|
Kaverin HiJackThis loki
|
|
|
Ratazz
Suspended due to non-functional email address
|
18. maaliskuuta 2006 @ 17:14 |
Linkki tähän viestiin
|
|
Logfile of HijackThis v1.99.1
Scan saved at 22:08:49, on 18.3.2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
E:\heikki\smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\nvidGUIv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\winsis32.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\System32\MSDNSD32.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\MSDNSD32.exe
C:\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NTSF MICROSOFT SYSTEM] winsis32.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SmcService] E:\heikki\smc.exe -startgui
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MS Domain Name Server Deamon] MSDNSD32.exe
O4 - HKLM\..\RunServices: [NTSF MICROSOFT SYSTEM] winsis32.exe
O4 - HKLM\..\RunServices: [MS Domain Name Server Deamon] MSDNSD32.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [NTSF MICROSOFT SYSTEM] winsis32.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MS Domain Name Server Deamon] MSDNSD32.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: nvidGUIv (nvidGUIv2) - Unknown owner - C:\WINDOWS\nvidGUIv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - E:\heikki\smc.exe
|
|
mawdrgn
Member
|
18. maaliskuuta 2006 @ 18:07 |
Linkki tähän viestiin
|
|
|
|
Ratazz
Suspended due to non-functional email address
|
18. maaliskuuta 2006 @ 19:40 |
Linkki tähän viestiin
|
|
---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------
+ Created on: 22:31:03, 18.3.2006
+ Report-Checksum: 3CD231BD
+ Scan result:
[704] C:\WINDOWS\System32\winsis32.exe -> Backdoor.Rbot : Cleaned with backup
C:\WINDOWS\nvidGUIv.exe -> Backdoor.SdBot.aad : Cleaned with backup
C:\WINDOWS\system32\eraseme_80324.exe -> Backdoor.SdBot.aad : Cleaned with backup
C:\WINDOWS\system32\MSDNSD32.exe -> Backdoor.Rbot.asu : Cleaned with backup
C:\WINDOWS\system32\remon.sys -> Rootkit.Agent.ab : Cleaned with backup
C:\WINDOWS\system32\setup_85771.exe -> Backdoor.SdBot.aad : Cleaned with backup
C:\WINDOWS\system32\Sygate.exe -> Backdoor.Rbot : Cleaned with backup
C:\WINDOWS\system32\winsis32.exe -> Backdoor.Rbot : Cleaned with backup
C:\Documents and Settings\harri\Cookies\harri@2o7[2].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\harri\Cookies\harri@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned with backup
::Report End
|
|
mawdrgn
Member
|
18. maaliskuuta 2006 @ 20:00 |
Linkki tähän viestiin
|
|
Taisipa se lähteä ainakin osittain...
Laita vielä uusi Hijack This-loki, niin nähdään for sure =)
|
|
Ratazz
Suspended due to non-functional email address
|
18. maaliskuuta 2006 @ 20:02 |
Linkki tähän viestiin
|
|
Logfile of HijackThis v1.99.1
Scan saved at 1:01:24, on 19.3.2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
E:\heikki\smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Mixer.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SmcService] E:\heikki\smc.exe -startgui
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: nvidGUIv (nvidGUIv2) - Unknown owner - C:\WINDOWS\nvidGUIv.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - E:\heikki\smc.exe
|
|
mawdrgn
Member
|
18. maaliskuuta 2006 @ 20:07 |
Linkki tähän viestiin
|
|
Sinne meni =)
Nyt loki näyttää puhtaalta :)
|
|
Marku2
Senior Member
|
19. maaliskuuta 2006 @ 03:28 |
Linkki tähän viestiin
|
|
Ja sitten äkkiä hakemaan service pack 2!
|
|
Mainos
|
|
|
|
mawdrgn
Member
|
19. maaliskuuta 2006 @ 05:00 |
Linkki tähän viestiin
|
|
:O Miksi en huomannut tuota?! Liikaväsymys tuohon aikaan...
Hyvä Marku2, kun huomautit.
En voi painottaa tarpeeksi Ratazz, miten tärkeää on, että haet Service Pack 2:hden! Muuten logisi on foorumeilla vähintään kerran viikossa!
|
