virus

[shiljak]

evo vako. Probao sa Avast-om i sa NOD32 i nista. NOD32 mi samo kaze da ce ga izbrisati nakon restart-a ali opet isto...Probao preko safe moda i nije mi dao da ga izbrisem, probao sa jednim programom (posto ga nisam mogao samo delete, kaze da je zazet....)i ja ga tako izgasim i odma mi siseem padne (nema nista na monitoru osim jedne crtice "_"), ali kad upalim COMP ponovo radi sve kako treba samo sto mi virus ostane...I sto je najgore cim se konektujem na internet i virus ide na internet pa mi konekcija bude jos gora...
evo gdje se nalazi:C:\WINDOWS\system32\khffcab.dll
i jos mi antivirus kaze:
Event occurred at an attempt to access the file by the application: \??\C:\WINDOWS\system32\winlogon.exe.
---------------------------
E haj ljudi pomazite

[Lisac]

shiljak josipe druzhe broze

daj josh malo informacija mozhda ne bi bilo zgoreg znati i o kojem je virusu rijech mozhda i kompletan log od avasta ili NOD-a ako necesh da ti preporuchimo MAXFLU ili COLDREX

[shiljak]

shiljak josipe druzhe broze

daj josh malo informacija mozhda ne bi bilo zgoreg znati i o kojem je virusu rijech mozhda i kompletan log od avasta ili NOD-a ako necesh da ti preporuchimo MAXFLU ili COLDREX

Jel ovo:

Code: Select all

Time	Module	Object	Name	Threat	Action	User	Information
16.9.2006 12:24:26	AMON	file	C:\WINDOWS\system32\khffcab.dll	probably unknown WIN32 virus		NT AUTHORITY\SYSTEM	Event occurred at an attempt to access the file by the application: \??\C:\WINDOWS\system32\winlogon.exe.

Kao sto pise, a i tracio sam po google-u, ovo je neki novi virus (mozda sam ja prvi zarazeni )
Takvih imam 100 poruka...evo jos po neki virus (mislim da se ti stvaraju zbog tog khffcab.dll-a)...

Code: Select all

Time	Module	Object	Name	Threat	Action	User	Information
16.9.2006 17:43:17	AMON	file	C:\System Volume Information\_restore{18318B3A-A841-43B5-9712-080DDFB25528}\RP24\A0027353.exe	probably a variant of Win32/TrojanDownloader.Adload.NAN trojan	quarantined - deleted	NT AUTHORITY\SYSTEM	Event occurred on a new file created by the application: C:\WINDOWS\System32\svchost.exe. The file was moved to quarantine. You may close this window. 

Code: Select all

Time	Module	Object	Name	Threat	Action	User	Information
16.9.2006 16:21:02	AMON	file	C:\System Volume Information\_restore{18318B3A-A841-43B5-9712-080DDFB25528}\RP24\A0027352.exe	probably unknown NewHeur_PE virus	quarantined - deleted	NT AUTHORITY\SYSTEM	Event occurred on a new file created by the application: C:\WINDOWS\System32\svchost.exe. The file was moved to quarantine. You may close this window. 

Code: Select all

Time	Module	Object	Name	Threat	Action	User	Information
16.9.2006 15:47:46	AMON	file	C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\RGU0Q5PI\loader[1].exe	Win32/TrojanDownloader.VB.NGW trojan	deleted	WINDOWSXP\shiljak	Event occurred at an attempt to access the file by the application: C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe.

Code: Select all

Time	Module	Object	Name	Threat	Action	User	Information
16.9.2006 14:58:37	AMON	file	C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\RGU0Q5PI\drsmartload195a[1].exe	Win32/TrojanDownloader.VB.NGV trojan	quarantined - deleted		Event occurred on a new file created by the application: C:\WINDOWS\system32\ssmc.exe. The file was moved to quarantine. You may close this window. 

Code: Select all

Time	Module	Object	Name	Threat	Action	User	Information
16.9.2006 14:58:28	AMON	file	C:\winde.exe	Win32/TrojanDownloader.VB.NGV trojan	quarantined - deleted		Event occurred on a new file created by the application: C:\WINDOWS\system32\ssmc.exe. The file was moved to quarantine. You may close this window. 

Code: Select all

Time	Module	Object	Name	Threat	Action	User	Information
15.9.2006 20:38:34	Kernel	file	C:\WINDOWS\System32\winupcd.exe	a variant of Win32/Rbot trojan		

Mislim da sam sve izbrisao viruse osim onog na pocetku (khffcab.dll)...
Eto sta jos hocete !!

[Saraswati]

Eto sta jos hocete !!

Mozel' muzicka, care?

[Lisac]

shiljak majstore imash trojanaca i helena bi ti na njima pozavidjela

kako stojimo sa firewallom legendo imamo li aktualizirane virusne liste

idemo od pochetka, barem ono shto je meni zapelo za oko a pishe sve misha mu diznijevog

A0027353.exe probably a variant of Win32/TrojanDownloader.Adload.NAN iako stoji da je u karantenu

A0027352.exe probably unknown NewHeur_PE virus
takodjer uklonjen iliti izoliran al' haj' znaj

i tako dalje red za redom iako su svi navodno rijesheni do ovog zadnjeg

C:\WINDOWS\System32\winupcd.exe a variant of Win32/Rbot trojan tu ne pishe da je a-virusni program ishta sa njim uradio

a program inache utiche na svashta neshto imash u ovom textu ispod opis i listu shtetnih procesa koje trojanac stvara a koji je sve su prilike instaliran od nekog spyware-a ili adware

UNSAFE Application/Process Description
Below is a basic description of the application/process you have selected. This application may not be safe to have on your computer. If this application is running on your computer, it is advised that you scan your computer for both viruses and spyware/adware immediately.
Summary : Worm.Rbot Variant.Process

Description : Worm.RBot appears in the system folder as many different file names that are all typically less than 100K in size.

Trojans are programs that can appear to serve a legitimate purpose but actually have an unwanted or harmful effect.

A large segment of trojan programs download other harmful software components to a user's PC without his/her knowledge.

This application is most likely downloaded and installed by another application that is considered to be adware or spyware.

Company : Unknown

Threat Level : Threat Level : 7
Category : TROJAN

Processes : MSNMSGR.EXE
MSNPLUS.EXE
IE.EXE
NTSSF.EXE
MSNMSNGR.EXE
WINDOWSUPFIXER.EXE
MINSVCS_R.EXE
KLJS_SERVER.EXE
WINSYSSVC.EXE
ISMINI.EXE
IEKM32.EXE
WINSYSDIR.EXE
WINUPCD.EXE
WINKRXM.EXE
TASKWIZ.EXE
TASKMNGR32.EXE
AD_ELMD.EXE
SYSMGR64.EXE
MSACONF.EXE
LOGO1_.EXE
WINFIXRAR.EXE
2236_32.DLL
WTLT32.EXE
TSHZ168.EXE
COCOMUSIC51.EXE
SETUP-168.EXE
SERVICE32.EXE

o rjeshenju problema kasnije sutra ako nadjem vremena za surfanje

a dotad, obzirom da si iskusan hacker probaj sam http://fileinfo.prevx.com/adware/qq4d02 ... D.EXE.html

ako ne upali javi

[amarce]

format disc C i rijesena stvar.Naravno to bi ti bila vjerovatno zadnja opcija ali uvijek pomaze.E taj NOD32 je sr**e.Cuj ON tako izvikat i sta ja znam ne jos nemoze da obrise(dezinfikuje) neki virus.Ubuduce koristi Bitdefender,Kaspersky ili F-secure.Naravno,sto neko vec spomenu,mozes koristiti i aspirin sumece sa C vitaminom,a nije los ni paracetamol-tabla 0.5KM

[shiljak]

Lisac, valjda ce pomoci to sto si mi dao/sto ces mi dati...
Valja skinuti 8MB...bar moze sa download menagerom
Ako ti ne javim nista to znaci da nisam rrjesio problem (ova 2-3 dana nisam mogao nikako da otvorim sarajevo-x)....

amarce-ovo mi je stari comp, i taman sam zaokruzio na 100-ju (formatiranja C-a)

[hool]

Meni je KASPERSKY sve ocistio

[EI Presidente]

Ma trial verzija Kasperskog ce ti pomoci, downloadiraj je i ostavi nek skenira preko noci (dugo traje prvi scan). Sutra ujutro-k'o nov

[shiljak]

e ljudi stvarno kaspersky je najbolji antivirus. Izbrisao mi sve zive viruse cak i onaj "khffcab". Nasao mi 32 virusa!!!