|
|
|
Keskustelualueet
Keskustelualueet
|
|
|
work offline hyppii ruudulle
|
|
|
S4msa
Newbie
|
8. maaliskuuta 2008 @ 14:59 |
Linkki tähän viestiin
|
Tasaisin väliajoin koneeni ruudulle hyppii internet explorerin "work offline"-ruutu,vaikka en ole koskenut IE:n moneen kuukauteen. Avast eikä avg antispyware löydä mitään haittaohjelman tapaistakaan.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:56, on 2008-03-08
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {229EA40F-902A-497E-AA98-4E0820A14695} - (no file)
O2 - BHO: (no name) - {4391423E-9A5A-4A57-945E-342A54260307} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: {9366d9fd-acb7-2fba-10a4-885f5ae4c789} - {987c4ea5-f588-4a01-abf2-7bcadf9d6639} - (no file)
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O21 - SSODL: ChkUnknown - {de50462e-2e4d-49ff-b0b7-f39496bc97ed} - C:\WINDOWS\Installer\{de50462e-2e4d-49ff-b0b7-f39496bc97ed}\ChkUnknown.dll
O21 - SSODL: zip - {c8d86992-a579-48d9-aac0-82eeecf6b782} - C:\WINDOWS\Installer\{c8d86992-a579-48d9-aac0-82eeecf6b782}\zip.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
|
|
Hujo
Suspended permanently
|
8. maaliskuuta 2008 @ 15:31 |
Linkki tähän viestiin
|
scannaa hjt:llä merkkaa paina Fix checked
O2 - BHO: (no name) - {229EA40F-902A-497E-AA98-4E0820A14695} - (no file)
O2 - BHO: (no name) - {4391423E-9A5A-4A57-945E-342A54260307} - (no file)
O2 - BHO: {9366d9fd-acb7-2fba-10a4-885f5ae4c789} - {987c4ea5-f588-4a01-abf2-7bcadf9d6639} - (no file)
=============
Lataa SmitfraudFix (c) S!Ri
Pura sisältö (kansio nimeltä SmitfraudFix) työpöydällesi:
Avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
Valitse optio #1 - Search kirjoittamalla 1 ja painamalla "Enter"; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa).
Postita ponnahtava rapport ? muistion sisältö viestiketjuusi.
Löytyy myös C:\rapport.txt
Huomaa : process.exe filun tunnistaa jotkut Anti-virus ohjelmat (AntiVir, Dr.Web, Kaspersky) "Haittakaluna"; se ei ole virus, vaan ohjelma joka pysäyttää prosesseja. A/V ohjelmat eivät pysty tunnistamaan hyvän ja pahan käytön tälläisten ohjelmian väliltä, silloin ne saattavat varoittaa käyttäjää.
===========
1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
combofix1
combofix2
2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
=========
Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.
Käynnistä koneesi vikasietotilaan:
sammuta ja käynnistä
käynnistyksen yhteydessä hakkaa F8 nappia
valitse nuolinäppäimellä vikasietotila
paina enter ja enter
valitse käyttäjätilisi
paina kyllä
Jossakin koneissa hakataan F8:sin sijasta F5:tä
" Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
" Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
" Paina Y käynnistääksesi skriptin.
" Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
" Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
" Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
" Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
" Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
" Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.
Voiko tietsikka koskaan toimia?
|
|
S4msa
Newbie
|
8. maaliskuuta 2008 @ 16:29 |
Linkki tähän viestiin
|
SmitFraudFix v2.300
Scan done at 15:56:41.01, 2008-03-08
Run from C:\Documents and Settings\Samu\Local Settings\Desktop\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode
ｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻ Process
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\cmd.exe
ｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻ hosts
ｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻ C:\
ｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻ C:\WINDOWS
ｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻ C:\WINDOWS\system
ｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻ C:\WINDOWS\Web
ｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻ C:\WINDOWS\system32
ｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻ C:\WINDOWS\system32\LogFiles
ｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻ C:\Documents and Settings\Samu
ｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻ C:\Documents and Settings\Samu\Application Data
ｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻ Start Menu
ｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻ
ｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻ Desktop
ｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻ C:\Program Files
ｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻ Corrupted keys
ｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻ Desktop Components
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
ｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻ IEDFix
!!!Attention, following keys are not inevitably infected!!!
IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
ｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻ VACFix
!!!Attention, following keys are not inevitably infected!!!
VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
[!] Suspicious: ChkUnknown.dll
SSODL: ChkUnknown - {de50462e-2e4d-49ff-b0b7-f39496bc97ed}
[!] Suspicious: zip.dll
SSODL: zip - {c8d86992-a579-48d9-aac0-82eeecf6b782}
ｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻ Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
ｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻ AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=" C:\\WINDOWS\\system32\\guard32.dll"
ｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻ Winlogon.System
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""
ｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻ Rustock
ｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻ DNS
Description: Marvell Yukon 88E8039 PCI-E Fast Ethernet Controller - Packet Scheduler Miniport
DNS Server Search Order: 62.240.64.97
DNS Server Search Order: 62.216.99.250
HKLM\SYSTEM\CCS\Services\Tcpip\..\{4E752A68-E93A-4201-80C7-B42F575D15AE}: DhcpNameServer=62.240.64.97 62.216.99.250
HKLM\SYSTEM\CS1\Services\Tcpip\..\{4E752A68-E93A-4201-80C7-B42F575D15AE}: DhcpNameServer=62.240.64.97 62.216.99.250
HKLM\SYSTEM\CS2\Services\Tcpip\..\{4E752A68-E93A-4201-80C7-B42F575D15AE}: DhcpNameServer=62.240.64.97 62.216.99.250
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=62.240.64.97 62.216.99.250
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=62.240.64.97 62.216.99.250
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=62.240.64.97 62.216.99.250
ｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻ Scanning for wininet.dll infection
ｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻ End
|
|
Hujo
Suspended permanently
|
8. maaliskuuta 2008 @ 16:40 |
Linkki tähän viestiin
|
Printtaa ohjeet ulos
Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi.
Vikasietotilaan:
sammuta ja käynnistä
käynnistyksen yhteydessä hakkaa F8 nappia
valitse nuolinäppäimellä vikasietotila
paina enter ja enter
valitse käyttäjätilisi
paina kyllä
Jossakin koneissa hakataan F8:sin sijasta F5:tä
Kun vikasietotilassa, avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
Valitse optio #2 - Clean kirjoittamalla 2 ja painamalla "Enter" poistaaksesi tarttuneet tiedostot.
Sinulta kysytään: "Registry cleaning - Do you want to clean the registry ?"; vastaa "Yes" kirjoittamalla Y ja paina "Enter" poistaaksesi työpöydän taustakuvan ja puhdistaaksesi tarttuneet rekisteriavaimet.
Työkalu tarkistaa jos wininet.dll on tarttunut. Sinua saatetaan pyytää korvaamaan tarttunut .dll (jos löytyy); vastaa "Yes" kirjoittamalla Y ja painamalla "Enter".
Työkalun saattaa tarvita käynnistää kone uudelleen; jos ei tee niin, käynnistä normaaliin Windowsiin.
Tekstitiedosto ilmestyy, puhdistusprosessin jäljiltä; kopioi & liitä tämän raportin tulokset vastaukseesi.
Raportti löytyy paikalliselta levyltäsi, useimmiten C:\rapport.txt.
Varoitus : Ajamalla optio 2:n EI-tarttuneessa tietokoneessa, poistaa sinun työpöytäsi taustakuvan.
Voiko tietsikka koskaan toimia?
|
|
S4msa
Newbie
|
8. maaliskuuta 2008 @ 16:49 |
Linkki tähän viestiin
|
ComboFix 08-03-07.4 - Samu 2008-03-08 16:01:17.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.932.81.1033.18.1618 [GMT 2:00]
Running from: C:\Documents and Settings\Samu\Local Settings\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-02-08 to 2008-03-08 )))))))))))))))))))))))))))))))
.
2008-03-08 15:56 . 2008-03-08 15:56 1,000 --a------ C:\WINDOWS\system32\tmp.reg
2008-03-08 14:18 . 2008-03-08 14:18 <DIR> d-------- C:\Program Files\Trend Micro
2008-03-05 20:47 . 2008-03-05 20:47 <DIR> d-------- C:\Program Files\Quick StartUp
2008-03-05 20:10 . 2001-08-17 13:48 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2008-03-05 20:10 . 2001-08-17 13:48 12,160 --a------ C:\WINDOWS\system32\dllcache\mouhid.sys
2008-03-05 19:08 . 2008-03-05 19:08 <DIR> d-------- C:\Documents and Settings\Samu\Application Data\Ahead
2008-03-02 15:28 . 2008-03-02 15:28 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-02-24 17:42 . 2003-03-27 13:55 11,776 --a------ C:\WINDOWS\system32\drivers\kbfilter.sys
2008-02-24 17:41 . 2003-09-22 14:00 57,344 --------- C:\WINDOWS\system32\HKLock.dll
2008-02-24 17:41 . 2003-09-22 14:00 57,344 --------- C:\WINDOWS\HKLock.dll
2008-02-24 17:41 . 2003-01-23 14:29 9,548 --a------ C:\WINDOWS\system32\drivers\moufiltr.sys
2008-02-22 20:29 . 2008-02-27 23:26 <DIR> d-------- C:\Documents and Settings\Samu\Application Data\dvdcss
2008-02-19 18:18 . 2008-02-19 18:18 1,066,176 --a------ C:\WINDOWS\system32\mscomctl.ocx
2008-02-11 20:50 . 2008-02-11 20:49 139,008 --a------ C:\WINDOWS\system32\guard32.dll.vir
2008-02-11 20:50 . 2008-02-11 20:49 83,064 --a------ C:\WINDOWS\system32\drivers\cmdGuard.sys
2008-02-11 20:50 . 2008-02-11 20:49 23,800 --a------ C:\WINDOWS\system32\drivers\cmdhlp.sys
2008-02-11 09:56 . 2008-02-11 09:56 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Comodo
2008-02-09 17:16 . 2008-02-09 21:26 <DIR> d-------- C:\Program Files\Kingdom of Dreams
2008-02-09 02:07 . 2008-02-11 17:47 <DIR> d-------- C:\Program Files\CCleaner
2008-02-09 01:02 . 2008-02-09 01:02 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Grisoft
2008-02-09 00:34 . 2008-02-09 00:34 <DIR> d-------- C:\Documents and Settings\Samu\Application Data\Grisoft
2008-02-09 00:34 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-02-09 00:33 . 2008-02-09 00:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-09 00:24 . 2008-02-09 00:24 <DIR> d-------- C:\WINDOWS\system32\xircom
2008-02-09 00:24 . 2008-02-09 00:24 <DIR> d-------- C:\WINDOWS\srchasst
2008-02-09 00:24 . 2008-02-09 00:24 <DIR> d-------- C:\Program Files\microsoft frontpage
2008-02-09 00:19 . 2007-06-24 09:40 578,048 --a------ C:\WINDOWS\system32\dllcache\user32.dll
2008-02-09 00:18 . 2008-02-09 00:18 <DIR> d-------- C:\WINDOWS\ERUNT
2008-02-09 00:13 . 2008-02-09 01:02 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\OpenOffice.org2
2008-02-08 12:40 . 2008-02-08 12:40 <DIR> d-------- C:\Program Files\ToniArts
2008-02-08 10:51 . 2008-02-08 10:51 84 --a------ C:\WINDOWS\Wininit.INI
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-08 12:33 --------- d-----w C:\Documents and Settings\Samu\Application Data\Azureus
2008-03-05 17:05 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-29 19:48 --------- d-----w C:\Documents and Settings\Samu\Application Data\OpenOffice.org2
2008-02-19 15:21 --------- d-----w C:\Documents and Settings\Samu\Application Data\Skype
2008-02-11 19:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\comodo
2008-02-11 18:50 --------- d-----w C:\Documents and Settings\Samu\Application Data\Comodo
2008-02-07 21:47 --------- d-----w C:\Program Files\Alwil Software
2008-02-07 21:26 4,534 ----a-w C:\Documents and Settings\Samu\Application Data\wklnhst.dat
2008-02-07 20:45 --------- d-----w C:\Program Files\Common Files\Adobe
2008-02-07 18:15 --------- d-----w C:\Documents and Settings\Samu\Application Data\Template
2008-02-07 18:14 --------- d-----w C:\Documents and Settings\Samu\Application Data\Thinstall
2008-02-07 17:57 --------- d-----w C:\Program Files\Microsoft Reader
2008-02-06 18:33 --------- d-----w C:\Program Files\Superjoy Box Pro
2008-02-05 08:28 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-01-26 20:53 --------- d-----w C:\Documents and Settings\Samu\Application Data\vlc
2008-01-26 20:07 --------- d-----w C:\Program Files\VideoLAN
2008-01-26 10:31 --------- d-----w C:\Documents and Settings\Samu\Application Data\fretsonfire
2008-01-22 18:42 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-01-18 18:53 --------- d-----w C:\Program Files\OpenOffice.org 2.3
2008-01-13 14:04 --------- d-----w C:\Documents and Settings\Samu\Application Data\skypePM
2008-01-13 11:58 --------- d-----w C:\Program Files\Winamp
2008-01-13 11:58 --------- d-----w C:\Documents and Settings\Samu\Application Data\Winamp
2008-01-13 11:07 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-01-13 10:48 --------- d-----w C:\Program Files\Azureus
2008-01-13 10:46 --------- d-----w C:\Program Files\Java
2008-01-13 10:44 --------- d-----w C:\Program Files\Common Files\Java
2008-01-13 10:25 --------- d-----w C:\Program Files\Skype
2008-01-13 10:25 --------- d-----w C:\Program Files\Common Files\Skype
2008-01-13 10:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype
2008-01-12 22:25 --------- d-----w C:\Documents and Settings\Samu\Application Data\Media Player Classic
2008-01-12 22:24 --------- d-----w C:\Program Files\Combined Community Codec Pack
2008-01-12 22:19 --------- d-----w C:\Program Files\COMODO
2008-01-12 22:18 --------- d-----w C:\Program Files\DIFX
2008-01-12 22:15 --------- d-----w C:\Program Files\CONEXANT
.
------- Sigcheck -------
a11391be25035570ae4b8970920f2c74 C:\WINDOWS\system32\drivers\tcpip.sys
----a-w 360,704 2007-06-27 19:46:01 C:\WINDOWS\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:56 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2007-06-24 09:40 208952]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-05-22 22:35 8433664]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 15:00 79224]
"COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [2008-02-11 20:49 5046016]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:56 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2007-06-24 09:41 124928 C:\WINDOWS\system32\advpack.dll]
"ShowDeskFix"="regsvr32 /s /n /i:u shell32" []
C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\
OpenOffice.org 2.3.lnk - C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe [2007-11-14 17:32:04 393216]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableStatusMessages"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoDesktopCleanupWizard"= 1 (0x1)
"HideRunAsVerb"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"ChkUnknown"= {de50462e-2e4d-49ff-b0b7-f39496bc97ed} - C:\WINDOWS\Installer\{de50462e-2e4d-49ff-b0b7-f39496bc97ed}\ChkUnknown.dll [2008-02-07 23:35 14374]
"zip"= {c8d86992-a579-48d9-aac0-82eeecf6b782} - C:\WINDOWS\Installer\{c8d86992-a579-48d9-aac0-82eeecf6b782}\zip.dll [2008-02-08 13:22 39462]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"= C:\WINDOWS\system32\guard32.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Java\\jre1.6.0_03\\bin\\javaw.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\WINDOWS\system32\DRIVERS\cmdguard.sys [2008-02-11 20:49]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\WINDOWS\system32\DRIVERS\cmdhlp.sys [2008-02-11 20:49]
R1 kbfilter;Keyboard Filter Driver;C:\WINDOWS\system32\drivers\kbfilter.sys [2003-03-27 13:55]
R1 moufiltr;Mouse Filter Driver;C:\WINDOWS\system32\drivers\moufiltr.sys [2003-01-23 14:29]
S3 MayPro;TigerGame SuperJoy Box Pro Filter Service;C:\WINDOWS\system32\Drivers\MayPro.sys [2006-05-05 16:24]
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-08 16:04:44
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\explorer.exe [6.00.2900.2894]
-> C:\WINDOWS\Installer\{de50462e-2e4d-49ff-b0b7-f39496bc97ed}\ChkUnknown.dll
.
Completion time: 2008-03-08 16:05:40
|
|
S4msa
Newbie
|
8. maaliskuuta 2008 @ 17:02 |
Linkki tähän viestiin
|
SDFix: Version 1.138
Run by Administrator on 08.03.2008 la at 16:12
Microsoft Windows XP [Version 5.1.2600]
Running From: C:\DOCUME~1\ADMINI~1\Desktop\sdfix\SDFix
Safe Mode:
Checking Services:
Restoring Windows Registry Values
Restoring Windows Default Hosts File
Rebooting...
Normal Mode:
Checking Files:
No Trojan Files Found
Removing Temp Files...
ADS Check:
Final Check:
catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-08 16:17:56
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden services & system hive ...
scanning hidden registry entries ...
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes]
"\31j\x58a8\16f\35g?"="\xff2d\xff33 \x660e\x671d"
"\31j\x58a8\xff740\xff770\xff830\xff6f0?"="\xff2d\xff33 \x30b4\x30b7\x30c3\x30af"
"\xff740\xff770\xff830\xff6f0"="\xff2d\xff33 \x30b4\x30b7\x30c3\x30af"
"z\xf8f3\x30fb|\xf8f3o\xf8f3x\xf8f3?"="\xff2d\xff33 \x30b4\x30b7\x30c3\x30af"
"x\xf8f3p\xf8f3\x30fbt\xf8f3?"="Courier"
"\x80\xf8f3r\xf8f3\x30fb}\xf8f3\x30fb\x30fb\x30fb\x30fb?????"="Times New Roman"
"\x30fb\x30fb\x30fb\x30fb\x30fbv\xf8f3?????"="Arial"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\\xff6f0\x30fb\x30fb\xff780\x30fb]
"Order"=hex:08,00,00,00,02,00,00,00,a6,00,00,00,01,00,00,00,01,00,00,00,9a,..
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
Remaining Services:
------------------
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Java\\jre1.6.0_03\\bin\\javaw.exe"="C:\\Program Files\\Java\\jre1.6.0_03\\bin\\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"
Remaining Files:
---------------
Files with Hidden Attributes:
Fri 8 Feb 2008 39,462 ..SHR --- "C:\WINDOWS\Installer\{c8d86992-a579-48d9-aac0-82eeecf6b782}\zip.dll"
Thu 7 Feb 2008 14,374 ..SHR --- "C:\WINDOWS\Installer\{de50462e-2e4d-49ff-b0b7-f39496bc97ed}\ChkUnknown.dll"
Finished!
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 8. maaliskuuta 2008 @ 17:04
|
|
S4msa
Newbie
|
8. maaliskuuta 2008 @ 17:33 |
Linkki tähän viestiin
|
SmitFraudFix v2.300
Scan done at 17:23:24,59, 08.03.2008 la
Run from C:\Documents and Settings\Samu\Local Settings\Desktop\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode
ｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻ SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
ｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻ Killing process
ｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻ hosts
127.0.0.1 localhost
ｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻ VACFix
VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
C:\WINDOWS\Installer\{de50462e-2e4d-49ff-b0b7-f39496bc97ed}\ChkUnknown.dll deleted
C:\WINDOWS\Installer\{c8d86992-a579-48d9-aac0-82eeecf6b782}\zip.dll deleted
ｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻ Winsock2 Fix
S!Ri's WS2Fix: LSP not Found.
ｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻ Generic Renos Fix
GenericRenosFix by S!Ri
ｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻ Deleting infected files
ｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻ IEDFix
IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
ｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻ DNS
HKLM\SYSTEM\CCS\Services\Tcpip\..\{4E752A68-E93A-4201-80C7-B42F575D15AE}: DhcpNameServer=62.240.64.97 62.216.99.250
HKLM\SYSTEM\CS1\Services\Tcpip\..\{4E752A68-E93A-4201-80C7-B42F575D15AE}: DhcpNameServer=62.240.64.97 62.216.99.250
HKLM\SYSTEM\CS2\Services\Tcpip\..\{4E752A68-E93A-4201-80C7-B42F575D15AE}: DhcpNameServer=62.240.64.97 62.216.99.250
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=62.240.64.97 62.216.99.250
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=62.240.64.97 62.216.99.250
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=62.240.64.97 62.216.99.250
ｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻ Deleting Temp Files
ｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻ Winlogon.System
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""
ｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻ Registry Cleaning
Registry Cleaning done.
ｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻ SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
ｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻｻ End
|
|
S4msa
Newbie
|
8. maaliskuuta 2008 @ 17:37 |
Linkki tähän viestiin
|
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:35:59, on 8.3.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Uninterruptible Power Supply (UPS) - Unknown owner - C:\WINDOWS\System32\ups.exe (file missing)
--
End of file - 3975 bytes
|
|
Mainos
|
|
|
|
Hujo
Suspended permanently
|
8. maaliskuuta 2008 @ 17:38 |
Linkki tähän viestiin
|
Voiko tietsikka koskaan toimia?
|
|
