Collected.2.D

#37
calandrin

Posted 22 January 2005 - 12:13

Member

Grup: Members
Posts: 563
Înscris: 19.01.2005

S-a rezolvat, merci mult.
Dar spuneai ca mai sunt niste ramasite ale troianului. Crezi ca mai putem face ceva ?

Back to top

#38
Daisuke

Posted 22 January 2005 - 17:28

Moderator

Grup: Senior Members
Posts: 2,173
Înscris: 19.01.2004

Quote

Crezi ca mai putem face ceva ?

Da, posteaza te rog un log proaspat.

Back to top

#39
calandrin

Posted 23 January 2005 - 11:19

Member

Grup: Members
Posts: 563
Înscris: 19.01.2005

Logfile of HiJackThis v1.99.0
Scan saved at 11:18:56 AM, on 1/23/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
C:\Program Files\Softwin\BitDefender8\bdoesrv.exe
C:\Program Files\Softwin\BitDefender8\bdnagent.exe
C:\Program Files\Softwin\BitDefender8\bdswitch.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\qttask.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Softwin\BitDefender8\vsserv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Yahoo!\Messenger\YPager.exe
C:\Documents and Settings\C\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.freeze.com
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5AE3F786-A244-5109-DCF1-C2A7A15D072E} - (no file)
O2 - BHO: (no name) - {B5AEF25C-F582-F791-D041-28392190211F} - (no file)
O2 - BHO: (no name) - {D7480A4C-6005-71D3-49AD-A91B26DC8C3A} - (no file)
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
O4 - HKLM\..\Run: [BDOESRV] C:\Program Files\Softwin\BitDefender8\\bdoesrv.exe
O4 - HKLM\..\Run: [BDNewsAgent] C:\Program Files\Softwin\BitDefender8\bdnagent.exe
O4 - HKLM\..\Run: [BDSwitchAgent] C:\Program Files\Softwin\BitDefender8\\bdswitch.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\system32\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Traceless] C:\Program Files\Traceless\launch.exe
O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Ati HotKey Poller - Unknown - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: BitDefender Scan Server - Unknown - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: BitDefender Virus Shield - Unknown - C:\Program Files\Softwin\BitDefender8\vsserv.exe
O23 - Service: BitDefender Communicator - Softwin - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

Back to top

#40
Daisuke

Posted 23 January 2005 - 18:39

Moderator

Grup: Senior Members
Posts: 2,173
Înscris: 19.01.2004

Copiaza continutul Quote Box de mai jos in Notepad.
Click File menu -> Save si denumeste fisierul fix.reg
Schimba Save as Type --> All Files
Salveaza-l pe Desktop.

Quote

REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5AE3F786-A244-5109-DCF1-C2A7A15D072E}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B5AEF25C-F582-F791-D041-28392190211F}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D7480A4C-6005-71D3-49AD-A91B26DC8C3A}]

Dublu click pe fix.reg si repara registry.

REBOOT si posteaza un nou log te rog.

Edited by cryo, 23 January 2005 - 18:39.

Back to top

#41
calandrin

Posted 23 January 2005 - 18:50

Member

Grup: Members
Posts: 563
Înscris: 19.01.2005

Cyo, antivirusul meu a depistat din nou przenta trojanului!

Back to top

#42
Daisuke

Posted 23 January 2005 - 18:56

Moderator

Grup: Senior Members
Posts: 2,173
Înscris: 19.01.2004

Cum se numeste si unde l-a depistat ? Ultimul log al tau este curat.

Pagina asta de start e pusa de tine ?
http://my.freeze.com/ <-- ??

Back to top

#43
calandrin

Posted 23 January 2005 - 19:05

Member

Grup: Members
Posts: 563
Înscris: 19.01.2005

Nu am pus eu pagina asta de start. Chiar m-am mirat cand am observat ca ma trimite acolo.
Iti mai trimit un log imediat.

Back to top

#44
calandrin

Posted 23 January 2005 - 19:13

Member

Grup: Members
Posts: 563
Înscris: 19.01.2005

Logfile of HiJackThis v1.99.0
Scan saved at 7:13:06 PM, on 1/23/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Softwin\BitDefender8\bdoesrv.exe
C:\Program Files\Softwin\BitDefender8\bdnagent.exe
C:\Program Files\Softwin\BitDefender8\bdswitch.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\qttask.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Yahoo!\Messenger\YPager.exe
C:\Program Files\mIRC\mirc.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Softwin\BitDefender8\vsserv.exe
c:\progra~1\softwin\bitdef~1\bdmcon.exe
C:\Documents and Settings\C\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.freeze.com
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5AE3F786-A244-5109-DCF1-C2A7A15D072E} - (no file)
O2 - BHO: (no name) - {B5AEF25C-F582-F791-D041-28392190211F} - (no file)
O2 - BHO: (no name) - {D7480A4C-6005-71D3-49AD-A91B26DC8C3A} - (no file)
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
O4 - HKLM\..\Run: [BDOESRV] C:\Program Files\Softwin\BitDefender8\\bdoesrv.exe
O4 - HKLM\..\Run: [BDNewsAgent] C:\Program Files\Softwin\BitDefender8\bdnagent.exe
O4 - HKLM\..\Run: [BDSwitchAgent] C:\Program Files\Softwin\BitDefender8\\bdswitch.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\system32\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Traceless] C:\Program Files\Traceless\launch.exe
O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Ati HotKey Poller - Unknown - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: BitDefender Scan Server - Unknown - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: BitDefender Virus Shield - Unknown - C:\Program Files\Softwin\BitDefender8\vsserv.exe
O23 - Service: BitDefender Communicator - Softwin - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

Back to top

#45
Daisuke

Posted 23 January 2005 - 19:48

Moderator

Grup: Senior Members
Posts: 2,173
Înscris: 19.01.2004

Trebuie sterse manual.

1. Backup tot Windows Registry (entire registry)
Backing up the Windows registry

2. Mergi la Start --> Run, si tasteaza regedit in Open box, apoi apasa OK.

3.Mergi la cheile astea si sterge-le:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5AE3F786-A244-5109-DCF1-C2A7A15D072E}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B5AEF25C-F582-F791-D041-28392190211F}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D7480A4C-6005-71D3-49AD-A91B26DC8C3A}

Daca nu merg sterse fa click dreapta pe cheie --> Permissions --> Add --> Advanced --> Find Now --> alege userul tau --> OK --> OK --> selecteaza userul tau si bifeaza Full control --> OK. Sterge cheia acum.

Posteaza un nou log te rog.

Edited by cryo, 23 January 2005 - 19:49.

Back to top

#46
calandrin

Posted 23 January 2005 - 20:40

Member

Grup: Members
Posts: 563
Înscris: 19.01.2005

Daca nu merg sterse fa click dreapta pe cheie --> Permissions --> Add --> Advanced --> Find Now --> alege userul tau --> OK --> OK --> selecteaza userul tau si bifeaza Full control --> OK. Sterge cheia acum.

Aici nu ma descurc
Am mers pana la Find Now si aici nu imi e clar ce sa selectez :angry:

Back to top

#47
Daisuke

Posted 23 January 2005 - 22:08

Moderator

Grup: Senior Members
Posts: 2,173
Înscris: 19.01.2004

Daca faci click pe Start, sus pe meniu este scris userul. Apesi Find Now si cauti mai jos userul.

Back to top

#48
Clayman

Posted 23 January 2005 - 22:16

InFlamer

Grup: Senior Members
Posts: 4,069
Înscris: 28.04.2004

Scuze calandrin da` io m-am saturat....imi inchipui saracu` Cryo :worthy:

. Stau si ma-ntreb pana unde merge rabdarea sa...

Back to top

#49
Daisuke

Posted 23 January 2005 - 22:22

Moderator

Grup: Senior Members
Posts: 2,173
Înscris: 19.01.2004

Clayman, fii intelegator. Nu toti oamenii se pricep la calculatoare. Sunt obisnuit cu persoane care ma intreaba ce e Notepad si cum se face copy and paste

si am multa rabdare.

Back to top

#50
calandrin

Posted 24 January 2005 - 08:33

Member

Grup: Members
Posts: 563
Înscris: 19.01.2005

Am sters ce mi-ai spus, Cryo.
Uite noul log.

Logfile of HiJackThis v1.99.0
Scan saved at 8:32:30 AM, on 1/24/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
C:\Program Files\Softwin\BitDefender8\bdoesrv.exe
C:\Program Files\Softwin\BitDefender8\bdnagent.exe
C:\Program Files\Softwin\BitDefender8\bdswitch.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\qttask.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Softwin\BitDefender8\vsserv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\C\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.freeze.com
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
O4 - HKLM\..\Run: [BDOESRV] C:\Program Files\Softwin\BitDefender8\\bdoesrv.exe
O4 - HKLM\..\Run: [BDNewsAgent] C:\Program Files\Softwin\BitDefender8\bdnagent.exe
O4 - HKLM\..\Run: [BDSwitchAgent] C:\Program Files\Softwin\BitDefender8\\bdswitch.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\system32\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Traceless] C:\Program Files\Traceless\launch.exe
O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Ati HotKey Poller - Unknown - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: BitDefender Scan Server - Unknown - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: BitDefender Virus Shield - Unknown - C:\Program Files\Softwin\BitDefender8\vsserv.exe
O23 - Service: BitDefender Communicator - Softwin - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

Back to top

#51
calandrin

Posted 24 January 2005 - 08:50

Member

Grup: Members
Posts: 563
Înscris: 19.01.2005

Clayman:

Sa stii ca rabdarea este una dintre virtutile cardinale. Iti urez sa intri la un moment dat intr-o situatie asemanatoare, in care sa ai nevoie de ajutor si sa apara un binevoitor care sa spuna ca s-a saturat.
Atunci sa-ti aduci aminte de calandrin si de interventia ta prieteneasca.

Back to top

#52
Daisuke

Posted 24 January 2005 - 09:49

Moderator

Grup: Senior Members
Posts: 2,173
Înscris: 19.01.2004

OK, logul e curat.

Urmeaza pasii de aici ca sa te protejezi:
How did I get infected ? With steps so it does not happen again !

Poti folosi un browser alternativ pentru a naviga pe site-uri dubioase:
Switching from Internet Explorer to Firefox

Quote

Sta la C:\Doccuments and settings\C\Localsettings\Temp\Nero.40
Dar acest Nero.40 nu poate fi gasit nicaieri. Asadar trebuie sa fie iarasi un nemernic de virus.

Nu e virus, ci un fisier temporar de la Nero. O fii prea mare si nu se descurca cu el sau dureaza foarte mult sa-l desfaca. Goleste temp files cu System Security Suite.

Back to top

#53
calandrin

Posted 24 January 2005 - 09:57

Member

Grup: Members
Posts: 563
Înscris: 19.01.2005

Multumesc pentru efort.

In orice caz, acum scanez cu AVG si a gasit din nou Trojan horse Collected.2.D
Primul fisier unde l-a gasit a fost dezinfectat. Urmatorul in schimb nu poate fi nici dezinfectat, nici sters, nici moved to Vault.

Back to top

#54
Daisuke

Posted 24 January 2005 - 09:59

Moderator

Grup: Senior Members
Posts: 2,173
Înscris: 19.01.2004

Unde ii gaseste ? In ce folder ?

Back to top

Anunturi

Second Opinion

Folosind serviciul second opinion ne puteți trimite RMN-uri, CT -uri, angiografii, fișiere .pdf, documente medicale.

Astfel vă vom putea da o opinie neurochirurgicală, fără ca aceasta să poată înlocui un consult de specialitate. Răspunsurile vor fi date prin e-mail în cel mai scurt timp posibil (de obicei în mai putin de 24 de ore, dar nu mai mult de 48 de ore). Second opinion – Neurohope este un serviciu gratuit.

www.neurohope.ro

#37 calandrin Posted 22 January 2005 - 12:13

#38 Daisuke Posted 22 January 2005 - 17:28

#39 calandrin Posted 23 January 2005 - 11:19

#40 Daisuke Posted 23 January 2005 - 18:39

#41 calandrin Posted 23 January 2005 - 18:50

#42 Daisuke Posted 23 January 2005 - 18:56

#43 calandrin Posted 23 January 2005 - 19:05

#44 calandrin Posted 23 January 2005 - 19:13

#45 Daisuke Posted 23 January 2005 - 19:48

#46 calandrin Posted 23 January 2005 - 20:40

#47 Daisuke Posted 23 January 2005 - 22:08

#48 Clayman Posted 23 January 2005 - 22:16

#49 Daisuke Posted 23 January 2005 - 22:22

#50 calandrin Posted 24 January 2005 - 08:33

#51 calandrin Posted 24 January 2005 - 08:50

#52 Daisuke Posted 24 January 2005 - 09:49

#53 calandrin Posted 24 January 2005 - 09:57

#54 Daisuke Posted 24 January 2005 - 09:59

Anunturi

▶ 1 user(s) are reading this topic

Sign In

#37
calandrin

Posted 22 January 2005 - 12:13

#38
Daisuke

Posted 22 January 2005 - 17:28

#39
calandrin

Posted 23 January 2005 - 11:19

#40
Daisuke

Posted 23 January 2005 - 18:39

#41
calandrin

Posted 23 January 2005 - 18:50

#42
Daisuke

Posted 23 January 2005 - 18:56

#43
calandrin

Posted 23 January 2005 - 19:05

#44
calandrin

Posted 23 January 2005 - 19:13

#45
Daisuke

Posted 23 January 2005 - 19:48

#46
calandrin

Posted 23 January 2005 - 20:40

#47
Daisuke

Posted 23 January 2005 - 22:08

#48
Clayman

Posted 23 January 2005 - 22:16

#49
Daisuke

Posted 23 January 2005 - 22:22

#50
calandrin

Posted 24 January 2005 - 08:33

#51
calandrin

Posted 24 January 2005 - 08:50

#52
Daisuke

Posted 24 January 2005 - 09:49

#53
calandrin

Posted 24 January 2005 - 09:57

#54
Daisuke

Posted 24 January 2005 - 09:59