|
|
|
Keskustelualueet
Keskustelualueet
|
|
|
HJT-lokini
|
|
|
ursulla
Newbie
|
8. huhtikuuta 2008 @ 15:23 |
Linkki tähän viestiin
|
Mitä tästä mahdollisesti kannattaisi poistaa?
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:17:42, on 8.4.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\System32\M-AudioTaskBarIcon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\LaCie\Backup Software\LaCieBackup.exe
C:\Program Files\DMTS\BIN\e3DMTSMediaServer.exe
C:\Program Files\DMTS\BIN\e3DMTSServer.exe
C:\Program Files\M-Audio Fast Track\GBInst.exe
C:\Program Files\M-Audio\JamLab\JamLabInst.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
C:\Program Files\M-Audio\Audiophile USB\MAUSBAPInst.exe
C:\Program Files\M-Audio\Black Box\MAUSBBBInst.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\Program Files\M-Audio\Conectiv\MAUSBCVInst.exe
C:\Program Files\M-Audio\Fast Track Pro\MAUSBInst.exe
C:\Program Files\M-Audio\MobilePre\Install\MPInst.exe
C:\Program Files\NetLimiter 2 Pro\nlsvc.exe
C:\Program Files\M-Audio\Ozone\Install\ozinst.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\M-Audio\Transit\Install\TUSBInst.exe
C:\Program Files\NetLimiter 2 Pro\NLClient.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\Program Files\BitTorrent\bittorrent.exe
C:\Program Files\Webteh\BSplayerPro\bsplayer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50168
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [NTFSSAPI] ntfsapi.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [M-Audio Taskbar Icon] C:\WINDOWS\System32\M-AudioTaskBarIcon.exe
O4 - HKLM\..\RunServices: [NTFSSAPI] ntfsapi.exe
O4 - HKLM\..\RunServices: [Media Load] msn32.exe
O4 - HKLM\..\RunServices: [winguard] wingrd32.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [LaCie Backup] C:\Program Files\LaCie\Backup Software\\LaCieBackup.exe /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [Windows Lmhost Util] lmhost.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [Microsoft IE] IEXPLORE.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [Windows Messenger] msmsgs.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [Sysino] lsess.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [Nvidia CTRL Panel] ncsvc32.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunServices: [MSN Messanger] msnmsng.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [Windows Lmhost Util] lmhost.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunServices: [MSN Messanger] msnmsng.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Web Savings - file://C:\Program Files\WebSavingsfromEbates\System\Temp\ebateswebsavings_script0.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{39D78B64-F1D5-4C55-8DB8-2759D59EBBE4}: NameServer = 213.139.190.3 212.50.131.153
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O23 - Service: e-3 DMTS Media Server (e3DMTSMediaServer) - Unknown owner - C:\Program Files\DMTS\BIN\e3DMTSMediaServer.exe
O23 - Service: e-3 DMTS Server (e3DMTSServer) - Unknown owner - C:\Program Files\DMTS\BIN\e3DMTSServer.exe
O23 - Service: Fast Track Installer (FastTrackInstallerService) - Nemesis - C:\Program Files\M-Audio Fast Track\GBInst.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: JamLab Installer (JamLabInstallerService) - M-Audio - C:\Program Files\M-Audio\JamLab\JamLabInst.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
O23 - Service: M-Audio Audiophile Installer (MAudioAudiophileService) - Avid Technology, Inc. - C:\Program Files\M-Audio\Audiophile USB\MAUSBAPInst.exe
O23 - Service: M-Audio BlackBox Installer (MAudioBlackBoxService) - Avid Technology, Inc. - C:\Program Files\M-Audio\Black Box\MAUSBBBInst.exe
O23 - Service: M-Audio Conectiv Installer (MAudioConectivService) - Avid Technology, Inc. - C:\Program Files\M-Audio\Conectiv\MAUSBCVInst.exe
O23 - Service: M-Audio USB Installer (MAudioUSBService) - M-Audio - C:\Program Files\M-Audio\Fast Track Pro\MAUSBInst.exe
O23 - Service: MobilePre Installer (MobilePreInstallerService) - M-Audio - C:\Program Files\M-Audio\MobilePre\Install\MPInst.exe
O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\Program Files\NetLimiter 2 Pro\nlsvc.exe
O23 - Service: M-Audio Ozone Installer (OzoneInstallerService) - Nemesis - C:\Program Files\M-Audio\Ozone\Install\ozinst.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PPPoE Service (PPPoEService) - Unknown owner - C:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe
O23 - Service: M-Audio Transit Installer (TransitInstallerService) - M-Audio - C:\Program Files\M-Audio\Transit\Install\TUSBInst.exe
--
End of file - 8467 bytes
houston is comign
|
|
Hujo
Suspended permanently
|
8. huhtikuuta 2008 @ 15:32 |
Linkki tähän viestiin
|
Javan päivitys ja välimuistin tyhjennys:
1. Klikkaa Käynnistä -> Ohjauspaneeli ja tupla-klikkaa Lisää tai poista sovellus Ohjauspaneelissa.
2. Etsi listasta kaikki entiset Java versiosi. (J2SE Runtime Environment.... )
Niissä pitäisi olla seuraava kuva vieressä: 
3. Valitse kaikki entiset Java versiosi ja valitse Poista.
4. Asenna uusin Java päivitys seuraavasta linkistä..
5. Käynnistä kone uudelleen asennuksen jälkeen:
http://java.sun.com/javase/downloads/index.jsp
Rullaa alas kohteeseen Java Runtime Environment (JRE) 6u5
Paina Download
Ruksaa Accept, ota offline installation, tallenna vaikka työpöydälle ja asenna se.
6. Käynnistyksen jälkeen, mene takaisin Ohjauspaneeliin ja avaa Java asetuksesi (Muita Ohjauspaneelin asetuksia -> Java kahvikuppi).
7. General Settings -osion alla, vedä liukusäädintä (Disk Space) pienemmälle, ja klikkaa Delete Files -nappia.
(Jotkut javapohjaiset ohjelmat saattavat tarvita enemmän levytilaa.
Jos huomaat säädön pienentämisen jälkeen koneessa hitautta, siirrä liukusäädintä isommalle).
8. Varmista että kaikki kaksi valintaa ovat rastitettuja:
*Applications and Applets
*Trace and Log Files
Ja paina OK -nappia
9. Klikkaa OK "Temporary Files Settings" -ikkunassasi.
10. Klikkaa OK jättääksesi Java asetusikkunasi.
============
Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.
Käynnistä koneesi vikasietotilaan:
sammuta ja käynnistä
käynnistyksen yhteydessä hakkaa F8 nappia
valitse nuolinäppäimellä vikasietotila
paina enter ja enter
valitse käyttäjätilisi
paina kyllä
Jossakin koneissa hakataan F8:sin sijasta F5:tä
" Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
" Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
" Paina Y käynnistääksesi skriptin.
" Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
" Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
" Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
" Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
" Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
" Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.
Voiko tietsikka koskaan toimia?
|
|
ursulla
Newbie
|
8. huhtikuuta 2008 @ 16:33 |
Linkki tähän viestiin
|
Tässä SDFixin report muistio:
SDFix: Version 1.167
Run by jari on ti 08.04.2008 at 16:16
Microsoft Windows XP [versio 5.1.2600]
Running From: C:\SDFix
Checking Services :
Restoring Windows Registry Values
Restoring Windows Default Hosts File
Rebooting
Checking Files :
Trojan Files Found:
C:\WINDOWS\smdat32a.sys - Deleted
Removing Temp Files
ADS Check :
Final Check :
catchme 0.3.1351.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-08 16:23:48
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden services & system hive ...
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{259F814B-410F-489B-8E7C-666816BFA02A}]
"LeaseObtainedTime"=dword:47fb7aba
"T1"=dword:47fb7aba
"T2"=dword:47fb7aba
"DhcpRetryTime"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{259F814B-410F-489B-8E7C-666816BFA02A}\Parameters\Tcpip]
"LeaseObtainedTime"=dword:47fb7aba
"T1"=dword:47fb7aba
"T2"=dword:47fb7aba
scanning hidden registry entries ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
Remaining Services :
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:µTorrent"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
"C:\\Program Files\\DNA\\btdna.exe"="C:\\Program Files\\DNA\\btdna.exe:*:Enabled:DNA"
"C:\\Program Files\\BitTorrent\\bittorrent.exe"="C:\\Program Files\\BitTorrent\\bittorrent.exe:*:Enabled:BitTorrent"
"C:\\Program Files\\Sunbelt Software\\Personal Firewall 4\\kpf4gui.exe"="C:\\Program Files\\Sunbelt Software\\Personal Firewall 4\\kpf4gui.exe:*:Enabled:Sunbelt Kerio Personal Firewall 4 - GUI"
"C:\\Soldat\\Soldat.exe"="C:\\Soldat\\Soldat.exe:*:Enabled:Soldat"
"C:\\Program Files\\DC++\\DCPlusPlus.exe"="C:\\Program Files\\DC++\\DCPlusPlus.exe:*:Enabled:DC++"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
Remaining Files :
File Backups: - C:\SDFix\backups\backups.zip
Files with Hidden Attributes :
Mon 25 Jun 2007 61,440 A..H. --- "C:\Program Files\MSN Messenger\winmm.dll"
Mon 27 Dec 2004 56 ..SHR --- "C:\WINDOWS\system32\89931FC656.sys"
Sat 5 Apr 2008 13,304 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"
Sat 22 Oct 2005 1,024 ...HR --- "C:\WINDOWS\system32\NTICDMK7.dll"
Sat 22 Oct 2005 1,024 ...HR --- "C:\WINDOWS\system32\NTIMPEG2.dll"
Tue 23 Dec 2003 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Tue 23 Dec 2003 401 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv11.bak"
Fri 5 Mar 2004 401 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv12.bak"
Sat 4 Dec 2004 400 ..SH. --- "C:\Documents and Settings\All Users\DRM\v2ks.bla.bak"
Sat 4 Dec 2004 48 ..SH. --- "C:\Documents and Settings\All Users\DRM\v2ks.sec.bak"
Tue 23 Dec 2003 4,348 A..H. --- "C:\Documents and Settings\jari\Mallit\Omat tiedostot\Omat musiikkitiedostot\K?ytt?oikeuden varmuuskopio\drmv1key.bak"
Mon 5 Feb 2007 401 A..H. --- "C:\Documents and Settings\jari\Mallit\Omat tiedostot\Omat musiikkitiedostot\K?ytt?oikeuden varmuuskopio\drmv1lic.bak"
Sat 4 Dec 2004 400 A..H. --- "C:\Documents and Settings\jari\Mallit\Omat tiedostot\Omat musiikkitiedostot\K?ytt?oikeuden varmuuskopio\drmv2key.bak"
Mon 5 Feb 2007 1,536 A..H. --- "C:\Documents and Settings\jari\Mallit\Omat tiedostot\Omat musiikkitiedostot\K?ytt?oikeuden varmuuskopio\drmv2lic.bak"
Finished!
Ja uusi HJT-Loki:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:31:47, on 8.4.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\DMTS\BIN\e3DMTSMediaServer.exe
C:\Program Files\DMTS\BIN\e3DMTSServer.exe
C:\Program Files\M-Audio Fast Track\GBInst.exe
C:\Program Files\M-Audio\JamLab\JamLabInst.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
C:\Program Files\M-Audio\Audiophile USB\MAUSBAPInst.exe
C:\Program Files\M-Audio\Black Box\MAUSBBBInst.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\Program Files\M-Audio\Conectiv\MAUSBCVInst.exe
C:\Program Files\M-Audio\Fast Track Pro\MAUSBInst.exe
C:\Program Files\M-Audio\MobilePre\Install\MPInst.exe
C:\Program Files\NetLimiter 2 Pro\nlsvc.exe
C:\Program Files\M-Audio\Ozone\Install\ozinst.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\M-Audio\Transit\Install\TUSBInst.exe
C:\Program Files\NetLimiter 2 Pro\NLClient.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\System32\M-AudioTaskBarIcon.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\LaCie\Backup Software\LaCieBackup.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50168
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://paivitys.dnainternet.fi/yhteys/proxy.pac
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.suomi.net:8080
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [NTFSSAPI] ntfsapi.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [M-Audio Taskbar Icon] C:\WINDOWS\System32\M-AudioTaskBarIcon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\RunServices: [NTFSSAPI] ntfsapi.exe
O4 - HKLM\..\RunServices: [Media Load] msn32.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [LaCie Backup] C:\Program Files\LaCie\Backup Software\\LaCieBackup.exe /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [Windows Lmhost Util] lmhost.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [Microsoft IE] IEXPLORE.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [Windows Messenger] msmsgs.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [Sysino] lsess.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [Nvidia CTRL Panel] ncsvc32.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunServices: [MSN Messanger] msnmsng.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [Windows Lmhost Util] lmhost.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunServices: [MSN Messanger] msnmsng.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Web Savings - file://C:\Program Files\WebSavingsfromEbates\System\Temp\ebateswebsavings_script0.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{39D78B64-F1D5-4C55-8DB8-2759D59EBBE4}: NameServer = 213.139.190.3 212.50.131.153
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O23 - Service: e-3 DMTS Media Server (e3DMTSMediaServer) - Unknown owner - C:\Program Files\DMTS\BIN\e3DMTSMediaServer.exe
O23 - Service: e-3 DMTS Server (e3DMTSServer) - Unknown owner - C:\Program Files\DMTS\BIN\e3DMTSServer.exe
O23 - Service: Fast Track Installer (FastTrackInstallerService) - Nemesis - C:\Program Files\M-Audio Fast Track\GBInst.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: JamLab Installer (JamLabInstallerService) - M-Audio - C:\Program Files\M-Audio\JamLab\JamLabInst.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
O23 - Service: M-Audio Audiophile Installer (MAudioAudiophileService) - Avid Technology, Inc. - C:\Program Files\M-Audio\Audiophile USB\MAUSBAPInst.exe
O23 - Service: M-Audio BlackBox Installer (MAudioBlackBoxService) - Avid Technology, Inc. - C:\Program Files\M-Audio\Black Box\MAUSBBBInst.exe
O23 - Service: M-Audio Conectiv Installer (MAudioConectivService) - Avid Technology, Inc. - C:\Program Files\M-Audio\Conectiv\MAUSBCVInst.exe
O23 - Service: M-Audio USB Installer (MAudioUSBService) - M-Audio - C:\Program Files\M-Audio\Fast Track Pro\MAUSBInst.exe
O23 - Service: MobilePre Installer (MobilePreInstallerService) - M-Audio - C:\Program Files\M-Audio\MobilePre\Install\MPInst.exe
O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\Program Files\NetLimiter 2 Pro\nlsvc.exe
O23 - Service: M-Audio Ozone Installer (OzoneInstallerService) - Nemesis - C:\Program Files\M-Audio\Ozone\Install\ozinst.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PPPoE Service (PPPoEService) - Unknown owner - C:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe
O23 - Service: M-Audio Transit Installer (TransitInstallerService) - M-Audio - C:\Program Files\M-Audio\Transit\Install\TUSBInst.exe
--
End of file - 8763 bytes
houston is comign
|
|
Hujo
Suspended permanently
|
8. huhtikuuta 2008 @ 16:38 |
Linkki tähän viestiin
|
Lataa Malwarebytes' Anti-Malware työpöydällesi.
1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
8. Lähetä lokin sisältö seuraavassa viestissäsi.
Voiko tietsikka koskaan toimia?
|
|
ursulla
Newbie
|
8. huhtikuuta 2008 @ 18:33 |
Linkki tähän viestiin
|
Tässä tuo Malware loki:
Malwarebytes' Anti-Malware 1.11
Tietokantaversio: 599
Tarkistustyyppi: Täysi tarkistus (C:\|E:\|)
Tarkistetut kohteet: 141107
Kulunut aika: 47 minute(s), 53 second(s)
Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 12
Saastuneita rekisteriarvoja: 0
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 43
Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)
Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriavaimia:
HKEY_CLASSES_ROOT\Interface\{bf06da8e-2beb-4816-9bbd-f7625246e245} (Adware.ISTBar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{db447818-96b4-40df-8a55-720da496f514} (Adware.ISTBar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a4730ebe-43a6-443e-9776-36915d323ad3} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2bb15d36-43be-4743-a3a0-3308f4b1a610} (Adware.Delphinmediaviewer) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{41700749-a109-4254-af13-be54011e8783} (Adware.Delphinmediaviewer) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{2a7db8d1-43be-4ad3-a81e-9bb8c9d00073} (Adware.Delphinmediaviewer) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{aa4939c3-deca-4a48-a454-97cd587c0ef5} (Adware.NetOptimizer) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{eee4a2e5-9f56-432f-a6ed-f6f625b551e0} (Adware.NetOptimizer) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\software\salm (Adware.180Solutions) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
Saastuneita rekisteriarvoja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)
Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)
Saastuneita tiedostoja:
C:\Program Files\mozilla.org\Mozilla\regxpcom.exe (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0760012.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0760013.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0760014.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0762014.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0762015.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0762016.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0762027.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0762028.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0762029.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0763029.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0763030.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0763031.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0766029.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0766030.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0767029.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0773029.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0773030.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0774029.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0774030.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0774031.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0777029.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0777030.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0777031.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1321\A0779041.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1322\A0779100.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1322\A0779106.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1322\A0779153.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1322\A0779154.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1322\A0779174.sys (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1322\A0779175.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1322\A0779176.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1322\A0779179.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1322\A0779180.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1322\A0779181.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1322\A0779182.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1322\A0779183.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1322\A0779184.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ide21201.vxd (Adware.Winad) -> Quarantined and deleted successfully.
E:\Program Files\mozilla.org\Mozilla\regxpcom.exe (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\WINDOWS\inf\ultra.PNF (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\eglivecam_1028.dll (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Documents and Settings\jari\Suosikit\Online Security Test.url (Rogue.Link) -> Quarantined and deleted successfully.
ja HiJackThis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:30:16, on 8.4.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\DMTS\BIN\e3DMTSMediaServer.exe
C:\Program Files\DMTS\BIN\e3DMTSServer.exe
C:\Program Files\M-Audio Fast Track\GBInst.exe
C:\Program Files\M-Audio\JamLab\JamLabInst.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
C:\Program Files\M-Audio\Audiophile USB\MAUSBAPInst.exe
C:\Program Files\M-Audio\Black Box\MAUSBBBInst.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\Program Files\M-Audio\Conectiv\MAUSBCVInst.exe
C:\Program Files\M-Audio\Fast Track Pro\MAUSBInst.exe
C:\Program Files\M-Audio\MobilePre\Install\MPInst.exe
C:\Program Files\NetLimiter 2 Pro\nlsvc.exe
C:\Program Files\M-Audio\Ozone\Install\ozinst.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\M-Audio\Transit\Install\TUSBInst.exe
C:\Program Files\NetLimiter 2 Pro\NLClient.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\System32\M-AudioTaskBarIcon.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\LaCie\Backup Software\LaCieBackup.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\BitTorrent\bittorrent.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50168
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [NTFSSAPI] ntfsapi.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [M-Audio Taskbar Icon] C:\WINDOWS\System32\M-AudioTaskBarIcon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\RunServices: [NTFSSAPI] ntfsapi.exe
O4 - HKLM\..\RunServices: [Media Load] msn32.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [LaCie Backup] C:\Program Files\LaCie\Backup Software\\LaCieBackup.exe /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [Windows Lmhost Util] lmhost.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [Microsoft IE] IEXPLORE.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [Windows Messenger] msmsgs.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [Sysino] lsess.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [Nvidia CTRL Panel] ncsvc32.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunServices: [MSN Messanger] msnmsng.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [Windows Lmhost Util] lmhost.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunServices: [MSN Messanger] msnmsng.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Web Savings - file://C:\Program Files\WebSavingsfromEbates\System\Temp\ebateswebsavings_script0.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{39D78B64-F1D5-4C55-8DB8-2759D59EBBE4}: NameServer = 213.139.190.3 212.50.131.153
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O23 - Service: e-3 DMTS Media Server (e3DMTSMediaServer) - Unknown owner - C:\Program Files\DMTS\BIN\e3DMTSMediaServer.exe
O23 - Service: e-3 DMTS Server (e3DMTSServer) - Unknown owner - C:\Program Files\DMTS\BIN\e3DMTSServer.exe
O23 - Service: Fast Track Installer (FastTrackInstallerService) - Nemesis - C:\Program Files\M-Audio Fast Track\GBInst.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: JamLab Installer (JamLabInstallerService) - M-Audio - C:\Program Files\M-Audio\JamLab\JamLabInst.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
O23 - Service: M-Audio Audiophile Installer (MAudioAudiophileService) - Avid Technology, Inc. - C:\Program Files\M-Audio\Audiophile USB\MAUSBAPInst.exe
O23 - Service: M-Audio BlackBox Installer (MAudioBlackBoxService) - Avid Technology, Inc. - C:\Program Files\M-Audio\Black Box\MAUSBBBInst.exe
O23 - Service: M-Audio Conectiv Installer (MAudioConectivService) - Avid Technology, Inc. - C:\Program Files\M-Audio\Conectiv\MAUSBCVInst.exe
O23 - Service: M-Audio USB Installer (MAudioUSBService) - M-Audio - C:\Program Files\M-Audio\Fast Track Pro\MAUSBInst.exe
O23 - Service: MobilePre Installer (MobilePreInstallerService) - M-Audio - C:\Program Files\M-Audio\MobilePre\Install\MPInst.exe
O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\Program Files\NetLimiter 2 Pro\nlsvc.exe
O23 - Service: M-Audio Ozone Installer (OzoneInstallerService) - Nemesis - C:\Program Files\M-Audio\Ozone\Install\ozinst.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PPPoE Service (PPPoEService) - Unknown owner - C:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe
O23 - Service: M-Audio Transit Installer (TransitInstallerService) - M-Audio - C:\Program Files\M-Audio\Transit\Install\TUSBInst.exe
--
End of file - 8496 bytes
houston is comign
|
|
Hujo
Suspended permanently
|
8. huhtikuuta 2008 @ 18:42 |
Linkki tähän viestiin
|
1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
combofix1
combofix2
2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
Ota tosta kakkos kohdasta
===============
Lataa SmitfraudFix (c) S!Ri
Pura sisältö (kansio nimeltä SmitfraudFix) työpöydällesi:
Avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
Valitse optio #1 - Search kirjoittamalla 1 ja painamalla "Enter"; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa).
Postita ponnahtava rapport ? muistion sisältö viestiketjuusi.
Löytyy myös C:\rapport.txt
Huomaa : process.exe filun tunnistaa jotkut Anti-virus ohjelmat
(AntiVir, Dr.Web, Kaspersky) "Haittakaluna"; se ei ole virus, vaan ohjelma joka pysäyttää prosesseja.
A/V ohjelmat eivät pysty tunnistamaan hyvän ja pahan käytön tälläisten ohjelmian väliltä,
silloin ne saattavat varoittaa käyttäjää.
Voiko tietsikka koskaan toimia?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 8. huhtikuuta 2008 @ 18:55
|
|
ursulla
Newbie
|
8. huhtikuuta 2008 @ 21:10 |
Linkki tähän viestiin
|
Combofix Logi:
ComboFix 08-04-08.1 - jari 2008-04-08 20:49:52.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.441 [GMT 2:00]
Running from: E:\Sälät\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\smdat32m.sys
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-03-08 to 2008-04-08 )))))))))))))))))
.
2008-04-08 17:52 . 2008-04-08 17:57 <KANSIO> d-------- C:\Documents and Settings\jari\.onnet
2008-04-08 17:40 . 2008-04-08 17:40 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-04-08 17:40 . 2008-04-08 17:40 <KANSIO> d-------- C:\Documents and Settings\jari\Application Data\Malwarebytes
2008-04-08 17:40 . 2008-04-08 17:40 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-04-08 16:12 . 2008-04-08 16:29 <KANSIO> d----c--- C:\SDFix
2008-04-06 17:34 . 2008-04-07 15:15 632 --a------ C:\WINDOWS\Sof2.INI
2008-04-05 23:54 . 2008-04-05 23:54 <KANSIO> d-------- C:\Program Files\Alex Buturuga
2008-04-05 10:37 . 2008-04-05 10:37 <KANSIO> d-------- C:\Program Files\Steam
2008-04-05 10:19 . 2008-04-07 23:19 <KANSIO> d-------- C:\Program Files\Counter-Strike
2008-04-05 01:22 . 2008-04-05 01:31 <KANSIO> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-04-05 01:12 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-04-05 01:12 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-04-05 01:12 . 2008-03-22 15:49 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-04-05 01:12 . 2008-03-26 08:50 82,432 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-04-05 01:12 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-04-05 01:12 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-04-05 01:12 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-04-05 01:06 . 2008-04-05 01:06 <KANSIO> d-------- C:\Program Files\Yahoo!
2008-04-04 22:08 . 2008-04-08 16:36 <KANSIO> d-------- C:\WINDOWS\system32\LogFiles
2008-04-04 22:08 . 2008-04-07 23:14 107,832 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2008-04-04 22:08 . 2008-04-04 22:08 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
2008-04-04 22:08 . 2008-04-07 23:14 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-04-04 17:25 . 2008-04-04 21:59 <KANSIO> d-------- C:\Program Files\Wolfenstein - Enemy Territory
2008-04-04 12:55 . 2008-04-04 12:55 <KANSIO> d-------- C:\Program Files\PC Wizard 2008
2008-04-04 12:55 . 2007-09-15 15:11 27,136 --a------ C:\WINDOWS\system32\PCWizard.cpl
2008-04-03 22:15 . 2008-04-03 22:15 <KANSIO> d-------- C:\Program Files\LaCie
2008-04-03 22:15 . 2008-04-03 22:15 <KANSIO> d-------- C:\Documents and Settings\jari\Application Data\LaCie
2008-04-03 19:11 . 2008-04-03 19:11 0 -ra--c--- C:\logwmemory.bin
2008-04-03 19:07 . 2008-04-03 19:07 <KANSIO> d----c--- C:\Soldat
2008-04-02 21:45 . 2008-04-02 21:45 <KANSIO> d-------- C:\Program Files\Windows Live Safety Center
2008-03-31 23:14 . 2008-03-31 23:14 <KANSIO> d-------- C:\Program Files\DNA
2008-03-31 23:14 . 2008-03-31 23:14 <KANSIO> d-------- C:\Program Files\BitTorrent
2008-03-31 23:14 . 2008-04-08 20:50 <KANSIO> d-------- C:\Documents and Settings\jari\Application Data\DNA
2008-03-31 23:14 . 2008-04-08 20:47 <KANSIO> d-------- C:\Documents and Settings\jari\Application Data\BitTorrent
2008-03-30 21:56 . 2008-04-03 16:27 <KANSIO> d-------- C:\Program Files\IDoser v4
2008-03-24 19:09 . 2008-03-24 19:15 <KANSIO> d-------- C:\Documents and Settings\jari\Application Data\BSplayer Pro
2008-03-23 23:15 . 2008-03-23 23:15 <KANSIO> d-------- C:\Program Files\MessengerDiscovery
2008-03-23 22:58 . 2008-03-23 22:58 <KANSIO> d-------- C:\Program Files\Trend Micro
2008-03-23 21:30 . 2008-03-23 21:30 <KANSIO> d-------- C:\Program Files\ToniArts
2008-03-15 15:51 . 2008-03-27 18:29 <KANSIO> d-------- C:\Program Files\REAPER
2008-03-15 15:51 . 2008-03-15 18:15 <KANSIO> d-------- C:\Documents and Settings\jari\Application Data\REAPER
2008-03-15 15:21 . 2008-03-15 15:43 <KANSIO> d-------- C:\Program Files\Steinberg
2008-03-15 15:15 . 2003-07-31 21:28 147,425 --a------ C:\WINDOWS\system32\SYNSOACC-Aide.chm
2008-03-15 15:15 . 2003-05-26 16:29 120,468 --a------ C:\WINDOWS\system32\SYNSOACC-Hilfe.chm
2008-03-15 15:15 . 2003-05-26 16:29 114,279 --a------ C:\WINDOWS\system32\SYNSOACC-Help.chm
2008-03-15 15:15 . 2005-05-09 21:08 33,792 --a------ C:\WINDOWS\system32\drivers\cledx.sys
2008-03-15 15:14 . 2008-03-15 15:15 <KANSIO> d-------- C:\Program Files\Syncrosoft
2008-03-15 15:14 . 2005-10-17 10:35 704,512 --a------ C:\WINDOWS\system32\SYNSOACC.dll
2008-03-15 15:14 . 2004-05-10 16:58 147,456 --a------ C:\WINDOWS\system32\SynsoLChk.dll
2008-03-15 15:14 . 2002-11-25 09:36 45,056 --a------ C:\WINDOWS\system32\Synsopos.exe
2008-03-15 15:14 . 2002-11-25 06:46 16,896 --a------ C:\WINDOWS\system32\drivers\synasUSB.sys
2008-03-15 01:54 . 2008-03-25 18:52 <KANSIO> d-------- C:\Documents and Settings\jari\Application Data\skypePM
2008-03-15 01:54 . 2008-03-15 01:54 32 --a------ C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-03-15 01:49 . 2008-03-15 01:49 <KANSIO> d-------- C:\Program Files\Skype
2008-03-15 01:49 . 2008-03-15 01:49 <KANSIO> d-------- C:\Program Files\Common Files\Skype
2008-03-08 20:10 . 2008-03-23 22:46 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-08 14:09 497 ----a-w C:\WINDOWS\system32\drivers\fwdrv.err
2008-04-08 13:58 --------- d-----w C:\Program Files\Java
2008-04-07 21:20 --------- d-----w C:\Program Files\DC++
2008-04-04 22:52 13,304 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2008-03-26 14:42 --------- d-----w C:\Program Files\WINAMP
2008-03-25 17:06 --------- d-----w C:\Documents and Settings\jari\Application Data\Skype
2008-03-24 17:09 --------- d-----w C:\Program Files\Webteh
2008-03-23 21:15 --------- d-----w C:\Program Files\CCleaner
2008-03-23 20:01 --------- d-----w C:\Program Files\MSN Messenger
2008-03-23 19:30 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-16 11:43 --------- d-----w C:\Program Files\RevConnect
2008-03-14 23:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype
2008-03-04 15:23 --------- d-----w C:\Program Files\NetLimiter 2 Pro
2008-03-04 15:23 --------- d-----w C:\Documents and Settings\jari\Application Data\Locktime
2008-03-04 15:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Locktime
2008-03-03 20:15 --------- d-----w C:\Program Files\ASIO4ALL v2
2008-03-03 15:39 --------- d-----w C:\Documents and Settings\jari\Application Data\Ableton
2008-03-03 15:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ableton
2008-03-03 15:36 --------- d-----w C:\Program Files\Ableton
2008-03-03 15:32 --------- d-----w C:\Program Files\M-Audio Fast Track
2008-03-01 18:50 --------- d-----w C:\Program Files\M-Audio Transit
2008-03-01 18:50 --------- d-----w C:\Program Files\M-Audio
2008-03-01 18:48 --------- d-----w C:\Program Files\M-Audio MobilePre
2008-03-01 18:45 --------- d-----w C:\Program Files\M-Audio Firewire Family
2008-03-01 18:43 --------- d-----w C:\Program Files\M-Audio Fast Track USB
2008-03-01 15:28 --------- d-----w C:\Documents and Settings\jari\Application Data\DSound
2008-03-01 15:26 --------- d-----w C:\Program Files\DSound
2008-03-01 05:59 --------- d-----w C:\Program Files\MP4 Player
2008-02-14 12:06 --------- d-----w C:\Documents and Settings\jari\Application Data\gtk-2.0
2006-09-20 19:35 33 ----a-w C:\Documents and Settings\jari\Application Data\tvmuknwrd.dll
2006-09-20 19:34 0 ----a-w C:\Documents and Settings\jari\Application Data\tvmknwrd.dll
2004-10-01 01:49 58 ----a-w C:\Documents and Settings\jari\swe.bat
2004-12-27 15:03 56 --sh--r C:\WINDOWS\system32\89931FC656.sys
2006-07-07 11:02 36,761 --sha-w C:\WINDOWS\system32\stsohcvs.dat
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:55 5674352]
"BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-03-31 23:14 288576]
"LaCie Backup"="C:\Program Files\LaCie\Backup Software\\LaCieBackup.exe" [2006-07-06 10:30 2596864]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-12-14 18:19 221184]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2004-12-14 18:57 458752]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2004-12-14 18:51 217088]
"NTFSSAPI"="ntfsapi.exe" []
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-10-25 07:37 35328]
"M-Audio Taskbar Icon"="C:\WINDOWS\System32\M-AudioTaskBarIcon.exe" [2006-02-01 10:24 94208]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"NTFSSAPI"="ntfsapi.exe" []
"Media Load"="msn32.exe" []
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-15 01:12 15360]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:55 5674352]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Windows Lmhost Util"="lmhost.exe" []
"starter"="scvhosting.exe" []
"MicrosoftUpdate"="syshelper.exe" []
"Win32 USB2 Driver"="win32usb.exe" []
"Microsoft IE"="IEXPLORE.EXE" []
"Windows Messenger"="msmsgs.exe" []
"Sysino"="lsess.exe" []
"Nvidia CTRL Panel"="ncsvc32.exe" []
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunServices]
"MSN Messanger"="msnmsng.exe" []
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoBandCustomize"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoBandCustomize"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= C:\PROGRA~1\ffdshow\ffdshow.ax
"VIDC.HFYU"= huffyuv.dll
"vidc.DIV3"= DivXc32.dll
"vidc.DIV4"= DivXc32f.dll
"msacm.divxa32"= DivXa32.acm
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=
"C:\\Program Files\\BitTorrent\\bittorrent.exe"=
"C:\\Program Files\\Sunbelt Software\\Personal Firewall 4\\kpf4gui.exe"=
"C:\\Soldat\\Soldat.exe"=
"C:\\Program Files\\DC++\\DCPlusPlus.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"11292:TCP"= 11292:TCP:BitComet 11292 TCP
"11292:UDP"= 11292:UDP:BitComet 11292 UDP
R0 BsStor;InCD Storage Helper Driver;C:\WINDOWS\system32\DRIVERS\bsstor.sys [2002-06-06 01:07]
R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2005-12-15 18:13]
R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2005-12-15 18:01]
R1 nltdi;nltdi;C:\WINDOWS\system32\drivers\nltdi.sys [2007-04-23 13:03]
R1 XPROTECTOR;XPROTECTOR;C:\WINDOWS\system32\drivers\Oreans.sys [2005-05-28 19:55]
R2 BsUDF;InCD UDF Driver;C:\WINDOWS\system32\drivers\BsUDF.sys [2003-01-15 19:02]
R2 e3DMTSMediaServer;e-3 DMTS Media Server;C:\Program Files\DMTS\BIN\e3DMTSMediaServer.exe [2004-06-08 13:05]
R2 e3DMTSServer;e-3 DMTS Server;C:\Program Files\DMTS\BIN\e3DMTSServer.exe [2004-03-22 11:59]
R2 JamLabInstallerService;JamLab Installer;C:\Program Files\M-Audio\JamLab\JamLabInst.exe [2006-01-09 17:39]
R2 MAudioAudiophileService;M-Audio Audiophile Installer;C:\Program Files\M-Audio\Audiophile USB\MAUSBAPInst.exe [2006-03-14 11:52]
R2 MAudioBlackBoxService;M-Audio BlackBox Installer;C:\Program Files\M-Audio\Black Box\MAUSBBBInst.exe [2006-03-16 11:02]
R2 MAudioConectivService;M-Audio Conectiv Installer;C:\Program Files\M-Audio\Conectiv\MAUSBCVInst.exe [2006-06-16 15:11]
R2 MAudioUSBService;M-Audio USB Installer;C:\Program Files\M-Audio\Fast Track Pro\MAUSBInst.exe [2005-12-02 10:20]
R2 MobilePreInstallerService;MobilePre Installer;C:\Program Files\M-Audio\MobilePre\Install\MPInst.exe [2005-06-15 15:00]
R2 PPPoEService;PPPoE Service;C:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe [2000-07-11 10:48]
R2 TransitInstallerService;M-Audio Transit Installer;C:\Program Files\M-Audio\Transit\Install\TUSBInst.exe [2005-06-22 21:51]
R3 MA763010;M-Audio Fast Track;C:\WINDOWS\system32\drivers\MA763010.sys [2004-08-31 16:57]
R3 NTSPPPOE;Efficient Networks Enternet P.P.P.o.E LAN Miniport Driver;C:\WINDOWS\system32\DRIVERS\ntspppoe.sys [2002-03-06 11:44]
S3 RAWESR;RAWESR;C:\PROGRA~1\EFFICI~1\ENTERN~1\app\RAWESR.SYS [2002-03-06 11:39]
S3 TAPBIND;TAPBIND;C:\PROGRA~1\EFFICI~1\ENTERN~1\app\TAPBIND1.SYS [2002-03-06 11:42]
S4 NetFxUpdate_v1.1.4322;Microsoft .NET Framework v1.1.4322 Update;C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\netfxupdate.exe [2007-01-15 17:11]
.
**************************************************************************
catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-08 20:56:47
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-04-08 20:58:42
ComboFix-quarantined-files.txt 2008-04-08 18:58:34
Pre-Run: 21,429,768,192 tavua vapaana
Post-Run: 21,424,803,840 tavua vapaana
.
2008-03-17 02:01:37 --- E O F ---
SmitFraudFix raport:
SmitFraudFix v2.309
Scan done at 21:02:08,90, ti 08.04.2008
Run from C:\unzipped\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode
»»»»»»»»»»»»»»»»»»»»»»»» Process
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\DMTS\BIN\e3DMTSMediaServer.exe
C:\Program Files\DMTS\BIN\e3DMTSServer.exe
C:\Program Files\M-Audio Fast Track\GBInst.exe
C:\Program Files\M-Audio\JamLab\JamLabInst.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
C:\Program Files\M-Audio\Audiophile USB\MAUSBAPInst.exe
C:\Program Files\M-Audio\Black Box\MAUSBBBInst.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\Program Files\M-Audio\Conectiv\MAUSBCVInst.exe
C:\Program Files\M-Audio\Fast Track Pro\MAUSBInst.exe
C:\Program Files\M-Audio\MobilePre\Install\MPInst.exe
C:\Program Files\NetLimiter 2 Pro\nlsvc.exe
C:\Program Files\M-Audio\Ozone\Install\ozinst.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\M-Audio\Transit\Install\TUSBInst.exe
C:\Program Files\NetLimiter 2 Pro\NLClient.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\System32\M-AudioTaskBarIcon.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\LaCie\Backup Software\LaCieBackup.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\BitTorrent\bittorrent.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\cmd.exe
»»»»»»»»»»»»»»»»»»»»»»»» hosts
»»»»»»»»»»»»»»»»»»»»»»»» C:\
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS
C:\WINDOWS\d3??.dll FOUND !
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\jari
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\jari\Application Data
»»»»»»»»»»»»»»»»»»»»»»»» Start Menu
»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\jari\Suosikit
»»»»»»»»»»»»»»»»»»»»»»»» Desktop
»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys
»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Nykyinen kotisivu"
»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!
IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!
VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\\PROGRA~1\\Google\\GOOGLE~2\\GOEC62~1.DLL"
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
"System"=""
»»»»»»»»»»»»»»»»»»»»»»»» Rustock
»»»»»»»»»»»»»»»»»»»»»»»» DNS
Description: WAN (PPP/SLIP) Interface
DNS Server Search Order: 213.139.190.3
DNS Server Search Order: 212.50.131.153
HKLM\SYSTEM\CCS\Services\Tcpip\..\{39D78B64-F1D5-4C55-8DB8-2759D59EBBE4}: NameServer=213.139.190.3 212.50.131.153
HKLM\SYSTEM\CS1\Services\Tcpip\..\{39D78B64-F1D5-4C55-8DB8-2759D59EBBE4}: NameServer=213.139.190.3 212.50.131.153
»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection
»»»»»»»»»»»»»»»»»»»»»»»» End
houston is comign
|
|
Hujo
Suspended permanently
|
8. huhtikuuta 2008 @ 21:21 |
Linkki tähän viestiin
|
Printtaa ohjeet ulos
Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi.
Vikasietotilaan:
sammuta ja käynnistä
käynnistyksen yhteydessä hakkaa F8 nappia
valitse nuolinäppäimellä vikasietotila
paina enter ja enter
valitse käyttäjätilisi
paina kyllä
Jossakin koneissa hakataan F8:sin sijasta F5:tä
Kun vikasietotilassa, avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
Valitse optio #2 - Clean kirjoittamalla 2 ja painamalla "Enter" poistaaksesi tarttuneet tiedostot.
Sinulta kysytään: "Registry cleaning - Do you want to clean the registry ?"; vastaa "Yes" kirjoittamalla Y ja paina "Enter" poistaaksesi työpöydän taustakuvan ja puhdistaaksesi tarttuneet rekisteriavaimet.
Työkalu tarkistaa jos wininet.dll on tarttunut. Sinua saatetaan pyytää korvaamaan tarttunut .dll (jos löytyy); vastaa "Yes" kirjoittamalla Y ja painamalla "Enter".
Työkalun saattaa tarvita käynnistää kone uudelleen; jos ei tee niin, käynnistä normaaliin Windowsiin.
Tekstitiedosto ilmestyy, puhdistusprosessin jäljiltä; kopioi & liitä tämän raportin tulokset vastaukseesi.
Raportti löytyy paikalliselta levyltäsi, useimmiten C:\rapport.txt.
Varoitus : Ajamalla optio 2:n EI-tarttuneessa tietokoneessa, poistaa sinun työpöytäsi taustakuvan.
Voiko tietsikka koskaan toimia?
|
|
ursulla
Newbie
|
8. huhtikuuta 2008 @ 21:55 |
Linkki tähän viestiin
|
Siinäpä tuo rapportti
SmitFraudFix v2.309
Scan done at 21:44:18,95, ti 08.04.2008
Run from C:\unzipped\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» Killing process
»»»»»»»»»»»»»»»»»»»»»»»» hosts
127.0.0.1 localhost
»»»»»»»»»»»»»»»»»»»»»»»» VACFix
VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix
S!Ri's WS2Fix: LSP not Found.
»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix
GenericRenosFix by S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files
C:\WINDOWS\d3??.dll Deleted
»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» DNS
»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""
»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning
Registry Cleaning done.
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» End
houston is comign
|
|
Mainos
|
|
|
|
Hujo
Suspended permanently
|
9. huhtikuuta 2008 @ 02:51 |
Linkki tähän viestiin
|
Ohje AVG:n Anti-Spyware 7.5:n käyttöön
Huom! Tässä ohjeessa sammutetaan tuo reaaliaikasuojaus (Shield). Näin vältetään tilanteet joissa suojaus estäisi esim HijackThis:n työkalun toimintaa.
Tallenna nämä ohjeet tekstitiedostoon tai tulosta nämä, muuten et pääse niihin käsiksi vikasietotilasta
Lataa AVG:n Anti-Spyware 7.5:n
ja tallenna ohjelma työpöydällesi.
o Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa.
o Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää.
o Käynnistä AVG:n Anti-Spyware.
o Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta.
o Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa.
o Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti.
o Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine".
o Sitten "Reports" valikon alta:
o Laita täppi kohtaan "Automatically generate report after every scan"
o Ota täppi pois kohdasta"Only if threats were found"
o Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa
o "Resident shield is", muuta tila active:sta inactive:ksi
o Sulje ohjelma, ÄLÄ skannaa vielä.
Käynnistä koneesi vikasietotilaan,
sammuta ja käynnistä
käynnistyksen yhteydessä naputtele F8
valitse nuoli näppäimellä vikasietotila
paina enter ja enter
Toisissa koneissa paukutetaan F8:sin sijasta F5:tä
HUOM! Älä käytä muita ohjelmia AVG:n skannauksen aikana, tämä saattaa häiritä skannausta.
o Kun vikasietotilassa, käynnistä AVG:n Anti-Spyware.
o Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan".
o Ewido aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa.
Kun skannaus on valmis:
TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions"
o Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta.
o Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions"
o Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta.
o Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle.
o Sulje ohjelma, käynnistä kone normaalisti ja lähetä AVG:n raportti viestikejuusi.
Voiko tietsikka koskaan toimia?
|
|
