Problem me virus/spyware/antivirus/antispyware dhe reklama.

[Eagle]

Ne ato qe te shpjegova me lart iu referova Windows 2000 ose XP por ti ndoshta ke nje version me te hershem . Per me teper rreth problemit tend referoju ketij linku dhe besoj se do te gjesh zgjidhjen e duhur http://support.microsoft.com/?kbid=293623.
Beje copy - paste ne address bar .

[Shpirt Njeriu]

U flm per ndihmen.

Shpirt Njeriu

[rachi]

Zt ksperta

Kam nje virus ne kompjuter qe ma kapi bit defenderi dje. Tani kur e zbulon se ka fare opsionin delete po vetem ignore, ndoshta meqe eshte inkorporuar ne sis e windows.
Virusi saktesisht eshte
Object C:\WINDOWS\system32\Issas.exe/(ASAPack 2.12) is infected with Backdoor.FTP.ioFtpd.B

tani kur mundohem me hap sys 32 dhete gjj filen ku ndodhet, nuk me del fare. E provova edhe duke disable system restore, po prap se fshin.
Rachi

[benseven11]

Nga direktoria qe ke vene aty del qe mbartesi i trojanit Backdor,eshte skedari issas.exe.Issas.exe eshte trojan i njohur me emrin optix.pro.Per ta hequr issa.exe dhe me heqjen e saj hiqet edhe backdori,duhet te mbash sistem restore te windowsit te caktivizuar(disable).Shkarkohet skedari Fx saser qe dikton dhe heq issas.exe-ne. http://securityresponse.symantec.com...r/FxSasser.exe
Te duhet te kontrollosh dhe pastrosh kompjuterin,nga celesat ne regjister qe kane lidhje me trojanin.Per kete perdoret programi Hijack this.I ben skanim kompjuterit.Rezultatet i kursen si tekst file duke shtypur ne butonin "Save log"Pastaj i poston rezultatet e skanimit ketu.Mund te gjejme cfare duhet hequr nga lista e rezultateve. http://www.merijn.org/files/hijackthis.zip Duhet pare edhe te task manaxheri per procesin issas,exe.Pasi e gjen i ben klik dhe klikon ne fund te butoni end proces.Mund te perdoresh programin Windows inspektor per te pare dhe vrare cdo proces qe ka lidhje me trojanin
http://www.realclicks.com/WindowsIns...rsionSetup.EXE Pasi programi hapet ,klik ne butonin procese dhe me pas i ve nje pike rrethit ku thote trego gjithe proceset.
Duhet besh ndryshim te opsionet e programit adaware per te bere skanim te thelle dhe gjithe direktorive te kompjuterit.Kjo te siguron diktim te te gjitha spywareve dhe pastrim te plote.

[rachi]

Logfile of HijackThis v1.99.0
Scan saved at 21:47:33, on 25/12/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\WINDOWS\system32\winmgnt.exe
C:\WINDOWS\system32\SSMS.EXE
C:\WINDOWS\System32\DVDRAMSV.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\winmgnt.exe
C:\WINDOWS\system32\csrs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\xcommsvr.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\Program Files\Filseclab\xfilter\xfilter.exe
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
C:\program files\amp winoff\winoff.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Netscape\Netscape\Netscp.exe
C:\Program Files\iolo\System Mechanic 4 Professional\PopupStopper.exe
C:\Program Files\AOL 9.0\aoltray.exe
C:\Program Files\SOFTWIN\BDHome\aqmon.exe
C:\Program Files\Common Files\Softwin\Live\avxlive.exe
C:\Program Files\Common Files\Filseclab\FilMsg.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\MSI\PC Alert 4\PCAlert4.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WordWeb\wweb32.exe
C:\PROGRA~1\Webshots\webshots.scr
C:\Program Files\AOL 9.0\waol.exe
C:\Program Files\AOL 9.0\shellmon.exe
C:\Program Files\Common Files\AOL\aoltpspd.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Documents and Settings\Administrator\My Documents\Downloads\FxSasser.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX01.438\Hi jackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...ch/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.balkanweb.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...ch/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/cust...//my.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
N3 - Netscape 7: user_pref("browser.startup.homepage", "www.shekulli.com.al"); (C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\h767nb57.slt\prefs.j s)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csea rchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\h767nb57.slt\prefs.j s)
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0. dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SolidConverter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\ExploreExtP DF.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0. dll
O3 - Toolbar: SolidConverter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\ExploreExtP DF.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [XFILTER] C:\Program Files\Filseclab\xfilter\xfilter.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\Run: [AMP WinOFF] c:\program files\amp winoff\winoff.exe -quiet
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Program Files\Netscape\Netscape\Netscp.exe" -turbo
O4 - HKCU\..\Run: [System Mechanic Popup Stopper] "C:\Program Files\iolo\System Mechanic 4 Professional\PopupStopper.exe"
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Startup: WordWeb.lnk = C:\Program Files\WordWeb\wweb32.exe
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: BitDefender for ICQ.lnk = ?
O4 - Global Startup: BitDefender for MSN Messenger.lnk = ?
O4 - Global Startup: BitDefender for Net Meeting.lnk = ?
O4 - Global Startup: BitDefender for Yahoo! Messenger.lnk = ?
O4 - Global Startup: BitDefender Live!.lnk = ?
O4 - Global Startup: Filseclab Messenger.lnk = ?
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: PC Alert 4.lnk = C:\Program Files\MSI\PC Alert 4\PCAlert4.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: (no name) - SolidConverterPDF - (no file)
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)
O10 - Unknown file in Winsock LSP: c:\program files\filseclab\xfilter\xfilter.dll
O10 - Unknown file in Winsock LSP: c:\program files\filseclab\xfilter\xfilter.dll
O10 - Unknown file in Winsock LSP: c:\program files\filseclab\xfilter\xfilter.dll
O10 - Unknown file in Winsock LSP: c:\program files\filseclab\xfilter\xfilter.dll
O10 - Unknown file in Winsock LSP: c:\program files\filseclab\xfilter\xfilter.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - http://www.webshots.com/samplers/WSDownloader.ocx
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/soft...ch/alaunch.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yaho...ymmapi_416.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{65448938-5A9F-4355-A017-D1FAFE7EF2CD}: NameServer = 195.93.34.134
O23 - Service: AOL Connectivity Service - America Online, Inc. - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Ati HotKey Poller - Unknown - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Avx Init Serv - Unknown - C:\Program Files\SOFTWIN\BDHome\avxinit.exe
O23 - Service: COM+ Component Service - Unknown - C:\WINDOWS\system32\winmgnt.exe
O23 - Service: COM+ System Service - Unknown - C:\WINDOWS\system32\SSMS.EXE
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe
O23 - Service: Network DDE Connections - Unknown - C:\WINDOWS\system32\winmgnt.exe
O23 - Service: AVX Communicator - Softwin - C:\WINDOWS\system32\xcommsvr.exe
O23 - Service: Network DDE Connections - Unknown - C:\WINDOWS\system32\winmgnt.exe
O23 - Service: AVX Communicator - Softwin - C:\WINDOWS\system32\xcommsvr.exe

[benseven11]

I vihet shenja e V-se katroreve te bardhe perpara rreshtave me poshte:
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\Explorer.EXE Kjo duket si proces i rregullt i Internet explorerit.
Ne te vertete eshte proces i virusit W32 My Doom B(procesi i rregullt i eksplorerit ndodhet ne direktorine C:Windows/System32/explorer.exe)
O23 - Service: COM+ System Service - Unknown - C:\WINDOWS\system32\SSMS.EXE (virus worm gizmor)
Vetem keto te treja duhen hequr.Pasi u vihet shenja e V-se,klikohet ne butonin fix te programit.

[edspace]

rachi, hidhi një sy dhe programeve kundër reklamave dhe spiunëve se nga ato më lart ka shumë të dyshimta.

Gjithashtu e ke ngarkuar kompjuterin së tepërmi me programet AOL, Yahoo, Webshots, Netscape, ati, hp, etj.

Shko tek start > settings > control panel > add/remove programs dhe hiqi ato që nuk të duhen. Për yahoo psh lër vetëm Yahoo Messenger dhe ato të tjerat hiqi. Për AOL lër vetëm programin kryesor dhe hiqi ato të tjerat si AOL Dialer, AOL connectivity, etj.

Këto më poshtë duhen hequr dhe nuk besoj të sjellin probleme. Do lirojnë kompjuterin nga programe që nuk duhen.

O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0. dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0. dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\Run: [AMP WinOFF] c:\program files\amp winoff\winoff.exe -quiet
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Program Files\Netscape\Netscape\Netscp.exe" -turbo
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Startup: WordWeb.lnk = C:\Program Files\WordWeb\wweb32.exe
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: BitDefender for ICQ.lnk = ?
O4 - Global Startup: BitDefender for MSN Messenger.lnk = ?
O4 - Global Startup: BitDefender for Net Meeting.lnk = ?
O4 - Global Startup: BitDefender for Yahoo! Messenger.lnk = ?
O4 - Global Startup: BitDefender Live!.lnk = ?
O4 - Global Startup: Filseclab Messenger.lnk = ?
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)
O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - http://www.webshots.com/samplers/WSDownloader.ocx
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/sof...nch/alaunch.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yah.../ymmapi_416.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{65448938-5A9F-4355-A017-D1FAFE7EF2CD}: NameServer = 195.93.34.134
O23 - Service: Ati HotKey Poller - Unknown - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown - C:\WINDOWS\system32\ati2sgag.exe

[Era1]

Nuk mendoj se do te eleminohet problemi vetem duke i ber fix.
Eshte nje rruge pak e gjate nqse ti di spanjisht regjistrohu tek kjo adrese:
http://www.trucoswindows.net/
regjistrohu shko tek forumi seguridad paraqit logsat e tu dhe ata te shkruajne te gjithe rrugen sepse vetem me fix ne scanimin e Hijackthis nuk eleminohen.
Nqse deshiron une ta shkruaj rrugen por disa komanda ne kompjuter nuk i di se si jane ne anglisht.

[benseven11]

Era,faleminderit per ate faqen.Dua te te bej nje pyetje.A i kupton ato rreshtat qe jane vene ne postet ketu,nga Hijack this?Neqofte se i kupton,bravo,urime.Ke kuptuar si hijack this funksionon dhe si pastrohet kompjuteri.Neqofte se nuk i kupton rreshtat atehere harxhon kohen kot.Ai butoni fix,neqoftese behet zgjedhja e rreshtave ne liste korrekt,vertet e pastron kompjuterin dhe te kursen1 ore pune,po te krahasohet me menyra te tjera pastrimi, duke bredhur me miun neper windows.

[Era1]

Nuk dua te hy ne debat por po te sqaroj