Šta je novo?
Od:
Filteri

Virus,rootkit...???

  • Začetnik teme Začetnik teme cipela
  • Datum pokretanja Datum pokretanja
cipela

cipela

Slavan
Učlanjen(a)
09.03.2007
Poruke
139
Poena
319
E ovako,imam veliki problem sa Winom.Problem je to da ja vise nisam admin na svom pc-u vec samo user i kao user nemam pristup bitnim stvarima(control panel,sat itd..).To se desilo kad je moj brat skinuo sve i svasta sa LW ne obracajuci paznju na Avastova upozorenja,tako da sam te veceri preko spybota nasao 14 trojanaca i ne znam tacno koliko virusa preko Avasta.Sve sam to obrisao medjutim ostao mi je gore pomenuti problem.Probao sam skoro sve anti-rootkitove i nijedan nije naso nista,ali je Rootkit Unhooker nasao fajl u registriju koga nije mogao da skenira,a mora da moze da pristupi svima,tako da ja sumnjam da se mozda unutra krije rootkit,ali ne znam da li smem da obrisem.Format bih uradio kao zadnju opciju,tak da je svaki savet dobrodosao.
 
Verovatno si skenirao sistem u safe modu,probaj da skines AVG Antispyware i probaj sa njim.
 
Skenirao sam u normalnom modu i pri podizanju wina i nista.Od anti-spyware sam koristio spybot,supera anti-spyware pro,pomenuti avg,ad-aware pro,i ono sto su propustila ova poslednja 3 nalazio je spybot,ali nista mi nije pomoglo.Stvarno ne znam sta dalje da radim...
 
Ako jos imas instaliran SUPERAntiSpyware idi u Preferences>Repairs pa pokusaj odatle da popravis Reg modifikacije. Ne verujem da imas rootkit, ovo je odlican primer Zlob & Co. 🙂P) infekcije... samo ti je neke kljuceve u reg bazi podesio kako ne treba. Javi ako je pomoglo (ta opcija u SASu je bas namenjena za ovakve situacije).

Edit:
Ako to ne pomogne pogledaj ovaj link.
 
Poslednja izmena:
Probao sam ovo sa repairom al nista.Inace taj spomenuti Zlob mi je nalazio spybot svaki put iako sam ga prethodno obrisao,u pitanju je Zlob.DNSChanger.Inace onaj fajl u registriju sam nasao preko rootkit revealer-a ne unhooker-a i probao da obrisem al ne moze:wall::wall::wall😛omagajte!!!
 
cipela je napisao(la):
Probao sam ovo sa repairom al nista.Inace taj spomenuti Zlob mi je nalazio spybot svaki put iako sam ga prethodno obrisao,u pitanju je Zlob.DNSChanger.Inace onaj fajl u registriju sam nasao preko rootkit revealer-a ne unhooker-a i probao da obrisem al ne moze:wall::wall::wall😛omagajte!!!
Kliknite za proširenje...
Napisi celu putanju Zlob-a.
 
Probao sam sa fixwareoutom i evo ga log skeniranja:
Kod: 
Username "User" - 16.10.2007 20:45:34 [Fixwareout edited 9/01/2007]

~~~~~ Prerun check


System was rebooted successfully. 
 
~~~~~ Postrun check 
HKLM\SOFTWARE\~\Winlogon\ "system"="" 
....
....
~~~~~ Misc files. 
....
~~~~~ Checking for older varients.
....

~~~~~ Current runs (hklm hkcu "run" Keys Only)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"SoundMan"="SOUNDMAN.EXE"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\""
"RemoteControl"="\"C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\""
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
"UnlockerAssistant"="\"C:\\Program Files\\Unlocker\\UnlockerAssistant.exe\""
"DAEMON Tools-1033"="\"C:\\Program Files\\D-Tools\\daemon.exe\"  -lang 1033"
"Hotkey"="C:\\Program Files\\Hotkey\\Hotkey.exe"
"USB Keyboard"="C:\\Program Files\\USB Keyboard Driver\\kb_2k.exe"
"LogMeIn GUI"="\"C:\\Program Files\\LogMeIn\\x86\\LogMeInSystray.exe\""
"RivaTunerStartupDaemon"="\"C:\\Program Files\\RivaTuner v2.03\\RivaTuner.exe\" /S"
"F-Secure Manager"="\"C:\\Program Files\\F-Secure Internet Security\\Common\\FSM32.EXE\" /splash"
"F-Secure TNB"="\"C:\\Program Files\\F-Secure Internet Security\\FSGUI\\TNBUtil.exe\" /CHECKALL /WAITFORSW"
"avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"updateMgr"="\"C:\\Program Files\\Adobe\\Acrobat 7.0\\Reader\\AdobeUpdateManager.exe\" AcRdB7_0_9"
"swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.2.1128.5462\\GoogleToolbarNotifier.exe"
"SUPERAntiSpyware"="C:\\Program Files\\SUPERAntiSpyware\\SUPERAntiSpyware.exe"
....

evo ga i log sa Smitfraudom,ciscenje uradjeno iz safemoda

Kod: 
SmitFraudFix v2.240

Scan done at 20:33:46,01, uto 16.10.2007
Run from C:\Documents and Settings\User\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» DNS Before Fix

Description: WAN (PPP/SLIP) Interface
DNS Server Search Order: 194.106.162.10
DNS Server Search Order: 194.106.162.2

HKLM\SYSTEM\CCS\Services\Tcpip\..\{05F2FBED-8E6F-46AF-ACE4-F23C52FCD85E}: DhcpNameServer=208.67.220.220,208.67.222.222 
HKLM\SYSTEM\CCS\Services\Tcpip\..\{64E47C19-D30A-4AAD-AC1E-13CC6D1A3626}: NameServer=194.106.162.10 194.106.162.2
HKLM\SYSTEM\CCS\Services\Tcpip\..\{77CFD082-833E-4ACE-ABE6-1FC5BF45F866}: DhcpNameServer=208.67.220.220,208.67.222.222 
HKLM\SYSTEM\CCS\Services\Tcpip\..\{77CFD082-833E-4ACE-ABE6-1FC5BF45F866}: NameServer=208.67.220.220,208.67.222.222 
HKLM\SYSTEM\CS3\Services\Tcpip\..\{05F2FBED-8E6F-46AF-ACE4-F23C52FCD85E}: DhcpNameServer=208.67.220.220,208.67.222.222 
HKLM\SYSTEM\CS3\Services\Tcpip\..\{64E47C19-D30A-4AAD-AC1E-13CC6D1A3626}: NameServer=194.106.162.10 194.106.162.2
HKLM\SYSTEM\CS3\Services\Tcpip\..\{77CFD082-833E-4ACE-ABE6-1FC5BF45F866}: DhcpNameServer=208.67.220.220,208.67.222.222 
HKLM\SYSTEM\CS3\Services\Tcpip\..\{77CFD082-833E-4ACE-ABE6-1FC5BF45F866}: NameServer=208.67.220.220,208.67.222.222 
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: NameServer=208.67.220.220,208.67.222.222 
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: NameServer=208.67.220.220,208.67.222.222 

»»»»»»»»»»»»»»»»»»»»»»»» DNS After Fix

Iz safe moda sam mogao pristupiti kao admin ali dalje nisam imao te opcije(control panel,nemogucnost menjanja backgrounda...).Supera nije nasla nista a Spybot ne nalazi vise Zlob vec samo Cydoor.I jos nesto posle ciscenja fixwareout-om startup mi je dosta brzi.Ne znam sta dalje da radim:wall:
 
Poslednja izmena:
Pročitaj na forumu,link sam ti dao u prethodnom postu,imaš detaljno uputstvo koje programe da koristiš i na koji način da ukloniš Zlob.Koliko vidim i tebi se kao i postu na ovom forumu javlja isti ulaz u registriju
HKLM\SYSTEM\CCS\Services\Tcpip\..\{05F2FBED-8E6F-46AF-ACE4-F23C52FCD85E}: DhcpNameServer=208.67.220.220,208.67.222.222
koji preporučuju da se obriše pomoću HiJackThis,pa ako se ništa ne popravi onda i sa fixwareoutom.I da obrišeš i restore pointe.
 
Poslednja izmena:
Okaci ovde HijackThis log, kada skines HJ preimenuj ga u nesto drugo (bla.exe na primer) i klikni na Do a System scan and save a logfile. Taj log kopiraj ovde... izgleda da si delimicno resio problem do sada...

Da li imas instaliran i Avast! i F-Secure?(vidim po logu od Fixwareout-a)

Da ti nije RootkitRevealer detektovao ova dva kljuca:
HKLM\Security\Policy\Secrets\SAC*
HKLM\Security\Policy\Secrets\SAI*

Ako jeste onda nemas frke... to na svakoj masini se detektuje.

Edit: mozda imas jos infekcija pored DNSChanger-a pa sam zato trazio HJT log.
 
Poslednja izmena:
Maratonac hvala na linku,uradio sam te stvari al nista,jedino nisam koristio HJT,koji cu veceras da skinem i da skeniram.Imam i Avast i F-Secure,i da je moj brat nije dirao Avasta bilo bi sve u redu,a FS sam skino posle infekcije al ni to nije pomglo a sad ne mogu da ga obrisem jer nemam pristup Control Panelu.Javljam veceras sta sam uradio.
Edit:
Evo ga i log sa HJT:
Kod: 
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 0:09:22, on 17.10.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
C:\WINDOWS\system32\slserv.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
C:\Program Files\F-Secure Internet Security\FSPC\fspc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\F-Secure Internet Security\FSAUA\program\fsus.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\slrundll.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MessengerDiscovery\MessengerDiscovery Live.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Opera\Opera.exe
C:\Documents and Settings\User\Desktop\bla.exe

R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [Hotkey] C:\Program Files\Hotkey\Hotkey.exe
O4 - HKLM\..\Run: [USB Keyboard] C:\Program Files\USB Keyboard Driver\kb_2k.exe
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.03\RivaTuner.exe" /S
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: MutiKeyboard Driver.lnk = C:\Program Files\MultiKeyboard Driver\KbdDrv.exe
O4 - Global Startup: DSLMON.lnk = ?
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Parental... - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: Parental... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {8436FE12-31DB-48BF-83BF-FE682F9160B4} (NanoInstaller Class) - http://www.nanoscan.com/cabs/nanoinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{64E47C19-D30A-4AAD-AC1E-13CC6D1A3626}: NameServer = 194.106.162.10 194.106.162.2
O17 - HKLM\System\CCS\Services\Tcpip\..\{77CFD082-833E-4ACE-ABE6-1FC5BF45F866}: NameServer = 208.67.220.220,208.67.222.222 
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 
O17 - HKLM\System\CS4\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI\RpcSandraSrv.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exe

--
End of file - 9578 bytes
Sta treba da brisem,posto sa ovim veze nemam.Izvinite ako smaram,al ne bih da jos vise upropastim PC.
 
Poslednja izmena:
cipela je napisao(la):
O17 - HKLM\System\CCS\Services\Tcpip\..\{64E47C19-D30A-4AAD-AC1E-13CC6D1A3626}: NameServer = 194.106.162.10 194.106.162.2
O17 - HKLM\System\CCS\Services\Tcpip\..\{77CFD082-833E-4ACE-ABE6-1FC5BF45F866}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS4\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222

Sta treba da brisem,posto sa ovim veze nemam.Izvinite ako smaram,al ne bih da jos vise upropastim PC.
Kliknite za proširenje...
Ovo treba da brises, 194.106.162.10 bi trebalo da si ti na beotelu a problem je 208.67.222.222.
maratonac je napisao(la):
Pogledaj ovaj forum imaš objašnjenje kako se uklanja Zlob.DNSChanger
http://forums.techguy.org/malware-removal-hijackthis-logs/637011-solved-zlob-dnschanger.html
Kliknite za proširenje...
maratonac ti je dao odlican link, samo treba da ponovis.
 
Link je odlican, hvala Maratoncu jos jednom,HJT sam bio ostavio za kraj.Obrisao sam ono sto je navedeno,al i problem nazalost i dalje postoji.Probao sam i da uradim nove restore point-ove kao sto je lik sa datog saja naveo al ne mogu jer nisam admin:wall:Izgleda da mi ne gine format...
 
Poslednja izmena:
cipela je napisao(la):
Link je odlican, hvala Maratoncu jos jednom,HJT sam bio ostavio za kraj.Obrisao sam ono sto je navedeno,al i problem nazalost i dalje postoji.Probao sam i da uradim nove restore point-ove kao sto je lik sa datog saja naveo al ne mogu jer nisam admin:wall:Izgleda da mi ne gine format...
Kliknite za proširenje...
Pitanje pre formatiranja: scan i brisanje radis iskljucivo u safe mod-u, system restore iskljucen?
 
Da samo sto ne mogu da iskljucim sr jer nisam admin tj nemam njegove funkcije,cak ni u safe modu.Sad narezati 40 diskova i format:wall:Hvala svima na pomoci i trudu:wave:
 
Poslednja izmena:
Jesi li koristio Brute Force Uninstaler,pošto je i on pominjan u postu na onom forumu?
 
Morate se prijaviti ili registrovati da odgovorite ovde.
Nazad
Vrh Dno