|
HTJ-logi
|
|
|
tebaboy
Member
9 tuotearviota
|
20. heinäkuuta 2009 @ 22:50 |
Linkki tähän viestiin
|
Moro. Koneessa on havaittavissa selvää hidastelua ja hiiri jäätyy aina muutamanksi sekunniksi tietyin väliajoin. Siksi halusinkin tarkistaa tämän. Saattaisikohan tämä riippua siitä, että palomuuri saattaa päästää jotain läpi. Päivitin comodon uusimpaan versioon vähän aikaa sitten ja testejen perusteella ei kai ole ihan kaikki kunnossa. Voisiko joku auttaa myös sen kanssa?
Hijack logi
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:42:20, on 20.7.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Avast4\aswUpdSv.exe
C:\Program Files\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Avast4\ashDisp.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
E:\Program Files\Valve\Steam\Steam.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] "E:\Program Files\Valve\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/sh...ash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Avast4\ashServ.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
--
End of file - 8569 bytes
GRC.com-sivuston File Sharing ja All Service Ports testeistä tuli tämmöistä:
Attempting connection to your computer. . .
Shields UP! is now attempting to contact the Hidden Internet Server within your PC. It is likely that no one has told you that your own personal computer may now be functioning as an Internet Server with neither your knowledge nor your permission. And that it may be serving up all or many of your personal files for reading, writing, modification and even deletion by anyone, anywhere, on the Internet!
Preliminary Internet connection established!
Your computer has accepted an anonymous connection from another machine it knows nothing about! (That's not good.) This ShieldsUP! web server has been permitted to connect to your computer's highly insecure NetBIOS File and Printer Sharing port (139). Subsequent tests conducted on this page, and elsewhere on this website, will probe more deeply to determine the extent of this system's vulnerability. But regardless of what more is determined, the presence and availability of some form of Internet Server HAS BEEN CONFIRMED within this machine . . . and it is accepting anonymous connections!
The rest of this website explains the implications and dangers of your present configuration and provides complete and thorough instruction for increasing the security of this system. At the moment, any passing high speed Internet scanner will quickly spot this computer as a target for attack. (When this page has completely finished displaying, you might wish to sneak a quick peek at these two pages to see what lies ahead at this website: Scanner1 & Scanner2)
The phrase you must remember is:
"My port 139 is wide OPEN!"
Remotely connected to your NetBIOS system!
This computer is exposing its internal NetBIOS networking protocol over the Internet. This is called "NetBIOS over TCP/IP" or "NBT" for short. This is a security risk because it gives anyone in the world a point of entry to your system. Connecting to your computer is NOT something that anyone on the Internet should be allowed to do . . . but we've just done it! The following pages provide information about the consequences and your options for increasing your system's security.
Your computer's name is: KOTIKONE / MSHOME.
This is an example of some of the information about you and your computer that is leaking out onto the Internet and is openly available to anyone. Such information is commonly used as a starting point for guessing your name and/or your passwords and learning more about who you are.
Your computer is exposing NO SHARES to the Internet.
Either your computer has no shared resources (disk drive directories or printers) or they are effectively hidden from external view and attack. This is beneficial for your security because exposed shares can provoke system intrusion. However, allowing unknown persons or software anywhere in the world to connect to your system without your knowledge still affords them the opportunity to poke holes in your system's security.
Also, as you can see below, significant personal information is still leaking out of your system and is readily available to curious intruders. Since you do not appear to be sharing files or printers over the TCP/IP protocol, this system is relatively secure. It is exposing its NetBIOS names (see below) over the Internet, but it is refusing to allow connections, so it is unlikely that anyone could gain casual entry into your system due to its connection to the Internet.
Several of your private names are being served up to the
Internet by the Windows networking system. (see below)
While it's unlikely that this information can be exploited, you
should know what anyone can learn about you and your system.
~ ~ ? Your User Name
KOTIKONE ? Your Computer's Name
MSHOME ? Your Workgroup
Disconnecting from your computer. . .
A Next-Generation PRIVACY THREAT is present!
The Media Access Control (MAC) address of the network interface card in your computer can be easily read by any computer or web server on the Internet. Yours is:
00-XX-XX-BD-xx-xx (muutin tuota)
The MAC address is a "guaranteed to be globally unique" 48-bit serial number embedded into every Ethernet network adapter ever made. The problem is you can't change it ? it's like your machine's unique indelible fingerprint ? and it's being made available to any web site (like this one) that you visit. In many ways it's like a "super web browser cookie on steroids" that cannot be disabled or blocked by normal means.
Many people have become very upset over the unique serial number embedded into every Pentium III processor, fearing the invasion of privacy that such a "globally unique ID tag" would represent. But the exposed network MAC address problem is much worse since it's already here, it's fully deployed and available for the asking from most computers on the Internet! More importantly . . . it's freely available from your computer.
Since the presence and significance of this has just occurred to me, I have not yet added background information about this problem to this website. Therefore, if this is a concern to you, please plan to return to this site a few days from now when you'll find a thorough treatment of ? and a solution for ? this newly discovered significant privacy threat.
Your System's Internet Connection Security Synopsis:
This system's silent NetBIOS over TCP/IP (NBT) Internet Server is actively advertising its existence across the Internet and thus inviting equally silent connection and intrusion into your system. We were just now able to connect to your computer and establish a dialog with it, asking for its name and other information. That is the first step in breaking into a system. Automated "hacking tools" already exist to scan the Internet looking for computer targets exactly like this one . . . and then silently cracking any passwords you may be using to "protect" those resources.
Your system is not exposing ANY shared resources to the Internet. That's very good. But as you can see, the fact that there's a computer here is still completely exposed and dangling out there on the Internet for everyone to see and to cause people to wonder what might be here.
What YOU can do:
Unless you actively need to share your personal computer's resources across the Internet, you should immediately "unbind" the "File and Printer Sharing" from your TCP/IP properties in your computer's "Network Neighborhood" properties. This will render your system somewhat more "opaque" to the outside world and much less prone to attracting and enticing intruders. This will not impede your ability to use the Internet in any way, and you'll still be able to share resources among the computers on your own internal network.
Note that you may need to add the "NetBEUI" protocol to all of your systems if it is not already installed (it generally is). Please see the following pages for detailed explanations and instructions.
Once "File and Printer Sharing" has been disabled for the TCP/IP protocol, you'll be safe from this type of Internet system attack. Revisit this page after making the changes to be sure that everything is working the way you expect. Please also consider joining my User-Managed eMail System so that I can inform you of future enhancements to this and other free security services and tools.
ja all service ports testissä havaittiin, ett portit
-port 139: netbios-ssn
-port 445: microsoft-ds
ovat auki.
Ahaa, huomasin myös, että pari troijalaista/muuta on myös.Portit on siis suljettuna, mutta eivät "salattuna). portit: 1031, 1032, 1035 (Trojan Sightings: Multidropper), 1037, 1039, 1041, 1042 (Trojan Sightings: BLA trojan)
Kaipaisin nyt pikaista apua, koska koneella kyätetään verkkopankkia ja muita sovellutuksia, joiden käytössä suojaus olisi suotavaa olla kunnossa :D
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 20. heinäkuuta 2009 @ 22:55
|
AfterDawn Addict
|
21. heinäkuuta 2009 @ 12:38 |
Linkki tähän viestiin
|
Login mukaan sulla on seuraavat virusohjelmat päällä !!!
Säädöistä riippuen sulla on 2 tukaa tai 2 muuria
yht'aikaa päällä ??? (aiheuttaa ongelmia)
[avast!]
[COMODO Firewall Pro]
[COMODO Internet Security]
Tämän voit poistaa.
Siihen ei ole tullut virus päivityksiä pian vuoteen.
AVG Anti-Spyware Guard 7.5
.
(:)
|
|
tebaboy
Member
9 tuotearviota
|
21. heinäkuuta 2009 @ 14:10 |
Linkki tähän viestiin
|
Lainaus, alkuperäisen viestin kirjoitti kalminen:
Login mukaan sulla on seuraavat virusohjelmat päällä !!!
Säädöistä riippuen sulla on 2 tukaa tai 2 muuria
yht'aikaa päällä ??? (aiheuttaa ongelmia)
[avast!]
[COMODO Firewall Pro]
[COMODO Internet Security]
Tämän voit poistaa.
Siihen ei ole tullut virus päivityksiä pian vuoteen.
AVG Anti-Spyware Guard 7.5
.
Aika outo, koska poistin comodon lisää/poista sovelluksella ja en mielestäni asentanut kuin pelkän palomuurin. Yritän tuon spyware guardin poistaa..
Mites tuo raportti?
|
|
tebaboy
Member
9 tuotearviota
|
21. heinäkuuta 2009 @ 15:31 |
Linkki tähän viestiin
|
Poistin/asensin kaikki comodo homman uusiks, mutta onko tämä internet security vieläkin olemassa? Aika v-mäistä. Varmasti en asentanut viruksentorjunta-ohjelmaa samassa.
Voisiko olla mahdollista, ettei tuo comodo internet security olekkaan mikään viruksentorjunta-ohjelma?
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:29:37, on 21.7.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Avast4\aswUpdSv.exe
C:\Program Files\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Avast4\ashDisp.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
E:\Program Files\Valve\Steam\Steam.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] "E:\Program Files\Valve\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/sh...ash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - AppInit_DLLs:
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Avast4\ashServ.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
--
End of file - 8532 bytes
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 21. heinäkuuta 2009 @ 15:48
|
AfterDawn Addict
|
21. heinäkuuta 2009 @ 18:17 |
Linkki tähän viestiin
|
|
Jatketaan sitten kun sulla on aikaa.
.
(:)
|
|
tebaboy
Member
9 tuotearviota
|
21. heinäkuuta 2009 @ 18:48 |
Linkki tähän viestiin
|
Lainaus, alkuperäisen viestin kirjoitti kalminen:
Jatketaan sitten kun sulla on aikaa.
.
häh?
|
AfterDawn Addict
|
21. heinäkuuta 2009 @ 19:18 |
Linkki tähän viestiin
|
Ollaan lähtökuopissa edelleen !!!
Lainaus, alkuperäisen viestin kirjoitti tebaboy:
Lainaus, alkuperäisen viestin kirjoitti kalminen:
Login mukaan sulla on seuraavat virusohjelmat päällä !!!
Säädöistä riippuen sulla on 2 tukaa tai 2 muuria
yht'aikaa päällä ??? (aiheuttaa ongelmia)
[avast!]
[COMODO Firewall Pro]
[COMODO Internet Security]
Tämän voit poistaa.
Siihen ei ole tullut virus päivityksiä pian vuoteen.
AVG Anti-Spyware Guard 7.5
.
Aika outo, koska poistin comodon lisää/poista sovelluksella ja en mielestäni asentanut kuin pelkän palomuurin. Yritän tuon spyware guardin poistaa..
Mites tuo raportti?
Eteenpäin on turha mennä ennenkuin virusturva on
selvillä vesillä.
Löytyykö koneelta tämmöinen hakemisto => C:\Program Files\COMODO\Firewall\ ???
Tupla klikaa alapalkista Comodon kilpeä ja yhteeveto välilehdeltä
katsot mitä sä sinne olet asentanut ???
.
(:)
|
|
tebaboy
Member
9 tuotearviota
|
21. heinäkuuta 2009 @ 22:01 |
Linkki tähän viestiin
|
Ei löydy tuota comodo firewall, vaan kansio nimeltä Comodo internet security. Comodo firewall yhteenveto hommasssa on 2-ohjelmaa, "Verkon suoja", sekä "ennakoiva suojaus". Ennakoiva suojaus on poissa käytössä, mutta verkon suoja, eli palomuuri on käynnissä.
|
AfterDawn Addict
|
22. heinäkuuta 2009 @ 12:06 |
Linkki tähän viestiin
|
Onhan tuo virusturva sitten kunnossa.
Comodon => hallintapaneelin / Palomuuri / Porttini
siellä voit käpistellä portteja kiini ja auki.
Winukassa on 65000 porttia. Osalle portteja tulee
määrityksiä rekisteristä.
Minulla ei ole mahdollisuutta määritellä sinun
kokoonpanosi portteja.
Viruksia logilla ei näy.
Tarviitko ohjeet AVG:n poistoon ???
Onko muita ongelmia ???
.
(:)
|
|
tebaboy
Member
9 tuotearviota
|
22. heinäkuuta 2009 @ 14:06 |
Linkki tähän viestiin
|
Lainaus, alkuperäisen viestin kirjoitti kalminen:
Onhan tuo virusturva sitten kunnossa.
Comodon => hallintapaneelin / Palomuuri / Porttini
siellä voit käpistellä portteja kiini ja auki.
Winukassa on 65000 porttia. Osalle portteja tulee
määrityksiä rekisteristä.
Minulla ei ole mahdollisuutta määritellä sinun
kokoonpanosi portteja.
Viruksia logilla ei näy.
Tarviitko ohjeet AVG:n poistoon ???
Onko muita ongelmia ???
.
Jos kaikki on kunnossa, niin hyvä. Tämä hiiren väliaikainen jumittuminenkin varmaan jostain muusta johtuu.
Käytän tuota AVG:tä scannaamaan spywarea aina tietyin väliajoin, joten sitä ei tarvitse poistaa.
Comodon uudelleen asennuksen jälkeen tuo GRC-sivuton testit antoivat paljon paremmat tulokset!
Eipä tässä kai nyt ole mitään. Kiitoksia avusta.
|
AfterDawn Addict
|
22. heinäkuuta 2009 @ 16:24 |
Linkki tähän viestiin
|
Oletko tosissasi ????
Lainaus, alkuperäisen viestin kirjoitti kalminen:
Tämän voit poistaa.
Siihen ei ole tullut virus päivityksiä pian vuoteen.
AVG Anti-Spyware Guard 7.5
.
Kyllä siellä sun koneella on turhia jarruja.
.
(:)
|
|
Mainos
|
|
|
|
tebaboy
Member
9 tuotearviota
|
22. heinäkuuta 2009 @ 23:51 |
Linkki tähän viestiin
|
Lainaus, alkuperäisen viestin kirjoitti kalminen:
Oletko tosissasi ????
Lainaus, alkuperäisen viestin kirjoitti kalminen:
Tämän voit poistaa.
Siihen ei ole tullut virus päivityksiä pian vuoteen.
AVG Anti-Spyware Guard 7.5
.
Kyllä siellä sun koneella on turhia jarruja.
.
Ai ei ole tullut? No siinä tapauksessa poistan!
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 22. heinäkuuta 2009 @ 23:51
|
