mozda je virus

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

imam problem sa kompom posto bilo koju igricu da pustim komp koci nzm sta je sve sam pokusao skenirao sa 2 av avastom i avirom i nasao je viruse i sve sam izbrisao ali nekoliko nisam jer su bila i c/windows/system32 zatim sam skinao program malwarebytes anti malware pronasao je 36.izbrisao je 33 a ostala 3 nije mogao jer su u system32,skidao sam i tune up utilites i resio sve greske u kompu do tada je nenormalno kocio ali sad se oseca da je komp ubrzan ali nedovoljno jer i dalje nmg da igram igrice pa ako mozete da pomognete.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Isprati uputstvo i dostavi izvestaje

http://www.mycity.rs/Ambulanta/Kako-otvoriti-temu-u-Ambulanti.html

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Uloguj se preko Facebooka da bi skinuo fajl:

DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 8.0.6001.18702
Run by Administrator at 16:18:51 on 2013-05-12
Microsoft Windows XP Professional 5.1.2600.3.1252.61.1033.18.511.99 [GMT 2:00]
.
AV: Avira Desktop *Disabled/Outdated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
============== Running Processes ================
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\dmwu.exe
C:\WINDOWS\system32\jmdp\stij.exe
C:\Windows\Temp\wincjkj.exe
C:\Windows\Temp\winwiuar.exe
C:\Program Files\MCShield\MCShieldRTM.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uSearch Page = hxxp://www.google.com
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
dURLSearchHooks: {EEE6C35D-6118-11DC-9C72-001320C79847} - <orphaned>
mWinlogon: SFCDisable = dword:-99
BHO: SpecialSavings: {938958E8-355C-49FF-92B0-53C1B87ACEA9} - c:\program files\specialsavings\ScriptHost.dll
BHO: Smiley Bar for Facebook: {944FEDFD-C4FD-441D-8275-9C651A9FFBDE} - c:\program files\smiley bar for facebook\ScriptHost.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - <orphaned>
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
uRun: [Facebook Update] "c:\users\administrator\local settings\application data\facebook\update\FacebookUpdate.exe" /c /nocrashserver
uRun: [Funenj] c:\users\administrator\application data\Funenj.exe
uRun: [MCShield Monitor] c:\program files\mcshield\MCShieldRTM.exe
mRun: [SystemTray] SysTray.Exe
mRun: [ATIPTA] "c:\program files\ati technologies\ati control panel\atiptaxx.exe"
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
dRunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
dRunOnce: [NewUser] c:\windows\lastxp\NewUser.cmd
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
uPolicies-Explorer: NoSMConfigurePrograms = dword:1
uPolicies-System: DisableRegistryTools = dword:1
uPolicies-System: DisableTaskMgr = dword:1
mPolicies-Explorer: NoSMConfigurePrograms = dword:1
mPolicies-System: SynchronousMachineGroupPolicy = dword:0
mPolicies-System: SynchronousUserGroupPolicy = dword:0
mPolicies-System: EnableLUA = dword:0
mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: NoSMHelp = dword:1
mPolicies-Explorer: NoSMConfigurePrograms = dword:1
IE: E&xport to Microsoft Excel - c:\progra~1\micros~1\office11\EXCEL.EXE/3000
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
TCP: NameServer = 192.168.1.1
TCP: Interfaces\{D723FCB8-4D55-4F4E-8570-A85D81E4F0E5} : DHCPNameServer = 192.168.1.1
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\wpdshserviceobj.dll
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:\program files\google\chrome\application\26.0.1410.64\installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
.
============= SERVICES / DRIVERS ===============
.
R0 m5289;m5289;c:\windows\system32\drivers\m5289.sys [2009-3-8 52480]
R0 uliagpkx;ULi AGP Bus Filter Driver;c:\windows\system32\drivers\AGPKX.SYS [2012-8-27 45056]
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [2013-4-14 37352]
R2 ALIEHCD;ULi PCI to USB Enhanced Host Controller;c:\windows\system32\drivers\AliEhci.sys [2012-8-27 84471]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2013-4-14 84744]
R2 IBUpdaterService;IBUpdaterService;c:\windows\system32\dmwu.exe [2013-1-11 1156400]
R3 aliroothub;USB 2.0 Root Hub;c:\windows\system32\drivers\AliRtHub.sys [2012-8-27 5304]
R3 amsint32;amsint32;\??\c:\windows\system32\drivers\jlonj.sys --> c:\windows\system32\drivers\jlonj.sys [?]
R3 ULI5261XP;ULi M526X Ethernet NT Driver;c:\windows\system32\drivers\ULILAN51.SYS [2012-8-27 28672]
S2 AntiVirSchedulerService;Avira Scheduler;c:\program files\avira\antivir desktop\sched.exe [2013-4-14 86752]
S2 AntiVirService;Avira Real-Time Protection;"c:\program files\avira\antivir desktop\avguard.exe" --> c:\program files\avira\antivir desktop\avguard.exe [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;"c:\program files\tuneup utilities 2013\tuneuputilitiesservice32.exe" --> c:\program files\tuneup utilities 2013\TuneUpUtilitiesService32.exe [?]
S3 aligp;USB Composite Device;c:\windows\system32\drivers\AliGP.sys [2012-8-27 9658]
S3 ALSysIO;ALSysIO;\??\c:\windows\temp\alsysio.sys --> c:\windows\temp\ALSysIO.sys [?]
S3 AndNetDiag;LGE AndroidNet USB Serial Port;c:\windows\system32\drivers\lgandnetdiag.sys [2013-2-25 23040]
S3 ANDNetModem;LGE AndroidNet USB Modem;c:\windows\system32\drivers\lgandnetmodem.sys [2013-2-25 27776]
S3 andnetndis;LGE AndroidNet NDIS Ethernet Adapter;c:\windows\system32\drivers\lgandnetndis.sys [2013-2-25 70400]
S3 PBDOWNFORCE_SERVICE;PBDOWNFORCE_SERVICE;\??\c:\users\administrator\my documents\downloads\pbdownforce v0.2 maniacosxiter.net\pbdownforce.sys --> c:\users\administrator\my documents\downloads\pbdownforce v0.2 maniacosxiter.net\PBDownforce.sys [?]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;\??\c:\program files\tuneup utilities 2013\tuneuputilitiesdriver32.sys --> c:\program files\tuneup utilities 2013\TuneUpUtilitiesDriver32.sys [?]
S3 udsstub;USBDeviceShare USB Device Stub;c:\windows\system32\drivers\udsstub.sys --> c:\windows\system32\drivers\udsstub.sys [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
.
=============== Created Last 30 ================
.
2013-05-12 14:07:17 -------- d-----w- c:\users\all users\application data\MCShield
2013-05-12 14:07:17 -------- d-----w- c:\program files\MCShield
2013-05-12 12:17:49 -------- d-----w- c:\program files\VS Revo Group
2013-05-12 11:47:33 97105 ----a-w- c:\users\administrator\application data\DA.exe
2013-05-11 22:31:29 97105 ----a-w- c:\users\administrator\application data\396.exe
2013-05-11 22:30:04 153424 ----a-w- c:\users\administrator\application data\winrar.exe
2013-05-07 21:26:23 -------- d-----w- c:\users\administrator\application data\Malwarebytes
2013-05-07 21:26:05 -------- d-----w- c:\users\all users\application data\Malwarebytes
2013-05-07 21:26:02 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-05-07 21:26:02 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-04-26 13:09:12 -------- d-----w- c:\windows\system32\NtmsData
2013-04-19 21:45:11 -------- d-----w- c:\users\administrator\Downloads
2013-04-15 13:15:39 -------- d-sh--w- c:\users\administrator\PrivacIE
2013-04-14 19:22:38 99840 ------w- c:\windows\system32\dllcache\srvsvc.dll
2013-04-14 19:22:36 75776 ------w- c:\windows\system32\dllcache\strmfilt.dll
2013-04-14 19:22:35 265728 ------w- c:\windows\system32\dllcache\http.sys
2013-04-14 19:22:35 25088 ------w- c:\windows\system32\dllcache\httpapi.dll
2013-04-14 15:36:36 -------- d-----w- c:\users\administrator\application data\Avira
2013-04-14 15:33:30 84744 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-04-14 15:33:30 37352 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2013-04-14 15:33:19 -------- d-----w- c:\users\all users\application data\Avira
2013-04-14 15:33:19 -------- d-----w- c:\program files\Avira
2013-04-14 15:17:29 -------- d--h--w- c:\windows\system32\GroupPolicy
2013-04-14 15:11:23 -------- d-sh--r- C:\Win
2013-04-14 12:13:19 -------- d-sh--w- c:\users\administrator\IETldCache
2013-04-14 11:56:04 522240 ------w- c:\windows\system32\dllcache\jsdbgui.dll
2013-04-14 11:55:32 6144 ------w- c:\windows\system32\dllcache\iecompat.dll
2013-04-14 11:55:16 -------- d-----w- c:\windows\ie8updates
2013-04-14 11:55:02 12800 ------w- c:\windows\system32\dllcache\xpshims.dll
2013-04-14 11:55:00 743424 ------w- c:\windows\system32\dllcache\iedvtool.dll
2013-04-14 11:55:00 247808 ------w- c:\windows\system32\dllcache\ieproxy.dll
2013-04-14 11:54:08 -------- dc-h--w- c:\windows\ie8
2013-04-13 22:31:59 726528 ----a-w- c:\windows\system32\dllcache\jscript.dll
2013-04-13 22:30:59 58368 ------w- c:\windows\system32\dllcache\synceng.dll
2013-04-13 22:29:31 457856 ------w- c:\windows\system32\dllcache\mrxsmb.sys
2013-04-13 22:29:26 617472 ------w- c:\windows\system32\dllcache\comctl32.dll
2013-04-13 22:28:57 471552 ------w- c:\windows\system32\dllcache\aclayers.dll
2013-04-13 22:28:13 744448 ------w- c:\windows\system32\dllcache\helpsvc.exe
2013-04-13 22:28:07 40960 ------w- c:\windows\system32\dllcache\ndproxy.sys
2013-04-13 22:27:55 81920 ------w- c:\windows\system32\dllcache\fontsub.dll
2013-04-13 22:27:55 119808 ------w- c:\windows\system32\dllcache\t2embed.dll
2013-04-13 22:27:53 401408 ------w- c:\windows\system32\dllcache\rpcss.dll
2013-04-13 22:27:53 35328 ------w- c:\windows\system32\dllcache\sc.exe
2013-04-13 22:27:53 284160 ------w- c:\windows\system32\dllcache\pdh.dll
2013-04-13 22:27:52 473600 ------w- c:\windows\system32\dllcache\fastprox.dll
2013-04-13 22:27:52 227840 ------w- c:\windows\system32\dllcache\wmiprvse.exe
2013-04-13 22:27:52 110592 ------w- c:\windows\system32\dllcache\services.exe
2013-04-13 22:27:51 617472 ------w- c:\windows\system32\dllcache\advapi32.dll
2013-04-13 22:27:51 453120 ------w- c:\windows\system32\dllcache\wmiprvsd.dll
2013-04-13 22:27:14 153088 ------w- c:\windows\system32\dllcache\triedit.dll
2013-04-13 22:27:09 290560 ------w- c:\windows\system32\dllcache\atmfd.dll
2013-04-13 22:26:59 105472 ------w- c:\windows\system32\dllcache\mup.sys
2013-04-13 22:26:55 12928 ------w- c:\windows\system32\dllcache\usb8023x.sys
2013-04-13 22:26:55 12928 ------w- c:\windows\system32\dllcache\usb8023.sys
2013-04-13 22:25:05 57344 ------w- c:\windows\system32\dllcache\msador15.dll
2013-04-13 22:25:05 565248 ------w- c:\windows\system32\dllcache\msado15.dll
2013-04-13 22:25:05 200704 ------w- c:\windows\system32\dllcache\msadox.dll
2013-04-13 22:25:05 143360 ------w- c:\windows\system32\dllcache\msadco.dll
2013-04-13 22:25:05 102400 ------w- c:\windows\system32\dllcache\msjro.dll
2013-04-13 22:25:04 180224 ------w- c:\windows\system32\dllcache\msadomd.dll
2013-04-13 22:24:52 3558912 ------w- c:\windows\system32\dllcache\moviemk.exe
2013-04-13 22:24:49 139784 ------w- c:\windows\system32\dllcache\rdpwd.sys
2013-04-13 22:23:01 718336 ------w- c:\windows\system32\dllcache\ntdll.dll
2013-04-13 22:23:00 2193536 ------w- c:\windows\system32\dllcache\ntoskrnl.exe
2013-04-13 22:23:00 2149888 ------w- c:\windows\system32\dllcache\ntkrnlmp.exe
2013-04-13 22:22:59 2070016 ------w- c:\windows\system32\dllcache\ntkrnlpa.exe
2013-04-13 22:22:59 2028544 ------w- c:\windows\system32\dllcache\ntkrpamp.exe
2013-04-13 22:22:36 218112 ------w- c:\windows\system32\dllcache\wordpad.exe
2013-04-13 22:22:17 10496 ------w- c:\windows\system32\dllcache\ndistapi.sys
2013-04-13 22:22:05 3072 ------w- c:\windows\system32\iacenc.dll
2013-04-13 22:22:05 3072 ------w- c:\windows\system32\dllcache\iacenc.dll
2013-04-13 22:21:54 45568 ------w- c:\windows\system32\dllcache\wab.exe
2013-04-13 22:21:50 590848 ------w- c:\windows\system32\dllcache\rpcrt4.dll
2013-04-13 22:21:50 5120 ----a-w- c:\windows\system32\xpsp4res.dll
2013-04-13 22:20:07 86016 ------w- c:\windows\system32\dllcache\cabview.dll
2013-04-13 21:55:32 -------- d-sh--w- c:\users\all users\application data\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}
2013-04-13 21:51:30 -------- d-----w- c:\windows\system32\SoftwareDistribution
2013-04-13 19:17:33 32032 ----a-w- c:\windows\system32\TURegOpt.exe
2013-04-13 19:17:13 -------- d-----w- c:\users\administrator\application data\TuneUp Software
2013-04-13 19:16:47 -------- d-----w- c:\program files\TuneUp Utilities 2013
2013-04-13 19:16:31 -------- d-----w- c:\users\all users\application data\TuneUp Software
.
==================== Find3M ====================
.
2013-04-15 22:27:58 1562112 ----a-w- c:\windows\system32\mmc.exe
2013-04-15 22:27:54 420864 ----a-w- c:\windows\system32\mspaint.exe
2013-04-15 22:27:50 143872 ----a-w- c:\windows\system32\notepad.exe
2013-04-15 22:27:47 93696 ----a-w- c:\windows\system32\regsvr32.exe
2013-04-15 22:27:43 110592 ----a-w- c:\windows\system32\rundll32.exe
2013-04-15 22:27:40 72704 ----a-w- c:\windows\system32\systray.exe
2013-04-15 22:27:36 877568 ----a-w- c:\windows\system32\taskmgr.exe
2013-04-15 18:42:49 102400 ----a-w- c:\windows\hh.exe
2013-04-13 16:07:52 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-04-13 16:07:52 691592 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-04-07 08:54:58 1156400 ----a-w- c:\windows\system32\dmwu.exe
2013-04-07 08:52:34 27136 ----a-w- c:\windows\system32\ImHttpComm.dll
2013-03-15 21:42:39 861088 ----a-w- c:\windows\system32\npDeployJava1.dll
2013-03-15 21:42:39 782240 ----a-w- c:\windows\system32\deployJava1.dll
2013-03-08 08:36:22 293376 ----a-w- c:\windows\system32\winsrv.dll
2013-03-07 04:23:36 2070016 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-03-07 01:31:48 2193536 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-03-02 02:06:31 916480 ----a-w- c:\windows\system32\wininet.dll
2013-03-02 02:06:30 43520 ------w- c:\windows\system32\licmgr10.dll
2013-03-02 02:06:30 1469440 ------w- c:\windows\system32\inetcpl.cpl
2013-03-02 01:31:30 1876224 ----a-w- c:\windows\system32\win32k.sys
2013-03-02 01:08:47 385024 ------w- c:\windows\system32\html.iec
2013-02-12 00:32:23 12928 ----a-w- c:\windows\system32\drivers\usb8023.sys
.
============= FINISH: 16:19:56,46 ===============

mycity.rs/must-login.png

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Na računaru imaš opasnu infekciju - fajl infektor Sality.
Pošto je dezinfekcija nemoguća iz aktivnog Windowsa, preporučujem ti sljedeće solucije:

1) Da posjetiš temu Primena Live CD Rescue rešenja kako bi skenirao računar sa nekim RescueCD rješenjem. Napisana su detaljna uputstva kako se skenira računar sa popularnim rješenjima. Ovo ti je najlakša solucija, ako nisi zainteresovan za reinstalaciju operativnog sistema.

2) Hard disk možeš da izvadiš iz računara i montiraš ga na drugi računar, koji nije inficiran. Sa tog drugog računara skeniraj montirani hard disk (napomena: ako se odlučiš za ovu varijantu, nemoj ulaziti na zaraženi hard disk dok ga prethodno ne skeniraš i ukloniš infekciju).

3) Formatiraj sistemsku particiju (particiju na kojoj ti je instaliran operativni sistem) i nanovo instaliraj Windows. Nemoj da ulaziš na druge particije, već instaliraj antivirus, ažuriraj ga i skeniraj ostale particije koje imaš. Nakon uklanjanja infekcije, možeš otvarati i druge particije.

Javi za koju si se varijantu odlučio.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

razmisljam se izmedju 1. i 2. stavke mogu obe da probam prvo ovu drugu,da stavim hard disk u drugi komp i scan.Sad imam jedno pitanje kad ubacim hard disk u drugi komp skeniram ga i izbrisem te viruse da li cu u potpunosti izbrisati te viruse i ima li sanse da padne sistem tokom brisanja tih virusa sa tog hard diska.A ako ne uspe ovo hard disk skinucu ovaj dr.web live cd i sa njim probati,ali probaj da mi odgovoris na ovo prvo,hvala u svakom slucaju

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Pa pazi, postoji verovatnoca da je neki bitan fajl toliko ostecen, da je dezinfekcija od strane antivirusa nemoguca, vec je moguce samo brisanje, pa da u nedostatku tog fajla sistem postane neupotrebljiv...

Ja sam cistio Sality sa Kaspersky Rescue Disk-om i proslo sve bez problema...

Ti kako zelis, nisam siguran kakvo ce stanje sistema biti nakon toga, no ako zelis da eksperimentises ti to uradi


Jos jedna napomena, Sality se najcesce siri preko prenosivih uredjaja kao sto je fles. Kada ocistis virus ili instaliras novi sistem, ne ubacuj nista, vec isprati ovo uputstvo


Preuzmi MCShield sa sljedeće adrese:

http://amf.mycity.rs/mcshield/MCShield-Setup.exe

Instaliraj MCShield i sačekaj da se završi uvodno skeniranje.

Kad se završi uvodno skeniranje, ubacuj sve USB memorijske uređaje redom u USB port i svaki zadrži u portu dok MCShield ne izbaci poruku da je skeniranje završeno. Ukoliko imaš više USB uređaja, zabilježi negdje kojim su redom ubacivani.

Objašnjenje: U USB memorijske uređaje spadaju svi oni uređaji koji po priključivanju na kompjuter dobijaju svoju oznaku particije. Tu spadaju USB flash drajvovi, eksterni hard-diskovi, memorijske kartice, MP3 i MP4 plejeri, neki mobilni telefoni, neki GPS (navigacioni) uređaji itd.

Idi na Start -> All Programs -> MCShield -> Logs -> AllScans

Otvoriće ti se izvještaj u Notepad-u čiji sadržaj treba da postaviš u poruku