Probleme cu office si mess

Am vrut sa trimit un document word pe mail si mi-a aparut ceva de genul "hotmail nu poate trimite docul pentru ca are un virus". Acum m-am trezit cu un milion de mesaje pe Yahoo Messenger de la tipi necunoscuti.
Am scanat cu nod32 si cu SSD si nu au gasit nimic. Pun log de HiJackThis, cu multumiri anticipate.

C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\Raul\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset\nod32krn.exe

Acum a aparut alta problema:
 nero.JPG   16.49K   50 downloads

Ultima miscare: compul a incetinit dramatic, orice vreau sa deschid se deschide dupa un minut!

1. Scaneaza si cu alt antivirus , iti recomand Kaspersky sau Active Virus Shield ( al 2 lea e gratis si e de fapt un Kaspersky )
2. Daca prima varianta nu-ti surade, scaneaza online Bitdefender
3. Scaneaza cu antispyware ( Lavasoft Ad-aware, Spybot Search & Destroy, Microsft Antispyware , etc )
4. Uita-te in task manager ce program tine procesorul ocupat.

Ewido anti-spyware gaseste ceva ?

Scaneaza computerul aici:
Kaspersky Online Scanner: http://www.kaspersky.com/virusscanner

Copiaza logul si posteaza-l.

Ar fi bine sa postezi si logul complet HiJackThis. Lipseste partea de sus si headerul.

bogdanar, on Nov 15 2006, 19:22, said:

Chestia e ca AVS este incompatibil cu Nod32 si nu am chef sa renunt la el.
Acum scanez online cu kaspersky si o sa pun imediat logul.

Putin offtopic...
Pana acum o luna eram convins ca nod32 e cel mai bun av. Consuma putine resurse, e actualizat foarte des, multe semnaturi.. etc..
Apoi a aparut virusul care se raspandea pe ymess ( cel care trimitea zeci de mesaje cu link-uri ) si kaspersky a fost primul av care a detectat virusul. Am trecut imediat pe AVS.

on topic
Ai gasit ceva suspect in task manager? vreun proces care tine ocupat procesorul

Quote

Pai daca le-am trimis o mostra. Si Bitdefender l-a depistat la cateva ore dupa ce le-am trimis fisierul.

log kaspersky:

Infected Object Name   Virus Name   Last Action
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Raul\Application Data\Mozilla\Firefox\Profiles\4vwm0wga.default\cert8.db Object is locked skipped
C:\Documents and Settings\Raul\Application Data\Mozilla\Firefox\Profiles\4vwm0wga.default\formhistory.dat Object is locked skipped
C:\Documents and Settings\Raul\Application Data\Mozilla\Firefox\Profiles\4vwm0wga.default\history.dat Object is locked skipped
C:\Documents and Settings\Raul\Application Data\Mozilla\Firefox\Profiles\4vwm0wga.default\key3.db Object is locked skipped
C:\Documents and Settings\Raul\Application Data\Mozilla\Firefox\Profiles\4vwm0wga.default\parent.lock Object is locked skipped
C:\Documents and Settings\Raul\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Raul\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Raul\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Raul\Local Settings\Application Data\Mozilla\Firefox\Profiles\4vwm0wga.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\Raul\Local Settings\Application Data\Mozilla\Firefox\Profiles\4vwm0wga.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\Raul\Local Settings\Application Data\Mozilla\Firefox\Profiles\4vwm0wga.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\Raul\Local Settings\Application Data\Mozilla\Firefox\Profiles\4vwm0wga.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\Raul\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Raul\Local Settings\Temp\Perflib_Perfdata_48c.dat Object is locked skipped
C:\Documents and Settings\Raul\Local Settings\Temp\Perflib_Perfdata_954.dat Object is locked skipped
C:\Documents and Settings\Raul\Local Settings\Temp\~DFE8CD.tmp Object is locked skipped
C:\Documents and Settings\Raul\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Raul\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Raul\NTUSER.DAT.LOG Object is locked skipped
C:\Program Files\ESET\cache\CACHE.NDB Object is locked skipped
C:\Program Files\ESET\logs\virlog.dat Object is locked skipped
C:\Program Files\ESET\logs\warnlog.dat Object is locked skipped
C:\Program Files\LIUtilities\WinTasks\pldt.dat Object is locked skipped
C:\Program Files\Yahoo!\Messenger\logs\billing_Raul.log Object is locked skipped
C:\Program Files\Yahoo!\Messenger\logs\client_Raul.log Object is locked skipped
C:\Program Files\Yahoo!\Messenger\logs\network_Raul.log Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{57766D23-A50C-4845-BFF6-CFCA90290B07}\RP56\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
D:\System Volume Information\_restore{57766D23-A50C-4845-BFF6-CFCA90290B07}\RP56\change.log Object is locked skipped
E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
E:\System Volume Information\_restore{57766D23-A50C-4845-BFF6-CFCA90290B07}\RP56\change.log Object is locked skipped
K:\bck 09 06\prg\AltoMP3 Gold\unins000.exe Infected: Trojan-PSW.Win32.Delf.sp skipped
K:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
K:\System Volume Information\_restore{57766D23-A50C-4845-BFF6-CFCA90290B07}\RP56\change.log Object is locked skipped
Scan process completed.


log HijackThis:
Logfile of HiJackThis v1.99.1
Scan saved at 11:43:31 PM, on 11/15/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\Program Files\LIUtilities\WinTasks\wintasks.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Raul\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\RunOnce: [avp6_post_install] msiexec.exe /i"C:\Documents and Settings\Raul\Desktop\avs.msi"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset\nod32krn.exe

Quote

Asta pare a fi mai curand un false positive.

Logurile sunt OK. Daca primesti mesaje pe YM de la necunoscuti nu inseamna ca esti tu ala infectat.

Cat despre DOC daca e infectat poti verifica aici: www.virustotal.com
Click pe "Distribute" ca sa nu trimiti fisierul la producatorii AV.

Daisuke, on Nov 16 2006, 00:13, said:

Multumesc Daisuke.
Imi recomanzi sa renunt la Nod32 si sa trec la AVS?

Edited by Petrache_Lupu, 16 November 2006 - 07:14.

Quote

In general nu recomand un AV anume. Nici schimbarea la primul esec al AV-ului. Daca-ti place Nod32 foloseste-l. AVS nu stiu ce e.

AVS -> http://www.reyrey.co...virus/index.asp

Ma mir de pe unde l-a gasit  

AVS e Active Virus Shield? si http://www.virus.gr/...l...d=82&mnu=82

OK, am inteles acum. E Kaspersky verde de la AOL   .

Cat despre REYNOLDS ANTI-VIRUS SERVICE (AVS) asta imi place cel mai mult   "Virus Calculator"
 calculator.gif   1.75K   9 downloads

Daisuke, on Nov 16 2006, 20:45, said:

Asa-i, e cel pe care mi l-a recomandat bogdanar. Daca ar fi mai bun decat Nod32, l-as instala.

Pai ( desi eu nu pun mare baza in topuri ) uita-te la topul asta http://www.virus.gr/...l...d=82&mnu=82 . AVS e pe 2 cu acelas scor ca si Kaspersky ( normal ca sunt frati ).Iar Nod32 e pe locul 10. Totusi topul are o chestie cel putin ciudata... pana si Bitdefender 8 ( free edition ) e mai bine clasat decat nod32    

LE: am editat postul, ar trebui sa se incarce acum pagina

Edited by bogdanar, 17 November 2006 - 10:29.

bogdanar, on Nov 17 2006, 09:36, said:

Nu pot accesa pagina aia. Imi da "The system cannot find the file specified". Poate ca era un top "din top" si l-au sters in urma ilaritatii generale.

Edited by Petrache_Lupu, 17 November 2006 - 10:15.