rizal 1 Report post Posted April 16, 2008 (edited) Buat masa ni, saya dah install nod32 dlm pc akak saya.Tapi ada beberapa simptom.1)Ram yang didetect ialah 64 MB sahaja.sebenarnya RAM dia ialah 256 + 128 keping.cam na jadi camni?Virus ker?So, pc jd sgt lembab.2)Tray cd rom asik ndak terbukak ajer walaupun dah cuba tutup ngan tangan lepaih tutup dia kuar balik.ampeh la.3)WIndow task manager disabled.pelikla rasanya komp akaka sy administrator.bila masuk safe mode ada dua plak satu Administrator satu lagi akak saya punya .Kira dua akaun.Masa loading cam biasa x nampak pung akaun Administrator tuh.Bila check akaun akak ianya akaun administrator.Camna boleh ada 2 akaun?Laptop abg ipar plak1)Symantec antivirus asik detect ada banyak worm dlm laptop padahal nod 32 relaks aja cam x da apapung.Dah isap update dr internet pung still selamba xda apa2.Cuma symantec aja yg kecoh.Asik ada worm dlm mcm fail.saya bg scan log hijack this.Tolong tengok yer..Pc Akak PunyaLogfile of Trend Micro HijackThis v2.0.2Scan saved at 9:31:53 PM, on 15-Apr-08Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\System32\drivers\CDAC11BA.EXEC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\RVHOST.exeC:\WINDOWS\system32\UTSCSI.EXEC:\WINDOWS\RavMonE.exeD:\Scansoft Omnipage SE 4\OpwareSE4.exeC:\Program Files\Messenger\msmsgs.exeC:\WINDOWS\system32\RVHOST.exeC:\WINDOWS\system32\rundll32.exeG:\NOD32 Antivirus Software 2.70.32 + fix\NOD32 Antivirus Software 2.70.32 + fix.exeG:\NOD32 Antivirus Software 2.70.32 + fix\NOD32 Antivirus Software 2.70.32 + fix.exeG:\NOD32 Antivirus Software 2.70.32 + fix\NOD32 Antivirus Software 2.70.32 + fix.exeG:\NOD32 Antivirus Software 2.70.32 + fix\NOD32 Antivirus Software 2.70.32 + fix.exeG:\NOD32 Antivirus Software 2.70.32 + fix\NOD32 Antivirus Software 2.70.32 + fix.exeG:\NOD32 Antivirus Software 2.70.32 + fix\NOD32 Antivirus Software 2.70.32 + fix.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exeG:\ccsetup206.exeC:\DOCUME~1\RIZAL~1.RIZ\LOCALS~1\Temp\ytb3.exeC:\DOCUME~1\RIZAL~1.RIZ\LOCALS~1\Temp\GLB1B.tmpC:\DOCUME~1\RIZAL~1.RIZ\LOCALS~1\TEMP\YCOMP_~1.EXEC:\DOCUME~1\RIZAL~1.RIZ\LOCALS~1\Temp\GLB22.tmpC:\DOCUME~1\RIZAL~1.RIZ\LOCALS~1\Temp\GLJ24.tmpR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ali213.126.com/F2 - REG:system.ini: Shell=Explorer.exe RVHOST.exeO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO4 - HKLM\..\Run: [VTPreset] VTPreset.exeO4 - HKLM\..\Run: [RavAV] C:\WINDOWS\RavMonE.exeO4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startupO4 - HKLM\..\Run: [sSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -bootO4 - HKLM\..\Run: [OpwareSE4] "D:\Scansoft Omnipage SE 4\OpwareSE4.exe"O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICEO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [Yahoo Messengger] C:\WINDOWS\system32\RVHOST.exeO4 - HKUS\S-1-5-18\..\Run: [Tok-Cirrhatus] "C:\Documents and Settings\NetworkService\Local Settings\Application Data\smss.exe" (User 'SYSTEM')O4 - HKUS\S-1-5-18\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')O4 - HKUS\S-1-5-18\..\Run: [Yahoo Messengger] C:\WINDOWS\system32\RVHOST.exe (User 'SYSTEM')O4 - HKUS\.DEFAULT\..\Run: [Tok-Cirrhatus] "C:\Documents and Settings\NetworkService\Local Settings\Application Data\smss.exe" (User 'Default user')O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dllO17 - HKLM\System\CCS\Services\Tcpip\..\{3BA0398D-CF1B-4AA2-A1F3-FF38BDC04BD2}: NameServer = 202.188.0.133,202.188.1.5O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXEO23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exeO23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exeO23 - Service: USBest Service Zero (UTSCSI) - USBest - C:\WINDOWS\system32\UTSCSI.EXE--End of file - 4166 bytesLaptop abg ipar punyaLogfile of Trend Micro HijackThis v2.0.2Scan saved at 9:05:38 PM, on 4/15/2008Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exeC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exeC:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Symantec AntiVirus\DefWatch.exeC:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXEC:\Program Files\Eset\nod32krn.exeC:\Program Files\CyberLink\Shared files\RichVideo.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Symantec AntiVirus\Rtvscan.exeC:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exeC:\WINDOWS\system32\igfxtray.exeC:\WINDOWS\system32\hkcmd.exeC:\WINDOWS\system32\igfxpers.exeC:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exeC:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exeC:\Program Files\Apoint2K\Apoint.exeC:\Program Files\Java\jre1.6.0_05\bin\jusched.exeC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\PROGRA~1\SYMANT~1\VPTray.exeC:\WINDOWS\system32\igfxsrvc.exeC:\Program Files\Cyberlink\Shared Files\brs.exeC:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exeC:\Program Files\Eset\nod32kui.exeC:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exeC:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exeC:\Program Files\Apoint2K\Apntex.exeC:\Program Files\Hewlett-Packard\Shared\HpqToaster.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Eset\nod32.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.swisspac.com.my/R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://codecs.r8.org/R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dllO2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dllO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllO3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dllO4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNCO4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMENameO4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exeO4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exeO4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exeO4 - HKLM\..\Run: [uCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /StartO4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exeO4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exeO4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exeO4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exeO4 - HKLM\..\Run: [iMSCMIG40W] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40W\IMSCMIG.EXE /SetPreload /LogO4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"O4 - HKLM\..\Run: [bDRegion] C:\Program Files\Cyberlink\Shared Files\brs.exeO4 - HKLM\..\Run: [sSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -bootO4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICEO4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - Global Startup: Bluetooth.lnk = ?O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htmO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLLO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dllO17 - HKLM\System\CCS\Services\Tcpip\..\{68FCF0F2-6DA4-4153-9FEC-11AB8B15F642}: NameServer = 202.188.0.133 202.188.1.5O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exeO23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exeO23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exeO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeO23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exeO23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exeO23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXEO23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exeO23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exeO23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeO23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exeO23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exeO23 - Service: XAudioService - Conexant Systems, Inc. - C:\WINDOWS\system32\DRIVERS\xaudio.exe--End of file - 7956 bytesSaya ucapkan terima kasih berbanyak... Edited April 16, 2008 by rizal Quote Share this post Link to post Share on other sites
Hiruka 4 Report post Posted April 16, 2008 Buat masa ni, saya dah install nod32 dlm pc akak saya.Tapi ada beberapa simptom.1)Ram yang didetect ialah 64 MB sahaja.sebenarnya RAM dia ialah 256 + 128 keping.cam na jadi camni?Virus ker?So, pc jd sgt lembab.2)Tray cd rom asik ndak terbukak ajer walaupun dah cuba tutup ngan tangan lepaih tutup dia kuar balik.ampeh la.3)WIndow task manager disabled.pelikla rasanya komp akaka sy administrator.bila masuk safe mode ada dua plak satu Administrator satu lagi akak saya punya .Kira dua akaun.Masa loading cam biasa x nampak pung akaun Administrator tuh.Bila check akaun akak ianya akaun administrator.Camna boleh ada 2 akaun?Laptop abg ipar plak1)Symantec antivirus asik detect ada banyak worm dlm laptop padahal nod 32 relaks aja cam x da apapung. Dah isap update dr internet pung still selamba xda apa2.Cuma symantec aja yg kecoh.Asik ada worm dlm mcm fail.1. Cuba try bukak notebook tu. cabut, bersihkan gold plate RAM tu guna pemadam. pasang blik try boot. pastikan msuk btul².2. Klik start > run > dxdiag. cek jumlah RAM. klu tepat kira ok.3. Window task manager disable ader 2 kemungkinan. 1st, technician setting (klu die sengal la)..2nd, Virus attack. Cara nk retrieve task manager guna internal setting: Start > Run > taip gpedit.msc > Admin template > System > CTRL+ALT+DEL option > Remove Task Manager > tick Disable > apply & OK.Administrator account pada safe mode adalah normal. Bukan virus ke ape. itu mmg khas untuk system admin, contoh jika lost user password leh msuk safe mode ikut situ retrieve/tukar password.4. Aku sarankn ko donlod antispyware nih. SUPERantispyware yg free je. Lepas install run system scan. Delete yg mane dier detect. pastu reboot.5. Klu masih ade probs, aku rase better ko buat system fix guna windows XP CD. Jgn ko tersalah msuk format lak. Nangis nnti 6. Symantec Antivirus aku tak baper suka. System load berat. Klu takat memory 1GB kebawah. mmg cam siput pc..tukarla kepada Antivirus lain cam Bitdefender Pro/Plus/2008 or Kapersky or ESET Nod32..ni rank bagus nyer software..klu tak update serupa gak So papehal report lepas wat sumer nih..tgk amacam system ko.. Quote Share this post Link to post Share on other sites
BasicCX 27 Report post Posted April 16, 2008 Buat masa ni, saya dah install nod32 dlm pc akak saya.Tapi ada beberapa simptom.1)Ram yang didetect ialah 64 MB sahaja.sebenarnya RAM dia ialah 256 + 128 keping.cam na jadi camni?Virus ker?So, pc jd sgt lembab.2)Tray cd rom asik ndak terbukak ajer walaupun dah cuba tutup ngan tangan lepaih tutup dia kuar balik.ampeh la.3)WIndow task manager disabled.pelikla rasanya komp akaka sy administrator.bila masuk safe mode ada dua plak satu Administrator satu lagi akak saya punya .Kira dua akaun.Masa loading cam biasa x nampak pung akaun Administrator tuh.Bila check akaun akak ianya akaun administrator.Camna boleh ada 2 akaun?Laptop abg ipar plak1)Symantec antivirus asik detect ada banyak worm dlm laptop padahal nod 32 relaks aja cam x da apapung.Dah isap update dr internet pung still selamba xda apa2.Cuma symantec aja yg kecoh.Asik ada worm dlm mcm fail.RAM ni masa mula-mula install & sebelum perkara ni berlaku memang detect betul 384 MB atau tidak? Kalau tidak kemungkinan RAM tersebut adalah high-density RAM. Sila gunakan RAM jenis low-density.Berikut terdapat dua jenis TROJAN di dalam komputer kakak ko iaitu RVHOST & RAVMONE:C:\WINDOWS\system32\RVHOST.exeC:\WINDOWS\RavMonE.exeC:\WINDOWS\system32\RVHOST.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ali213.126.com/F2 - REG:system.ini: Shell=Explorer.exe RVHOST.exeO4 - HKLM\..\Run: [RavAV] C:\WINDOWS\RavMonE.exeO4 - HKCU\..\Run: [Yahoo Messengger] C:\WINDOWS\system32\RVHOST.exeO4 - HKUS\S-1-5-18\..\Run: [Yahoo Messengger] C:\WINDOWS\system32\RVHOST.exe (User 'SYSTEM')O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1Laptop abang ipar kau OK. NOD32, keupayaan mengesan memang telah disetkan supaya tidak terlalu sensitif. Maka, seperti yg anda katakan anda, WORM biasanya masuk PC anda melalui installatasi toolbar, shareware, freeware program ke dalam PC. Quote Share this post Link to post Share on other sites
baok 0 Report post Posted April 18, 2008 (edited) Hello...Pc Akak Punya1. Download Flash_Disinfector oleh sUBs dan run.. Pastikan attach sekali pendrive yang selalu digunakan kat PC tu..2. Carik dan delete file nihC:\WINDOWS\system32\RVHOST.exe C:\WINDOWS\RavMonE.exe G:\NOD32 Antivirus Software 2.70.32 + fix\NOD32 Antivirus Software 2.70.32 + fix.exe C:\Documents and Settings\NetworkService\Local Settings\Application Data\smss.exe3. Fix entry nih dalam HijackThisF2 - REG:system.ini: Shell=Explorer.exe RVHOST.exeO4 - HKLM\..\Run: [RavAV] C:\WINDOWS\RavMonE.exeO4 - HKCU\..\Run: [Yahoo Messengger] C:\WINDOWS\system32\RVHOST.exeO4 - HKUS\S-1-5-18\..\Run: [Tok-Cirrhatus] "C:\Documents and Settings\NetworkService\Local Settings\Application Data\smss.exe" (User 'SYSTEM')O4 - HKUS\S-1-5-18\..\Run: [Yahoo Messengger] C:\WINDOWS\system32\RVHOST.exe (User 'SYSTEM')O4 - HKUS\.DEFAULT\..\Run: [Tok-Cirrhatus] "C:\Documents and Settings\NetworkService\Local Settings\Application Data\smss.exe" (User 'Default user')O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)4. Download ATF Cleaner oleh Atribune. Tandakan semua yg ko rasa patut dan run.5. Restart PC.. Download Deckard System Scanner.. dan run.. Yes atau Ok kan ajer ape-ape pop-up.. Nanti ada dua log (main.txt dan extra.txt) pos kan dua-dua sekali log dia kat sini...Laptop abg ipar punya1. Ada dua antivirus.. Norton dan NOD32... uninstall salah satu dari dua-dua tu..2. Download Deckard System Scanner.. dan run.. Yes atau Ok kan ajer ape-ape pop-up.. Nanti ada dua log (main.txt dan extra.txt) pos kan dua-dua sekali log dia kat sini...3. Buat online scan dengan Kaspersky WebScannerInstall dia punya ActiveXKat scan setting, select nihScan using the following Anti-Virus database: ExtendedScan Options: Scan Archives dan Scan Mail BasesKat "select a target to scan": pilih My ComputerKemudian post kan semua log kat sini.. Edited April 18, 2008 by baok Quote Share this post Link to post Share on other sites
MindaIM 0 Report post Posted April 18, 2008 banyaknya teknik dalam nie..tapi cam susah nak paham jer..kalau ko nak jadi penggempur virus, ko leh masuk kat http://viruskillz.blogspot.com Quote Share this post Link to post Share on other sites
baok 0 Report post Posted April 21, 2008 (edited) Rizal.. yg hijackthis akak punya pc tu log lama bukan barudan saya mintak dss log bukannya hijackthisok..yg pc abang ipar tu baru format ker 28/3 aritu. log nampak ok pada aku. tapi abang ipar kau ada 2 antivirus dan 2 firewallantivirus tu Symantec dan ESET manakala firewall pulak Symantec dan Comodo. jangan dengar kata orang yg ada banyak firewall dan antivirus tu bagus. diorang tak tau apa-apa sebenarnya. buang satu antivirus dan satu firewall.aku cadangkan ko buang Symantec/Norton dan tinggalkan ESET dan Comodo dalam pc abg ipar ko.dan postkan kaspersky online kat siniatau lebih baik lagi.. masuk laman web nih dan pilih mana-mana forum yg tertera kt belah kiri website tu..http://asap.maddoktor2.com/ Edited April 21, 2008 by baok Quote Share this post Link to post Share on other sites
Ku2_BiO_X 0 Report post Posted April 21, 2008 3)WIndow task manager disabled.pelikla rasanya komp akaka sy administrator.bila masuk safe mode ada dua plak satu Administrator satu lagi akak saya punya .Kira dua akaun.Masa loading cam biasa x nampak pung akaun Administrator tuh.Bila check akaun akak ianya akaun administrator.Camna boleh ada 2 akaun?Laptop abg ipar plak1)Symantec antivirus asik detect ada banyak worm dlm laptop padahal nod 32 relaks aja cam x da apapung.Dah isap update dr internet pung still selamba xda apa2.Cuma symantec aja yg kecoh.Asik ada worm dlm mcm fail.pasal akaun Administrator tu, benda tu mmg camtu...kalau nak selamat, letak password kat akaun Admin tu..kalau x, org lain leh masuk sesuka ati jer..pasal laptop abg ipar ko, aku dulu guna norton jugak...tiap kali scan mesti ade worm, pastu tak boleh delete...aku pun x faham; skrg ni guna KIS7..biasanya kalau ko nak bersihkan virus RVHOST.exe, ko kena delete sekali file dia kat system32 tu, kalau tak, ko restart nanti dia ada balik...mula2 sekali buang source dia, than baru repair benda2 lain contohnya task man, regedit dll... Quote Share this post Link to post Share on other sites
rizal 1 Report post Posted April 22, 2008 camna ndak buang symantec?sy dah uninstall, tapi sebahagian file dia masih ada. Quote Share this post Link to post Share on other sites
rizal 1 Report post Posted April 22, 2008 dah cuba delete folder dia tp x boleh. Quote Share this post Link to post Share on other sites
mfaizul89 3 Report post Posted April 22, 2008 camna ndak buang symantec?sy dah uninstall, tapi sebahagian file dia masih ada.tulah salah satu problm symantec...aku pun x tahu cam ner nak wat...klau dah uninstall, ttp ada jgak, folder pun delete x bleh... adeh...ok, sy dah wat apa yg korang siruh, cuma bab scanning guna kapersky aja belum sempatC:\WINDOWS\system32\RVHOST.exeC:\WINDOWS\system32\UTSCSI.EXEC:\WINDOWS\RavMonE.exeC:\WINDOWS\system32\RVHOST.exeC:\WINDOWS\system32\rundll32.exeG:\NOD32 Antivirus Software 2.70.32 + fix\NOD32 Antivirus Software 2.70.32 + fix.exeG:\NOD32 Antivirus Software 2.70.32 + fix\NOD32 Antivirus Software 2.70.32 + fix.exeG:\NOD32 Antivirus Software 2.70.32 + fix\NOD32 Antivirus Software 2.70.32 + fix.exeG:\NOD32 Antivirus Software 2.70.32 + fix\NOD32 Antivirus Software 2.70.32 + fix.exeG:\NOD32 Antivirus Software 2.70.32 + fix\NOD32 Antivirus Software 2.70.32 + fix.exeG:\NOD32 Antivirus Software 2.70.32 + fix\NOD32 Antivirus Software 2.70.32 + fix.exeC:\DOCUME~1\RIZAL~1.RIZ\LOCALS~1\Temp\ytb3.exeC:\DOCUME~1\RIZAL~1.RIZ\LOCALS~1\Temp\GLB1B.tmpC:\DOCUME~1\RIZAL~1.RIZ\LOCALS~1\TEMP\YCOMP_~1.EXEC:\DOCUME~1\RIZAL~1.RIZ\LOCALS~1\Temp\GLB22.tmpC:\DOCUME~1\RIZAL~1.RIZ\LOCALS~1\Temp\GLJ24.tmpO4 - HKLM\..\Run: [RavAV] C:\WINDOWS\RavMonE.exe--End of file - 4166 byteshijack this abg ipar syF:\dss.exe--adeh... ko nak pkai kaspersky plak dah....nie je yg aku nampak... Quote Share this post Link to post Share on other sites
E_peace6679 2 Report post Posted April 22, 2008 sbb tu saya pun x suka guna sepupu sekali,dua kali symentac hehehe.... Quote Share this post Link to post Share on other sites
rizal 1 Report post Posted April 22, 2008 waaa....kener pakai balik symantec kot .laptop abg ipar sy 2 gb.eh, kapersky =nod32? sy ndak install nod32 pasal boleh transfer update nod32 ke pc aka yg pakai nod 32 gak.cuma pc akak xda internet.skang sedang google how to remove symantec. Quote Share this post Link to post Share on other sites
baok 0 Report post Posted April 22, 2008 @mfaizcuba tengok betul2 Logfile of Trend Micro HijackThis v2.0.2Scan saved at 9:31:53 PM, on 15-Apr-08tengok kat pos no.1 dan pos no.6.. sama tak???F:\dss.exe tu Deckard System Scanner yg di run dari F:\dah banyak kali aku cakap.. pergi belajar HijackThis kat tempat yang sepatutnya.. bukan buat tekaan liar semata-mata...nak buang Symantec kene pakai Norton Removal Tool.. pergi kat laman web di bawah,.,http://service1.symantec.com/SUPPORT/tsgen...005033108162039 Quote Share this post Link to post Share on other sites
mfaizul89 3 Report post Posted April 22, 2008 @mfaizcuba tengok betul2 Logfile of Trend Micro HijackThis v2.0.2Scan saved at 9:31:53 PM, on 15-Apr-08tengok kat pos no.1 dan pos no.6.. sama tak???F:\dss.exe tu Deckard System Scanner yg di run dari F:\oopsss.... sorry!aku x tengok btol2... aku just tengok yg saspen jerk... sory ek... thanks! Quote Share this post Link to post Share on other sites
baok 0 Report post Posted April 22, 2008 oopsss.... sorry!aku x tengok btol2... aku just tengok yg saspen jerk... sory ek... thanks!don't worry.. we all learn from our mistakes Quote Share this post Link to post Share on other sites
mfaizul89 3 Report post Posted April 22, 2008 don't worry.. we all learn from our mistakes yaa... thats right... Quote Share this post Link to post Share on other sites