15 05 2010

Facebook – lažne poruke u Inboxu

Objavio: gsk u servisi, sigurnost

Danas sam dobio kakti poruku od Facebook-a – obavijest. Poruka je završila u spam-u, ali sam ipak odlučio ovo objaviti, čisto za one kojima možda ovo neće završiti u spam-u, tak da ne klikaju bez veze i zaraze komp nekom ‘boleštinom’.

SAVJET
Kada dobijete poruku sa Facebook-a, neka vam to služi samo kao obavijest. Ne klikajte na link i poruku obrišite. Zatim se lijepo logirate na svoj Facebook račun i tamo provjerite da li ste zaista dobili poruku ili je poruka bila lažna.

Evo kako izgleda tijelo poruke:

Facebook scam notification

Adresa u poruci koja je kakti link do Facebook-a izgleda ovako:

http:// www. facebook. com/n/?inbox/readmessage.php&t=174723748127&mid=3921299eea237d19dfe7d84892acedb1&n_m=facebook support

a ispod adresa u biti izgleda ovako:

http:// merass. com/accidents.html

Otišao sam na dolje navedenu adresu, uključivši sve filtere i blokatore koje sam imao, ali sam naišao na poruku upozorenja pa ipak nisam dalje klikao, čisto da ne izazivam ’sudbinu’. : )

Ne klikati na link.

Upozorenje - malware

Osim ove poruke, nedavno sam dobio još jednu i to kao od prijatelja sa Facebook-a, koji i je u adresaru kao prijatelj. To upućuje na to da je njegov račun možda čak i kompromitiran.

Poruka izgleda ovako:

Facebook - lazna poruka - malware

Kada se klikne na link u poruci, link vas vodi na YouTube India. Na stranici se nalazi lažan ‘video’, koji je u biti slika. Naslov ‘videa’ je How to be sexy (najvjerojatnije može biti i neki drugi naslov).

Facebook - lazan video

Na slici je prikazana poruka da vam nedostaje Flash player (ja ga imam instaliranog), te da ga morate instalirati kako bi vidjeli video.

Link koji vodi do datoteke izgleda otprilike ovako:

http:// 123.456.78/~blablabla/Flash.exe

Ta datoteka Flash.exe je najvjerojatnije neki virus, spyware, uglavnom malware. Ne klikati na link, te obvezno obrisati email poruku iz Inbox-a.

————–

INFO

Naknadno sam malo guglao i otkrio da se radi o Koobface crvu (za ovu priču sa YouTube-om i Flash player-om).

Sa 24sata:
Računalni virus Koobface širi se slanjem poruka iz korisničkog inboxa na Facebooku. Virus ulazi u računalo i krade osobne podatke uključujući imena, lozinke te brojeve kreditnih kartica. Virus sa zaraženog računala potom šalje poruke svim prijateljima s liste te link na “video”. Oni koji žele pogledati video preusmjereni su na stranicu gdje trebaju skinuti navodni update za Adobe Flash player koji je zapravo virus.

Simptomi
Računalo radi jako usporeno
Desktop schortcuts (poveznice, kratice) su se promijenile (izgled)
Pop-up prozori se pojavljuju na ekranu
Email poruke se šalju iz vašeg Inbox-a, a koje niste napisali

Prije svega skini neki od antispyware programa (ako nemaš) ili antivirusa (ako nemaš), skeniraj i sve uništi.

CLEANCOOBFACE – AUTOMATSKO UKLANJANJE KOOBFACE CRVA
Ovdje možete skinuti CLEANCOOBFACE – alat (portable) za skeniranje računala i automatsko uklanjanje svih poznatih inačica (varijanti) Coobface crva (worm).

.

Ručno uklanjanje Koobface-a – za Windows XP

Prije svega treba isključiti System Restore – Start > Settings > Control Panel > System > System Restore > Označiti Turn off System Restore on all drives

01. Treba ubiti slijedeće procese (za XP > Ctrl+Alt+DEl > idi na Processes te označi te datoteke i stisni End process puce)

%SYSTEMROOT%\bolivar28.exe
che07.exe
bolivar28.exe
%WinDir%\system32\nScan\ekrn.exe
%WinDir%\system32\nScan\ecls.exe
%WinDir%\system32\splm\ncsjapi32.exe
%WinDir%\bolivar28.exe
C:\Windows\fbtre6.exe
freddy79
fbtre6.exe
mstre6.exe
ld08.exe
Ld12.exe

02. Obrisati registry vrijednosti (Start > Run > upiši regedit i kada se prozor otvori idi po stablu kako je navedeno)

Ključevi:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\LEGACY_FIO32
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\fioo32
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\LEGACY_FIOO32
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\captcha
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ipokoraid
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_IPOKORAID
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmoko
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DMOKO
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rianbow
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sproeval
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dac6oko
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\fio32
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\afwoko
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dpti3o
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\afcunt
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\httpo
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\w83c600
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vmx64o
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\aladdins
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\haspntt
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ALADDINS
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ftdisoko
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ql600oko
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_QL600OKO
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AFWOKO
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DPTI3O
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VMX64O
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HASPNTT
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_W83C600
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OKO6
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OKOSRV
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AFCUNT
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HTTPO
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\swoko
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SWOKO
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srvoko6
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\apto6ko
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cpqoko6
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\birokod
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\elantos
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\okosrv
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i600oko
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_I600OKO
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\o6ko
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\oko6
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\oko6

Vrijednosti:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost, fioo32=
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, pp=[%WINDOWS%]\pp11.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost, captcha=
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost, rpcSsc=
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\bill110.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost, termisvc=
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost, WinError=
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, pp=[%WINDOWS%]\pp10.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\freddy70.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost, termsv=
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost, trmsvcs=
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost, vmapisvc=
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\bill109.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost, emusvc=
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost, meetsvc=
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysmstray=[%WINDOWS%]\mstre19.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\freddy64.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\bill107.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, pp=[%WINDOWS%]\pp12.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\bill103.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\bill108.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\freddy42.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost, tapisrvs=
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost, termsvc=
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\bill106.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost, netsvc6=
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysmstray=[%WINDOWS%]\mstre23.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost, termsvcr=
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost, okogrp=
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\bill104.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, Captcha7=rundll “[%PROGRAM_FILES%]\captcha7.dll”,captcha
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, pp=[%WINDOWS%]\pp14.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\freddy101.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysmstray=[%WINDOWS%]\mstre22.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\freddy75.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysmstray=[%WINDOWS%]\mstre24.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, Captcha7=rundll “[%PROGRAM_FILES%]\captcha.dll”,captcha
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysmstray=[%WINDOWS%]\mstre26.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, systgray2=[%WINDOWS%]\tag16.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysberay2=[%WINDOWS%]\romeo15.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysmstray=[%WINDOWS%]\mstre21.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\freddy61.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\freddy82.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\freddy44.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysbetray2=[%WINDOWS%]\sber18.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\freddy84.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\freddy46.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\freddy81.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\freddy58.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\freddy79.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, systgray2=[%WINDOWS%]\tag14.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\freddy66.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\freddy72.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, pp=[%WINDOWS%]\pp13.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, Captcha5=rundll “[%PROGRAM_FILES%]\captcha5.dll”,captcha
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysbetray2=[%WINDOWS%]\sber20.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, pp=[%WINDOWS%]\pp06.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\freddy63.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysmstray=[%WINDOWS%]\mstre25.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, systwtray=[%WINDOWS%]\twitty07.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\freddy62.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysmstray=[%WINDOWS%]\mstre18.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\freddy49.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\freddy74.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\freddy73.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\freddy57.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\freddy43.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysmstray=[%WINDOWS%]\mstre20.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\freddy41.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\freddy71.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\freddy50.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\freddy69.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\freddy68.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\freddy65.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\freddy67.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\freddy47.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\freddy59.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\freddy60.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysberay2=[%WINDOWS%]\romeo16.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\freddy55.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\freddy54.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\freddy53.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysmstray=[%WINDOWS%]\mstre15.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\freddy48.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, systgray2=[%WINDOWS%]\tag07.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysberay2=[%WINDOWS%]\romeo14.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysfbtray=[%WINDOWS%]\freddy45.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, sysberay2=[%WINDOWS%]\romeo12.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, systgray2=C:\windows\tag12.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, pp=[%WINDOWS%]\pp04.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, systgray2=[%WINDOWS%]\tag12.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current Version\Run\”systray” = “c:\windows\mstre6.exe”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current Version\Run\”systray” = “C:\Windows\fbtre6.exe”
HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\Navigating

03. Obrisati datoteke:

freddy79 fbtre6.exe fmark2.dat ld08.exe Ld12.exe
[%WINDOWS%]\ld09.exe
[%SYSTEM%]\Drivers\fio32.sys
[%WINDOWS%]\bk23567.dat
[%WINDOWS%]\bk20856.dat
[%WINDOWS%]\0101120101465348.xxe
[%WINDOWS%]\fdgg34353edfgdfdf
[%WINDOWS%]\010112010146114101.xxe
[%WINDOWS%]\01011201014650115.xxe
[%WINDOWS%]\rdr_1264654334.exe
[%WINDOWS%]\rdr_1264825084.exe
[%WINDOWS%]\msmark2.dat
[%WINDOWS%]\b4657.dat
[%WINDOWS%]\sto453165.dat
[%WINDOWS%]\sto453163.dat
[%WINDOWS%]\sto453192.dat
[%WINDOWS%]\sto453601.dat
[%WINDOWS%]\tw23567.dat
[%WINDOWS%]\pp11.exe
[%WINDOWS%]\ld14.exe
[%WINDOWS%]\0535251103110107106.yux
[%WINDOWS%]\hpm2.dat
[%WINDOWS%]\010112010146116101.xxe
[%WINDOWS%]\0101120101465349.xxe
[%WINDOWS%]\tgm2.dat
[%WINDOWS%]\0101120101465249.xxe
[%WINDOWS%]\0101120101465649.xxe
[%WINDOWS%]\0101120101465055.xxe
[%WINDOWS%]\0101120101465048.xxe
[%WINDOWS%]\0101120101465155.xxe
[%WINDOWS%]\0101120101465150.xxe
[%WINDOWS%]\0101120101465255.xxe
[%WINDOWS%]\0101120101465355.xxe
[%WINDOWS%]\0101120101465250.xxe
[%WINDOWS%]\0101120101465548.xxe
[%WINDOWS%]\bx4657.dat
[%WINDOWS%]\010112010146111103.xxe
[%WINDOWS%]\0101120101465350.xxe
[%WINDOWS%]\010112010146103110.xxe
[%WINDOWS%]\0101120101465450.xxe
[%WINDOWS%]\0101120101465755.xxe
[%WINDOWS%]\9g2234wesdf3dfgjf23
[%WINDOWS%]\0101120101465455.xxe
[%WINDOWS%]\0101120101465449.xxe
[%WINDOWS%]\bill110.exe
[%WINDOWS%]\rdr_1262631244.exe
[%WINDOWS%]\rdr_1262631246.exe
[%WINDOWS%]\rdr_1262631247.exe
[%WINDOWS%]\rdr_1262697021.exe
[%SYSTEM%]\devconus.dll
[%PROFILE_TEMP%]\zazodin_1255035457.exe
[%PROFILE_TEMP%]\zazodin_1255467681.exe
[%PROFILE_TEMP%]\zazodin_1257075686.exe
[%PROFILE_TEMP%]\zazodin_1257932001.exe
[%PROFILE_TEMP%]\zazodin_1261596553.exe
[%PROFILE_TEMP%]\zazodin_1261603903.exe
[%PROFILE_TEMP%]\zazodin_1261604224.exe
[%PROFILE_TEMP%]\zazodin_1261612842.exe
[%PROFILE_TEMP%]\zazodin_1261613182.exe
[%PROFILE_TEMP%]\zazodin_1261613811.exe
[%PROFILE_TEMP%]\zazodin_1261619847.exe
[%WINDOWS%]\rdr_1257296250.exe
[%WINDOWS%]\rdr_1257296261.exe
[%LOCAL_APPDATA%]\0535049569854.xxe
[%WINDOWS%]\bill109.exe
[%LOCAL_APPDATA%]\0485351984956.xxe
[%LOCAL_APPDATA%]\rdr_1273567146.exe
[%WINDOWS%]\t55ft2807f44.dat
[%WINDOWS%]\lgo
[%WINDOWS%]\ligh
[%LOCAL_APPDATA%]\010112010146111103.xxe
[%PROFILE%]\Local Settings\Application Data\0101120101465198.xxe
[%PROFILE%]\Local Settings\Application Data\010112010146115119.xxe
[%PROFILE%]\Local Settings\Application Data\010112010146100109.xxe
[%SYSTEM%]\Drivers\vgaoko.sys
[%PROFILE%]\Local Settings\Application Data\0535049569854.xxe
[%PROFILE%]\Local Settings\Application Data\0485351984956.xxe
[%WINDOWS%]\tt_1237370532.exe
[%WINDOWS%]\rdr_1260233754.exe
[%WINDOWS%]\rdr_1260233757.exe
[%WINDOWS%]\010112010146118114.dat
[%WINDOWS%]\010112010146118114.lso
[%WINDOWS%]\jmmark2.dat
[%WINDOWS%]\0101120101465749.dat
[%WINDOWS%]\0101120101465749.lso
[%WINDOWS%]\0101120101465752.dat
[%WINDOWS%]\0101120101465554.xxe
[%WINDOWS%]\0101120101464855.xxe
[%WINDOWS%]\010112010146100101.xxe
[%WINDOWS%]\934fdfg34fgjf23
[%PROFILE_TEMP%]\vcru_1248446111.exe
[%PROFILE_TEMP%]\vcru_1248869157.exe
[%PROFILE_TEMP%]\vcru_1248875455.exe
[%PROFILE_TEMP%]\vcru_1248887587.exe
[%PROFILE_TEMP%]\vcru_1249562183.exe
[%PROFILE_TEMP%]\vcru_1249836450.exe
[%PROFILE_TEMP%]\vcru_1250109491.exe
[%WINDOWS%]\soc_1245648134.exe
[%SYSTEM%]\captcha.dll
[%WINDOWS%]\bill106.exe

04. Obrisati mape:

[%WINDOWS%]\fdgg34353edfgdfdf
[%WINDOWS%]\ligh
[%WINDOWS%]\ro
[%WINDOWS%]\lgo
[%WINDOWS%]\9g2234wesdf3dfgjf23
[%WINDOWS%]\934fdfg34fgjf23
[%WINDOWS%]\9g234sdff3d23dfgjf23
[%WINDOWS%]\9gdfgjf23
[%WINDOWS%]\9g234sdfdfgjf23

U slučaju da se neka mapa neda obrisati, obrisati ju Unlocker-om ili Desni klik na mapu > odaberi Permissions, odaberi User Group koja je trenutno logirana ( najvjerojatnije Users ili All Users) i odaberi Full Control.

U slučaju da nikaj ne pomaže, potraži pomoć stručne osobe (kao što sam ja – uz malu naknadu : )

Post je objavljen subota, svibanj 15th, 2010 u 19:32 i spada pod servisi, sigurnost. Mozes pratiti putem RSS 2.0 feed-a. Mozes ostaviti komentar, ili pratiti sa svoje stranice.

Ostavi komentar

Stranica osvježena: 08/09/2010 @ 14:01 --- Tekst osvježen: 18/05/2010 @ 22:46