|
|
|
Keskustelualueet
Keskustelualueet
|
|
|
Koneessa aika ajoittain suoritinkäyttö 100%...
|
|
|
Xfect
Newbie
|
27. elokuuta 2008 @ 15:31 |
Linkki tähän viestiin
|
eli tässä on hjt-logi
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:30:57, on 27.8.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Logitech\SetPoint\MediaPlayerMgr.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: Live TV Toolbar - {b69a9db4-d0a1-4722-b56b-f20757a29cdf} - C:\Program Files\Live_TV\tbLive.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1C1B8A44-61FE-411E-8F33-813A4E2E2984} - (no file)
O2 - BHO: (no name) - {6584C510-924B-486A-A1A0-E380DE08C2DB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Live TV Toolbar - {b69a9db4-d0a1-4722-b56b-f20757a29cdf} - C:\Program Files\Live_TV\tbLive.dll
O3 - Toolbar: Live TV Toolbar - {b69a9db4-d0a1-4722-b56b-f20757a29cdf} - C:\Program Files\Live_TV\tbLive.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/sh...ash/swflash.cab
O20 - Winlogon Notify: ljJCsrRJ - ljJCsrRJ.dll (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: AVG Firewall (AVGFwSrv) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
--
End of file - 5831 bytes
|
|
Hujo
Suspended permanently
|
27. elokuuta 2008 @ 15:47 |
Linkki tähän viestiin
|
scannaa hjt:llä merkkaa paina Fix checked
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: (no name) - {1C1B8A44-61FE-411E-8F33-813A4E2E2984} - (no file)
O2 - BHO: (no name) - {6584C510-924B-486A-A1A0-E380DE08C2DB} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O20 - Winlogon Notify: ljJCsrRJ - ljJCsrRJ.dll (file missing)
=================
1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
combofix1
combofix2
2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen
=============
Lataa Malwarebytes' Anti-Malware työpöydällesi.
1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
8. Lähetä lokin sisältö seuraavassa viestissäsi.
==============
Lataa Tästä Ccleaner
CCleaner v2.05.555- Standard Build, ÄLÄ aseenna Yahoo toolbaria!
Asennuksessa poista merkki/rasti kohdasta "asenna Yahoo! toolbar/työkalupalkki".
Asennuksen jälkeen aukaise CCleaner.
Valitse vasemmalta pystyrivistä Options.
Valitse viereisestä pystyrivistä Settings.
Language kohtaan valitse Suomi.
Puhdistaja
Valitse vasemmalta pystyrivistä Puhdistaja.
Paina alhaalta Tutki.
Nyt CCleaner tutkii, mitä voidaan poistaa (tempit, cookiessit jne.).
Kun tutkiminen on valmis, paina Aja CCleaner.
Nyt CCleaner poistaa löydetyt tempit, cookiessit jne.
Rekisterin virheiden korjaus
Valitse vasemmalta pystyrivistä Rekisteri.
Paina alhaalta Etsi rekisterin virheitä.
Kun etsintä on valmis ja olet varma, että haluat korjata ne rivit jotka ovat merkattuja, niin paina Korjaa valitut rekisterin virheet.
Sinulta kysytään "haluatko varmuuskopioida muutokset rekisteriin", paina Kyllä. Tallenna varmuuskopio vaikka "Omat tiedostot" -kansioon.
Klikkaa uudesta aukeavasta ikkunasta Korjaa kaikki valitut virheet.
Saat vielä varmistus kysymyksen, paina Ok.
Kun virheet on korjattu, paina Sulje.
Nyt voit sulkea CCleanerin painamalla oikealta ylhäältä punaista rastia.
Voiko tietsikka koskaan toimia?
|
|
Xfect
Newbie
|
27. elokuuta 2008 @ 16:12 |
Linkki tähän viestiin
|
ComboFix 08-08-26.03 - Toni 2008-08-27 16:04:30.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.658 [GMT 3:00]
Running from: C:\Documents and Settings\Toni.HOME-50943DEFA3\Työpöytä\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Toni\Application Data\macromedia\Flash Player\#SharedObjects\9PSDZMKP\bin.clearspring.com
C:\Documents and Settings\Toni\Application Data\macromedia\Flash Player\#SharedObjects\9PSDZMKP\bin.clearspring.com\clearspring.sol
C:\Documents and Settings\Toni\Application Data\macromedia\Flash Player\#SharedObjects\9PSDZMKP\static.youku.com
C:\Documents and Settings\Toni\Application Data\macromedia\Flash Player\#SharedObjects\9PSDZMKP\static.youku.com\v\swf\qplayer.swf\youku.sol
C:\Documents and Settings\Toni\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com
C:\Documents and Settings\Toni\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com\settings.sol
C:\Documents and Settings\Toni\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#static.youku.com
C:\Documents and Settings\Toni\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#static.youku.com\settings.sol
C:\Documents and Settings\User\Suosikit\Error Cleaner.url
C:\Documents and Settings\User\Suosikit\Privacy Protector.url
C:\Documents and Settings\User\Suosikit\Spyware&Malware Protection.url
C:\Documents and Settings\User\Työpöytä\Privacy Protector.url
C:\WINDOWS\msvrc20.dll
C:\WINDOWS\privacy_danger
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-07-27 to 2008-08-27 )))))))))))))))))
.
2008-08-27 15:57 . 2008-08-27 15:57 <KANSIO> d-------- C:\Documents and Settings\Toni.HOME-50943DEFA3\Application Data\MetaProducts
2008-08-27 15:46 . 2008-08-27 15:46 <KANSIO> d-------- C:\Program Files\TweakNow WinSecret
2008-08-27 15:46 . 2008-08-27 15:46 <KANSIO> d-------- C:\Documents and Settings\Toni.HOME-50943DEFA3\Application Data\TweakNow WinSecret
2008-08-27 15:24 . 2008-08-27 15:24 <KANSIO> d-------- C:\Program Files\Trend Micro
2008-08-26 21:45 . 2008-08-26 21:45 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-08-26 21:45 . 2008-08-26 21:45 1,409 --a------ C:\WINDOWS\QTFont.for
2008-08-26 00:15 . 2008-08-26 00:15 <KANSIO> d-------- C:\Program Files\Yahoo!
2008-08-23 13:27 . 2008-08-24 12:31 <KANSIO> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\FLEXnet
2008-08-23 13:05 . 2008-08-23 13:05 <KANSIO> d-------- C:\Program Files\Common Files\Macrovision Shared
2008-08-23 11:53 . 2008-08-24 06:25 <KANSIO> d-------- C:\WINDOWS\system32\CatRoot_bak
2008-08-10 20:16 . 2005-05-23 09:27 137,884 -ra------ C:\WINDOWS\system32\drivers\sscdmdm.sys
2008-08-10 20:16 . 2005-05-23 09:27 80,272 -ra------ C:\WINDOWS\system32\drivers\sscdbus.sys
2008-08-10 20:16 . 2005-05-23 09:27 11,877 -ra------ C:\WINDOWS\system32\drivers\sscdcmnt.sys
2008-08-10 20:16 . 2005-05-23 09:27 11,877 -ra------ C:\WINDOWS\system32\drivers\sscdcm.sys
2008-08-10 20:16 . 2005-05-23 09:27 11,188 -ra------ C:\WINDOWS\system32\drivers\sscdwhnt.sys
2008-08-10 20:16 . 2005-05-23 09:27 11,188 -ra------ C:\WINDOWS\system32\drivers\sscdwh.sys
2008-08-10 20:16 . 2005-05-23 09:27 10,864 -ra------ C:\WINDOWS\system32\drivers\sscdmdfl.sys
2008-08-10 20:10 . 2008-08-10 20:14 <KANSIO> d-------- C:\Program Files\Samsung
2008-08-10 20:10 . 2008-08-10 20:11 <KANSIO> d-------- C:\Hermes
2008-08-10 20:10 . 2008-08-10 20:10 <KANSIO> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Samsung
2008-07-28 21:26 . 2008-07-28 21:26 287 --a------ C:\WINDOWS\game.ini
2008-07-28 16:05 . 2008-07-28 16:05 <KANSIO> d-------- C:\Program Files\Live_TV
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-26 19:36 --------- d-----w C:\Program Files\mIRC
2008-08-26 19:26 --------- d-----w C:\Documents and Settings\Toni.HOME-50943DEFA3\Application Data\HLSW
2008-08-26 18:40 --------- d-----w C:\Documents and Settings\Toni.HOME-50943DEFA3\Application Data\uTorrent
2008-08-26 11:14 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-08-26 11:14 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-08-25 21:15 --------- d-----w C:\Documents and Settings\Toni.HOME-50943DEFA3\Application Data\AVG7
2008-08-25 20:20 --------- d-----w C:\Program Files\DC++
2008-08-23 10:22 --------- d-----w C:\Program Files\Common Files\Adobe
2008-08-16 13:32 --------- d-----w C:\Program Files\Steam
2008-07-30 20:24 --------- d-----w C:\Program Files\VentSrv
2008-07-30 20:24 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-07-28 23:29 --------- d-----w C:\Program Files\Java
2008-07-28 18:26 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-25 21:45 20,481 ----a-w C:\WINDOWS\system32\SystemHook.dll
2008-07-25 16:47 --------- d-----w C:\Documents and Settings\Toni.HOME-50943DEFA3\Application Data\Ahead
2008-07-25 16:45 --------- d-----w C:\Program Files\Ahead
2008-07-25 13:43 --------- d-----w C:\Program Files\Common Files\eSellerate
2008-07-22 17:26 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
2008-07-15 01:10 --------- d-----w C:\Program Files\GoldWave
2008-07-13 15:40 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-07-12 01:31 --------- d-----w C:\Program Files\Microsoft Windows OneCare Live
2008-07-09 23:30 --------- d-----w C:\Program Files\Webteh
2008-07-09 13:44 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP
2008-07-07 20:43 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Lavasoft
2008-07-07 20:42 --------- d-----w C:\Program Files\Lavasoft
2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-07-06 19:48 --------- d-----w C:\Program Files\Wolfenstein - Enemy Territory
2008-07-06 12:32 --------- d-----w C:\Documents and Settings\Toni.HOME-50943DEFA3\Application Data\ATI
2008-07-04 22:29 --------- d--h--w C:\Documents and Settings\Toni.HOME-50943DEFA3\Application Data\ijjigame
2008-07-03 11:50 --------- d-s---w C:\Program Files\HLSW
2008-07-03 11:49 --------- d-----w C:\Documents and Settings\Toni\Application Data\HLSW
2008-06-30 17:34 --------- d-----w C:\Documents and Settings\Toni.HOME-50943DEFA3\Application Data\Locktime
2008-06-30 17:32 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Locktime
2008-06-30 12:34 --------- d-----w C:\Program Files\Common Files\INCA Shared
2008-06-28 11:06 --------- d-----w C:\Program Files\Common Files\Stardock
2008-06-27 23:43 --------- d-----w C:\Documents and Settings\Toni.HOME-50943DEFA3\Application Data\mIRC
2008-06-27 23:42 --------- d-----w C:\Program Files\nbs-irc
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 16:29 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:41 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-04-06 16:55 1,599,488 --sh--w C:\Documents and Settings\Toni\Omat tiedostotOca0Mx_cfdg.exe
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
REGEDIT4
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 15:00 15360]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-05-13 23:10 219136]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"MaxRecentDocs"= 11 (0xb)
"NoStartMenuMFUprogramsList"= 1 (0x1)
[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Käynnistä-valikko^Ohjelmat^Käynnistys^Logitech SetPoint.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Käynnistä-valikko\Ohjelmat\Käynnistys\Logitech SetPoint.lnk
backup=C:\WINDOWS\pss\Logitech SetPoint.lnkCommon Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
--a------ 2008-05-15 12:28 579584 C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-03-30 10:36 267048 C:\Program Files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
--a------ 2007-10-18 12:34 5724184 C:\Program Files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RaidTool]
--a------ 2005-02-25 14:26 589824 C:\Program Files\VIA\RAID\raid_tool.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2008-07-06 00:21 1271032 c:\Program Files\Steam\Steam.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPLpr]
--a------ 2005-03-18 15:35 98393 C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
--a------ 2004-10-21 14:28 29696 C:\WINDOWS\KHALMNPR.Exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"WLSetupSvc"=3 (0x3)
"usnjsvc"=3 (0x3)
"iPod Service"=3 (0x3)
"Bonjour Service"=2 (0x2)
"Ati HotKey Poller"=2 (0x2)
"Apple Mobile Device"=2 (0x2)
"aawservice"=2 (0x2)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\HLSW\\hlsw.exe"=
"C:\\Program Files\\Wolfenstein - Enemy Territory\\ET.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
S3 DMSKSSRh;DMSKSSRh;C:\DOCUME~1\TONI~1.HOM\LOCALS~1\Temp\DMSKSSRh.sys []
*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
- - - - ORPHANS REMOVED - - - -
MSConfigStartUp-CTFMON - (no file)
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Toni.HOME-50943DEFA3\Application Data\Mozilla\Firefox\Profiles\ywizwioi.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
FF -: plugin - C:\Program Files\Yahoo!\Common\npyaxmpb.dll
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-27 16:09:43
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-08-27 16:10:27
ComboFix-quarantined-files.txt 2008-08-27 13:10:23
Pre-Run: 27,799,044,096 tavua vapaana
Post-Run: 31,135,518,720 tavua vapaana
179 --- E O F --- 2008-08-23 18:55:04
|
|
Hujo
Suspended permanently
|
27. elokuuta 2008 @ 16:54 |
Linkki tähän viestiin
|
Lataa SmitfraudFix (c) S!Ri
Pura sisältö (kansio nimeltä SmitfraudFix) työpöydällesi:
Avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
Valitse optio #1 - Search kirjoittamalla 1 ja painamalla "Enter"; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa).
Postita ponnahtava rapport ? muistion sisältö viestiketjuusi.
Löytyy myös C:\rapport.txt
Huomaa : process.exe filun tunnistaa jotkut Anti-virus ohjelmat
(AntiVir, Dr.Web, Kaspersky) "Haittakaluna"; se ei ole virus, vaan ohjelma joka pysäyttää prosesseja.
A/V ohjelmat eivät pysty tunnistamaan hyvän ja pahan käytön tälläisten ohjelmian väliltä,
silloin ne saattavat varoittaa käyttäjää.
Voiko tietsikka koskaan toimia?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 27. elokuuta 2008 @ 16:55
|
|
Xfect
Newbie
|
27. elokuuta 2008 @ 17:36 |
Linkki tähän viestiin
|
|
Malwarebytes' Anti-Malware 1.25
Tietokantaversio: 1062
Windows 5.1.2600 Service Pack 2
17:29:41 27.8.2008
mbam-log-08-27-2008 (17-29-36).txt
Tarkistustyyppi: Täysi tarkistus (C:\|)
Tarkistetut kohteet: 155726
Kulunut aika: 1 hour(s), 14 minute(s), 17 second(s)
Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 6
Saastuneita rekisteriarvoja: 3
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 5
Saastuneita tiedostoja: 53
Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)
Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriavaimia:
HKEY_CLASSES_ROOT\CLSID\{b69a9db4-d0a1-4722-b56b-f20757a29cdf} (Adware.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b69a9db4-d0a1-4722-b56b-f20757a29cdf} (Adware.Agent) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b} (Adware.Agent) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Live_TV (Adware.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Live_TV (Adware.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Live_TV Toolbar (Adware.Agent) -> No action taken.
Saastuneita rekisteriarvoja:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{b69a9db4-d0a1-4722-b56b-f20757a29cdf} (Adware.Agent) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{b69a9db4-d0a1-4722-b56b-f20757a29cdf} (Adware.Agent) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{b69a9db4-d0a1-4722-b56b-f20757a29cdf} (Adware.Agent) -> No action taken.
Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)
Saastuneita hakemistoja:
C:\Program Files\Live_TV (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\RadioPlayer (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\rss (Adware.Agent) -> No action taken.
Saastuneita tiedostoja:
C:\Program Files\Live_TV\tbLive.dll (Adware.Agent) -> No action taken.
C:\System Volume Information\_restore{0FE560B8-F38C-49FB-A1D5-7841E13F43F7}\RP36\A0007933.exe (BHO.Baidu) -> No action taken.
C:\System Volume Information\_restore{0FE560B8-F38C-49FB-A1D5-7841E13F43F7}\RP45\A0014932.exe (Trojan.FakeAlert) -> No action taken.
C:\Program Files\Live_TV\INSTALL.LOG (Adware.Agent) -> No action taken.
C:\Program Files\Live_TV\toolbar.cfg (Adware.Agent) -> No action taken.
C:\Program Files\Live_TV\UNWISE.EXE (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\LanguagePack.xml (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\LocalSettings.txt (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\ThirdPartyComponents.xml (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\update.xml (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___storage_conduit_com_63_136_CT1360763_Images_1256613422_gif.gif (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___storage_conduit_com_65_64_CT649865_Images_-1611650343_gif.gif (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___storage_conduit_com_65_64_CT649865_Images_-1616510062_gif.gif (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___storage_conduit_com_65_64_CT649865_Images_1256574750_gif.gif (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___storage_conduit_com_65_64_CT649865_Images_1256594985_gif.gif (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___storage_conduit_com_65_64_CT649865_Images_1477248454_gif.gif (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___storage_conduit_com_65_64_CT649865_Images_633211004690737500_gif.gif (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___storage_conduit_com_65_64_CT649865_Images_633323304820925000_gif.gif (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___storage_conduit_com_65_64_CT649865_Images_633323304996393750_gif.gif (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___storage_conduit_com_65_64_CT649865_Images_633323305088425000_gif.gif (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___storage_conduit_com_65_64_CT649865_Images_633323305474518750_gif.gif (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___storage_conduit_com_65_64_CT649865_Images_633341279781868750_gif.gif (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___storage_conduit_com_65_64_CT649865_Images_633403616553356250_gif.gif (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___storage_conduit_com_65_64_CT649865_Images_633463264160275000_gif.gif (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___storage_conduit_com_65_64_CT649865_Images_735535110_gif.gif (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___storage_conduit_com_65_64_CT649865_Images_999644891_gif.gif (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___storage_conduit_com_65_64_CT649865_Images_Email-04orange_gif-Colorized-633323306911237500_gif.gif (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___storage_conduit_com_65_64_CT649865_Images_PopUpBlocker-21_gif-comic02-633323306370612500_gif.gif (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___weather_conduit_com_images_weather_Default_drizzle_gif.gif (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___weather_conduit_com_images_weather_Default_partly_cloudy_gif.gif (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___weather_conduit_com_images_weather_Default_sunny_gif.gif (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___weather_conduit_com_images_weather_Default_sunny_night_gif.gif (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___www_conduit_com_bankimages_commandcomps_block_gif.gif (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___www_conduit_com_BankImages_CommandComps_highlighter_dis_gif.gif (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___www_conduit_com_BankImages_CommandComps_highlighter_icon_gif.gif (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___www_conduit_com_Images_ClientImages_radio_gif.gif (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___www_conduit_com_Images_rssImages_rrs16Images_rss01x16green_gif.gif (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___www_conduit_com_Images_rssImages_rrs16Images_rss01x16red_gif.gif (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___www_conduit_com_Images_rssImages_rrs16Images_rss01x16_gif.gif (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___www_conduit_com_Images_rssImages_rrs16Images_rss03x16blue_gif.gif (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___www_conduit_com_Images_SearchEngines_images_search_gif.gif (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___www_conduit_com_Images_SearchEngines_news_search_gif.gif (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___www_conduit_com_Images_SearchEngines_site_search_gif.gif (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\CacheIcons\http___www_conduit_com_Images_SearchEngines_weather_search_gif.gif (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\RadioPlayer\Predefined_Media_List.xml (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\rss\http___feeds_feedburner_com_metacafe_TYps.xml (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\rss\http___feeds_feedburner_com_metacafe_TYps_history.xml (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\rss\http___feeds_feedburner_com_metacafe_TYps_structured.xml (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\rss\http___video_google_com_videofeed_type=top100new&num=20&output=rss.xml (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\rss\http___video_google_com_videofeed_type=top100new&num=20&output=rss_structured.xml (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\rss\http___youtube_com_rss_global_top_viewed_today_rss.xml (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\rss\http___youtube_com_rss_global_top_viewed_today_rss_structured.xml (Adware.Agent) -> No action taken.
C:\Documents and Settings\Toni.HOME-50943DEFA3\Local Settings\Application Data\Live_TV\rss\sabfmts=2&saprclo=150&sascs=2&saprchi=550&saaff=afepn&ftrv=8&fbfmt=1&ftrt=1&fcl=3&ft=1&frpp=50&customid=&nojspr=y&satitle=new&afmp=&sacat=293&saslop=1&fss=0.xml (Adware.Agent) -> No action taken.
|
|
Xfect
Newbie
|
27. elokuuta 2008 @ 17:40 |
Linkki tähän viestiin
|
SmitFraudFix v2.339
Scan done at 17:37:50,17, ke 27.08.2008
Run from C:\Documents and Settings\Toni.HOME-50943DEFA3\Ty?p?yt?\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode
»»»»»»»»»»»»»»»»»»»»»»»» Process
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\cmd.exe
»»»»»»»»»»»»»»»»»»»»»»»» hosts
»»»»»»»»»»»»»»»»»»»»»»»» C:\
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Toni.HOME-50943DEFA3
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Toni.HOME-50943DEFA3\Application Data
»»»»»»»»»»»»»»»»»»»»»»»» Start Menu
»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\TONI~1.HOM\Suosikit
»»»»»»»»»»»»»»»»»»»»»»»» Desktop
»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys
»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Nykyinen kotisivu"
»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!
IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!
VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!
404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
!!!Attention, following keys are not inevitably infected!!!
AntiXPVSTFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
"System"=""
»»»»»»»»»»»»»»»»»»»»»»»» RK
»»»»»»»»»»»»»»»»»»»»»»»» DNS
Description: Realtek RTL8169/8110 Family Gigabit Ethernet NIC - Paketinajoituksen miniportti
DNS Server Search Order: ***.***.*.*
HKLM\SYSTEM\CCS\Services\Tcpip\..\{672B33B8-69DE-4455-B12C-41A2F2C80371}: DhcpNameServer=***.***.*.*
HKLM\SYSTEM\CS1\Services\Tcpip\..\{672B33B8-69DE-4455-B12C-41A2F2C80371}: DhcpNameServer=***.***.*.*
HKLM\SYSTEM\CS2\Services\Tcpip\..\{672B33B8-69DE-4455-B12C-41A2F2C80371}: DhcpNameServer=***.***.*.*
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=***.***.*.*
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=***.***.*.*
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=***.***.*.*
»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection
»»»»»»»»»»»»»»»»»»»»»»»» End
|
|
Mainos
|
|
|
|
Hujo
Suspended permanently
|
27. elokuuta 2008 @ 17:43 |
Linkki tähän viestiin
|
|
sitten vain listaa alas päin
===============
Malwarebytes' Anti-Malware
5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
tuossa tuo kohta meni vikaan
Voiko tietsikka koskaan toimia?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 27. elokuuta 2008 @ 18:25
|
|
