(riješeno) Nestaju exe fajlovi

[fanATIk]

Neki dan sam zbog problematičnog ponašanja windowsa, čačkanja po njima do totalnog kraha istih napravio format c i stavio novu instalaciju. Danas opet počelo. Prilikom dizanja windowsa dobijam ovu sličicu. I to u više izdanja s tim da je razlika samo u zadnjih par slova u poruci. Hm, wtf, da pokrenem nod32, kadli gle, nema exe datoteke. Dobijem ovu sličicu. Gledam šta još ne štima, pokrenem HL2:E2 i dobijem ovo. Da ne stavljam sličice dalje, nestao mi i steam, daemon tools, skype itd. Ista ona poruka BAD IMAGE mi se javljala i nedavno prilikom problema s prošlim windowsima i to učestalo. U čemu je problem? Da nije hard u qrcu? Ili instalacijski disk od windowsa da nije sheban? Unaprijed zahvaljujem.

[kasko]

hiti gore nove windowse...

[fanATIk]

Pa naveo sam da sam to neki dan napravio. I to očito ništa nije promijenilo.

[Codiac]

90% da si pobrao virus koji ti zdere exe fajlove... e sada najbolje bi bilo odfurati disk kod nekoga i procesljati sa AV kojem bi bio podesen high alert.

[fanATIk]

Yep, nanovo instalirao nod, našao 13 komada nekog đubreta. Čekam da dovrši do kraja pa restart pa da vidim.

[kasko]

nakon 13 virusa bi trebao staviti nove windowse... a ako su virusi bili problem reinstalacija windowsa je pomogla samo što nemaš dobar AV kad ima tako puno virusa...

[Hari Poter]

Skoro sam imao slican problem, a evo sta se tacno desilo:
Virus JEEFO se zalepio za sve .exe fajlove u racunaru
Antivirus je poceo da vristi i signalizira prisustvo virusa.
Prilikom ciscenja obrisao je i windows i sebe.
Od tada izbegavam nod.
Preporucujem AVAST, besplatan je za home user-e, a ume da ocisti .exe nedestruktivno.
pozdrav.
p.s. pitanje je da li bi jeefo napravio ikakvu stetu da nije bilo antivirusa.

[fanATIk]

yep, isti slučaj. nod32 instaliran i pobrisao exe fajlove za koje se zalijepio virus. i nije 13 virusa nego jedan koji se zalijepio za 13 fajlova.

[fanATIk]

Riječ je o mljgg.dll fajlu. Vundo džubre. I neda se s ničim skinut. Izgleda da mi ne gine reinstalacija vindouza.

[greenfly]

Probaj barem

http://www.symantec.com/security_res...112210-3747-99

ili

http://www.softpedia.com/progDownloa...oad-33165.html

to ti je Vundofix......evo i uputa :

• Double-click VundoFix.exe to run it.
• Put a check next to Run VundoFix as a task.
• You will receive a message saying vundofix will close and re-open in a minute or less. Click OK
• When VundoFix re-opens, click the Scan for Vundo button.
• Once it's done scanning, click the Remove Vundo button.
• You will receive a prompt asking if you want to remove the files, click YES
• Once you click yes, your desktop will go blank as it starts removing Vundo.
• When completed, it will prompt that it will shutdown your computer, click OK.
• Turn your computer back on.

[fanATIk]

Isprobano, ne radi. Ovo je vjerojatno malo novija verzija virusa i uopće ne doživljava taj vundofix.

[greenfly]

Onda makni Nod-a , pukni trial od Kasperskog,updejtaj database,očisti pa ako ti se ne sviđa vrati NOD.

Pogledaj i ovaj REMOVAL : Ne znam kako da ga attach-am jer ima linkova za neke alate i tutorijale pa ću ga paste-at:


Please download Process Explorer by Systernals from HERE

Also download KillBox by Option^Explicit from HERE


Then boot up in SAFE MODE

the rest of this fix must be done in safe mode.


Unzip Process Explorer and double click on procexp.exe

In the top section of the Process Explorer screen double click on winlogon.exe to bring up the winlogon.exe properties screen. Click on the Threads tab at the top.

Once you see this screen click on each instance of <bad file from 02 and 020> once and then click the kill button.

After you have killed all of the <bad file from 02 and 020> under winlogon click OK.

Also look for any .ini or bak files or other dll's with either the same name or the file name in reverse & kill them as well

Example:

<bad filename from 02 and 020>.bak
<bad filename from 02 and 020>.ini
<bad filename from 02 and 020>.reg etc

or

<bad filename(reversed) from 02 and 020>.dll
<bad filename(reversed) from 02 and 020>.bak
<bad filename(reversed) from 02 and 020>.ini etc

Next double click on explorer.exe and again click once on each instance of <bad file from 02 and 020> then click the kill button.

Also look for any .ini or bak files or reverse named dll's with either the same name or the file name in reverse & kill them as well. See above for examples

Click on the Threads tab at the top.

Once you have done that click OK again.

Next run HijackThis and place a check beside each of the following.


<Hijack fix goes here>

Now click fix checked and close HijackThis.

Please copy the text in BOLD below, and paste it into a blank notepad window.
Save it as vundo.reg and in the save as type box choose all files.

Once you have saved it double click it and allow it to merge with the registry.

REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B8B55274-0F9A-41E5-9067-A3539BD9E860}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{44240BB5-BD7D-4D49-A1AA-8AB0F3D3CB44}]

[-HKEY_CLASSES_ROOT\CLSID\{581F22DA-7202-4F21-AEF3-114787156016}]

[-HKEY_CLASSES_ROOT\CLSID\{B8B55274-0F9A-41E5-9067-A3539BD9E860}]

[-HKEY_CLASSES_ROOT\CLSID\{44240BB5-BD7D-4D49-A1AA-8AB0F3D3CB44}]

[-HKEY_CLASSES_ROOT\MSEvents.MSEvents]

[-HKEY_CLASSES_ROOT\MSEvents.MSEvents.1]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSEvents.MSEvents]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSEvents.MSEvents.1]

Double click on Killbox.exe and check the Delete on Reboot button.

Enter the following filepath and filename into the "Full path of file to delete" box:

<Full pathname of bad 02 and 020>

Click the red and white "Delete File" button.
Click "Yes" at the first prompt .
Click "No" at the second.

Repeat those same steps for any of the same named or reversed named .bak, .ini. reg, etc, files you may have found earlier.

Once you have entered in all the files, reboot.

After your computer has rebooted please run Hijackthis and post a new log.

==============================================

Optional Fix if problems are encountered when trying to Killbox the bad file:

Copy/paste the following quote box into a new text document.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B8B55274-0F9A-41E5-9067-A3539BD9E860}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{44240BB5-BD7D-4D49-A1AA-8AB0F3D3CB44}]

[HKEY_CLASSES_ROOT\CLSID\{581F22DA-7202-4F21-AEF3-114787156016}]

[HKEY_CLASSES_ROOT\CLSID\{B8B55274-0F9A-41E5-9067-A3539BD9E860}]

[HKEY_CLASSES_ROOT\CLSID\{44240BB5-BD7D-4D49-A1AA-8AB0F3D3CB44}]

[HKEY_CLASSES_ROOT\MSEvents.MSEvents]

[HKEY_CLASSES_ROOT\MSEvents.MSEvents.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSEvents.MSEvents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSEvents.MSEvents.1]

Double click on Killbox.exe and check the Delete on Reboot button.

Enter the following into the "Full path of file to delete" box:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B8B55274-0F9A-41E5-9067-A3539BD9E860}]

Click the red and white "Delete File" button.
Click "Yes" at the first prompt .
Click "No" at the second.

Repeat those same steps for each of the lines in the above quote box.

When done Copy/Paste this into the "Full path of file to delete" box:

<Full pathname of bad 02 and 020>

Click the red and white "Delete File" button.
Click "Yes" at the first prompt .
Click "Yes" at the second.



Bad file 02 i 020 se naravno odnosi na vundo zaraze u HJT-logu..

[fanATIk]

Riješeno. Nisam ni vidio ovaj tvoj post jerbo sam u međuvremenu našao neki sličan tvom. Al svejedno hvala. Riješio sam ga koristeći CrapCleaner i ComboFix. Konačno izbrisano. Maknuo NOD32, sad tražim alternativu. A dosad sam fakat bio zadovoljan NOD-om. Al ovo sad kad mi je pobrisao gomilu exe fajlova mu neću zaboravit.

Dakle, thread može bit preimenovan u Riješeno.