ESENTIAL-ul ala nou de la Windows e o porcarie!

M-a dezamagit si suita completa de la PcTools. ;)

Cu ce ai reusit sa cureti pina la urma? :roll:

Antivirusii nu sunt facuti ptr. a strica pc-uri... asta daca stii ce anume fac virusii in pc.

Am sa dau aici cateva exemple, ptr. a intelege si putea lua hotarari in privinta antivirusilor CU LICENTA, nu VIRUSI pe post de ANTIVIRUS !!!

Sistem: <Windows XP Pro. / SP3>

--------------------------------------------------------------------------------------------------

.....nume virus ........................................................extensie .............................grad

Virus.Win32.Virut.ce(v) .........................................Virus.W32 ...........................High

fisierele atacate de virus, dupa cum urmeaza:

C:\Windows\ServicePackFiles\i386\dfrgntfs.exe

C:\Windows\SoftwareDistribution\Download\fa06e28c141c84f43a95ba02f93d3774\backup\nslookup.exe

C:\Windows\system32\dfrgfat.exe

C:\Windows\system32\dllcache\wb32.exe

C:\Windows\system32\ftp.exe

C:\Windows\system32\verifier.exe

-------------------------------------------------------------------------------------

TrojanDownloader-Win32/Cutwail.gen!B .............Trojan Downloader .............High

C:\Documents snd Settings\"name"\Local Settings\Temporary Internet Files\Content.IE5\4X25ETQN[1].txt

-------------------------------------------------------------------------------------

VirTool.Win32.Obfuscator.FH(v) ......................Trojan ...........................High

C:\Windows\system32\8.tmp

C:\Windows\system32\7.tmp

C:\Windows\system32\6.tmp

C:\Windows\system32\9.tmp - 12.tmp - 5.tmp ......"s.a.m.d."

--------------------------------------------------------------------------------------------------

<control din, command prompt>

C:\Documents and Settings\"name">netstat

Active Connections

Proto ..........Local Address ................Foreign Address .........................................State

TCP ......2bab14e1ec-ykm1:1757 ......jL.chura.pl:http ...................................SYN_SENT

TCP ......2bab14e1ec-ykm1:1667 ......218.93.205.24:65520 ..........................ESTABLISHED

TCP ......2bab14e1ec-ykm1:1668 ......s207.silver.fastwebserver.de:http ......CLOSE_WAIT

TCP ......2bab14e1ec-ykm1:1669 ......211.95.79.6:http .................................CLOSE_WAIT

--------------------------------------------------------------------------------------------------

PS: - Nici un ANTIVIRUS nu-ti poate sterge/dezinfecta modulele pe baza carora fct. windows-ul.... sunt insa posibile contracte facute intr tine si un provider de antivirus, care-ti asigura si garanteaza fct.rea pc-ului/serverului ev. ptr. toata perioada contractului, fara nici un fel de "riscuri virale"/pierderi de date, etc. etc. etc. dar, (acestea costa bani grei) !

Eu folosesc VIPRE in continuare, chiar daca nu a reusit sa-mi rezolve problemele cu virusii....

Si aproppo: ceea ce am aratat mai sus in ex. meu, e chiar de la mine din pc. pe cand eram "terorizat", (e bine spus), de "(infectiile astea si stapanii lor)" !!

O "Rezolvare" a acestor probleme:

1. FORMATAREA TUTUROR HDD-lor, (include pierderea tuturor "datelor" ce erau pe ele)... sau nu, dar doar daca stii bine ce si cum sa faci sa salvezi: (MUZICA, FILM, FOTO, DOCUMENTE text) si atat !

2. REINSTALAREA WINDOWS-ului,

3. Atentie la programele folosite in timpul infectarii pc-ului, daca ev. le vei mai folosi !!

4. Atentie la mail-urile "cu atasamente", primite de la necunoscuti si la programele descarcate "involuntar sau voluntar", care au de regula pe "vino'ncoace".

AVERTIZARE:

Eu nu am respectat acestea, aratate mai sus. Si am fost nevoit sa REFAC de 4 ORI la rand TOTUL. Plus ca am pierdut o saptamana cu incercarile de tot felul si (Muzica, Film, Foto, etc. etc.) (1500 GB), deci... !!!

<Succes si numai bine>

Deci nu stiu ce virus am ca imi face figuri pc-ul,ok vreau sa scanez pc-ul incerc cu Malwarebytes' Anti-Malware ii smecher nu ma lasa sa il deschid mil inchide imediat,sau orice antivirus ceva scanare mil inchide ce pot sa fac?

uitati poate va ajuta

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 2:57:36 PM, on 4/10/2009

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\System32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\FsUsbExService.Exe

C:\Program Files\MioNet\MioNetManager.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\MioNet\jvm\bin\MioNet.exe

C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe

C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\VM_STI.EXE

C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\WINDOWS\System32\ctfmon.exe

C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe

C:\Program Files\TS\tsc.exe

C:\Program Files\BitComet\BitComet.exe

C:\Program Files\Philips\Philips SPC210NC Webcam\TrayMin210.exe

C:\WINDOWS\System32\wuauclt.exe

C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

C:\WINDOWS\system32\RDSHOST.exe

C:\WINDOWS\system32\sessmgr.exe

C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpCtr.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpCtr.exe

C:\DOCUME~1\Covasa\LOCALS~1\Temp\dc28436820\z4f4vf.exe

C:\DOCUME~1\Covasa\LOCALS~1\Temp\dc28436820\aml83XP.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.theprizeday.com/today.php

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R3 - URLSearchHook: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll

R3 - URLSearchHook: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player\tbBS_P.dll

O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - (no file)

O2 - BHO: &IE Help - {35A5B43B-CB8A-49CA-A9F4-D3B308D2E3CC} - C:\WINDOWS\system32\iehelpmod.dll

O2 - BHO: NP Helper Class - {35B8D58C-B0CB-46b0-BA64-05B3804E4E86} - C:\Program Files\Internet Saving Optimizer\3.4.0.4340\NPIEAddOn.dll

O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.3.7.16.dll

O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll

O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll

O2 - BHO: System Search Dispatcher - {CDBFB47B-58A8-4111-BF95-06178DCE326D} - C:\Program Files\System Search Dispatcher\1.3.0.840\ssd.dll

O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\YTSingleInstance.dll

O2 - BHO: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player\tbBS_P.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O3 - Toolbar: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll

O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O3 - Toolbar: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player\tbBS_P.dll

O4 - HKLM\..\Run: [siSUSBRG] C:\WINDOWS\SiSUSBrg.exe

O4 - HKLM\..\Run: [siSRaid] C:\Program Files\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions

O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"

O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [bigDogPath] C:\WINDOWS\VM_STI.EXE Philips SPC210NC Webcam

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9

O4 - HKCU\..\Run: [search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe

O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe

O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet

O4 - HKCU\..\Run: [AutoStartNPSAgent] C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe

O4 - HKCU\..\Run: [TS] C:\Program Files\TS\tsc.exe

O4 - HKCU\..\Run: [bitComet] "C:\Program Files\BitComet\BitComet.exe" /tray

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: TrayMin210.exe.lnk = ?

O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm

O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm

O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.3.7.16.dll/206 (file missing)

O17 - HKLM\System\CCS\Services\Tcpip\..\{E4FED0AD-93A1-4385-AC86-5497EC5F0F76}: NameServer = 213.154.124.1 193.231.252.1

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: ESET Service (ekrn) - Unknown owner - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe (file missing)

O23 - Service: FsUsbExService - Teruten - C:\WINDOWS\System32\FsUsbExService.Exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: MioNet Service (MioNet) - Unknown owner - C:\Program Files\MioNet\MioNetManager.exe

O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--

End of file - 10245 bytes

s-ar putea sa fie de la windows, cred ca ai prins un virus foarte ciudat, ai incercat cu reinstalarea windows-ului?

reinstalarea windowsului este pe ultimul loc,vreau sa incerc inainte sa scap de virus daca nu se poate am sa il reinstalez

daca ti se inchide orice antivirus cand dai o scanare nu ai ce sa ii mai faci, trebuie sa reinstalezi windows-ul (la fel cum am patit-o si eu cu un virus)

da ms pentru solutie..,dar nu cred ca este necesar

Sharp 132376 a scris:

Deci nu stiu ce virus am ca imi face figuri pc-ul,ok vreau sa scanez pc-ul incerc cu Malwarebytes' Anti-Malware ii smecher nu ma lasa sa il deschid mil inchide imediat,sau orice antivirus ceva scanare mil inchide ce pot sa fac?

uitati poate va ajuta

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 2:57:36 PM, on 4/10/2009

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Boot mode: Normal

--

End of file - 10245 bytes

Nu e de mirare sa ti se intample toate astea, daca ai :

Windows XP SP1 (WinNT 5.01.2600) si...

Internet Explorer v6.00 SP1 (6.00.2800.1106) !!!

E ca si cum ti-ai dori performante de la o pusca antica si ne-unsa.

Nu mai spun...

Daca mai ai si Windows-ul fara licenta si folosesti Anti Virusi la fel........ !

In aceste cazuri, o "rezolvare" _{daca se poate zice asa}sa poti folosi pe o perioada cat mai lunga PC-ul si fara riscuri prea mari de infestari cu virusi, e:

Navigarea cat mai putin pe net......

Fara programe de downlodat "odc, dc++, eMule, uTorente, bittorente," etc.etc.....

Fara instalari repetate si mai ales a progr. kit-uite, krack-uite s.a.m.d. - toate au coduri naspa in ele ....

O buna cunoastere a satarilor si comportamentului PC-ului, ca sa poti lua la timp masuri - cand ai probl.

Si nu uita ca experienta ta in PC-ul tau, e mai buna ca cea gasita pe net sau luata de la altii.....

Iti poti scana ON-LINE:aici:

Sau un ANTI VIRUS bun:aici: