NOD 32

Mam NOD 32 v karantene mam tieto výrusy,čo mám stým robyť? win32 trojan downlander.ani.gen trojsky kôn win32 trojan downloander zlob.AYF trojsky kôn

Ktorý modul ich detekoval?

Vymazal som to,no zda sa mi že AMON

Takže sa na to budeme musieť pozrieť bližšie. Poprosím log z HijackThis, návod ako na to je tu:
http://www.pcforum.sk/postup-pri-cisteni-napadnuteho-pc-vt17087.html

aviro901-ako ti to mam poslať

Log skopíruj do príspevku na fórum.

Z karanteny sa mi to neda kopirovat?

On asi myslel ten virus

Sú tie trojany ešte v karanténe?


Tým logom myslím toto (posledný príspevok):
http://www.pcforum.sk/postup-pri-cisteni-napadnuteho-pc-vt17087.html

Ja viem,ale nemam tam možnosť kopiruj

Keď to budeš mať v poznámkovom bloku otvorené, daj: ctrl+A, ctrl+C, potom dáš kurzor do príspevku a stlačíš: ctrl+V

trojany su v karantenehttp://www.trendsecure.com/por ... his.php-to by som musel vedieť čo mam stým robyť?

http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe

Spustiť a to, čo robiť je v návode:
http://www.pcforum.sk/postup-pri-cisteni-napadnuteho-pc-vt17087.html

Mam ich na ploche no nemam vinRAR

Tu si prosím ten log.

Nejak mi to všetko blbne,dnes by som to nechal tak.Daju sa tie trojany dať naspeť do karanteny?

Áno, otvor karanténu a tam je pridať.


Ale ten log by si sem mohol hodiť, nech aspoň vidím, čo a ako chodí.

ako zbaliť trojany do win RAR,napiš postup?

Nejde mi to dať naspeť do karanteny

Ak si ch poslal, zmaž ich: shift+delete


A bude ten log z HijackThis?

Neposlal.Ked som ich dal naspeť do karanteny,prešli tam no na ploche zostali?

Tak buď ich pošli alebo nie. A potom ich zmaž aj z karantény, aj z plochy, aj odkiaľ chceš. A daj sem ten log.

Konečne tu mam ten Log:Logfile of HijackThis v1.99.1
Scan saved at 20:38:36, on 14. 8. 2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
C:\Program Files\ICQLite\ICQLite.exe
C:\WINDOWS\CameraFixer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Eset\nod32krn.exe
C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\NVIDIA\NetworkAccessManager\bin\nSvcIp.exe
C:\NVIDIA\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\WinRAR\WinRAR.exe
C:\DOCUME~1\Ludka\LOCALS~1\Temp\Rar$EX52.906\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.azet.sk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dl ... ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://localhost:3476/cgi-bin/ncgir.exe?menu/index.html
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = 192.168.1.10
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=192.168.1.10:3;gopher=192.168.1.10:3;http=192.168.1.10:1;https=192.168.1.10:2;socks=192.168.1.10:4
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PCLEPCI] C:\PROGRA~1\PINNAC~1\PPE\PPE.EXE
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
O4 - HKLM\..\Run: [ICQ Lite] "C:\Program Files\ICQLite\ICQLite.exe" -minimize
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [CameraFixer] C:\WINDOWS\CameraFixer.exe
O4 - HKLM\..\Run: [BigDog303] C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{894E3C27-EFD8-4CD0-91CB-25FC653A5C66}: NameServer = 195.146.128.60,195.146.132.59
O17 - HKLM\System\CCS\Services\Tcpip\..\{F68571C0-1C13-4705-AC94-7F40A28AE96E}: NameServer = 195.146.128.60,195.146.132.59
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\NVIDIA\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - Unknown owner - C:\NVIDIA\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

Fixni:

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer =
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\


Chýba firewall a pošleš ešte log zo starej verzie


Toto si odinštaloval?

Forceware Web Interface

Musiš mi to vysvetliť po lopaťe,som začiatočnik a mam stoho španielsku dedinu!

Fixni v HijackThis tak, že pri položke dáš fajku a po označení všetkých položiek zvolíš „Fix checked“:

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer =
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\


Toto by som fixol tiež, ale nie som si na 100% istý (len 99%):

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://localhost:3476/cgi-bin/ncgir.exe?menu/index.html


Toto je odinštalované?

Forceware Web Interface

Toto je odinštalované?

Forceware Web Interface -neviem,ako to zistim?

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://localhost:3476/cgi-bin/ncgir.exe?menu/index.html -Tak mam aj toto fixnúť?

Ja by som to fixol.


No, ak nemáš ten program, daj: štart - spustiť - services.msc - a tam zastav službu: Forceware Web Interface

Tak som to zastavil,bolo to spustene-a čo dalej?