Probleme me Bllokim te Kompjuterit,Startim/Ristartim,Instalim te Windowsit.

[GL_Branch]

Benseven-11 ja atu shifrat qe tha ti dergoj ne FOrum , edhe te kisha lut te ndihmojsh edhe pak , se une e gjeta Isse.EXE nuk po fshihet e bera Kill Proces por nuk u heq....qka te bej tash une???? , edhe virusi gjendet ne diskun C: , Temporary FIles (qe nuk po di si ta gjej) dhe ne DESKTOP , dmth jane 3 lloje virusash

StartupList report, 1/9/2005, 4:55:39 PM
StartupList version: 1.52.2
Started from : C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX03.672\Hi jackThis.EXE
Detected: Windows XP SP1 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\HELP\NLLIJ.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-us\msnappau.exe
C:\WINDOWS\System32\LMSAL8HS.EXE
C:\WINDOWS\System32\systime.exe
C:\WINDOWS\process.exe
C:\Program Files\Internet Optimizer\optimize.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\systime.exe
C:\Documents and Settings\Administrator\Application Data\cwtp.exe
C:\Program Files\Internet Optimizer\actalert.exe
C:\WINDOWS\System32\??chost.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Grisoft\AVG6\avgw.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\dktibs.exe
C:\WINDOWS\System32\dktibs.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX03.672\Hi jackThis.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
AL-800 Status Monitor.lnk = C:\Program Files\AL-800 Series\engss.exe

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

RavTimeXP = C:\WINDOWS\HELP\NLLIJ.exe
NeroFilterCheck = C:\WINDOWS\system32\NeroCheck.exe
AVG_CC = C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
WinampAgent = C:\Program Files\Winamp\winampa.exe
SoundMan = SOUNDMAN.EXE
NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
nwiz = nwiz.exe /install
msnappau = "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-us\msnappau.exe"
AL-800 LM Status = LMSAL8HS.EXE
SysTime = C:\WINDOWS\System32\systime.exe
process.exe = C:\WINDOWS\process.exe
Internet Optimizer = "C:\Program Files\Internet Optimizer\optimize.exe"
SurfSideKick 2 = C:\Program Files\SurfSideKick 2\Ssk.exe
IE Menu Extension toolbar = rundll32.exe "C:\PROGRA~1\IEMENU~1\tbextn.dll" DllShowTB

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

ctfmon.exe = C:\WINDOWS\System32\ctfmon.exe
MsnMsgr = "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
SysTime = C:\WINDOWS\System32\systime.exe
SurfSideKick 2 = C:\Program Files\SurfSideKick 2\Ssk.exe
Tooa = C:\Documents and Settings\Administrator\Application Data\cwtp.exe
Ghmqr = C:\WINDOWS\System32\??chost.exe

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\System32\logon.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------


Enumerating Browser Helper Objects:

(no name) - C:\WINDOWS\nem220.dll - {00000010-6F7D-442C-93E3-4A4827C2E4C8}

--------------------------------------------------

Enumerating Download Program Files:

[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\system32\Macromed\Director\SwDir.dll
CODEBASE = http://fpdownload.macromedia.com/get...irector/sw.cab

[Loader2 Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\loader2.ocx
CODEBASE = http://iframedollars.biz/tb/loader2.ocx

[VacPro.internazionale_ver4]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\internazionale_ver4.ocx
CODEBASE = http://www.globalphon.com/dialer/int...onale_ver4.CAB

[MediaTicketsInstaller Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\MEDIAT~1.OCX
CODEBASE = http://www.mt-download.com/MediaTick...cab?refid=2732

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\System32\macromed\flash\Flash.ocx
CODEBASE = http://download.macromedia.com/pub/s...sh/swflash.cab

--------------------------------------------------

Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*

Windows NT checkdisk command:
BootExecute = autocheck autochk *

Windows NT 'Wininit.ini':
PendingFileRenameOperations: ||

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\System32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll
Web Event Logger: C:\WINDOWS\System32\Pghapn32.dll

--------------------------------------------------
End of report, 6,458 bytes
Report generated in 0.063 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

[GL_Branch]

Tash mu benen me shume Virusa i kisha 3 mu e tash u beren mbi 30 virusa , e bera UDBATE AVG-se (Antivirusin e kam AVG) , pasi e bera UDBATE me vershuan mbi 30 virusa , perveq Trojaneve mu futen edhe virusa tjera si: I-Worm/Wurkill-B , Downloader.Small , StartPage 15Q , ETJ. ,

Gjithashtu tash po de del nje dritare

Virus Trojan Hotese backdorr

is found un file
C;\WINSDOWS|system32\Omccpbkl.exe

Qka te bej tash une??

[Eagle]

Qenka semure rende kompiuteri yt .
Ajo qe te kane dale me shume viruse pasi ke bere update nuk do te thote se tani kane hyre ne kompiuter porse antivirusi yt nuk i ka njohur sepse nuk ka qene i update-ur (nuk ka qene me i fundit).
C'fare te keshilloj une
1. meqe e ke bere update-in , bej nje skan te te gjithe kompiuterit me antivirus dhe kerko te delete-esh te gjithe viruset qe programi te nxjerr .
2. Per viruset te cilat per nje aresye apo tjeter nuk i delete dot nepermjet antivirusit .
- Sheno te gjitha vendodhjet e skedareve te infektuar ne leter nese jane shume dhe nuk i mban mend .
- Turn off . Fike kompiuterin
- Turn onn . Ndize dhe kalo ne Safe mode .Pasi te logosh shko dhe delete nje nga nje te gjithe skedaret e infektuar sipas shenimeve qe ke nxjerre .
- Te keshilloj po ne Safe mode te ekzekutosh nje program anti-spy (ad-ware apo spy- sweeper etj ) dhe pastro kompiuterin nga programet spy
- Te keshilloj gjithashtu menjanosh startimin ne fillim kur ndez kompiuterinte programeve qe nuk te nevojiten (mund te perdoresh run - msconfig ose ndonje program tjeter si System Mechanic qe ka nje opcion per Startup manager .
- Ne fund bej nje pastrim te register-ave te systemit . Mund te perdoresh po System Mechanic qe ka nje opcion per te pastruar register-at ose programin e quajtur Registry Mechanic.
3.Te gjitha keto duhet ti besh kur ke kohe te lire ose ke materiale qe nuk do ti fshish nga kompiuteri . Perndryshe menyra me e thjeshte eshte ta formatosh dhe instalosh windowsin nga fillimi .

[benseven11]

Vuri shenjen e V-se ne katroret e bardhe perpara ketyre rreshtave:
C:\WINDOWS\HELP\NLLIJ.exe
C:\WINDOWS\System32\systime.exe
C:\ProgramFiles\MSNApps\Updater\01.02.3000.1001\en-us\msnappau.exe=kjo
eshte MSN toolbar,nqs nuk e perdor duhet hequr.
C:\WINDOWS\System32\systime.exe
C:\Program Files\Internet Optimizer\optimize.exe(cinstalo programin Internet optimizer)
C:\WINDOWS\System32\systime.exe
C:\Program Files\Internet Optimizer\actalert.exe
C:\WINDOWS\System32\??chost.exe
C:\WINDOWS\System32\wuauclt.exe(windows Me update,Ti ke XP, kjo ste duhet)
C:\WINDOWS\System32\dktibs.exe
C:\WINDOWS\System32\dktibs.exe
RavTimeXP = C:\WINDOWS\HELP\NLLIJ.exe
msnappau="C:\ProgramFiles\MSNApps\Updater\01.02.3000.1001\en-us\msnappau.exe
SysTime = C:\WINDOWS\System32\systime.exe
Internet Optimizer = "C:\Program Files\Internet Optimizer\optimize.exe"
SurfSideKick 2 = C:\Program Files\SurfSideKick 2\Ssk.exe
IE Menu Extensiontoolbar=rundll32.exe"C:\PROGRA~1\IEMENU~1\tbextn.dll" DllShowTB
SysTime = C:\WINDOWS\System32\systime.exe
SurfSideKick 2 = C:\Program Files\SurfSideKick 2\Ssk.exe
Ghmqr = C:\WINDOWS\System32\??chost.exe
no name) -C:\WINDOWS\nem220.dll-{00000010-6F7D-442C-93E3-4A4827C2E4C8}
InProcServer32 = C:\WINDOWS\DOWNLO~1\loader2.ocx
CODEBASE = http://iframedollars.biz/tb/loader2.ocx
Pasi u ke vene shenjen e V se perpara te katrori ketyre rreshtave,klikohet tek hijackthis,poshte ne butonin fix.
Te dyshimta:
C:\Documents and Settings\Administrator\Application Data\cwtp.exe(gjej skedarin cwtp.exe beji klik me te djathte dhe skan me AVG.Gjithashtu bej nje kerkim me Start/search.Ne qofte se kjo nuk eshte pjese e ndonje programi qe ke instaluar hiqe,pasi nuk eshte as pjese e windowsit)
Skedar tjeter i dyshimte: Web Event Logger: C:\WINDOWS\System32\Pghapn32.dll(vepro njelloj si me skedarin e dyshimte me lart)

[GL_Branch]

Benseven prap FLM , une veprova ashtu qysh tha ti , por me duhet disa qe u heqen nga ato qe mi permnda por disa jo p.sh kjo nuk hiqet http://O4 - HKLM\..\Run: [SurfSideKi...Kick 2\Ssk.exe

Gjithashtu ne faqen e pare qka ke shkru une skam vepru ashtu, por direkt jam fut ne hijackthis ,duke mos e u futur ne System Restore.

Prap kam virusa momentalisht i kam 7 virusa , edhe NON-Stop po me dalin Dritare te ndryshme , (si shenje qe ke virus, edhe nuk po mundem te punoj fare)
Ja kur po Skanoj me Antivirusin AVG , po de dalin keto Virusa (po mendoj lokacioni i tyre se 6 virusa jane Trojan): pra:
1) C:\Documents and Settings\Administrator\Local Setting\Temporary Files.... (gje qe nuk po mundem ta zbuloj se ku eshte)
2) C:\WINDOWS\Toolbar.exe
3) C:\WINDOWS\system32\CHILL.DLL (edhe kete nuk po mund ta gjej te folderi System 32)
4) C:\124787.exe

Qka te veproj tash???

[Badis5]

tungat...

per mos me pas problem me Pc duhet qe prej kure e formaton PC te besh te gjitha ne regull se nese e formaton Pc edhe kabllen e rjetin ja len aty hiq pa e qite ndonje antivirus ateher per mendiminn tim un sa di kurgja skemi ba se prap ne ate moment po hyjn virusa PC duhet mbrojt prej antivirusave un qka e perdori ne Pc eshte MCAFFE , DEPPFREZEE , Norton 2004 sma mer mendja qe njani prej qetyne me pas ner 2 muj apo ma shum ke me pas problem me PC kjo qe un skam problem ... un kure e formatoj PC ner 3 muj dite nuk kom probleme kure me PC normal edhe Porrnichin duhet me dite qe krejte vijn prej kesaj Virusat po ky ke veq nje ide e imja ndoshta e kot ama un me kto qfare i baj jam shum rahat me Pc ner 3 muj dire kure skom probleme ......

me te mira
badis5

[Dani_Tux]

Ne ket vent mun te jen fshehur virusat zakonisht ketu shkojn pastaj ku te hish ketu fshij te ghith folderat ndodh qe edhe mos te shlyhen por provo
C:\Documents and Settings\Administrator\Local Setting\Temporary Internet Files\Content.IE5

[Dani_Tux]

Duhesh ta shkruash (address bar) sepse folderi Content.IE5 nuk shihet pra e mer copjo dhe lesho ne address bar edhe i sheh skedat (folderat)
C:\Documents and Settings\Administrator\Local Setting\Temporary Internet Files\Content.IE5

[benseven11]

Pastrimi i skedareve te perkohshem ne kompjuter.

Ashtu sic tha dhe Dani,kopjo tekstin C:\Documents and Settings\Administrator\Local Setting\Temporary Internet Files\Content.IE5 dhe me pas,fshij adresen lart http://www......,duke e lene te bardhe.Klikon me te djathte ne fushen e bardhe te pastruar te adreses dhe zgjedh paste.Do te futet komplet direktoria qe te ka dhene Dani.Pastaj godet ne tastjere ne enter.Do shfaqet dritarja e skedareve te perkohshem.Per ti fshire gjithe skedaret,klik lart ne Edit zgjidh "selekt all".klik lart ne File dhe zgjedh" Delete".Ne qofte se kjo menyre nuk te jep rezultat apo ngec diku per ndonje arsye,provo nje menyre tjeter.Shkohet ne start/run.Ketu fut komplet direktorine e mesiperme,klikon ok dhe do hapet dritarja e folderit te IE5.Per ti hequr te gjitha ndiq metoden e fshirjes me lart.Nje menyre tjeter eshte te klikosh lart ne tools/internet options/klik ne delete files,delete cookies dhe klik ne "Clear history" Kliko poshte apliko dhe OK. Shiko figuren me poshte:
Te figura eshte e rendesishme te klikohet edhe ne butonin Settings.Ne dritaren tjeter kliko ne butonin Shiko skedaret (view files).Menjehere do te hapet nje dritare me skedare te perkohshem.Klik lart ne edit/selekt all.Pastaj klik ne File/delete,duke pastruar edhe ate direktori.Direktoria do jete nje cike ndryshe nga ajo qe ka vene Dani.Mund ta shohesh ne nje forme te tille:
C:\Documents and Settings\Emri jot\Local Settings\Temporary Internet Files
Te dyja keto direktori eshte e rendesishme te pastrohen,pasi pervoja dhe faktet kane treguar qe ne keto direktori strehohen,viruse/trojane spyware dhe cookies spiune.

[benseven11]

Per te hequr skedaret isse.exe;sidekick/ssk.exe;toolbar.exe;124787.exe dhe chill.dll ndiqet kjo rruge:
E para sigurohu qe keto procese nuk jane aktive.Nqs proceset jane aktive ato nuk mund te hiqen.Per ti hequr duhet te shkosh ne Task manaxher.Klik CTRL+Alt+DEL.Ne dritaren e task manaxherit kliko ne butonin procese.Aty shiko per proceset me emrat me siper.Ne qofte se i gjen,atehere klikon te rreshti i procesit vetem nje here.Rreshti do nxihet(behet highlight).Klikon poshte ne butonin End process(perfundo procesin).Kete gje e ben me cdo proces te keq me emrat me siper.Pasi ke mbaruar kete shkon ne Start/run.Aty fut ekzakt rreshtin si ketu C:\Windows klikohet ok dhe do hapet dritarja ne windows eksplorer e direktorise se windowsit.Aty kliko lart ne view buton(shiko),ne menu zgjedh detaje(details).Pastaj kliko prape ne view,ne menune e do hapet vendose miun mbi rreshtin "arrange icons by"(organizoji ikonat sipas).Ne menune majtas zgjedh dhe klikon ne te Modifikuara.Si ne figuren me poshte.Me kete ndryshim qe ke bere,shiko ne fund te listes.Do gjesh skedaret e keqij toolbar.exe dhe ndonje tjeter qe te ka hyre.I ben skedarit ne liste klik me te djathte dhe zgjedh delete duke e hequr pa problem.Shkon prape, pastaj ne start/run dhe aty fut ekzakt direktorine si me poshte C:\windows\system32 Klikohet ok dhe ne dritaren me direktorine e sistemit 32,ndiq te njejten rruge si me siper,diktuar e hequr ndonje skedar spiun,ose virus.Me ndryshimet duke klikuar ne view...si me lart do i shohesh skedaret e keqij ne fund te listes.Shikoji sipas emrave.Mund ti njohesh menjehere.Mund te jene 2-3.Kontrollo edhe njehere proceset qe ke aktive duke hapur" Hijack this" Klik poshte,djathtas ne config.Ne dritaren tjeter klikohet ne butonin Misc.Aty kliko ne dy butona:Start up list,komplet listen e ben save dhe mund ta postosh ne forum,per tu siguruar qe nuk ke proces spiune ose virus.Gjithashtu kliko ne butonin proces manaxher,rezultatet i ruan si tekst dhe i poston ne forum.Kjo duhet bere qe te sigurohesh qe kompjteri eshte i paster nga proceset e keqia spyware/virus/trojane.Caktivizo sistem restore.Shiko postin 8-9 ne kete teme.Me pastrimin e viruseve dhe trojaneve qe te kane ngelur do te duhet te ri ndezesh kompjuterin.Sistemi restore duhet jete i caktivizuar ne menyre qe pastrimi te jete me sukses dhe te mos ndodh rikthimi i viruseve dhe trojaneve per shkak te sistemit restore aktiv.