|
|
|
Keskustelualueet
Keskustelualueet
|
|
|
Taas yks msn pöpö
|
|
|
deviltk
Newbie
|
27. syyskuuta 2006 @ 18:42 |
Linkki tähän viestiin
|
Eli sain tuossa viime viikolla kaverilta viestin että "check :P http:blaahblaah.com/photo.gif" ... Noh.. klikkasin sitä ja virushan se sieltä tuli.. Nyt on ewido löytäny yhteensä 5000 kohdetta ja kokoajan tulee lisää.
Progrma filessiiin on tullu deluxe communications niminen kansio jota olen yrittänyt poistaa vaikka miten..
Skannasin koneen hijackthissillä ja tässä oli se loki tiedosto..:
Lainaus:
Logfile of HijackThis v1.99.1
Scan saved at 22:34:19, on 27.9.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Ohjelmat\AVG\avgamsvr.exe
D:\Ohjelmat\AVG\avgupsvc.exe
C:\WINDOWS\System32\cisvc.exe
D:\Ohjelmat\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\wscntfy.exe
D:\Ohjelmat\AVG\avgcc.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\system32\taskswitch.exe
D:\Ohjelmat\DAEMON tools\daemon.exe
D:\Ohjelmat\CyperLink DVD Solution\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\crunner\cproc.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\ntvdm.exe
D:\Ohjelmat\xchat\xchat.exe
D:\Ohjelmat\Gaim\gaim.exe
C:\WINDOWS\explorer.exe
D:\Ohjelmat\ewido anti-spyware 4.0\ewido.exe
D:\Tänne\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Documents%20and%20Settings/Mika/Omat%20tiedostot/tk4bloodshed%20fansite/index.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - C:\Program Files\DeluxeCommunications\DxcBho.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - d:\ohjelmat\Acrobat Reader\Reader\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [AVG7_CC] D:\Ohjelmat\AVG\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Ohjelmat\DAEMON tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [BCMHal] rundll32.exe bcmhalnt.dll,BCInit
O4 - HKLM\..\Run: [BLSTAPP] "C:\Program Files\Creative\BlasterControl\Blstapp.exe"
O4 - HKLM\..\Run: [BCTWEAK] C:\Program Files\Creative\BlasterControl\BCTweak.exe -1
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RemoteControl] "D:\Ohjelmat\CyperLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [SmcService] D:\Ohjelmat\Sygate\smc.exe -startgui
O4 - HKLM\..\Run: [!ewido] "D:\Ohjelmat\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKLM\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gaim] D:\Ohjelmat\Gaim\gaim.exe
O4 - HKCU\..\Run: [cprocsvc] C:\WINDOWS\system32\crunner\cproc.exe
O4 - HKCU\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\Ohjelmat\Office\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://D:\Ohjelmat\OFFICE~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Ohjelmat\OFFICE~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdat...b?1132992370202
O20 - AppInit_DLLs: dxclib303562752.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\Ohjelmat\AVG\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\Ohjelmat\AVG\avgupsvc.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - D:\Ohjelmat\ewido anti-spyware 4.0\guard.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - D:\Ohjelmat\Sygate\smc.exe
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 27. syyskuuta 2006 @ 18:43
|
AfterDawn Addict
|
28. syyskuuta 2006 @ 05:35 |
Linkki tähän viestiin
|
Joo uus ssk-variantti deluxe communicationshan se siellä.
1. Lataa combofix.exe tiedosto työpöydällesi.
2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
Lähetä HjT-loki ja combofixin raportti.
Ei HjT-lokeja tms. yksityisviestillä!
|
|
deviltk
Newbie
|
28. syyskuuta 2006 @ 10:45 |
Linkki tähän viestiin
|
Lainaus:
Mika - 06-09-28 14:35:12,75 Service Pack 2
ComboFix 06.09.28 - Running from: "D:\Ohjelmat"
((((((((((((((((((((((((((((((((((((((((((( E-Give / Ssk's Log )))))))))))))))))))))))))))))))))))))))))))))))))
C:\WINDOWS\system32\dxclib303562752.dll
C:\Documents and Settings\Mika\Application Data\Dxcknwrd.dll
C:\WINDOWS\system32\bkd.exe
C:\Program Files\DeluxeCommunications\Dxc.exe
C:\Program Files\DeluxeCommunications\DxcBho.dll
C:\Program Files\DeluxeCommunications\DxcCore.dll
* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\Program Files\Common Files\misc002
C:\Program Files\Common Files\{B0F48860-0706-1035-0519-050111070166}
C:\WINDOWS\system32\crunner
((((((((((((((((((((((((((((((( Files Created from 2006-08-28 to 2006-09-28 ))))))))))))))))))))))))))))))))))
2006-09-21 19:26 138,862 --a------ C:\WINDOWS\system32\alfa.exe
2006-09-11 14:35 83,096 --a------ C:\WINDOWS\system32\SSSensor.dll
2006-09-11 14:35 60,496 --a------ C:\WINDOWS\system32\drivers\Teefer.sys
2006-09-11 14:35 21,075 --a------ C:\WINDOWS\system32\drivers\wpsdrvnt.sys
2006-09-11 14:35 14,568 --a------ C:\WINDOWS\system32\drivers\wg6n.sys
2006-09-11 14:35 14,568 --a------ C:\WINDOWS\system32\drivers\wg5n.sys
2006-09-11 14:35 14,568 --a------ C:\WINDOWS\system32\drivers\wg4n.sys
2006-09-11 14:35 14,568 --a------ C:\WINDOWS\system32\drivers\wg3n.sys
2006-09-06 14:54 10,578 --a------ C:\WINDOWS\system32\drivers\hamachi.sys
2006-09-05 23:19 520,192 --------- C:\WINDOWS\system32\ati2sgag.exe
(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
2006-09-28 14:37 -------- d-------- C:\Documents and Settings\Mika\Application Data\.gaim
2006-09-28 14:35 -------- d-------- C:\Program Files\Common Files
2006-09-28 14:33 -------- d-------- C:\Documents and Settings\Mika\Application Data\Skype
2006-09-28 14:33 -------- d-------- C:\Documents and Settings\Mika\Application Data\Hamachi
2006-09-27 23:20 -------- d-------- C:\Documents and Settings\Mika\Application Data\X-Chat 2
2006-09-27 14:47 778656 --a------ C:\WINDOWS\system32\drivers\avg7core.sys
2006-09-25 18:51 -------- d-------- C:\Documents and Settings\Mika\Application Data\Lavasoft
2006-09-21 22:42 -------- d--h----- C:\Program Files\Common Files\cloader
2006-09-21 22:42 -------- d---s---- C:\Documents and Settings\Mika\Application Data\Microsoft
2006-09-21 20:08 -------- d-------- C:\Program Files\MSN Messenger
2006-09-14 17:39 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-09-12 17:12 -------- d-------- C:\Documents and Settings\Mika\Application Data\vlc
2006-09-11 14:34 -------- d-------- C:\Program Files\Common Files\Wise Installation Wizard
2006-09-07 15:56 21840 --a----t- C:\WINDOWS\system32\SIntfNT.dll
2006-09-07 15:56 17212 --a----t- C:\WINDOWS\system32\SIntf32.dll
2006-09-07 15:56 12067 --a----t- C:\WINDOWS\system32\SIntf16.dll
2006-09-06 19:01 -------- d-------- C:\Documents and Settings\Mika\Application Data\.ABC
2006-09-05 23:22 -------- d-------- C:\Documents and Settings\Mika\Application Data\ATI
2006-09-05 23:19 -------- d-------- C:\Program Files\ATI Technologies
2006-09-05 22:11 -------- d-------- C:\Program Files\Internet Explorer
2006-09-05 19:55 27904 --a------ C:\WINDOWS\system32\drivers\avg7rsxp.sys
2006-09-04 16:19 -------- d-------- C:\Documents and Settings\Mika\Application Data\MSN6
2006-09-04 14:42 219136 --a------ C:\WINDOWS\system32\uxtheme.dll
2006-07-12 16:45 3082 --a------ C:\WINDOWS\system32\affv7018p6now.sys
(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries are not shown
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"PowerBar"=""
"Gaim"="D:\\Ohjelmat\\Gaim\\gaim.exe"
"cprocsvc"="C:\\WINDOWS\\system32\\crunner\\cproc.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="D:\\Ohjelmat\\AVG\\avgcc.exe /STARTUP"
"dla"="C:\\WINDOWS\\system32\\dla\\tfswctrl.exe"
"CoolSwitch"="C:\\WINDOWS\\system32\\taskswitch.exe"
"Cmaudio"="RunDll32 cmicnfg.cpl,CMICtrlWnd"
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"DAEMON Tools-1033"="\"D:\\Ohjelmat\\DAEMON tools\\daemon.exe\" -lang 1033"
"BCMHal"="rundll32.exe bcmhalnt.dll,BCInit"
"BLSTAPP"="\"C:\\Program Files\\Creative\\BlasterControl\\Blstapp.exe\""
"BCTWEAK"="C:\\Program Files\\Creative\\BlasterControl\\BCTweak.exe -1"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
"RemoteControl"="\"D:\\Ohjelmat\\CyperLink DVD Solution\\PowerDVD\\PDVDServ.exe\""
"AtiPTA"="atiptaxx.exe"
"ATICCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe\" runtime -Delay"
"SmcService"="D:\\Ohjelmat\\Sygate\\smc.exe -startgui"
"!ewido"="\"D:\\Ohjelmat\\ewido anti-spyware 4.0\\ewido.exe\" /minimized"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Nykyinen kotisivu"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,e6,00,00,00,00,00,00,00,9a,03,00,00,4a,03,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,\
00,00,04,00,00,40
"RestoredStateInfo"=hex:18,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,\
00,00,01,00,00,00
[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"
"AVG7_Run"="D:\\Ohjelmat\\AVG\\avgw.exe /RUNONCE"
[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"
"AVG7_Run"="D:\\Ohjelmat\\AVG\\avgw.exe /RUNONCE"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="ewido anti-spyware 4.0"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"MemCheckBoxInRunDlg"=dword:00000001
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]
[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"0aMCPClient"="{F5DF91F9-15E9-416B-A7C3-7519B11ECBFC}"
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"UPnPMonitor"="{e57ce738-33e8-4c51-8354-bb4de9d215d1}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^Mika^Käynnistä-valikko^Ohjelmat^Käynnistys^Adobe Gamma.lnk]
"path"="C:\\Documents and Settings\\Mika\\Käynnistä-valikko\\Ohjelmat\\Käynnistys\\Adobe Gamma.lnk"
"backup"="C:\\WINDOWS\\pss\\Adobe Gamma.lnkStartup"
"location"="Startup"
"command"="C:\\PROGRA~1\\COMMON~1\\Adobe\\CALIBR~1\\ADOBEG~1.EXE "
"item"="Adobe Gamma"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\HP CD-DVD]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="hpcdtray"
"hkey"="HKLM"
"command"="D:\\Ohjelmat\\HP\\Umbrella\\hpcdtray.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\TkBellExe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="realsched"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\WindowFX]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="wfxload"
"hkey"="HKCU"
"command"="D:\\Ohjelmat\\WindowFX\\\\wfxload.exe"
"inimapping"="0"
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders
securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll
Completion time: Thu 28.09.2006 14:40:28.93
ComboFix.txt
Ja tässä se hijack this loki..:Lainaus:
Logfile of HijackThis v1.99.1
Scan saved at 14:45:02, on 28.9.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
D:\Ohjelmat\Sygate\smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
D:\Ohjelmat\AVG\avgamsvr.exe
D:\Ohjelmat\AVG\avgupsvc.exe
C:\WINDOWS\System32\cisvc.exe
D:\Ohjelmat\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
D:\Ohjelmat\AVG\avgcc.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\system32\taskswitch.exe
D:\Ohjelmat\DAEMON tools\daemon.exe
C:\WINDOWS\system32\wuauclt.exe
D:\Ohjelmat\CyperLink DVD Solution\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Ohjelmat\Gaim\gaim.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
D:\Ohjelmat\firefox.exe
D:\Tänne\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Documents%20and%20Settings/Mika/Omat%20tiedostot/tk4bloodshed%20fansite/index.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - d:\ohjelmat\Acrobat Reader\Reader\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [AVG7_CC] D:\Ohjelmat\AVG\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Ohjelmat\DAEMON tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [BCMHal] rundll32.exe bcmhalnt.dll,BCInit
O4 - HKLM\..\Run: [BLSTAPP] "C:\Program Files\Creative\BlasterControl\Blstapp.exe"
O4 - HKLM\..\Run: [BCTWEAK] C:\Program Files\Creative\BlasterControl\BCTweak.exe -1
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RemoteControl] "D:\Ohjelmat\CyperLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [SmcService] D:\Ohjelmat\Sygate\smc.exe -startgui
O4 - HKLM\..\Run: [!ewido] "D:\Ohjelmat\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gaim] D:\Ohjelmat\Gaim\gaim.exe
O4 - HKCU\..\Run: [cprocsvc] C:\WINDOWS\system32\crunner\cproc.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\Ohjelmat\Office\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://D:\Ohjelmat\OFFICE~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Ohjelmat\OFFICE~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdat...b?1132992370202
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\Ohjelmat\AVG\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\Ohjelmat\AVG\avgupsvc.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - D:\Ohjelmat\ewido anti-spyware 4.0\guard.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - D:\Ohjelmat\Sygate\smc.exe
|
|
Mainos
|
|
|
AfterDawn Addict
|
28. syyskuuta 2006 @ 13:59 |
Linkki tähän viestiin
|
Aika hyvältä näyttää :)
Fixaa:
O4 - HKCU\..\Run: [cprocsvc] C:\WINDOWS\system32\crunner\cproc.exe
Poista:
C:\WINDOWS\system32\alfa.exe
C:\WINDOWS\system32\affv7018p6now.sys
Tyhjennä roskis
Käynnistä uudelleen.
Hae eScan -> http://koti.mbnet.fi/pattaya1/escanmwav.htm .
Asenna, päivitä, skannaa sivulla olevien ohjeiden mukaan. Lähetä sitten "örkkitulokset" tänne (ohje tuolla sivulla, alin kuva ja sen yläpuolella oleva teksti). Lähetä myös uusi HjT-loki.
Ei HjT-lokeja tms. yksityisviestillä!
|
|
