|
pöpöjä, hijackthis (ratkaistu)
|
|
|
onkelma
Junior Member
|
15. toukokuuta 2006 @ 21:21 |
Linkki tähän viestiin
|
Taas on pöpöt purreet, auttakaa...
Ewidolla ajettu sekä registry boosterilla + zone alarmin virus ohjelmalla.
Logfile of HijackThis v1.99.1
Scan saved at 1:16:45, on 16.5.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\WINDOWS\system32\LXSUPMON.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\MultiRes\MultiRes.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\pasi koivu\Työpöytä\virusten poistoon\hijackthis_199\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://elisa.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://elisa.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - Toimittaja Elisa Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [MultiRes] C:\Program Files\MultiRes\MultiRes.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Zone Labs Client] D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Uniblue Registry Booster] C:\Program Files\Uniblue\Registry Booster\RegistryBooster.exe /S
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: SMS-viesti - {18BC259E-7404-4A2D-800F-395EC2EDC35F} - http://sms.kolumbus.fi/ (file missing) (HKCU)
O9 - Extra button: Tuki - {4A6B751C-129B-49B7-9883-555136288A6F} - http://tuki.elisa.net/ (file missing) (HKCU)
O9 - Extra button: Palvelut - {68532556-E710-4C82-ADB5-7F0EEDDAC1E5} - http://service.kolumbus.fi/ (file missing) (HKCU)
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31...
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {D6E2C70F-C694-4FDB-9283-459FC77FEFE0} (Softers.efOrderX) - https://www.efoto.fi/efOrderX.CAB
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O20 - Winlogon Notify: winrzf32 - C:\WINDOWS\SYSTEM32\winrzf32.dll
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
|
|
jaska2
Junior Member
|
15. toukokuuta 2006 @ 22:52 |
Linkki tähän viestiin
|
O9 - Extra button: SMS-viesti - {18BC259E-7404-4A2D-800F-395EC2EDC35F} - http://sms.kolumbus.fi/ (file missing) (HKCU)
O9 - Extra button: Tuki - {4A6B751C-129B-49B7-9883-555136288A6F} - http://tuki.elisa.net/ (file missing) (HKCU)
O9 - Extra button: Palvelut - {68532556-E710-4C82-ADB5-7F0EEDDAC1E5} - http://service.kolumbus.fi/ (file missing) (HKCU)
------------------------
noi voisit kokeilla vaikka fixata
|
|
spertti
Senior Member
|
15. toukokuuta 2006 @ 23:30 |
Linkki tähän viestiin
|
|
@jaska2
Miksi nuo pitäisi mielestäsi fixata?
Nuo ovat aivan puhtaita rivejä, joiden fixaamisella ei saavuta muuta, kuin sen etteivät ne enää löydy IE:n työkalu valikosta...
Valitettavasti en itse kerkeä lokia tsekkaamaan, mutta noita ei tosiaankaan tarvitse/kannata fixata.
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 15. toukokuuta 2006 @ 23:49
|
AfterDawn Addict
|
16. toukokuuta 2006 @ 05:56 |
Linkki tähän viestiin
|
@jaska2 & spertti: Ei noita tosiaan fixata :) File missing O9-kohdassa on HjT:n bugi.
@onkelma:
Fixaa HjT:llä (do a system scan only, merkkaa ja paina fix checked):
O20 - Winlogon Notify: winrzf32 - C:\WINDOWS\SYSTEM32\winrzf32.dll
Hae KillBox
http://www.bleepingcomputer.com/files/spyware/KillBox.zip
Pura,avaa ja täppi kohtaan Delete on Reboot
Sitte kopioi rivi tosta alapuolelta
C:\WINDOWS\SYSTEM32\winrzf32.dll
Sitten KillBoxissa ylhäältä File > Paste from Clipboard
Valitse "All Files".Sen jälkeen paina Delete (punainen, jossa on valkonen X)
Vastaa myöntävästi kysymyksiin ja jos kone ei itestään käynnisty uudestaan,niin käynnistä se.
Päivitä ewido.
Käynnistä vikasietotilaan (F8 käynnistyksen yhteydessä)
Skannaa ewidolla, anna poistaa mitä löytää ja tallenna raportti.
Käynnistä uudelleen ja lähetä ewidon raportti sekä uusi HjT-loki.
|
|
onkelma
Junior Member
|
16. toukokuuta 2006 @ 08:45 |
Linkki tähän viestiin
|
Win32.moisho.e virus puskee läpi kokoajan myös ja yrittää muuttaa selaimen aloitussivua, ko pöpö poistetaan kuitenkin automaattisesti zone alarmin toimesta, mutta jotain siitä jää koska kokoajan tulee uudestaan.
Edelliset toimenpiteet mitä neuvoit on tehty ja tässä logeja:
Logfile of HijackThis v1.99.1
Scan saved at 12:43:00, on 16.5.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LXSUPMON.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\MultiRes\MultiRes.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\ZoneLabs\isafe.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\dcomcfg.exe
C:\Documents and Settings\pasi koivu\Työpöytä\virusten poistoon\hijackthis_199\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://elisa.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://elisa.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - Toimittaja Elisa Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Nothing - {b0398eca-0bcd-4645-8261-5e9dc70248d0} - C:\WINDOWS\system32\hp6A1A.tmp
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [MultiRes] C:\Program Files\MultiRes\MultiRes.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Zone Labs Client] D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Uniblue Registry Booster] C:\Program Files\Uniblue\Registry Booster\RegistryBooster.exe /S
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: SMS-viesti - {18BC259E-7404-4A2D-800F-395EC2EDC35F} - http://sms.kolumbus.fi/ (file missing) (HKCU)
O9 - Extra button: Tuki - {4A6B751C-129B-49B7-9883-555136288A6F} - http://tuki.elisa.net/ (file missing) (HKCU)
O9 - Extra button: Palvelut - {68532556-E710-4C82-ADB5-7F0EEDDAC1E5} - http://service.kolumbus.fi/ (file missing) (HKCU)
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31...
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {D6E2C70F-C694-4FDB-9283-459FC77FEFE0} (Softers.efOrderX) - https://www.efoto.fi/efOrderX.CAB
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
sekä ewido:
---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------
+ Created on: 12:36:42, 16.5.2006
+ Report-Checksum: CCB5CC4F
+ Scan result:
:mozilla.317:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Masterstats : Cleaned with backup
:mozilla.329:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.330:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.331:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.332:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.333:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.341:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Ivwbox : Cleaned with backup
:mozilla.346:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Spylog : Cleaned with backup
:mozilla.353:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Targetnet : Cleaned with backup
:mozilla.364:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Doubleclick : Cleaned with backup
:mozilla.381:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Valueclick : Cleaned with backup
:mozilla.389:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Specificclick : Cleaned with backup
:mozilla.432:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Centrport : Cleaned with backup
:mozilla.433:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Webtrendslive : Cleaned with backup
:mozilla.452:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Zedo : Cleaned with backup
:mozilla.457:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Commission-junction : Cleaned with backup
:mozilla.458:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Commission-junction : Cleaned with backup
:mozilla.485:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Onestat : Cleaned with backup
:mozilla.486:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Onestat : Cleaned with backup
:mozilla.487:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Onestat : Cleaned with backup
:mozilla.505:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.508:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.509:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.510:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.511:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.530:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Counted : Cleaned with backup
:mozilla.222:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Tribalfusion : Cleaned with backup
:mozilla.224:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Trafic : Cleaned with backup
:mozilla.279:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Atdmt : Cleaned with backup
:mozilla.280:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.281:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.282:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Clickzs : Cleaned with backup
:mozilla.283:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Clickzs : Cleaned with backup
:mozilla.288:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Adengage : Cleaned with backup
:mozilla.289:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Adengage : Cleaned with backup
:mozilla.290:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Adengage : Cleaned with backup
:mozilla.305:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Clickhype : Cleaned with backup
:mozilla.320:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Masterstats : Cleaned with backup
:mozilla.335:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Com : Cleaned with backup
:mozilla.336:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Com : Cleaned with backup
:mozilla.339:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.340:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.341:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.351:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Ivwbox : Cleaned with backup
:mozilla.355:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Spylog : Cleaned with backup
:mozilla.359:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Targetnet : Cleaned with backup
:mozilla.374:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Doubleclick : Cleaned with backup
:mozilla.389:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Web-stat : Cleaned with backup
:mozilla.390:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Web-stat : Cleaned with backup
:mozilla.391:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Web-stat : Cleaned with backup
:mozilla.394:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Valueclick : Cleaned with backup
:mozilla.404:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Bluestreak : Cleaned with backup
:mozilla.440:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Centrport : Cleaned with backup
:mozilla.441:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Webtrendslive : Cleaned with backup
:mozilla.460:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Zedo : Cleaned with backup
:mozilla.465:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Commission-junction : Cleaned with backup
:mozilla.466:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Commission-junction : Cleaned with backup
:mozilla.493:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Onestat : Cleaned with backup
:mozilla.494:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Onestat : Cleaned with backup
:mozilla.495:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Onestat : Cleaned with backup
:mozilla.513:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.516:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.517:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.518:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.519:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.538:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Counted : Cleaned with backup
:mozilla.232:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.233:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Adserver : Cleaned with backup
:mozilla.235:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Trafic : Cleaned with backup
:mozilla.295:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Atdmt : Cleaned with backup
:mozilla.296:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.297:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.298:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Clickzs : Cleaned with backup
:mozilla.299:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Clickzs : Cleaned with backup
:mozilla.305:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Adengage : Cleaned with backup
:mozilla.306:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Adengage : Cleaned with backup
:mozilla.307:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Adengage : Cleaned with backup
:mozilla.324:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Clickhype : Cleaned with backup
:mozilla.338:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Masterstats : Cleaned with backup
:mozilla.356:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Com : Cleaned with backup
:mozilla.357:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Com : Cleaned with backup
:mozilla.360:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.361:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.362:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.363:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.364:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.376:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Ivwbox : Cleaned with backup
:mozilla.381:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Spylog : Cleaned with backup
:mozilla.400:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Doubleclick : Cleaned with backup
:mozilla.414:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Web-stat : Cleaned with backup
:mozilla.415:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Web-stat : Cleaned with backup
:mozilla.416:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Web-stat : Cleaned with backup
:mozilla.419:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Valueclick : Cleaned with backup
:mozilla.429:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Bluestreak : Cleaned with backup
:mozilla.465:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Centrport : Cleaned with backup
:mozilla.466:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Webtrendslive : Cleaned with backup
:mozilla.485:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Zedo : Cleaned with backup
:mozilla.490:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Commission-junction : Cleaned with backup
:mozilla.491:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Commission-junction : Cleaned with backup
:mozilla.518:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Onestat : Cleaned with backup
:mozilla.519:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Onestat : Cleaned with backup
:mozilla.520:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Onestat : Cleaned with backup
:mozilla.538:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.541:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.542:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.543:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.544:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.563:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Counted : Cleaned with backup
:mozilla.137:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.138:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.139:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.140:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.141:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.167:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Burstnet : Cleaned with backup
:mozilla.168:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Burstnet : Cleaned with backup
:mozilla.178:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
:mozilla.179:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
:mozilla.180:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
:mozilla.181:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
:mozilla.182:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
:mozilla.183:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
:mozilla.184:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
:mozilla.185:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
:mozilla.186:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
:mozilla.187:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
:mozilla.188:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
:mozilla.189:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
:mozilla.190:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
:mozilla.191:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
:mozilla.192:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
:mozilla.193:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
:mozilla.194:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
:mozilla.195:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
:mozilla.196:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
:mozilla.197:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
:mozilla.198:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
:mozilla.199:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
:mozilla.200:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
:mozilla.208:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.233:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.247realmedia : Cleaned with backup
:mozilla.234:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Weborama : Cleaned with backup
:mozilla.236:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.237:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Adserver : Cleaned with backup
:mozilla.239:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Trafic : Cleaned with backup
:mozilla.250:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.253:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Ad-logics : Cleaned with backup
:mozilla.305:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Atdmt : Cleaned with backup
:mozilla.306:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Clickzs : Cleaned with backup
:mozilla.307:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Clickzs : Cleaned with backup
:mozilla.311:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Adengage : Cleaned with backup
:mozilla.312:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Adengage : Cleaned with backup
:mozilla.361:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Com : Cleaned with backup
:mozilla.364:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.365:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.366:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.367:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.368:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.382:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Spylog : Cleaned with backup
:mozilla.388:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Targetnet : Cleaned with backup
:mozilla.403:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Doubleclick : Cleaned with backup
:mozilla.418:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Web-stat : Cleaned with backup
:mozilla.419:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Web-stat : Cleaned with backup
:mozilla.420:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Web-stat : Cleaned with backup
:mozilla.423:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Valueclick : Cleaned with backup
:mozilla.435:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Bluestreak : Cleaned with backup
:mozilla.469:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Centrport : Cleaned with backup
:mozilla.470:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Webtrendslive : Cleaned with backup
:mozilla.484:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Zedo : Cleaned with backup
:mozilla.489:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Commission-junction : Cleaned with backup
:mozilla.490:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Commission-junction : Cleaned with backup
:mozilla.516:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Onestat : Cleaned with backup
:mozilla.517:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Onestat : Cleaned with backup
:mozilla.518:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Onestat : Cleaned with backup
:mozilla.536:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.539:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.540:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.541:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.542:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.561:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Counted : Cleaned with backup
::Report End
|
AfterDawn Addict
|
16. toukokuuta 2006 @ 08:47 |
Linkki tähän viestiin
|
Joo, sinne on tullut uutta pöpöä:
Lataa SmitfraudFix (c) S!Ri
http://siri.urz.free.fr/Fix/SmitfraudFix.zip
Pura sisältö (kansio nimeltä SmitfraudFix) työpöydällesi:
Avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
Valitse optio #1 - Search kirjoittamalla 1 ja painamalla "Enter"; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa).
Postita tämän tekstitiedoston sisältö viestiketjuusi.
Ajoithan muuten varmasti ewidolla "complete system scanin"?
|
|
onkelma
Junior Member
|
16. toukokuuta 2006 @ 08:57 |
Linkki tähän viestiin
|
|
Kyllä ajoin complete system scanin, tässä tämä uusi smitfraud:
SmitFraudFix v2.44
Scan done at 12:55:35.54, ti 16.05.2006
Run from C:\Documents and Settings\pasi koivu\Ty?p?yt?\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [versio 5.1.2600]
»»»»»»»»»»»»»»»»»»»»»»»» C:\
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32
C:\WINDOWS\system32\dcomcfg.exe FOUND !
C:\WINDOWS\system32\hp????.tmp FOUND !
C:\WINDOWS\system32\ld????.tmp FOUND !
C:\WINDOWS\system32\ot.ico FOUND !
C:\WINDOWS\system32\regperf.exe FOUND !
C:\WINDOWS\system32\simpole.tlb FOUND !
C:\WINDOWS\system32\stdole3.tlb FOUND !
C:\WINDOWS\system32\ts.ico FOUND !
C:\WINDOWS\system32\1024\ FOUND !
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\pasi koivu\Application Data
C:\Documents and Settings\pasi koivu\Application Data\Microsoft\Internet Explorer\Quick Launch\SpyFalcon 2.0.lnk FOUND !
»»»»»»»»»»»»»»»»»»»»»»»» Start Menu
C:\DOCUME~1\PASIKO~1\KYNNIS~1\SpyFalcon 2.0.lnk FOUND !
»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\PASIKO~1\Suosikit
C:\DOCUME~1\PASIKO~1\Suosikit\Antivirus Test Online.url FOUND !
»»»»»»»»»»»»»»»»»»»»»»»» Desktop
»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys
»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Nykyinen kotisivu"
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{64ba30a2-811a-4597-b0af-d551128be340}"="AppManager"
[HKEY_CLASSES_ROOT\CLSID\{64ba30a2-811a-4597-b0af-d551128be340}\InProcServer32]
@="C:\WINDOWS\system32\appmagr.dll"
[HKEY_CURRENT_USER\Software\Classes\CLSID\{64ba30a2-811a-4597-b0af-d551128be340}\InProcServer32]
@="C:\WINDOWS\system32\appmagr.dll"
»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection
»»»»»»»»»»»»»»»»»»»»»»»» End
|
AfterDawn Addict
|
16. toukokuuta 2006 @ 09:01 |
Linkki tähän viestiin
|
Sitten tuo infektio on tullut ewidon skannin jälkeen, koska ewido olisi poistanut suuren osan siitä.
Printtaa ohjeet ulos.
Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi.
Kun vikasietotilassa, avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
Valitse optio #2 - Clean kirjoittamalla 2 ja painamalla "Enter" poistaaksesi tarttuneet tiedostot.
Sinulta kysytään: "Registry cleaning - Do you want to clean the registry ?"; vastaa "Yes" kirjoittamalla Y ja paina "Enter" poistaaksesi työpöydän taustakuvan ja puhdistaaksesi tarttuneet rekisteriavaimet.
Työkalu tarkistaa jos wininet.dll on tarttunut. Sinua saatetaan pyytää korvaamaan tarttunut .dll (jos löytyy); vastaa "Yes" kirjoittamalla Y ja painamalla "Enter".
Työkalun saattaa tarvita käynnistää kone uudelleen; jos ei tee niin, käynnistä normaaliin Windowsiin.
Tekstitiedosto ilmestyy, puhdistusprosessin jäljiltä; kopioi & liitä tämän raportin tulokset vastaukseesi.
Raportti löytyy paikalliselta levyltäsi, useimmiten C:\rapport.txt.
Lähetä sen sisältö ja uusi HjT-loki.
|
|
onkelma
Junior Member
|
16. toukokuuta 2006 @ 09:22 |
Linkki tähän viestiin
|
Tässä rapport:
SmitFraudFix v2.44
Scan done at 13:10:27.67, ti 16.05.2006
Run from C:\Documents and Settings\pasi koivu\Ty?p?yt?\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [versio 5.1.2600]
»»»»»»»»»»»»»»»»»»»»»»»» Killing process
»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files
C:\WINDOWS\system32\atmclk.exe Deleted
C:\WINDOWS\system32\dcomcfg.exe Deleted
C:\WINDOWS\system32\hp????.tmp Deleted
C:\WINDOWS\system32\ld????.tmp Deleted
C:\WINDOWS\system32\ot.ico Deleted
C:\WINDOWS\system32\regperf.exe Deleted
C:\WINDOWS\system32\simpole.tlb Deleted
C:\WINDOWS\system32\stdole3.tlb Deleted
C:\WINDOWS\system32\ts.ico Deleted
C:\WINDOWS\system32\1024\ Deleted
C:\Documents and Settings\pasi koivu\Application Data\Microsoft\Internet Explorer\Quick Launch\SpyFalcon 2.0.lnk Deleted
C:\DOCUME~1\PASIKO~1\Suosikit\Antivirus Test Online.url Deleted
C:\DOCUME~1\PASIKO~1\KYNNIS~1\SpyFalcon 2.0.lnk Deleted
»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files
»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning
Registry Cleaning done.
»»»»»»»»»»»»»»»»»»»»»»»» End
sekä hjt:
Logfile of HijackThis v1.99.1
Scan saved at 13:19:47, on 16.5.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\ZoneLabs\isafe.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LXSUPMON.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\MultiRes\MultiRes.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\pasi koivu\Työpöytä\virusten poistoon\hijackthis_199\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - Toimittaja Elisa Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [MultiRes] C:\Program Files\MultiRes\MultiRes.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Zone Labs Client] D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Uniblue Registry Booster] C:\Program Files\Uniblue\Registry Booster\RegistryBooster.exe /S
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: SMS-viesti - {18BC259E-7404-4A2D-800F-395EC2EDC35F} - http://sms.kolumbus.fi/ (file missing) (HKCU)
O9 - Extra button: Tuki - {4A6B751C-129B-49B7-9883-555136288A6F} - http://tuki.elisa.net/ (file missing) (HKCU)
O9 - Extra button: Palvelut - {68532556-E710-4C82-ADB5-7F0EEDDAC1E5} - http://service.kolumbus.fi/ (file missing) (HKCU)
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Ja kun koneen käynnistin normaaliin tilaan tuli ilmoitus että järjestelmä on palautunut vakavasta virheestä.
|
AfterDawn Addict
|
16. toukokuuta 2006 @ 09:24 |
Linkki tähän viestiin
|
|
Lokit ovat ok. Kokeilepa käynnistää kone uudestaan ja kerro tuleeko sitä ilmoitusta vielä.
|
|
onkelma
Junior Member
|
16. toukokuuta 2006 @ 09:40 |
Linkki tähän viestiin
|
Ennen uudelleen käynnistystä ajelin vielä päivitetyn Spybot s&d:n läpi joka löysi avenue.a, double click ja spy falcon:in jonka ohjelma korjasi.
Nyt ei tullut mitään virhe ilmoitusta eikä tapahtumienvalvonta lokeissakaan mitään uutta näy.
Jos tämä on tällä erää selvä, niin kiitos sinulle kemisti aivojen lainasta =)
|
AfterDawn Addict
|
16. toukokuuta 2006 @ 09:42 |
Linkki tähän viestiin
|
|
Heh, ole hyvä :D
|
|
onkelma
Junior Member
|
16. toukokuuta 2006 @ 12:21 |
Linkki tähän viestiin
|
|
|
|
Mainos
|
|
|
AfterDawn Addict
|
16. toukokuuta 2006 @ 12:39 |
Linkki tähän viestiin
|
|
Joo tee Disa-:n ohjeiden mukaan ja tarkista myös prosessorin lämmöt ja ettei prossun/näyttiksen tuulettimessa ole pölyä.
|
