AdobeR - virus

Hardware, software, mobiteli, programiranje, internet...

Moderator: Benq

Post Reply
mIRCerka
Posts: 28084
Joined: 20/08/2004 15:21
Location: Bolje biti frustrirani mjesanac nego cistokrvni idiot.

#1 AdobeR - virus

Post by mIRCerka »

Summary : Trojan.AdobeR/RavAV.Process

Description : Trojan.AdobeR/RavAV.Process

Trojans are programs that can appear to serve a legitimate purpose but actually have an unwanted or harmful effect.

A large segment of trojan programs download other harmful software components to a user's PC without his/her knowledge.

This application is most likely downloaded and installed by another application that is considered to be adware or spyware.

Company : Unknown

Threat Level : Threat Level : 8
Category : TROJAN

Processes : ADOBER.EXE
bla bla bla truc

Image

E sad, davno ja skuzih ovo govno.
Skontala sam po tome sto ne da da izvadim stick ili telefon kad ga prikopcam...
cak ga lociram, pobrisem sve adobe instalacije, i njega, formatiram HDD, formatiram stickove, sve, i oca mu njegovog opet se pojavi, onako iz vedra neba.
Pitanje je: Da li iko zna efikasan ancin TRAJNOG uklanjanja ovog virusa?
Hvala
dugmee
Posts: 264
Joined: 19/11/2006 17:09

#2

Post by dugmee »

killbox
mIRCerka
Posts: 28084
Joined: 20/08/2004 15:21
Location: Bolje biti frustrirani mjesanac nego cistokrvni idiot.

#3

Post by mIRCerka »

dugmee wrote:killbox
:?

rado bih proguglala, ali mi se kompjuter resetuje svakih 10 minuta....
sabanss
Posts: 4768
Joined: 13/08/2006 11:20

#4

Post by sabanss »

Ukljuci da ti prikazuje skrivene fajlove i pobrisi AdobeR.exe, Autorun.inf i jos jedan fajl sa sticka. To bi trebalo ocistiti stick. Sa druge strane mozda ga redovno kupis odnekud posto je pravo dosadan i napravi kopije svih fajlova na nekoj lokaciji (naravno zarazene). I nema nikakve veze sa Adobeom :-)
User avatar
Neelix
Posts: 11864
Joined: 15/12/2006 14:08
Location: Ostani uz mene, i puni mi redenik
Contact:

#5

Post by Neelix »

Iskjuči system restore.Ako ti je on ukjučen trojan ti se ukopao u njega i sa svakim boot-om se diže ponovo.Safe mode-pa skeniraj ponovo(možeš proći i sa AVG antispyware-bivši Ewido ili sa Trojan hunter-om.

izguglah :D
User avatar
texel
Posts: 530
Joined: 05/02/2004 00:00
Location: Šta ima u Bosni?

#6

Post by texel »

ma da, isključi system restore, pa ako imaš avast, izaberi u opcijama scan on boot, izbaeri i da zipovane fajlove trazi, znaci dubinsko ciscenje :)
ostavi i stick u racunaru, tamo ce ga naci!
a kad izbrises, moraces se malo pozabaviti sa file actions itd..
huh, to sam vec sve predevero :-)
User avatar
bpsang
Posts: 10258
Joined: 10/07/2005 21:03
Location: AK,

#7

Post by bpsang »

zar je moguce da se to tebi desi ?
koji antivirus koristis,nadji nesto kvalitetno
User avatar
nuraH
Posts: 352
Joined: 25/04/2007 02:25

#8

Post by nuraH »

mIRCerka wrote:
dugmee wrote:killbox
:?

rado bih proguglala, ali mi se kompjuter resetuje svakih 10 minuta....
eh vako

odes na start - run i tu ukucas msconfig
na tome odes na startup i tu ugasis sve osim ctfmon
nakon toga restartujes kompjuter
onda fino instaliras nod32 i skeniras hardisc
i neces vise imat problema.
mIRCerka
Posts: 28084
Joined: 20/08/2004 15:21
Location: Bolje biti frustrirani mjesanac nego cistokrvni idiot.

#9

Post by mIRCerka »

Sve je to divno i krasno da meni sistem ne pada cim prodje 20% skeniranja...
xxxxxxxxxxxxxxxxxxxxx
Posts: 92
Joined: 12/04/2005 09:36

#10

Post by xxxxxxxxxxxxxxxxxxxxx »

Samo resetuj u safe mode ( restart pa f8 pritisci i onda safe mode) i pusti nek ga preskenira (naravno ako ti se ne resetuje u safe modu :D ), a dodje ti vjerovatno sa tog drugog racunara na kojem korisis stick. Ako ti nije mrsko se peglati evo kako ga mozes rucno ukinuti

http://www.trendmicro.com/vinfo/virusen ... D&VSect=Sn
mIRCerka
Posts: 28084
Joined: 20/08/2004 15:21
Location: Bolje biti frustrirani mjesanac nego cistokrvni idiot.

#11

Post by mIRCerka »

xxxxxxxxxxxxxxxxxxxxx wrote:Samo resetuj u safe mode ( restart pa f8 pritisci i onda safe mode) i pusti nek ga preskenira (naravno ako ti se ne resetuje u safe modu :D ), a dodje ti vjerovatno sa tog drugog racunara na kojem korisis stick. Ako ti nije mrsko se peglati evo kako ga mozes rucno ukinuti

http://www.trendmicro.com/vinfo/virusen ... D&VSect=Sn
i to sam radila, i u safemode se resetuje... mislim da sam mu ebala majku... kompjuteru...
xxxxxxxxxxxxxxxxxxxxx
Posts: 92
Joined: 12/04/2005 09:36

#12

Post by xxxxxxxxxxxxxxxxxxxxx »

Jesil sigurna da ti ga on resetuje? Ubij proces u task manageru pa vidi, a i ako vec mozes uci u vindoze sto nevratis sa system restore na neki datum kad je radio?
mIRCerka
Posts: 28084
Joined: 20/08/2004 15:21
Location: Bolje biti frustrirani mjesanac nego cistokrvni idiot.

#13

Post by mIRCerka »

xxxxxxxxxxxxxxxxxxxxx wrote:Jesil sigurna da ti ga on resetuje? Ubij proces u task manageru pa vidi, a i ako vec mozes uci u vindoze sto nevratis sa system restore na neki datum kad je radio?
ma napravila sam kardinalnu gresku-kad su nam instalirali "zastitu" nisam nadgledala sta mi rade s kompjutera...
Ja inace ne dam automatski download update-a, ali sve su isklikali, sve mi ujebali, tako da mi je odavno ugasen restore...jer su mi samo kreirali drugi account za ovaj kompjuter, a na stari account kad udjem, nemam admin ovlasti...
:(
rashomon
Posts: 1107
Joined: 15/01/2003 00:00
Location: "Bolestan; gostima pozdrav s poštovanjem!"

#14

Post by rashomon »

Diskove Windowsa u drive, u BIOS, boot sa CD-a, format C i fresh install, i bez surfanja po porno-fetish siteovima ubuduće!!!

Vrlo jednostavno!!!
mIRCerka
Posts: 28084
Joined: 20/08/2004 15:21
Location: Bolje biti frustrirani mjesanac nego cistokrvni idiot.

#15

Post by mIRCerka »

rashomon wrote:Diskove Windowsa u drive, u BIOS, boot sa CD-a, format C i fresh install, i bez surfanja po porno-fetish siteovima ubuduće!!!

Vrlo jednostavno!!!
i tu ja trebam da se nasmijem a? :x :x :x :x
da ga smijem formatirat, davno bih to uradila, ali u mojoj firmi se smijes bez pitanja i odobrenja samo pocesat po guzici, i to 4 puta dnevno!!!!!

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
danas se restartovao ravno 12 puta, jos jedan i ja ga bacam kroz prozor!
Ebo rad od 3 godine!!!!

PS ja ne surfam po porno sajtovima!
rashomon
Posts: 1107
Joined: 15/01/2003 00:00
Location: "Bolestan; gostima pozdrav s poštovanjem!"

#16

Post by rashomon »

ctrl+alt+del

i one procese (drugi tab, processes), jedan po jedan u google provjeri i vidi koji je dobar i koji je loš...

ove loše, desni klik i end process...

zatim search svaki taj loši .exe, i naravno delete

nakon toga sve te .exe fileove izbrisati iz registrija...Start>run> ukucaš regedit > edit > pa FIND opcija........ i jedan po jedan...

Nisam siguran da će uspjeti riješiti stvari do kraja, ali može pomoći...

Eto...

Poželjno bi bilo da to uradiš u safe modeu...

BTW, stranica na kojoj možeš provjeravati procese
http://www.liutilities.com/products/win ... rary/smss/

------------------------------------------------------------------------------

:D :D :D

BTW, ja se moram nasmijati...
Last edited by rashomon on 16/05/2007 19:20, edited 1 time in total.
mIRCerka
Posts: 28084
Joined: 20/08/2004 15:21
Location: Bolje biti frustrirani mjesanac nego cistokrvni idiot.

#17

Post by mIRCerka »

obicno vidim po 5 svchost.exe :S
rashomon
Posts: 1107
Joined: 15/01/2003 00:00
Location: "Bolestan; gostima pozdrav s poštovanjem!"

#18

Post by rashomon »

svchost.exe je ok...
mIRCerka
Posts: 28084
Joined: 20/08/2004 15:21
Location: Bolje biti frustrirani mjesanac nego cistokrvni idiot.

#19

Post by mIRCerka »

Image
User avatar
JohnnyS
Posts: 18379
Joined: 05/05/2007 12:03
Location: Brijuni

#20

Post by JohnnyS »

Probaj s avastom (besplatan za kućnu upotrebu), odmah testira memoriju i boot up tako da bi trebao odmah detektirati tu nesreću (imao sam i ja adobeR doduše na sticku, odmah ga je avast slistio)
hitman05
Posts: 206
Joined: 12/12/2004 23:58
Location: Sarajevo
Contact:

#21

Post by hitman05 »

JohnnyS wrote:Probaj s avastom (besplatan za kućnu upotrebu), odmah testira memoriju i boot up tako da bi trebao odmah detektirati tu nesreću (imao sam i ja adobeR doduše na sticku, odmah ga je avast slistio)

Imao sam ovaj adobeR virus i na sticku i na hdd i avast ga je izbrisao, sad nema problema.
User avatar
KAMI666
Posts: 1141
Joined: 02/07/2006 01:45
Location: Aljaska

#22

Post by KAMI666 »

mIRC-i, ev ja nesto nasao za tebe ;) ....
---------------------------------

Solution:



Terminating the Malware Program

This procedure terminates the running malware process.
Open Windows Task Manager.
• On Windows 98 and ME, press
CTRL+ALT+DELETE
• On Windows NT, 2000, XP, and Server 2003, press
CTRL+SHIFT+ESC, then click the Processes tab.
In the list of running programs*, locate the process:
ADOBER.EXE
Select the malware process, then press either the End Task or the End Process button, depending on the version of Windows on your computer.
To check if the malware process has been terminated, close Task Manager, and then open it again.
Close Task Manager.
*NOTE: On computers running Windows 98 and ME, Windows Task Manager may not show certain processes. You can use a third party process viewer such as Process Explorer to terminate the malware process.

On computers running all Windows platforms, if the process you are looking for is not in the list displayed by Task Manager or Process Explorer, continue with the next solution procedure, noting additional instructions. If the malware process is in the list displayed by either Task Manager or Process Explorer, but you are unable to terminate it, restart your computer in safe mode.

Removing Autostart Entries from the Registry

Removing autostart entries from the registry prevents the malware from executing at startup.

If the registry entry below is not found, the malware may not have executed as of detection. If so, proceed to the succeeding solution set.
Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>
CurrentVersion>Run
In the right panel, locate and delete the entry:
RavAV = "%Windows%\ADOBER.EXE"
(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)
Close Registry Editor.

Deleting the Malware File(s)
Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
In the Named input box, type:
ADOBER.EXE.LOG
In the Look In drop-down list, select the drive that contains Windows, then press Enter.
Once located, select the file then press SHIFT+DELETE.

Important Windows ME/XP Cleaning Instructions

Users running Windows ME and XP must disable System Restore to allow full scanning of infected computers.

Users running other Windows versions can proceed with the succeeding solution set(s).

Running Trend Micro Antivirus

If you are currently running in safe mode, please restart your computer normally before performing the following solution.

Scan your computer with Trend Micro antivirus and delete files detected as WORM_RJUMP.D. To do this, Trend Micro customers must download the latest virus pattern file and scan their computer. Other Internet users can use HouseCall, the Trend Micro online virus scanner.
uhljupce
Posts: 240
Joined: 16/05/2007 02:02

#23

Post by uhljupce »

1. Otvori stick
2. Folder options -View - zakaci: Show hiden files, otkaci: Hide extension ... i Hide protected ....
2. Ugasi adobeR proces (u task menadzeru :D :D glupe li rijeci)
3. Izbrisi adobeR.exe autorun.inf i jos jedan dll fajl koji ce se pokazat nakon sto ukljucis Hide extension ...

To je to ... Samo pregledaj imas AdobeR i na internim diskovima u kompu, jer ako ga imas opet ce ti se iskopirat na svaki USB drive koji nakacis na komp ...
Post Reply