de ce nu pot sa instalez nici un antivirus

de ce nu pot sa instalez nici un antivirus care stie de ce

 stamateBK, on Dec 5 2008, 17:07, said:

Pe ce sistem de operare incerci? Si ce erori iti da?
Da si ceva detalii legate de componentele de pe calculator...

Bafta!

Aceeasi problema cu laptopul unui amic.

S-a jucat cu ceva fisiere nesigure si mi-a spus ca s-a infectat cu un backdoor, cel putin...Trialul de la Norton Av nu se putea updata nici el si dadea un diagnostic de DNS poisoning.


Logfile of Trend Micro HiJackThis v2.0.2
Scan saved at 09:38:52, on 08.12.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ro/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.toshibadirect.com/dpdstart
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: ***** Pro - {F385C231-605B-4d8f-ACA9-DBFF765BBE17} - C:\Program Files\***** Pro\*****Pro.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O8 - Extra context menu item: &Block This Image (ABP) - C:\Program Files\***** Pro\blockimg.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ***** Pro Preferences - {E7FD3540-AB30-40f1-91E7-101F733C1FD5} - C:\Program Files\***** Pro\*****Pro.dll
O9 - Extra 'Tools' menuitem: ***** Pro Preferences - {E7FD3540-AB30-40f1-91E7-101F733C1FD5} - C:\Program Files\***** Pro\*****Pro.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.toshibadirect.com/dpdstart
O17 - HKLM\System\CCS\Services\Tcpip\..\{8F4620D5-3257-4DE8-961A-6473B66B71A9}: NameServer = 85.255.114.88;85.255.112.72
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.114.88;85.255.112.72
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.88;85.255.112.72
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Norton2009 Reset (.norton2009Reset) - Unknown owner - C:\Program Files\Norton2009Reset.exe (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: PsExec (PSEXESVC) - Unknown owner - C:\WINDOWS\PSEXESVC.EXE (file missing)
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 5492 bytes


Multumesc anticipat

Vad ca ai un program de blocat pop-ups. Iti reamintesc ca, folosirea lor pe forumul Softpedia este interzisa prin regulament.

Cand intrii pe pagina asta, dezactiveaza-l sau treci forumul Softpedia in Exclusions.

Vad ca ai si un Hijack la DNS (IP de Ucraina)

Descarca Malwarebytes Anti-Malware si salveaza-l pe Desktop.
Instaleaza-l si la sfarsit asigura-te ca ai bifat urmatoarele: Update Malwarebytes' Anti-Malware si Launch Malwarebytes' Anti-Malware. Apoi apasa Finish.
Dupa lansarea programului, selecteaza Perform full scan si apoi apasa pe Scan.
La terminarea scanarii apasa OK si apoi Show Results. Asigura-te ca e totul bifat si apoi apasa Remove Selected.
La final se va deschide un fisier in Notepad cu rezultatele scanarii. Posteaza continutul lui aici.

 crysty2k5, on Dec 8 2008, 13:28, said:

Mersi de răspuns.
Legat de programul acela de blocat pop-ups: nu e laptopul meu, postez de pe cel al prietenului căruia i s-a infectat Windows-ul. Încerc să-l ajut. Se observă ușor că el are un Toshiba iar eu sunt cunoscut pe subforumul Laptops că utilizez un Fujitsu-Siemens. În plus am observat că pop-ups blockerul ăla e doar pt IE7. Am oobservat că are Opera și din principiu folosesc orice altceva decât IE.
Chestia cu IP-ul nu e surprinzătoare. Are net prin modem Vodafone și de când s-a infectat dă o eroare critică Mobile Connect Vodafone la deschiderea acestuia. Pe de altă parte nici Avira Free pe care am vrut să i-l instalez nu își face update.
A mai avut probleme cu accesarea partițiilor: la accesarea cu dublu clic apărea un mesaj de eroare de genul „ resycled/boot.com in not a valid win32 application”. Am rezolvat-o cu un progrămel simplu: „Flash Disinfector”. Problema se găsește ușor cu google.

Aici e Log-ul Malwarebit:

Malwarebytes' Anti-Malware 1.31
Versiunea bazei de date: 1474
Windows 5.1.2600 Service Pack 2

08.12.2008 18:29:26
mbam-log-2008-12-08 (18-29-26).txt

Tipul scanarii: Scanare totala (C:\|F:\|X:\|)
Obiecte scanate: 109335
Timp trecut: 25 minute(s), 3 second(s)

Procese din memorie afectate: 0
Module de memorie afectate: 0
Chei de registri infectate: 1
Valori din registri afectate: 0
Elemente din registri infectate: 7
Foldere infectate: 0
Fisiere infectate: 3

Procese din memorie afectate:
(Nici un element periculos nu a fost detectat)

Module de memorie afectate:
(Nici un element periculos nu a fost detectat)

Chei de registri infectate:
HKEY_CLASSES_ROOT\homeview (Trojan.DNSChanger) -> Quarantined and deleted successfully.

Valori din registri afectate:
(Nici un element periculos nu a fost detectat)

Elemente din registri infectate:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.114.88;85.255.112.72 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{8f4620d5-3257-4de8-961a-6473b66b71a9}\NameServer (Trojan.DNSChanger) -> Data: 85.255.114.88;85.255.112.72 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.114.88;85.255.112.72 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{8f4620d5-3257-4de8-961a-6473b66b71a9}\NameServer (Trojan.DNSChanger) -> Data: 85.255.114.88;85.255.112.72 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.114.88;85.255.112.72 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.114.88;85.255.112.72 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{8f4620d5-3257-4de8-961a-6473b66b71a9}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.114.88;85.255.112.72 -> Quarantined and deleted successfully.

Foldere infectate:
(Nici un element periculos nu a fost detectat)

Fisiere infectate:
C:\WINDOWS\system32\msqpdxosvdnrsr.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\msqpdxriqpcfum.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\drivers\msqpdxpqltofxh.sys (Trojan.Agent) -> Quarantined and deleted successfully.


Rezultate:
Antivirusul își face update acum! Și s-ar părea că totul e curat. Ultima replică ți-o las ție.
În orice caz, mi de mulțumiri din partea amicului meu și a mea de sigur!  

Cu placere. Stiam eu ca asta rezolva problema.

Ruleaza un update la Avira si da un scan full la sistem

Poti de asemenea sa rulezi si un scan online aici: www.bitdefender.com

 crysty2k5, on 8th December 2008, 18:46, said:

Buna, poate ma ajuta cineva si pe mine
am o problema MARE zic eu ..totul a inceput cred de la avast  (l-am avut instalat vreo 2 ani cu licente din alea venite pe mail, nu am avut niciodata virusi totul a fost ok pana intr-o zi (la inceput de 2009) cand a crapat acest avast- a luat-o razna. Am pus sistemul de vreo cateva ori, am formatat tot, am incercat sa pun avira nu a mers atunci,  am stat o perioada fara antivirus, avast  nu mai merge nici in ziua de azi sa il instalez.)
   Am observat cred ca  de asta vara ca nu imi mai merge taskManager, de atunci tot incerc toate variantele postate pe net pentru a remedia problema. Nu a mers nici una. Azi am pus sistemul am instalat cu greu avira ma zapaceste nici mesengerul nu il accepta, am rulat si acel Malwarebytes' Anti-Malware 1.44 m-am gandit sa postez aici  testul poate ma lumineaza cineva, nu mai stiu ce sa-i mai fac:

Malwarebytes' Anti-Malware 1.44
Database version: 3899
Windows 5.1.2600 Service Pack 2
Internet Explorer 7.0.5730.13

3/22/2010 3:11:38 PM
mbam-log-2010-03-22 (15-11-38).txt

Scan type: Full Scan (C:\|D:\|E:\|)
Objects scanned: 217157
Time elapsed: 27 minute(s), 9 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 1
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 5
Folders Infected: 0
Files Infected: 11

Memory Processes Infected:
C:\Documents and Settings\Alyna\Local Settings\Temp\vvucry.exe (Trojan.Agent) -> Unloaded process successfully.

Memory Modules Infected:
C:\WINDOWS\system32\antiwpa.dll (Trojan.I.Stole.Windows) -> Delete on reboot.

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\Alyna\Local Settings\Temp\vvucry.exe (Trojan.Agent) -> Delete on reboot.
E:\kituri\antivirusi 2008\2010\Avast! AntiVirus Home Edition 4.8.1368 Registred\Avast Antivirus 4.8 keygen.exe (Rootkit.TDSS.Gen) -> Quarantined and deleted successfully.
E:\kituri\antivirusi 2008\2010\Avast_AntiVirus_2010_Pro__v4.8.870_Plus_keygen\Avast Antivirus 4.8 keygen.exe (Rootkit.TDSS.Gen) -> Quarantined and deleted successfully.
E:\kituri\SISTEM\Everest Home Edition v2.20\Everest Ultimate\keygen-300.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
E:\kituri\PTR  FILME !!\BsPlayer Ultima versiune 2007\keygen.EXE (Trojan.Hacktool) -> Quarantined and deleted successfully.
E:\kituri\PTR  FILME !!\BsPlayer Ultima versiune 2007\bs player\keygen.EXE (Trojan.Hacktool) -> Quarantined and deleted successfully.
E:\System Volume Information\_restore{3F7FDE07-8417-4BF2-8490-B023F17E760D}\RP4\A0003245.exe (Rootkit.TDSS.Gen) -> Quarantined and deleted successfully.
E:\System Volume Information\_restore{3F7FDE07-8417-4BF2-8490-B023F17E760D}\RP4\A0003249.exe (Rootkit.TDSS.Gen) -> Quarantined and deleted successfully.
E:\System Volume Information\_restore{3F7FDE07-8417-4BF2-8490-B023F17E760D}\RP6\A0003558.exe (Rootkit.TDSS.Gen) -> Quarantined and deleted successfully.
E:\System Volume Information\_restore{3F7FDE07-8417-4BF2-8490-B023F17E760D}\RP6\A0003563.exe (Rootkit.TDSS.Gen) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\antiwpa.dll (Trojan.I.Stole.Windows) -> Delete on reboot.

Daca nu ai pirata Windows si alte programe, nu ai mai avea probleme.

Quote