RAPORTEAZA un virus!

MSI
www.msi.com/ ‎Acest site poate dăuna computerului dvs.

iar daca intru direct primesc mesaju de avertizare

Edited by STARTREK1, 16 June 2013 - 19:33.

Ransomware, Dirty Decrypt.exe virus nou, iunie-iulie 2013 ! cripteaza toate fisierele ''jpg'' si nu se mai pot deshide pozele ! Solutia se pare ca nu exista momentan, daca stie cineva cum se mai pot decripta pozele, ii multumesc anticipat !

uite un site care ma streseaza de ceva timp http://win.prizeswee...64-d5d33c702d0e
nu intra la categoria virusi dare scam ce fac ei daca nu ma insel. cer codul pin al telefonului

Cand intru pe pagin asta: http://www.informati...st.ro/stiri.php (e site-ul unui ziar regional) o ia razna kaspersky.

hxxp://shareaza2.fr/vCUfdE7ZJlX3.jpg?d=4rWYGylbchpmU2Q

Se trimite pe facebook, tind sa cred ca in mod automat, prin chat. Ataca inclusiv conturile logate prin telefon mobil / smartphone. Initial am crezut ca se va descarca un fisier infectat, insa mai intai injecteaza "ceva" in browser si doar dupa aceea descarca un fisier de forma MobileUpload_xxxx-www.facebook.com.exe unde xxxx sunt 4 cifre.

Alte URL-uri:
hxxp://shareaza2.fr/6ZgAaazyufF7JIX7zCp5.jpg?d=MTL6fqFO98t5XAwmpUHv
hxxp://shareaza2.fr/JFb8AOS3ZUzpaWGLO6S.jpg?d=EpM7xkuEPxlp3mnt
hxxp://s569.hotfile.com/get/9b075592f495601984029bcde9361bd33332bar6/5208bf2f/2/af394140bfed6007/e412f4f/MobileUpload_0124-www.facebook.com.exe

spune-ti-mi si mie un antivirus bun va rog!

Din nou, un rootkit trimis prin mesaje facebook. Avast l-a detectat si blocat.

hxxp://un-coeur-sauvage-la-trilogie.fr/?qt9cvnyskx6g=e01b1bbe2

GeorgetaIo, on 20 august 2013 - 14:47, said:

Alege-ti de aici.

Nu mai pot accesa site-ul www.....ro de ieri, desi am incercat si cu Firefox, si cu Explorer. Daca tastez adresa site-ului pe scurt in browsere -  imi afiseaza mesajul ca este raportata ca pagina atacata/infectata, iar daca o scriu completa - www.....ro - imi afiseaza acest mesaj ,,This theme requires the Gantry Framework Plugin to be installed and active".

Edited by MhG_40, 29 December 2013 - 09:00.

Wahaby, on 29 decembrie 2013 - 08:38, said:

Am verificat , ai dreptate.Mor pe astia care fac site-uri web si daca doresti sa vezi ceva continut video,etc te bombardeaza cu nu stiu ce plug-in de instalat,fara de care nu poti vedea nimic,ca si pe cele de online tv,sa nu mai zic de cele cu pariuri deschise pop-up.

Am si eu o rugaminte, imi confirma si mie cineva daca forumurile ..... si ....... au alerta de troian ?  De 2 zile Avast imi raporteaza continuu asta!

Edited by MhG_40, 29 December 2013 - 12:54.
Fara reclama.

Asta e o prostie, nu e reclama sunt niste forumuri auto romanesti cunoscute, unde mie Avast imi raporteaza un troian. Spune tu ca admin cum sa ma exprim ca sa-mi rezolv problema fara a numi siteurile in cauza?!
Daca ai sters denumirile siteurilor poti sa stergi toata postarea, ca nu-si mai are rostul!!!

Edited by MembruAnonim, 29 December 2013 - 16:13.

Citeste asta:
1. http://forum.softped...s/#entry3922427
2. Poti sa vezi si singur ce spune Avast.
3. Primul, e cam asa:
[ http://s11.postimg.org/xq0u6kgkj/Screenshot_12292013_11_58_34_AM.png - Pentru incarcare in pagina (embed) Click aici ]
Celalalt e curat.

Da multumesc. Ambele alerte sunt false in concluzie... Deci nu e de la mine ci de la Avast
concluzia e ca s-a prostit AVAST

Edited by MembruAnonim, 29 December 2013 - 19:35.

Intrand pe msonfig/startup in PC ,vad nengine bifat sa porneasca la bootare. Caut in calculator si il gasesc nengine.dll in program files. La o cautare pe net vad ca uni il considera virus altii nu .AVG-ul si AntiMalware nu il vad. Voi ce credeti?

Daca virustotal spune ca nu este, atunci nu e

De astazi, de fiecare data cand pornesc PC-ul, se deschide automat o pagina goala alba cu urmatoarea adresa: hXXps://fbcdn-profile-a.akamaihd.net/hprofile-ak-frc3/hellocdn.html?v=1
Aveti idee ce este, si cum pot scapa de aceasta problema? Am dat o scanare cu Kaspersky Anti-Virus dar nu a gasit nimic.

1. Descarca AdwCleaner by Xplode pe Desktop.
Dublu click pe AdwCleaner.exe pentru al rula.
Pentru Windows Vista sau Windows7,
click dreapta, selecteaza Run as administrator.
Click pe Scan.
Asteapta sa termine de cautat.
Dupa click pe Clean.
Un fisier log se va deschide dupa ce va termina de curatat.
Posteaza continutul lui aici.
Logul se gaseste in C:\AdwCleaner[Sn].txt (n este un numar).

[ http://s16.postimg.org/rjimctqrp/Screenshot_08212013_08_09_26_PM.png - Pentru incarcare in pagina (embed) Click aici ]


2. Descarca si salveaza pe Desktop Junkware Removal Tool.
Inchide toate programele care ruleaza.
Pentru Windows Vista sau Windows7,
click dreapta, selecteaza Run as administrator.
Scaneaza cu el.
Ai rabdare cu el, dureaza putin mai mult.
Posteaza logul aici.
[ http://s7.postimage.org/z2rwy800r/JRT.jpg - Pentru incarcare in pagina (embed) Click aici ]

# Adwcleaner v3.016 - Report created 07/01/2014 at 20:22:43
# Updated 23/12/2013 by Xplode
# Operating System : Windows 7 Ultimate Service Pack 1 (64 bits)
# Username : a - a-PC
# Running from : C:\Users\a\Desktop\adwcleaner.exe
# Option : Clean
***** [ Services ] *****
Service Deleted : SCBackService
***** [ Files / Folders ] *****
Folder Deleted : C:\ProgramData\Splashtop
Folder Deleted : C:\Program Files (x86)\LSHunter.TV
Folder Deleted : C:\Program Files (x86)\Splashtop
Folder Deleted : C:\Users\a\AppData\Local\PackageAware
Folder Deleted : C:\Users\a\AppData\Local\visi_coupon
Folder Deleted : C:\Users\a\AppData\Roaming\Splashtop
Folder Deleted : C:\Users\a\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\LSHunter.TV
***** [ Shortcuts ] *****

***** [ Registry ] *****
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\kkfggacklibaabdomphfdpcodjgihgon
Key Deleted : HKLM\SOFTWARE\Classes\AddressBarSearch.SearchHook
Key Deleted : HKLM\SOFTWARE\Classes\AddressBarSearch.SearchHook.1
Key Deleted : HKLM\SOFTWARE\Classes\secman.OutlookSecurityManager
Key Deleted : HKLM\SOFTWARE\Classes\secman.OutlookSecurityManager.1
Key Deleted : HKLM\SOFTWARE\Classes\STC.FBServiceAPPEventsSink
Key Deleted : HKLM\SOFTWARE\Classes\STC.FBServiceAPPEventsSink.1
Key Deleted : HKLM\SOFTWARE\Classes\STC.OptionMenu
Key Deleted : HKLM\SOFTWARE\Classes\STC.OptionMenu.1
Key Deleted : HKLM\SOFTWARE\Classes\STC.Protocol
Key Deleted : HKLM\SOFTWARE\Classes\STC.Protocol.1
Key Deleted : HKLM\SOFTWARE\Classes\STC.VisualBookmark
Key Deleted : HKLM\SOFTWARE\Classes\STC.VisualBookmark.1
Key Deleted : HKLM\SOFTWARE\Classes\STC.WebObject
Key Deleted : HKLM\SOFTWARE\Classes\STC.WebObject.1
Key Deleted : HKLM\SOFTWARE\Classes\STCHelper.BHOHelper
Key Deleted : HKLM\SOFTWARE\Classes\STCHelper.BHOHelper.1
Key Deleted : HKLM\SOFTWARE\Classes\STCHelper.FBServiceAPP
Key Deleted : HKLM\SOFTWARE\Classes\STCHelper.FBServiceAPP.1
Key Deleted : HKLM\SOFTWARE\Classes\STCHelper.Protocol
Key Deleted : HKLM\SOFTWARE\Classes\STCHelper.Protocol.1
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\AskInstallChecker-1_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\AskInstallChecker-1_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{82A5CE4D-AF0C-45B6-8AF8-75625BE6A08D}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{B2B7E0CD-E169-43B3-A233-E129610EE314}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{00000001-4FEF-40D3-B3FA-E0531B897F98}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{058F0E48-61CA-4964-9FBA-1978A1BB060D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{0DEC13F0-5C8C-4147-8329-6CDFAD9755B7}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{18F33C35-8EF2-40D7-8BA4-932B0121B472}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{5E97F0FA-3B44-4634-A87E-8B0D5CFD6365}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{64697678-0000-0010-8000-00AA00389B71}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{951F5841-FD1E-4F1D-8607-67B174DBD753}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D1CCB0CC-DA45-4797-93D3-DEE7A13F8177}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DCE24E28-D8EF-49BE-BC01-A1DD3B58FCE3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E4F7F1A5-490E-4884-A9E3-CBD6A25749E1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FFE66D00-A56A-4F7F-81D7-4A28C5816D6C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{4E8E0178-00EF-413D-9324-E7B3E31572E3}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{A1A533A8-E106-422B-AE29-D0025269AF83}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{B1759D04-0EF9-472A-B5C3-C774997B5321}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FFE66D00-A56A-4F7F-81D7-4A28C5816D6C}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{80ED3EBC-CC05-4336-ABCC-295798855718}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Key Deleted : HKCU\Software\Splashtop Inc.
Key Deleted : HKCU\Software\AppDataLow\Software\Conduit
Key Deleted : HKLM\Software\dt soft\daemon tools toolbar
Key Deleted : HKLM\Software\Splashtop Inc.
***** [ Browsers ] *****
-\\ Internet Explorer v8.0.7601.17514

-\\ Mozilla Firefox v26.0 (en-US)
[ File : C:\Users\a\AppData\Roaming\Mozilla\Firefox\Profiles\n57tak32.default\prefs.js ]

-\\ Google Chrome v
[ File : C:\Users\a\AppData\Local\Google\Chrome\User Data\Default\preferences ]

*************************
AdwCleaner[R0].txt - [5152 octets] - [07/01/2014 20:21:44]
AdwCleaner[S0].txt - [5161 octets] - [07/01/2014 20:22:43]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [5221 octets] ##########

----------------------------------------------------------------------------------------------------------------------------------

# AdwCleaner v3.016 - Report created 07/01/2014 at 20:21:44
# Updated 23/12/2013 by Xplode
# Operating System : Windows 7 Ultimate Service Pack 1 (64 bits)
# Username : a - a-PC
# Running from : C:\Users\a\Desktop\adwcleaner.exe
# Option : Scan
***** [ Services ] *****
Service Found : SCBackService
***** [ Files / Folders ] *****
Folder Found C:\Program Files (x86)\LSHunter.TV
Folder Found C:\Program Files (x86)\Splashtop
Folder Found C:\ProgramData\Splashtop
Folder Found C:\Users\a\AppData\Local\PackageAware
Folder Found C:\Users\a\AppData\Local\visi_coupon
Folder Found C:\Users\a\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\LSHunter.TV
Folder Found C:\Users\a\AppData\Roaming\Splashtop
***** [ Shortcuts ] *****

***** [ Registry ] *****
Key Found : HKCU\Software\AppDataLow\Software\Conduit
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FFE66D00-A56A-4F7F-81D7-4A28C5816D6C}
Key Found : HKCU\Software\Splashtop Inc.
Key Found : [x64] HKCU\Software\Splashtop Inc.
Key Found : HKLM\SOFTWARE\Classes\AddressBarSearch.SearchHook
Key Found : HKLM\SOFTWARE\Classes\AddressBarSearch.SearchHook.1
Key Found : HKLM\SOFTWARE\Classes\AppID\{82A5CE4D-AF0C-45B6-8AF8-75625BE6A08D}
Key Found : HKLM\SOFTWARE\Classes\AppID\{B2B7E0CD-E169-43B3-A233-E129610EE314}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{00000001-4FEF-40D3-B3FA-E0531B897F98}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{058F0E48-61CA-4964-9FBA-1978A1BB060D}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{0DEC13F0-5C8C-4147-8329-6CDFAD9755B7}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{18F33C35-8EF2-40D7-8BA4-932B0121B472}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{5E97F0FA-3B44-4634-A87E-8B0D5CFD6365}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{64697678-0000-0010-8000-00AA00389B71}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{951F5841-FD1E-4F1D-8607-67B174DBD753}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{D1CCB0CC-DA45-4797-93D3-DEE7A13F8177}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{DCE24E28-D8EF-49BE-BC01-A1DD3B58FCE3}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E4F7F1A5-490E-4884-A9E3-CBD6A25749E1}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{FFE66D00-A56A-4F7F-81D7-4A28C5816D6C}
Key Found : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Key Found : HKLM\SOFTWARE\Classes\secman.OutlookSecurityManager
Key Found : HKLM\SOFTWARE\Classes\secman.OutlookSecurityManager.1
Key Found : HKLM\SOFTWARE\Classes\STC.FBServiceAPPEventsSink
Key Found : HKLM\SOFTWARE\Classes\STC.FBServiceAPPEventsSink.1
Key Found : HKLM\SOFTWARE\Classes\STC.OptionMenu
Key Found : HKLM\SOFTWARE\Classes\STC.OptionMenu.1
Key Found : HKLM\SOFTWARE\Classes\STC.Protocol
Key Found : HKLM\SOFTWARE\Classes\STC.Protocol.1
Key Found : HKLM\SOFTWARE\Classes\STC.VisualBookmark
Key Found : HKLM\SOFTWARE\Classes\STC.VisualBookmark.1
Key Found : HKLM\SOFTWARE\Classes\STC.WebObject
Key Found : HKLM\SOFTWARE\Classes\STC.WebObject.1
Key Found : HKLM\SOFTWARE\Classes\STCHelper.BHOHelper
Key Found : HKLM\SOFTWARE\Classes\STCHelper.BHOHelper.1
Key Found : HKLM\SOFTWARE\Classes\STCHelper.FBServiceAPP
Key Found : HKLM\SOFTWARE\Classes\STCHelper.FBServiceAPP.1
Key Found : HKLM\SOFTWARE\Classes\STCHelper.Protocol
Key Found : HKLM\SOFTWARE\Classes\STCHelper.Protocol.1
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{4E8E0178-00EF-413D-9324-E7B3E31572E3}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{A1A533A8-E106-422B-AE29-D0025269AF83}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{B1759D04-0EF9-472A-B5C3-C774997B5321}
Key Found : HKLM\Software\dt soft\daemon tools toolbar
Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\kkfggacklibaabdomphfdpcodjgihgon
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{80ED3EBC-CC05-4336-ABCC-295798855718}
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\AskInstallChecker-1_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\AskInstallChecker-1_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS
Key Found : HKLM\Software\Splashtop Inc.
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
***** [ Browsers ] *****
-\\ Internet Explorer v8.0.7601.17514

-\\ Mozilla Firefox v26.0 (en-US)
[ File : C:\Users\a\AppData\Roaming\Mozilla\Firefox\Profiles\n57tak32.default\prefs.js ]

-\\ Google Chrome v
[ File : C:\Users\a\AppData\Local\Google\Chrome\User Data\Default\preferences ]

*************************
AdwCleaner[R0].txt - [5004 octets] - [07/01/2014 20:21:44]
########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [5064 octets] ##########

---------------------------------------------------------------------------------------------------------------------

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.9 (01.01.2014:1)
OS: Windows 7 Ultimate x64
Ran by a on Tue 01/07/2014 at 20:38:40.97
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


~~~ Services
Successfully stopped: [Service] wcuservice_stc_ie
Successfully deleted: [Service] wcuservice_stc_ie
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\yt.ytnavassistplugin
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\yt.ytnavassistplugin.1
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\conduit
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\ConduitHelper_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\ConduitHelper_RASDLG
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\ConduitHelper_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\ConduitHelper_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\ConduitHelper_RASDLG
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\ConduitHelper_RASMANCS
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{53F9B132-6394-475B-9CFE-163401755BA8}

~~~ Files

~~~ Folders
Successfully deleted: [Folder] "C:\Users\a\AppData\Roaming\getrighttogo"
Successfully deleted: [Folder] "C:\Users\a\AppData\Roaming\w3i, llc"
Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"
~~~ FireFox
Emptied folder: C:\Users\a\AppData\Roaming\mozilla\firefox\profiles\n57tak32.default\minidumps [134 files]

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Tue 01/07/2014 at 20:44:46.40
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~