Problem sa resetom PCa i poruka ?

[Dark Angel]

Racunar se iz cista mira povremeno resetuje uz poruku (attachment )

 

[-Marko-]

Bice da je neki virus. Kada izbaci tu poruku, upali cmd i kucaj shutdown -a. To bi trebalo da iskljuci gasenje racunara. Koji firewall i antivirus imas?

Verovatno je u pitanju Sasser Worm ili nesto na tu temu. Ako imas originalan os to se resava preko update-a pomocu Security Update for Windows XP (KB835732). Ako nemas moze i ovako: http://www.microsoft.com/downloads/...9E-DA3F-43B9-A4F1-AF243B6168F3&displaylang=en ali nisam siguran da li ima neku genuine proveru.


Poz

 

[Dark Angel]

skinuo sam KB835732 ali prilikom instalacije prijavi mi da mi je SP noviji i da nema potrebe da se intalira KB835732.

koristim avg

 

[milika]

zafrknuto, neki od critical servisa ti puca, virus, memorija, losa instalacija, ploca, cpu, sve to mere bit... idi redom, najjeftinije pa ka najskupljem i testiraj...

 

[-Marko-]

Iskreno, avg i nije nesto u poslednje vreme jos od verzije 7.5. Ako te mrzi da predjes na neki drugi antivirus, skini za pocetak malwarebytes i skeniraj racunar iz safe mode-a a pusti avg kada si vec tu.
Probaj to pa da vidimo sta cemo dalje..

Poz

 

[Dark Angel]

evo sta je pronasao malwarebytes

Malwarebytes' Anti-Malware 1.42
Database version: 3392
Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

19/12/2009 01:41:08 PM
mbam-log-2009-12-19 (13-41-08).txt

Scan type: Quick Scan
Objects scanned: 109755
Time elapsed: 7 minute(s), 7 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 5

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysgif32 (Trojan.Proxy) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\Temp\~TM80.tmp (Trojan.Proxy) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\xiilcppw.sys (Rootkit.Agent) -> Delete on reboot.
C:\Documents and Settings\DJ\Desktop\Malwarebytes_Anti_Malware_1_41_crack.torrent (Dont.Steal.Our.Software) -> Quarantined and deleted successfully.
C:\Documents and Settings\DJ\Application Data\avdrn.dat (Malware.Trace) -> Quarantined and deleted successfully.
C:\Documents and Settings\LocalService\Application Data\fvgqad.dat (Malware.Trace) -> Quarantined and deleted successfully.

 

[-Marko-]

Ajde da vidimo da li ce to biti dovoljno. Ako nastavi sa gasenjem moraces da probas sa nekim drugim ativirusom, mozda portabilni clamwin (iz safe mode-a, naravno i kada avg nije aktivan) ili da predjes na aviru ili avast..

Za svaki slucaj proveri gde ti se nalazi services.exe.

Poz

 

[Igoritza]

ne juri odma sa virusom. mozda je virus BIO, a vishe ga nema, i u medjuvremenu korumpirao neshto od navedenog:

winlogon.exe

svchost.exe

uzmi i proveri na file info sajtovima vrednosti ta dva fajla, odnosno njihovu velichinu, sa onim koji su potvrdjeni da rade.

isto, ako znash kako - vidi da ih zamenish sa cd-a windows-a, jer ovaj shutdown izaziva upravo neregularno vrshenje jednog od ova dva procesa.