Page 1 of 1

#1 AdobeR - virus

Posted: 10/05/2007 14:36
by mIRCerka
Summary : Trojan.AdobeR/RavAV.Process

Description : Trojan.AdobeR/RavAV.Process

Trojans are programs that can appear to serve a legitimate purpose but actually have an unwanted or harmful effect.

A large segment of trojan programs download other harmful software components to a user's PC without his/her knowledge.

This application is most likely downloaded and installed by another application that is considered to be adware or spyware.

Company : Unknown

Threat Level : Threat Level : 8
Category : TROJAN

Processes : ADOBER.EXE
bla bla bla truc

Image

E sad, davno ja skuzih ovo govno.
Skontala sam po tome sto ne da da izvadim stick ili telefon kad ga prikopcam...
cak ga lociram, pobrisem sve adobe instalacije, i njega, formatiram HDD, formatiram stickove, sve, i oca mu njegovog opet se pojavi, onako iz vedra neba.
Pitanje je: Da li iko zna efikasan ancin TRAJNOG uklanjanja ovog virusa?
Hvala

#2

Posted: 10/05/2007 15:06
by dugmee
killbox

#3

Posted: 10/05/2007 15:11
by mIRCerka
dugmee wrote:killbox
:?

rado bih proguglala, ali mi se kompjuter resetuje svakih 10 minuta....

#4

Posted: 10/05/2007 15:41
by sabanss
Ukljuci da ti prikazuje skrivene fajlove i pobrisi AdobeR.exe, Autorun.inf i jos jedan fajl sa sticka. To bi trebalo ocistiti stick. Sa druge strane mozda ga redovno kupis odnekud posto je pravo dosadan i napravi kopije svih fajlova na nekoj lokaciji (naravno zarazene). I nema nikakve veze sa Adobeom :-)

#5

Posted: 10/05/2007 15:46
by Neelix
Iskjuči system restore.Ako ti je on ukjučen trojan ti se ukopao u njega i sa svakim boot-om se diže ponovo.Safe mode-pa skeniraj ponovo(možeš proći i sa AVG antispyware-bivši Ewido ili sa Trojan hunter-om.

izguglah :D

#6

Posted: 10/05/2007 15:51
by texel
ma da, isključi system restore, pa ako imaš avast, izaberi u opcijama scan on boot, izbaeri i da zipovane fajlove trazi, znaci dubinsko ciscenje :)
ostavi i stick u racunaru, tamo ce ga naci!
a kad izbrises, moraces se malo pozabaviti sa file actions itd..
huh, to sam vec sve predevero :-)

#7

Posted: 10/05/2007 18:48
by bpsang
zar je moguce da se to tebi desi ?
koji antivirus koristis,nadji nesto kvalitetno

#8

Posted: 10/05/2007 23:37
by nuraH
mIRCerka wrote:
dugmee wrote:killbox
:?

rado bih proguglala, ali mi se kompjuter resetuje svakih 10 minuta....
eh vako

odes na start - run i tu ukucas msconfig
na tome odes na startup i tu ugasis sve osim ctfmon
nakon toga restartujes kompjuter
onda fino instaliras nod32 i skeniras hardisc
i neces vise imat problema.

#9

Posted: 16/05/2007 13:28
by mIRCerka
Sve je to divno i krasno da meni sistem ne pada cim prodje 20% skeniranja...

#10

Posted: 16/05/2007 13:39
by xxxxxxxxxxxxxxxxxxxxx
Samo resetuj u safe mode ( restart pa f8 pritisci i onda safe mode) i pusti nek ga preskenira (naravno ako ti se ne resetuje u safe modu :D ), a dodje ti vjerovatno sa tog drugog racunara na kojem korisis stick. Ako ti nije mrsko se peglati evo kako ga mozes rucno ukinuti

http://www.trendmicro.com/vinfo/virusen ... D&VSect=Sn

#11

Posted: 16/05/2007 13:44
by mIRCerka
xxxxxxxxxxxxxxxxxxxxx wrote:Samo resetuj u safe mode ( restart pa f8 pritisci i onda safe mode) i pusti nek ga preskenira (naravno ako ti se ne resetuje u safe modu :D ), a dodje ti vjerovatno sa tog drugog racunara na kojem korisis stick. Ako ti nije mrsko se peglati evo kako ga mozes rucno ukinuti

http://www.trendmicro.com/vinfo/virusen ... D&VSect=Sn
i to sam radila, i u safemode se resetuje... mislim da sam mu ebala majku... kompjuteru...

#12

Posted: 16/05/2007 13:49
by xxxxxxxxxxxxxxxxxxxxx
Jesil sigurna da ti ga on resetuje? Ubij proces u task manageru pa vidi, a i ako vec mozes uci u vindoze sto nevratis sa system restore na neki datum kad je radio?

#13

Posted: 16/05/2007 13:56
by mIRCerka
xxxxxxxxxxxxxxxxxxxxx wrote:Jesil sigurna da ti ga on resetuje? Ubij proces u task manageru pa vidi, a i ako vec mozes uci u vindoze sto nevratis sa system restore na neki datum kad je radio?
ma napravila sam kardinalnu gresku-kad su nam instalirali "zastitu" nisam nadgledala sta mi rade s kompjutera...
Ja inace ne dam automatski download update-a, ali sve su isklikali, sve mi ujebali, tako da mi je odavno ugasen restore...jer su mi samo kreirali drugi account za ovaj kompjuter, a na stari account kad udjem, nemam admin ovlasti...
:(

#14

Posted: 16/05/2007 16:29
by rashomon
Diskove Windowsa u drive, u BIOS, boot sa CD-a, format C i fresh install, i bez surfanja po porno-fetish siteovima ubuduće!!!

Vrlo jednostavno!!!

#15

Posted: 16/05/2007 16:32
by mIRCerka
rashomon wrote:Diskove Windowsa u drive, u BIOS, boot sa CD-a, format C i fresh install, i bez surfanja po porno-fetish siteovima ubuduće!!!

Vrlo jednostavno!!!
i tu ja trebam da se nasmijem a? :x :x :x :x
da ga smijem formatirat, davno bih to uradila, ali u mojoj firmi se smijes bez pitanja i odobrenja samo pocesat po guzici, i to 4 puta dnevno!!!!!

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
danas se restartovao ravno 12 puta, jos jedan i ja ga bacam kroz prozor!
Ebo rad od 3 godine!!!!

PS ja ne surfam po porno sajtovima!

#16

Posted: 16/05/2007 16:39
by rashomon
ctrl+alt+del

i one procese (drugi tab, processes), jedan po jedan u google provjeri i vidi koji je dobar i koji je loš...

ove loše, desni klik i end process...

zatim search svaki taj loši .exe, i naravno delete

nakon toga sve te .exe fileove izbrisati iz registrija...Start>run> ukucaš regedit > edit > pa FIND opcija........ i jedan po jedan...

Nisam siguran da će uspjeti riješiti stvari do kraja, ali može pomoći...

Eto...

Poželjno bi bilo da to uradiš u safe modeu...

BTW, stranica na kojoj možeš provjeravati procese
http://www.liutilities.com/products/win ... rary/smss/

------------------------------------------------------------------------------

:D :D :D

BTW, ja se moram nasmijati...

#17

Posted: 16/05/2007 16:47
by mIRCerka
obicno vidim po 5 svchost.exe :S

#18

Posted: 16/05/2007 16:58
by rashomon
svchost.exe je ok...

#19

Posted: 16/05/2007 17:03
by mIRCerka
Image

#20

Posted: 16/05/2007 18:05
by JohnnyS
Probaj s avastom (besplatan za kućnu upotrebu), odmah testira memoriju i boot up tako da bi trebao odmah detektirati tu nesreću (imao sam i ja adobeR doduše na sticku, odmah ga je avast slistio)

#21

Posted: 16/05/2007 19:26
by hitman05
JohnnyS wrote:Probaj s avastom (besplatan za kućnu upotrebu), odmah testira memoriju i boot up tako da bi trebao odmah detektirati tu nesreću (imao sam i ja adobeR doduše na sticku, odmah ga je avast slistio)

Imao sam ovaj adobeR virus i na sticku i na hdd i avast ga je izbrisao, sad nema problema.

#22

Posted: 16/05/2007 21:27
by KAMI666
mIRC-i, ev ja nesto nasao za tebe ;) ....
---------------------------------

Solution:



Terminating the Malware Program

This procedure terminates the running malware process.
Open Windows Task Manager.
• On Windows 98 and ME, press
CTRL+ALT+DELETE
• On Windows NT, 2000, XP, and Server 2003, press
CTRL+SHIFT+ESC, then click the Processes tab.
In the list of running programs*, locate the process:
ADOBER.EXE
Select the malware process, then press either the End Task or the End Process button, depending on the version of Windows on your computer.
To check if the malware process has been terminated, close Task Manager, and then open it again.
Close Task Manager.
*NOTE: On computers running Windows 98 and ME, Windows Task Manager may not show certain processes. You can use a third party process viewer such as Process Explorer to terminate the malware process.

On computers running all Windows platforms, if the process you are looking for is not in the list displayed by Task Manager or Process Explorer, continue with the next solution procedure, noting additional instructions. If the malware process is in the list displayed by either Task Manager or Process Explorer, but you are unable to terminate it, restart your computer in safe mode.

Removing Autostart Entries from the Registry

Removing autostart entries from the registry prevents the malware from executing at startup.

If the registry entry below is not found, the malware may not have executed as of detection. If so, proceed to the succeeding solution set.
Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>
CurrentVersion>Run
In the right panel, locate and delete the entry:
RavAV = "%Windows%\ADOBER.EXE"
(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)
Close Registry Editor.

Deleting the Malware File(s)
Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
In the Named input box, type:
ADOBER.EXE.LOG
In the Look In drop-down list, select the drive that contains Windows, then press Enter.
Once located, select the file then press SHIFT+DELETE.

Important Windows ME/XP Cleaning Instructions

Users running Windows ME and XP must disable System Restore to allow full scanning of infected computers.

Users running other Windows versions can proceed with the succeeding solution set(s).

Running Trend Micro Antivirus

If you are currently running in safe mode, please restart your computer normally before performing the following solution.

Scan your computer with Trend Micro antivirus and delete files detected as WORM_RJUMP.D. To do this, Trend Micro customers must download the latest virus pattern file and scan their computer. Other Internet users can use HouseCall, the Trend Micro online virus scanner.

#23

Posted: 17/05/2007 00:56
by uhljupce
1. Otvori stick
2. Folder options -View - zakaci: Show hiden files, otkaci: Hide extension ... i Hide protected ....
2. Ugasi adobeR proces (u task menadzeru :D :D glupe li rijeci)
3. Izbrisi adobeR.exe autorun.inf i jos jedan dll fajl koji ce se pokazat nakon sto ukljucis Hide extension ...

To je to ... Samo pregledaj imas AdobeR i na internim diskovima u kompu, jer ako ga imas opet ce ti se iskopirat na svaki USB drive koji nakacis na komp ...