saastunut kone

Yksityisviestit

Luo uusi yksityisviesti

Kaikki uudet viestit

Ilman vastauksia olevat viestiketjut

Hae viestejä

torstai 9.1.2025 / 02:53

Hae keskustelualueilta:

afterdawn.com > keskustelu > yleistä keskustelua tietokoneista > virukset ja haittaohjelmat > saastunut kone

Aiheet

Keskustelualueet

Vastaa

Aloita uusi viestiketju

saastunut kone

Siirry:

Kirjoittaja

Viesti

Peter49

Newbie

14. lokakuuta 2005 @ 15:55

Linkki tähän viestiin

Moi.

F-Secure löysi seuraavat ongelmat:

F-Secure Anti-Spyware Build 1.05
Logfile Created on:14. lokakuuta 2005 19:34:24
Using definitions file:SE1R70 12.10.2005
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

References detected during the scan:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
CommonName(TAC index:7):2 total references.
CoolWebSearch(TAC index:10):7 total references.
MRU List(TAC index:0):9 total references.
Tracking Cookie(TAC index:3):1 total references.
Win32.Trojan.Puper.d(TAC index:6):2 total references.
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

F-Secure Anti-Spyware Settings
===========================
Set : Search for negligible risk entries
Set : Safe mode (always request confirmation)
Set : Scan active processes
Set : Scan registry
Set : Deep-scan registry
Set : Scan my IE Favorites for banned URLs
Set : Scan my Hosts file

Extended F-Secure Anti-Spyware Settings
===========================
Set : Unload recognized processes & modules during scan
Set : Ignore spanned files when scanning cab archives
Set : Scan registry for all users instead of current user only
Set : Always try to unload modules before deletion
Set : Prior to deletion, allow unloading Explorer and IE if necessary
Set : Let Windows remove files in use at next reboot
Set : Delete quarantined objects after restoring
Set : Block Pop-ups aggresively
Set : Automatically select problematic objects in result lists
Set : Include basic settings in log file
Set : Include additional settings in log file
Set : Include reference summary in log file
Set : Include Alternate Datastream details in log file
Set : Show splash screen
Set : Backup current definition file before updating
Set : Play sound at scan completion if scan locates critical objects

14.10.2005 19:34:24 - Scan started. (Smart mode)

Listing running processes
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

#:1 [smss.exe]
FilePath : \SystemRoot\System32\
ProcessID : 540
ThreadCreationTime : 14.10.2005 14:52:52
BasePriority : Normal

#:2 [csrss.exe]
FilePath : \??\C:\WINDOWS\system32\
ProcessID : 608
ThreadCreationTime : 14.10.2005 14:52:53
BasePriority : Normal

#:3 [winlogon.exe]
FilePath : \??\C:\WINDOWS\system32\
ProcessID : 632
ThreadCreationTime : 14.10.2005 14:52:53
BasePriority : High

#:4 [services.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 676
ThreadCreationTime : 14.10.2005 14:52:53
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® -käyttöjärjestelmä
CompanyName : Microsoft Corporation
FileDescription : Palvelu- ja ohjainohjelma
InternalName : services.exe
LegalCopyright : © Microsoft Corporation. Kaikki oikeudet pidätetään.
OriginalFilename : services.exe

#:5 [lsass.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 688
ThreadCreationTime : 14.10.2005 14:52:53
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : LSA Shell (Export Version)
InternalName : lsass.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : lsass.exe

#:6 [svchost.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 840
ThreadCreationTime : 14.10.2005 14:52:54
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:7 [svchost.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 916
ThreadCreationTime : 14.10.2005 14:52:54
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:8 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 1016
ThreadCreationTime : 14.10.2005 14:52:54
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:9 [svchost.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 1072
ThreadCreationTime : 14.10.2005 14:52:54
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:10 [svchost.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 1224
ThreadCreationTime : 14.10.2005 14:52:54
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:11 [explorer.exe]
FilePath : C:\WINDOWS\
ProcessID : 1400
ThreadCreationTime : 14.10.2005 14:52:55
BasePriority : Normal
FileVersion : 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 6.00.2900.2180
ProductName : Microsoft® Windows® -käyttöjärjestelmä
CompanyName : Microsoft Corporation
FileDescription : Resurssienhallinta
InternalName : explorer
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : EXPLORER.EXE

#:12 [spoolsv.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 1540
ThreadCreationTime : 14.10.2005 14:52:55
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Spooler SubSystem App
InternalName : spoolsv.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : spoolsv.exe

#:13 [msole32.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 1644
ThreadCreationTime : 14.10.2005 14:52:57
BasePriority : Normal

#:14 [shnlog.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 1652
ThreadCreationTime : 14.10.2005 14:52:57
BasePriority : Normal

#:15 [jmap5289.exe]
FilePath : C:\Program Files\ULI5289\
ProcessID : 1672
ThreadCreationTime : 14.10.2005 14:52:57
BasePriority : Normal

#:16 [fsm32.exe]
FilePath : C:\Program Files\F-Secure Internet Security\Common\
ProcessID : 1680
ThreadCreationTime : 14.10.2005 14:52:57
BasePriority : Normal
FileVersion : 5.61.7670
ProductVersion : 5.61 Build 7670
ProductName : F-Secure Management Agent
CompanyName : F-Secure Corporation
FileDescription : F-Secure Settings and Statistics
InternalName : FSM
LegalCopyright : Copyright © 1998-2004 F-Secure Corporation. All rights reserved.
LegalTrademarks : Windows (TM) is a trademark of Microsoft Corporation
OriginalFilename : FSM32.EXE

#:17 [ituneshelper.exe]
FilePath : C:\Program Files\iTunes\
ProcessID : 1708
ThreadCreationTime : 14.10.2005 14:52:57
BasePriority : Normal
FileVersion : 5.0.1.4
ProductVersion : 5.0.1.4
ProductName : iTunes
CompanyName : Apple Computer, Inc.
FileDescription : iTunesHelper Module
InternalName : iTunesHelper
LegalCopyright : © 2003-2005 Apple Computer, Inc. All Rights Reserved.
OriginalFilename : iTunesHelper.exe

#:18 [qttask.exe]
FilePath : C:\Program Files\QuickTime\
ProcessID : 1716
ThreadCreationTime : 14.10.2005 14:52:57
BasePriority : Normal
FileVersion : 7.0.2
ProductVersion : QuickTime 7.0.2
ProductName : QuickTime
CompanyName : Apple Computer, Inc.
FileDescription : QuickTime Task
InternalName : QuickTime Task
LegalCopyright : Copyright Apple Computer, Inc. 1989-2005
OriginalFilename : QTTask.exe

#:19 [soundman.exe]
FilePath : C:\WINDOWS\
ProcessID : 1748
ThreadCreationTime : 14.10.2005 14:52:57
BasePriority : Normal
FileVersion : 5.1.0.29
ProductVersion : 5.1.0.29
ProductName : Realtek Sound Manager
CompanyName : Realtek Semiconductor Corp.
FileDescription : Realtek Sound Manager
InternalName : ALSMTray
LegalCopyright : Copyright (c) 2001-2004 Realtek Semiconductor Corp.
OriginalFilename : ALSMTray.exe
Comments : Realtek AC97 Audio Sound Manager

#:20 [ctfmon.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 1756
ThreadCreationTime : 14.10.2005 14:52:57
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : CTF Loader
InternalName : CTFMON
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : CTFMON.EXE

#:21 [msmsgs.exe]
FilePath : C:\Program Files\Messenger\
ProcessID : 1764
ThreadCreationTime : 14.10.2005 14:52:57
BasePriority : Normal
FileVersion : 4.7.3001
ProductVersion : Version 4.7.3001
ProductName : Messenger
CompanyName : Microsoft Corporation
FileDescription : Windows Messenger
InternalName : msmsgs
LegalCopyright : Copyright (c) Microsoft Corporation 2004
LegalTrademarks : Microsoft(R) is a registered trademark of Microsoft Corporation in the U.S. and/or other countries.
OriginalFilename : msmsgs.exe

#:22 [rundll32.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 1840
ThreadCreationTime : 14.10.2005 14:52:57
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® -käyttöjärjestelmä
CompanyName : Microsoft Corporation
FileDescription : Suorita DLL sovelluksena
InternalName : rundll
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : RUNDLL.EXE

#:23 [intmon.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 1904
ThreadCreationTime : 14.10.2005 14:52:58
BasePriority : Normal

#:24 [servic~1.exe]
FilePath : C:\PROGRA~1\F-SECU~1\backweb\1245240\Program\
ProcessID : 340
ThreadCreationTime : 14.10.2005 14:53:15
BasePriority : Normal

#:25 [fsgk32st.exe]
FilePath : C:\Program Files\F-Secure Internet Security\Anti-Virus\
ProcessID : 408
ThreadCreationTime : 14.10.2005 14:53:15
BasePriority : Normal
FileVersion : 1, 0, 7360, 0
ProductVersion : 1, 0, 7360, 56
ProductName : F-Secure Corp. Startup service
CompanyName : F-Secure Corp.
FileDescription : fsgk32st
InternalName : fsgk32
LegalCopyright : Copyright © 2001
OriginalFilename : fsgk32st.exe
Comments : Startup service for Gatekeeper Handler

#:26 [fsbwsys.exe]
FilePath : C:\Program Files\F-Secure Internet Security\backweb\1245240\program\
ProcessID : 424
ThreadCreationTime : 14.10.2005 14:53:15
BasePriority : Normal
FileVersion : 6.70.734
ProductVersion : 6.70
ProductName : F-Secure BackWeb
CompanyName : F-Secure Corp.
FileDescription : fsbwsys
InternalName : fsbwsys
LegalCopyright : Copyright © 2004 F-Secure Corporation
OriginalFilename : fsbwsys.exe

#:27 [fsgk32.exe]
FilePath : C:\Program Files\F-Secure Internet Security\Anti-Virus\
ProcessID : 436
ThreadCreationTime : 14.10.2005 14:53:15
BasePriority : Normal
FileVersion : 5.53.10121
ProductVersion : 5.53.10121
ProductName : F-Secure Corp. fsgk32
CompanyName : F-Secure Corp.
FileDescription : Gatekeeper Handler II
InternalName : fsgk32
LegalCopyright : Copyright © 2003
OriginalFilename : fsgk32.exe
Comments : release

#:28 [fsma32.exe]
FilePath : C:\Program Files\F-Secure Internet Security\Common\
ProcessID : 448
ThreadCreationTime : 14.10.2005 14:53:15
BasePriority : Normal
FileVersion : 5.61.7670
ProductVersion : 5.61 Build 7670
ProductName : F-Secure Management Agent
CompanyName : F-Secure Corporation
FileDescription : F-Secure Management Agent
InternalName : VCH
LegalCopyright : Copyright © 1998-2004 F-Secure Corporation. All rights reserved.
LegalTrademarks : Windows (TM) is a trademark of Microsoft Corporation
OriginalFilename : FSMA32.EXE

#:29 [fssm32.exe]
FilePath : C:\Program Files\F-Secure Internet Security\Anti-Virus\
ProcessID : 476
ThreadCreationTime : 14.10.2005 14:53:15
BasePriority : Normal
FileVersion : 5.53.10210
ProductVersion : 5.53.10210
ProductName : F-Secure Corp. fssm32
CompanyName : F-Secure Corp.
FileDescription : fssm32
InternalName : fssm32
LegalCopyright : Copyright © 2003
OriginalFilename : fssm32.exe
Comments : release

#:30 [fsmb32.exe]
FilePath : C:\Program Files\F-Secure Internet Security\Common\
ProcessID : 352
ThreadCreationTime : 14.10.2005 14:53:15
BasePriority : Normal
FileVersion : 5.61.7670
ProductVersion : 5.61 Build 7670
ProductName : F-Secure Management Agent
CompanyName : F-Secure Corporation
FileDescription : F-Secure Message Broker
InternalName : FSMB
LegalCopyright : Copyright © 1998-2004 F-Secure Corporation. All rights reserved.
LegalTrademarks : Windows (TM) is a trademark of Microsoft Corporation
OriginalFilename : FSMB32.EXE

#:31 [fspex.exe]
FilePath : C:\Program Files\F-Secure Internet Security\backweb\1245240\Program\
ProcessID : 612
ThreadCreationTime : 14.10.2005 14:53:15
BasePriority : Normal

#:32 [fch32.exe]
FilePath : C:\Program Files\F-Secure Internet Security\Common\
ProcessID : 1804
ThreadCreationTime : 14.10.2005 14:53:18
BasePriority : Normal
FileVersion : 5.61.7670
ProductVersion : 5.61 Build 7670
ProductName : F-Secure Management Agent
CompanyName : F-Secure Corporation
FileDescription : F-Secure Configuration Handler
InternalName : FCH
LegalCopyright : Copyright © 1998-2004 F-Secure Corporation. All rights reserved.
LegalTrademarks : Windows (TM) is a trademark of Microsoft Corporation
OriginalFilename : FCH32.EXE

#:33 [fameh32.exe]
FilePath : C:\Program Files\F-Secure Internet Security\Common\
ProcessID : 2096
ThreadCreationTime : 14.10.2005 14:53:19
BasePriority : Normal
FileVersion : 5.61.7670
ProductVersion : 5.61 Build 7670
ProductName : F-Secure Management Agent
CompanyName : F-Secure Corporation
FileDescription : F-Secure Alert and Management Extension Handler
InternalName : FAMEH
LegalCopyright : Copyright © 1998-2004 F-Secure Corporation. All rights reserved.
LegalTrademarks : Windows (TM) is a trademark of Microsoft Corporation
OriginalFilename : FAMEH32.EXE

#:34 [fspc.exe]
FilePath : C:\Program Files\F-Secure Internet Security\FSPC\
ProcessID : 2160
ThreadCreationTime : 14.10.2005 14:53:20
BasePriority : Normal
FileVersion : 3.01.1100
ProductVersion : 3.01 Build 1100
ProductName : F-Secure Parental Control
CompanyName : F-Secure Corporation
FileDescription : F-Secure Parental Control
InternalName : FSPC
LegalCopyright : Copyright © 1998-2004 F-Secure Corporation. All rights reserved.
LegalTrademarks : Windows (TM) is a trademark of Microsoft Corporation
OriginalFilename : FSPC.EXE

#:35 [ipodservice.exe]
FilePath : C:\Program Files\iPod\bin\
ProcessID : 2240
ThreadCreationTime : 14.10.2005 14:53:20
BasePriority : Normal
FileVersion : 5.0.1.4
ProductVersion : 5.0.1.4
ProductName : iTunes
CompanyName : Apple Computer, Inc.
FileDescription : iPodService Module
InternalName : iPodService
LegalCopyright : © 2003-2005 Apple Computer, Inc. All Rights Reserved.
OriginalFilename : iPodService.exe

#:36 [fshttps.exe]
FilePath : C:\Program Files\F-Secure Internet Security\FSPC\fshttps\
ProcessID : 2304
ThreadCreationTime : 14.10.2005 14:53:21
BasePriority : Normal
FileVersion : 3.01.1100
ProductVersion : 3.01 Build 1100
ProductName : F-Secure Parental Control
CompanyName : F-Secure Corporation
FileDescription : F-Secure Http Server
InternalName : FSHTTPS
LegalCopyright : Copyright © 1998-2004 F-Secure Corporation. All rights reserved.
LegalTrademarks : Windows (TM) is a trademark of Microsoft Corporation
OriginalFilename : FSHTTPS.EXE

#:37 [fsdfwd.exe]
FilePath : C:\Program Files\F-Secure Internet Security\FWES\Program\
ProcessID : 2348
ThreadCreationTime : 14.10.2005 14:53:21
BasePriority : Normal
FileVersion : 5.80.370
ProductVersion : 5.80 Build 370
ProductName : F-Secure Anti-Virus Internet Shield
CompanyName : F-Secure Corporation
FileDescription : F-Secure Anti-Virus Internet Shield daemon
InternalName : fsdfwd
LegalCopyright : Copyright (c) F-Secure Corporation 1997-2004
OriginalFilename : fsdfwd.exe

#:38 [fsav32.exe]
FilePath : C:\Program Files\F-Secure Internet Security\Anti-Virus\
ProcessID : 2592
ThreadCreationTime : 14.10.2005 14:53:22
BasePriority : Normal
FileVersion : 5.53.10480
ProductVersion : 5.53.10480
ProductName : F-Secure Anti-Virus
CompanyName : F-Secure Corporation
FileDescription : FSAV Handler
InternalName : FSAV32
LegalCopyright : Copyright © 1998-2004, F-Secure Corporation
OriginalFilename : FSAV32.exe

#:39 [alg.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 2724
ThreadCreationTime : 14.10.2005 14:53:22
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Application Layer Gateway Service
InternalName : ALG.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : ALG.exe

#:40 [fsguiexe.exe]
FilePath : C:\Program Files\F-Secure Internet Security\FSGUI\
ProcessID : 3536
ThreadCreationTime : 14.10.2005 14:53:25
BasePriority : Normal
FileVersion : 5, 70, 1221, 0
ProductVersion : 5, 0, 560, 0
ProductName : ISP 2005
FileDescription : gui standby component
InternalName : fsguiexe
LegalCopyright : Copyright (C) 2004
OriginalFilename : fsguiexe.exe

#:41 [anti-spyware.exe]
FilePath : C:\Program Files\F-Secure Internet Security\Anti-Spyware\
ProcessID : 668
ThreadCreationTime : 14.10.2005 16:34:12
BasePriority : Normal
FileVersion : 6.2.0.182
ProductVersion : VI.Second Edition
ProductName : F-Secure Anti-Spyware
CompanyName : Lavasoft Sweden
FileDescription : F-Secure Anti-Spyware Core application
InternalName : Anti-Spyware.exe
LegalCopyright : Copyright © F-Secure
OriginalFilename : Ad-Aware.exe
Comments : Licensed from Lavasoft

Memory scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New Critical Objects: 0
Objects found so far: 0

Started registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

CommonName Object Recognized!
Type : RegKey
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : typelib\{1e1b286c-88ff-11d2-8d96-d7acac95951f}

CommonName Object Recognized!
Type : RegKey
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{1e1b2878-88ff-11d2-8d96-d7acac95951f}

CoolWebSearch Object Recognized!
Type : RegKey
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : clsid\{ffffffff-ffff-ffff-ffff-fffffffffffa}

CoolWebSearch Object Recognized!
Type : RegKey
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : clsid\vmhomepage

CoolWebSearch Object Recognized!
Type : RegValue
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : clsid\vmhomepage
Value : CurVer

CoolWebSearch Object Recognized!
Type : RegKey
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : clsid\vmhomepage.1

CoolWebSearch Object Recognized!
Type : RegKey
Data :
Category : Malware
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\windows\currentversion\explorer\browser helper objects\{ffffffff-ffff-ffff-ffff-fffffffffffa}

Win32.Trojan.Puper.d Object Recognized!
Type : RegKey
Data :
Category : Malware
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\windows\currentversion\explorer\browser helper objecta\{ffffffff-ffff-ffff-ffff-fffffffffffa}

Win32.Trojan.Puper.d Object Recognized!
Type : RegValue
Data :
Category : Malware
Comment : "paint.exe"
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\windows\currentversion\policies\explorer\run
Value : paint.exe

Registry scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New Critical Objects: 9
Objects found so far: 9

Started deep registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Deep registry scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New Critical Objects: 0
Objects found so far: 9

Started tracking cookie scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : pete@tribalfusion[1].txt
Category : Data Miner
Comment : Hits:1
Value : Cookie:pete@tribalfusion.com/
Expires : 1.1.2038 3:00:00
LastSync : Hits:1
UseCount : 0
Hits : 1

Tracking cookie scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New Critical Objects: 1
Objects found so far: 10

Deep scanning and examining files...
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Disk scan result for C:\WINDOWS
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New Critical Objects: 0
Objects found so far: 10

Disk scan result for C:\WINDOWS\system32
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New Critical Objects: 0
Objects found so far: 10

Disk scan result for C:\DOCUME~1\Pete\LOCALS~1\Temp\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New Critical Objects: 0
Objects found so far: 10

Scanning Hosts file...
Hosts file location:"C:\WINDOWS\system32\drivers\etc\hosts".
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Hosts file scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
1 entries scanned.
New Critical Objects:0
Objects found so far: 10

MRU List Object Recognized!
Location: : C:\Documents and Settings\Pete\recent
Description : list of recently opened documents

MRU List Object Recognized!
Location: : software\microsoft\directdraw\mostrecentapplication
Description : most recent application to use microsoft directdraw

MRU List Object Recognized!
Location: : S-1-5-21-1343024091-879983540-839522115-1004\software\microsoft\internet explorer
Description : last download directory used in microsoft internet explorer

MRU List Object Recognized!
Location: : S-1-5-21-1343024091-879983540-839522115-1004\software\microsoft\internet explorer\typedurls
Description : list of recently entered addresses in microsoft internet explorer

MRU List Object Recognized!
Location: : S-1-5-21-1343024091-879983540-839522115-1004\software\microsoft\windows\currentversion\explorer\comdlg32\lastvisitedmru
Description : list of recent programs opened

MRU List Object Recognized!
Location: : S-1-5-21-1343024091-879983540-839522115-1004\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru
Description : list of recently saved files, stored according to file extension

MRU List Object Recognized!
Location: : S-1-5-21-1343024091-879983540-839522115-1004\software\microsoft\windows\currentversion\explorer\recentdocs
Description : list of recent documents opened

MRU List Object Recognized!
Location: : S-1-5-21-1343024091-879983540-839522115-1004\software\nvidia corporation\global\nview\windowmanagement
Description : nvidia nview cached application window positions

MRU List Object Recognized!
Location: : S-1-5-21-1343024091-879983540-839522115-1004\software\microsoft\windows media\wmsdk\general
Description : windows media sdk

Performing conditional scans..
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

CoolWebSearch Object Recognized!
Type : RegValue
Data :
Category : Malware
Comment :
Rootkey : HKEY_CURRENT_USER
Object : software\microsoft\internet explorer\main
Value : Enable Browser Extensions

CoolWebSearch Object Recognized!
Type : File
Data : wbemess.log
Category : Malware
Comment :
Object : C:\WINDOWS\system32\wbem\logs\

Conditional scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New Critical Objects: 2
Objects found so far: 21

19:35:02 Scan Complete

Summary of this scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Total scanning time:00:00:37.203
Objects scanned:61348
Objects identified:12
Objects ignored:0
New Critical Objects:12

Eli koska kaikki pitää opetella kantapään kautta niin ilmeisesti koneen suojaus ei ollut ajantasalla.

F-Secure on asennettu, ja sieltä myös haittaohjelmien poistotyökalu.
XP:n oma palomuuri oli se ainoa palomuuri, ja se kai oli aivan riittämätön.
Olen kokeillut usita (en vielä kaikkia)noita ensimmäisen viestiketjun ohjelmia (sain poistettua suurimman osan haittaohjelmista, nuo 12 jäi)
Mitenkäs nyt?

Minulla on Nortonin ohjelma (tullut koneen mukana samalla cd:lla kuin koneen ajurit. Vaihdanko F-Securen Nortoniin?

Vai onko ainoa vaihtoehto formatointi?

Kiitos jo etukäteen.


		Käyttäjä	Salasana

		Puuttuuko tunnus? Liity jäseneksi nyt!. Salasana hukassa? Klikkaa tästä.