Ce s`a intamplat? poza+folder

[Preotu*]

sal all, de vreo cateva zile numai sora mea umbla pe pc, si acum am vazut ca la fiecare poza are cate un folder cu aceeasi denumire +JPG , de la ce sa fie, virus sau ? ms all

[ckosmo]

E o porcarie de virus, probabil facut de albanezi ca nu face prea multe decat foldere in prostie. Cauta pe google cleaner .avi . mp3 .exe si o sa gasesti. Nu mai dau linkuri ca am warn

[big_bum]

Pare a fi virusul Jeffo. Il scoti cu cam toate antivirusurile.

[Preotu*]

nu merge, am nod32 si cand dau scan nu gaseste nimik, sterg acele foldere,iar dupa restart apar la loc, ajutati`ma sa te scot, ms mult

[Johnny]

KAV papi.

Les connaisseurs

[Jonny Quest]

Descarca Hijackthis si posteaza un log - http://www.trendsecure.com/portal/en...ols/hijackthis

[Preotu*]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:03:35, on 02-Aug-08
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Eset\nod32kui.exe
C:\PROGRA~1\A4Tech\Keyboard\Ikeymain.exe
C:\WINDOWS\VM303_STI.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YServer.exe
D:\DC++\DCPlusPlus.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Ecko72t.ECKO72\Desktop\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [Vistadrv] C:\Program Files\Vortex Tools\Classes\vortex\vista\VIPhd\vsdrv.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [Trickler] "c:\documents and settings\ecko72t.ecko72\local settings\temp\~vis0000\fsg_4104.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [iKeyWorks] C:\PROGRA~1\A4Tech\Keyboard\Ikeymain.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [BigDog303] C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {41ACD49D-1974-791A-0981-AA9872721044} (Ganymede Board Games) - http://67.15.101.33/g_bin/eng/boards_2_0_0_35.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.adobe.com/pub/shoc...sh/swflash.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.33/g_bin/eng/snooker_2_0_0_35.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

--
End of file - 4121 bytes

[Jonny Quest]

Deschide Hijackthis, bifeaza O4 - HKLM\..\Run: [Trickler] "c:\documents and settings\ecko72t.ecko72\local settings\temp\~vis0000\fsg_4104.exe" si apasa Fix Checked.
Descarca ATF Cleaner, bifeaza tot si apasa Empty Selected http://majorgeeks.com/ATF_Cleaner_d4949.html

Daca tot revin fisierele dupa ce le stergi, incearca si o scanare cu KAV.

[wantedhacker]

big_bum am avut si eu odata virusul jeffo, dar nu-mi facea chesti de genul asta, mie mi-a facut urmatoarele:
1. infecta toate fisierele .exe si cand incercam sa le deschid zicea "this is not a valid win32 aplication"
2. imi stergea optiunea de hibernate
3. in unele cazuri imi stergea si driverul de la placa video
Si inca un detaliu, se baga in svchost.exe . Si desi este un fisier de windows, in safemode il stergeam si isi revenea pc-ul, insa trebuia sa reinstalez toate aplicatiile.

[Preotu*]

ms mult Jonny quest am rezolvat cu kav, sper sa nu mai reapara.