|
|
|
Keskustelualueet
Keskustelualueet
|
|
|
onko mulla jokin viirus koneella, kun....
|
|
|
albertto
Junior Member
|
27. kesäkuuta 2007 @ 19:47 |
Linkki tähän viestiin
|
|
explorer.exe ilmottaa sovellusvirhettä koko ajan...
käsky osoitteessa 0x7c918fea viittasi muistiin osoitteessa 0x2b323186. muisti ei voi olla written
HELP...
|
|
albertto
Junior Member
|
27. kesäkuuta 2007 @ 21:06 |
Linkki tähän viestiin
|
tässä olis HjT loki
Logfile of HijackThis v1.99.1
Scan saved at 1:05:15, on 28.6.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\ULI5289\ALi5289.exe
C:\Program Files\ULI5289\JMAP5289.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\allu\Työpöytä\voimailu videot\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {36645342-9475-2663-166A-466739207346} - (no file)
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO.dll
O2 - BHO: Image Helper - {64D712D1-84D9-281C-CE7D-32439D631863} - (no file)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ALi5289] C:\Program Files\ULI5289\ALi5289.exe
O4 - HKLM\..\Run: [JMAP5289] C:\Program Files\ULI5289\JMAP5289.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8
O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4CCA4E80-9259-11D9-AC6E-444553544200} (FixController Control) - http://h30155.www3.hp.com/ediags/dd/inst...llMgr_v01_5.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by109fd.bay109.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdat...b?1122481745233
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupd...b?1133517372306
O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} (F-Secure Online Scanner) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect -palvelu (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
|
|
Auttaja
Suspended permanently
|
28. kesäkuuta 2007 @ 07:09 |
Linkki tähän viestiin
|
Tallenna nämä ohjeet teksitiedostoon sillä et voi lukea niitä muuten vikasietotilassa.
==========
Avaa HijackThis merkkaa seuraavat rivi(t) ja paina fix checked, sulje muut ohjelmat siksi aikaa.
O2 - BHO: (no name) - {36645342-9475-2663-166A-466739207346} - (no file)
O2 - BHO: Image Helper - {64D712D1-84D9-281C-CE7D-32439D631863} - (no file)
Tässä ohje miten merkataan:
==========
1,Lataa AVG Anti-Spyware 7.5 ja tallenna ohjelma työpöydällesi. Jos sinulla on jo kyseinen ohjelma siirry suoraan kohtaan 2!
[*]Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa.
[*]Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää.
2. [*]Käynnistä AVG eAnti-Spyware.
[*]Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta.
[*]Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa.
[*]Paina hetken kuluttua uudestaan "Start Update" , jos päivitykset eivät heti onnistu
[*]Jos automaattipäivitys ei jostain syystä toimi, niin tunnisteet voi ladata manuaalisesti http://www.ewido.net/en/download/updates/ -linkin takaa.
[*]Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti.
[*]Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine".
[*]Sitten "Reports" valikon alta:a
[*]Laita täppi kohtaan "Automatically generate report after every scan"
[*]Ota täppi pois kohdasta"Only if threats were found"
[*]Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa
[*]"Resident shield is", muuta tila active:sta inactive:ksi
[*]Sulje ohjelma, ÄLÄ skannaa vielä.
Käynnistä tietokone vikasietotilaan:
HUOM! Älä käytä muita ohjelmia AVG skannauksen aikana, tämä saattaa häiritä skannausta.
[*]Kun vikasietotilassa, käynnistä AVG Anti-Spyware.
[*]Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan".
[*]AVG aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa.
Kun skannaus on valmis:
TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions"
[*]Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta.
[*]Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions"
[*]Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta.
[*]Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle.
[*]Sulje ohjelma, käynnistä kone normaalisti ja lähetä AVG:n raportti viestiketjuusi.
==========
Tämä jos tunnet tietokoneesi olevan hitaan puoleinen, etkä ole eheyttänyt pitkään aikaan:
Avaa Oma tietokone
-> Tee seuraava toimenpide kaikille Paikallisille levyille
==========
Lataa CCleaner ja asenna se:
Avaa "Options", sieltä "Language" ja valitse "Suomi (Finnish)"
Avaa "Virheet" kohta, paina "Etsi rekisterin virheitä", paina "Korjaa valitut rekisterin virheet..". Paina "Kyllä", kun ohjelma kysyy "Haluatko varmuuskopioida muutokset rekisteriin", tallenna tiedosto esim. työpöydälle.
Avaa "Puhdistaja", paina "Tutki" ja tämän jälkeen "Aja Ccleaner". Puhdista väliaikaistiedostot ja -kansiot ohjelmalla säännöllisesti.
==========
Jos sinulla ei ole tätä java versiota (6.1): Vanha java saastuttaa helposti koneesi!
Javan päivitys ja välimuistin tyhjennys:
1. Klikkaa Käynnistä -> Ohjauspaneeli ja tupla-klikkaa Lisää tai poista sovellus Ohjauspaneelissa.
2. Etsi listasta kaikki entiset Java versiosi. (J2SE Runtime Environment.... )
Niissä pitäisi olla seuraava kuva vieressä: 
3. Valitse kaikki entiset Java versiosi ja valitse Poista.
4. Asenna uusin Java päivitys seuraavasta linkistä..
5. Käynnistä kone uudelleen asennuksen jälkeen:
http://java.sun.com/javase/downloads/index.jsp
tai http://www.filehippo.com/download_java_runtime/
Rullaa alas kohteeseen Java Runtime Environment (JRE) 6u1
Paina Download
Ruksaa Accept, ota offline installation, tallenna vaikka työpöydälle ja asenna se.
6. Käynnistyksen jälkeen, mene takaisin Ohjauspaneeliin ja avaa Java asetuksesi (Muita Ohjauspaneelin asetuksia -> Java kahvikuppi).
7. General Settings -osion alla, vedä liukusäädintä (Disk Space) pienemmälle, ja klikkaa Delete Files -nappia.
(Jotkut javapohjaiset ohjelmat saattavat tarvita enemmän levytilaa.
Jos huomaat säädön pienentämisen jälkeen koneessa hitautta, siirrä liukusäädintä isommalle).
8. Varmista että kaikki kaksi valintaa ovat rastitettuja:
*Applications and Applets
*Trace and Log Files
Ja paina OK -nappia
9. Klikkaa OK "Temporary Files Settings" -ikkunassasi.
10. Klikkaa OK jättääksesi Java asetusikkunasi.
==========
Uusi HijackThis logi ja AVG as raportti, onko ongelmia?
|
|
albertto
Junior Member
|
28. kesäkuuta 2007 @ 19:06 |
Linkki tähän viestiin
|
olipas homma, mutta nyt on tehty...
täsä olisi se AVG loki
+ Created at: 22:56:50 28.6.2007
+ Scan result:
C:\Program Files\ewido anti-spyware 4.0\Patch.exe -> Not-A-Virus.Hacktool.Crack : Cleaned with backup (quarantined).
C:\Documents and Settings\allu\Cookies\allu@microsoftwga.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\allu\Cookies\allu@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\allu\Cookies\allu@paypal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\allu\Cookies\allu@adtech[2].txt -> TrackingCookie.Adtech : Cleaned.
C:\Documents and Settings\allu\Cookies\allu@advertising[1].txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\allu\Cookies\allu@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\allu\Cookies\allu@doubleclick[2].txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\allu\Cookies\allu@e-2dj6wjkywoajoko.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\allu\Cookies\allu@e-2dj6wjl4knajoeq.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\allu\Cookies\allu@e-2dj6wjlicnc5wcq.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\allu\Cookies\allu@e-2dj6wjnyoiazcep.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\allu\Cookies\allu@komtrack[2].txt -> TrackingCookie.Komtrack : Cleaned.
C:\Documents and Settings\allu\Cookies\allu@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.
C:\Documents and Settings\allu\Cookies\allu@ssl-hints.netflame[1].txt -> TrackingCookie.Netflame : Cleaned.
C:\Documents and Settings\allu\Cookies\allu@overture[1].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\allu\Cookies\allu@www.paypal[1].txt -> TrackingCookie.Paypal : Cleaned.
C:\Documents and Settings\allu\Cookies\allu@bs.serving-sys[1].txt -> TrackingCookie.Serving-sys : Cleaned.
C:\Documents and Settings\allu\Cookies\allu@serving-sys[1].txt -> TrackingCookie.Serving-sys : Cleaned.
C:\Documents and Settings\allu\Cookies\allu@statistik-gallup[1].txt -> TrackingCookie.Statistik-gallup : Cleaned.
C:\Documents and Settings\allu\Cookies\allu@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\allu\Cookies\allu@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Cleaned.
C:\Documents and Settings\allu\Cookies\allu@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\Documents and Settings\allu\Cookies\allu@m.webtrends[2].txt -> TrackingCookie.Webtrends : Cleaned.
C:\WINDOWS\winhp32cln.exe -> Trojan.Agent.alw : Cleaned with backup (quarantined).
::Report end
|
|
albertto
Junior Member
|
28. kesäkuuta 2007 @ 19:06 |
Linkki tähän viestiin
|
|
vielä sama homma esiintyy koko ajan?????
|
|
Auttaja
Suspended permanently
|
28. kesäkuuta 2007 @ 19:10 |
Linkki tähän viestiin
|
|
|
albertto
Junior Member
|
28. kesäkuuta 2007 @ 19:25 |
Linkki tähän viestiin
|
ComboFix 07-06-18.2
"allu" - 2007-06-28 23:13:08 - Service Pack 2 NTFS
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\as.txt
C:\Program Files\Common Files\microsoft shared\web folders\ibm00001.dll
C:\Program Files\Common Files\microsoft shared\web folders\ibm00002.dll
C:\WINDOWS\876029.exe
C:\WINDOWS\drsmartload.dat
C:\WINDOWS\system32\8_exception.nls
C:\WINDOWS\whcc-giant.exe
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
-------\LEGACY_CMDSERVICE
-------\EXAMPLE
-------\Runtime
((((((((((((((((((((((((( Files Created from 2007-05-28 to 2007-06-28 )))))))))))))))))))))))))))))))
2007-06-28 23:19 3,712 --a------ C:\DOCUME~1\allu\jm5289.sys
2007-06-28 23:11 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-06-28 21:48 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-06-27 21:17 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
2007-06-26 20:23 32,584 --a------ C:\WINDOWS\as.exe
2007-06-21 08:54 <KANSIO> d-------- C:\WINDOWS\system32\SoftwareDistribution
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-06-28 09:22:33 -------- d-----w C:\Program Files\ewido anti-spyware 4.0
2007-06-27 22:34:41 -------- d-----w C:\DOCUME~1\allu\APPLIC~1\Lavasoft
2007-06-27 21:50:25 -------- d-----w C:\Program Files\DC++
2007-06-27 14:36:36 -------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-06-21 19:42:17 -------- d-----w C:\Program Files\mIRC
2007-05-16 15:14:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-13 09:25:07 51,200 ----a-w C:\WINDOWS\dsb.exe
2007-05-11 00:02:30 -------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-05-06 20:05:11 77,312 ----a-w C:\WINDOWS\system32\abnmgopq.exe
2007-04-25 14:22:38 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
2007-04-18 16:14:18 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-16 19:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll
2007-04-16 19:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-16 19:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-04-16 19:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-04-16 19:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-04-16 19:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-04-16 19:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-16 19:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
2007-04-16 19:44:20 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll
2007-04-16 19:44:18 208,248 ----a-w C:\WINDOWS\system32\muweb.dll
2007-03-29 09:42:40 56,228 ----a-w C:\WINDOWS\system32\perfc00B.dat
2007-03-29 09:42:40 340,422 ----a-w C:\WINDOWS\system32\perfh00B.dat
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-01-12 21:38]
{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}=C:\Program Files\BitComet\tools\BitCometBHO.dll [2007-01-11 18:05]
{BDF3E430-B101-42AD-A544-FADC6B084872}=C:\Program Files\Norton AntiVirus\NavShExt.dll [2005-11-28 15:58]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ALi5289"="C:\Program Files\ULI5289\ALi5289.exe" [2004-09-16 17:49]
"JMAP5289"="C:\Program Files\ULI5289\JMAP5289.exe" [2004-07-19 15:37]
"SoundMan"="SOUNDMAN.EXE" [2004-07-27 17:01 C:\WINDOWS\SOUNDMAN.EXE]
"Zone Labs Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2006-08-23 23:38]
"SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" [2005-06-08 03:38]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-01-29 13:06]
"nwiz"="nwiz.exe" [2006-03-09 15:29 C:\WINDOWS\system32\nwiz.exe]
"Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2006-12-16 18:42]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-01-02 13:19]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-03-08 17:04]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 12:25]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-03-09 15:29]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 19:24]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2006-01-24 21:24]
"PopUpStopperFreeEdition"="C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe" [2003-04-29 11:40]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 02:12]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"slbado"=
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" /background
"slbado"=C:\WINDOWS\System32\slbado.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run]
"7H28X9M91L"=C:\WINDOWS\winlogon32.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]
"dmidhu"=C:\WINDOWS\System32\dmidhu.exe
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer\Run]
"slbado"=C:\WINDOWS\System32\slbado.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [2007-05-30 15:29]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Driver]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Guard]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\NetDDEsrv]
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - netsvcs
NtmlSvc
Contents of the 'Scheduled Tasks' folder
2007-06-22 20:05:03 C:\WINDOWS\tasks\Norton AntiVirus - Tarkista tietokone - allu.job
**************************************************************************
catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-28 23:19:30
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
Completion time: 2007-06-28 23:22:45 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-06-28 23:22
--- E O F ---
tällanen tuli?????
|
|
albertto
Junior Member
|
28. kesäkuuta 2007 @ 19:26 |
Linkki tähän viestiin
|
|
heiii... nyt toimii taas... KIITOKSET!!!!!!
|
|
Auttaja
Suspended permanently
|
28. kesäkuuta 2007 @ 19:41 |
Linkki tähän viestiin
|
Avaa Notepad ja kopioi/liitä allaoleva teksti sinne:
Lainaus:
File::
C:\Documents and Settings\allu\jm5289.sys
C:\WINDOWS\as.exe
C:\WINDOWS\dsb.exe
C:\WINDOWS\system32\abnmgopq.exe
C:\WINDOWS\System32\slbado.exe
C:\WINDOWS\winlogon32.exe
C:\WINDOWS\System32\dmidhu.exe
Tallenna se nimellä ComboFix-Do.txt
Sitten raahaa ComboFix-Do.txt ComboFix.exeen kuten alla.
Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
=========
Kaspersky online-skanneri
Skannaa koneesi Kaspersky Online Skannerilla
Sinulta kysytään sallitko ActiveX -komponentin asentamisen Kasperskyltä, klikkaa Kyllä.
[*] Ohjelma käynnistyy ja aloittaa viimeisimpien tunnistetiedostojen lataamisen.
[*] Kun skanneri on asennettu ja tunnistetiedot ladattu, klikkaa Next.
[*] Klikkaa nyt asetuksia, Scan Settings
[*] Tarkista asetuksista, että seuraavat ovat valittuina:
o Scan using the following Anti-Virus database:
+ Extended (Jos valittavissa, muuten valitse Standard)
o Scan Options:
+ Scan Archives
+ Scan Mail Bases
[*] Klikkaa OK
[*] Nyt valitse "select a target to scan" otsikon alta Oma Tietokone, My Computer
[*] Skannaus vie aikaa, joten ole kärsivällinen. Kun skannaus on valmis saat ilmoituksen, jos koneesi on saastunut.
[*] Klikkaa nyt Save as Text-painiketta.
[*] Tallenna tiedosto työpöydällesi.
[*] Kopioi ja Liitä tiedoston sisältö seuraavaan vastaukseesi.
viel uusi HJTlogi
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 28. kesäkuuta 2007 @ 19:41
|
|
albertto
Junior Member
|
28. kesäkuuta 2007 @ 20:36 |
Linkki tähän viestiin
|
ComboFix 07-06-18.2 - C:\Documents and Settings\allu\Ty?p?yt?\ComboFix.exe
"allu" - 2007-06-29 0:24:50 - Service Pack 2 NTFS
Command switches used :: C:\Documents and Settings\allu\ComboFix-Do.txt
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\WINDOWS\as.exe
C:\WINDOWS\dsb.exe
C:\WINDOWS\system32\abnmgopq.exe
((((((((((((((((((((((((( Files Created from 2007-05-28 to 2007-06-28 )))))))))))))))))))))))))))))))
2007-06-29 00:30 3,712 --a------ C:\DOCUME~1\allu\jm5289.sys
2007-06-28 23:11 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-06-28 21:48 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-06-27 21:17 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
2007-06-21 08:54 <KANSIO> d-------- C:\WINDOWS\system32\SoftwareDistribution
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-06-28 09:22:33 -------- d-----w C:\Program Files\ewido anti-spyware 4.0
2007-06-27 22:34:41 -------- d-----w C:\DOCUME~1\allu\APPLIC~1\Lavasoft
2007-06-27 21:50:25 -------- d-----w C:\Program Files\DC++
2007-06-27 14:36:36 -------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-06-21 19:42:17 -------- d-----w C:\Program Files\mIRC
2007-05-16 15:14:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-11 00:02:30 -------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-04-25 14:22:38 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
2007-04-18 16:14:18 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-16 19:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll
2007-04-16 19:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-16 19:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-04-16 19:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-04-16 19:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-04-16 19:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-04-16 19:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-16 19:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
2007-04-16 19:44:20 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll
2007-04-16 19:44:18 208,248 ----a-w C:\WINDOWS\system32\muweb.dll
2007-03-29 09:42:40 56,228 ----a-w C:\WINDOWS\system32\perfc00B.dat
2007-03-29 09:42:40 340,422 ----a-w C:\WINDOWS\system32\perfh00B.dat
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-01-12 21:38]
{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}=C:\Program Files\BitComet\tools\BitCometBHO.dll [2007-01-11 18:05]
{BDF3E430-B101-42AD-A544-FADC6B084872}=C:\Program Files\Norton AntiVirus\NavShExt.dll [2005-11-28 15:58]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ALi5289"="C:\Program Files\ULI5289\ALi5289.exe" [2004-09-16 17:49]
"JMAP5289"="C:\Program Files\ULI5289\JMAP5289.exe" [2004-07-19 15:37]
"SoundMan"="SOUNDMAN.EXE" [2004-07-27 17:01 C:\WINDOWS\SOUNDMAN.EXE]
"SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" [2005-06-08 03:38]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-01-29 13:06]
"nwiz"="nwiz.exe" [2006-03-09 15:29 C:\WINDOWS\system32\nwiz.exe]
"Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2006-12-16 18:42]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-01-02 13:19]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-03-08 17:04]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 12:25]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-03-09 15:29]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 19:24]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2006-01-24 21:24]
"PopUpStopperFreeEdition"="C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe" [2003-04-29 11:40]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 02:12]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"slbado"=
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" /background
"slbado"=C:\WINDOWS\System32\slbado.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run]
"7H28X9M91L"=C:\WINDOWS\winlogon32.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]
"dmidhu"=C:\WINDOWS\System32\dmidhu.exe
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer\Run]
"slbado"=C:\WINDOWS\System32\slbado.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [2007-05-30 15:29]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Driver]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Guard]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\NetDDEsrv]
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - netsvcs
NtmlSvc
Contents of the 'Scheduled Tasks' folder
2007-06-22 20:05:03 C:\WINDOWS\tasks\Norton AntiVirus - Tarkista tietokone - allu.job
**************************************************************************
catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-29 00:30:27
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
Completion time: 2007-06-29 0:34:56 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-06-29 00:34
C:\ComboFix2.txt ... 2007-06-28 23:22
--- E O F ---
|
|
albertto
Junior Member
|
28. kesäkuuta 2007 @ 21:36 |
Linkki tähän viestiin
|
|
tässä kaspersky loki
Friday, June 29, 2007 1:31:13 AM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.0
Kaspersky Anti-Virus database last update: 28/06/2007
Kaspersky Anti-Virus database records: 355159
Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true
Scan Target My Computer
A:\
C:\
D:\
E:\
F:\
G:\
H:\
I:\
Scan Statistics
Total number of scanned objects 43668
Number of viruses found 27
Number of infected objects 81
Number of suspicious objects 4
Duration of the scan process 00:47:43
Infected Object Name Virus Name Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\2007-06-29_Log.ALUSchedulerSvc.LiveUpdate Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\01A80004.VBN.mwt Infected: Backdoor.Win32.Codbot.bm skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\01A80005.VBN.mwt Infected: Backdoor.Win32.PoeBot.b skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\080C0000.VBN.mwt Infected: Backdoor.Win32.PoeBot.b skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08380000.VBN.mwt Infected: Backdoor.Win32.Codbot.bm skipped
C:\Documents and Settings\allu\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\allu\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\allu\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\allu\Local Settings\Sivuhistoria\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\allu\Local Settings\Sivuhistoria\History.IE5\MSHist012007062920070630\index.dat Object is locked skipped
C:\Documents and Settings\allu\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\allu\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\allu\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Sivuhistoria\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDALRT.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDCON.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDDBG.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDFW.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDIDS.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDSYS.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPPolicy.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPStart.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPStop.log Object is locked skipped
C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616 skipped
C:\Program Files\Norton AntiVirus\AVApp.log Object is locked skipped
C:\Program Files\Norton AntiVirus\AVError.log Object is locked skipped
C:\Program Files\Norton AntiVirus\AVVirus.log Object is locked skipped
C:\Program Files\Norton AntiVirus\Quarantine\07A12453.dll Infected: Trojan-Clicker.Win32.Small.kj skipped
C:\Program Files\Norton AntiVirus\Quarantine\084E5594.dll Infected: Trojan-Clicker.Win32.Small.kj skipped
C:\Program Files\Norton AntiVirus\Quarantine\08C7670F.dll Infected: Trojan-Clicker.Win32.Small.kj skipped
C:\Program Files\Norton AntiVirus\Quarantine\0A6448F2.exe Infected: Trojan-Downloader.Win32.Small.ekr skipped
C:\Program Files\Norton AntiVirus\Quarantine\0DDE7D0A.dll Suspicious: Packed.Win32.Morphine.a skipped
C:\Program Files\Norton AntiVirus\Quarantine\0EFB7542.sys Infected: Rootkit.Win32.Agent.dp skipped
C:\Program Files\Norton AntiVirus\Quarantine\119B6558.exe Infected: Trojan-Clicker.Win32.Small.kj skipped
C:\Program Files\Norton AntiVirus\Quarantine\14426CB2.tmp Infected: Trojan-Downloader.Win32.Murlo.en skipped
C:\Program Files\Norton AntiVirus\Quarantine\15915E8A.exe Infected: Trojan-Spy.Win32.BZub.in skipped
C:\Program Files\Norton AntiVirus\Quarantine\164563C4.exe Infected: Trojan-Spy.Win32.BZub.in skipped
C:\Program Files\Norton AntiVirus\Quarantine\16FE4FEC.tmp Infected: Email-Worm.Win32.Luder.a skipped
C:\Program Files\Norton AntiVirus\Quarantine\170C77DE.tmp Infected: Email-Worm.Win32.Luder.a skipped
C:\Program Files\Norton AntiVirus\Quarantine\17BC531C.tmp Infected: Trojan-Downloader.Win32.Small.dam skipped
C:\Program Files\Norton AntiVirus\Quarantine\17D94CFB.tmp Infected: Email-Worm.Win32.Zhelatin.a skipped
C:\Program Files\Norton AntiVirus\Quarantine\17E020F4.tmp Infected: Email-Worm.Win32.Zhelatin.a skipped
C:\Program Files\Norton AntiVirus\Quarantine\17E674ED.tmp Infected: Email-Worm.Win32.Zhelatin.a skipped
C:\Program Files\Norton AntiVirus\Quarantine\17F072E2.tmp Infected: Email-Worm.Win32.Zhelatin.a skipped
C:\Program Files\Norton AntiVirus\Quarantine\181B14B4.tmp Infected: Trojan-Downloader.Win32.Small.ciw skipped
C:\Program Files\Norton AntiVirus\Quarantine\1859326F.tmp Infected: Email-Worm.Win32.Zhelatin.h skipped
C:\Program Files\Norton AntiVirus\Quarantine\185F0668.tmp Infected: Email-Worm.Win32.Zhelatin.h skipped
C:\Program Files\Norton AntiVirus\Quarantine\186003C7.exe Infected: Backdoor.Win32.Small.na skipped
C:\Program Files\Norton AntiVirus\Quarantine\18632DC4.exe Infected: Trojan-Dropper.Win32.Small.avu skipped
C:\Program Files\Norton AntiVirus\Quarantine\18730253.tmp Infected: Email-Worm.Win32.Zhelatin.k skipped
C:\Program Files\Norton AntiVirus\Quarantine\18AE7612.tmp Infected: Trojan-Downloader.Win32.Tibs.jr skipped
C:\Program Files\Norton AntiVirus\Quarantine\1B8E77FA.tmp Infected: Trojan-Downloader.Win32.Murlo.en skipped
C:\Program Files\Norton AntiVirus\Quarantine\1B9121F6.tmp Infected: Trojan-Downloader.Win32.Murlo.en skipped
C:\Program Files\Norton AntiVirus\Quarantine\222635AE.tmp Infected: Trojan-Downloader.Win32.Murlo.en skipped
C:\Program Files\Norton AntiVirus\Quarantine\2745305A.exe Infected: Trojan-Downloader.Win32.Small.ekq skipped
C:\Program Files\Norton AntiVirus\Quarantine\28926AEC.exe Infected: Trojan-Clicker.Win32.Small.kj skipped
C:\Program Files\Norton AntiVirus\Quarantine\30096BCE.tmp Infected: Email-Worm.Win32.Luder.a skipped
C:\Program Files\Norton AntiVirus\Quarantine\30745557.tmp Infected: Email-Worm.Win32.Luder.a skipped
C:\Program Files\Norton AntiVirus\Quarantine\30ED66D2.tmp Infected: Trojan-Downloader.Win32.Small.dam skipped
C:\Program Files\Norton AntiVirus\Quarantine\310162BD.tmp Infected: Email-Worm.Win32.Zhelatin.a skipped
C:\Program Files\Norton AntiVirus\Quarantine\310736B5.tmp Infected: Email-Worm.Win32.Zhelatin.a skipped
C:\Program Files\Norton AntiVirus\Quarantine\310B60B2.tmp Infected: Email-Worm.Win32.Zhelatin.a skipped
C:\Program Files\Norton AntiVirus\Quarantine\311E5C9C.tmp Infected: Email-Worm.Win32.Zhelatin.a skipped
C:\Program Files\Norton AntiVirus\Quarantine\313F0078.tmp Infected: Trojan-Downloader.Win32.Small.ciw skipped
C:\Program Files\Norton AntiVirus\Quarantine\31660878.exe Suspicious: Packed.Win32.Morphine.a skipped
C:\Program Files\Norton AntiVirus\Quarantine\3166784D.tmp Infected: Email-Worm.Win32.Zhelatin.h skipped
C:\Program Files\Norton AntiVirus\Quarantine\316D4C46.tmp Infected: Email-Worm.Win32.Zhelatin.h skipped
C:\Program Files\Norton AntiVirus\Quarantine\31764A3B.tmp Infected: Email-Worm.Win32.Zhelatin.k skipped
C:\Program Files\Norton AntiVirus\Quarantine\31A16C0D.tmp Infected: Trojan-Downloader.Win32.Tibs.jr skipped
C:\Program Files\Norton AntiVirus\Quarantine\32BE7E71.exe Infected: Trojan-Spy.Win32.BZub.in skipped
C:\Program Files\Norton AntiVirus\Quarantine\34941B32.exe Infected: Trojan-Spy.Win32.BZub.in skipped
C:\Program Files\Norton AntiVirus\Quarantine\4DE0773E.tmp Infected: Email-Worm.Win32.Luder.a skipped
C:\Program Files\Norton AntiVirus\Quarantine\4DF0492C.tmp Infected: Email-Worm.Win32.Luder.a skipped
C:\Program Files\Norton AntiVirus\Quarantine\4EB42054.tmp Infected: Trojan-Downloader.Win32.Small.dam skipped
C:\Program Files\Norton AntiVirus\Quarantine\4ECB463B.tmp Infected: Email-Worm.Win32.Zhelatin.a skipped
C:\Program Files\Norton AntiVirus\Quarantine\4ED11A34.tmp Infected: Email-Worm.Win32.Zhelatin.a skipped
C:\Program Files\Norton AntiVirus\Quarantine\4EDB1829.tmp Infected: Email-Worm.Win32.Zhelatin.a skipped
C:\Program Files\Norton AntiVirus\Quarantine\4EE8401B.tmp Infected: Email-Worm.Win32.Zhelatin.a skipped
C:\Program Files\Norton AntiVirus\Quarantine\4F160BE8.tmp Infected: Trojan-Downloader.Win32.Small.ciw skipped
C:\Program Files\Norton AntiVirus\Quarantine\4F712384.tmp Infected: Email-Worm.Win32.Zhelatin.h skipped
C:\Program Files\Norton AntiVirus\Quarantine\4F7B2179.tmp Infected: Email-Worm.Win32.Zhelatin.h skipped
C:\Program Files\Norton AntiVirus\Quarantine\4F8B7367.tmp Infected: Email-Worm.Win32.Zhelatin.k skipped
C:\Program Files\Norton AntiVirus\Quarantine\4FC66726.tmp Infected: Trojan-Downloader.Win32.Tibs.jr skipped
C:\Program Files\Norton AntiVirus\Quarantine\5BEE196F.sys Infected: Rootkit.Win32.Agent.dw skipped
C:\Program Files\Norton AntiVirus\Quarantine\5CAC1C9F.sys Infected: Rootkit.Win32.Agent.el skipped
C:\Program Files\Norton AntiVirus\Quarantine\63925707.tmp Infected: Rootkit.Win32.Agent.dp skipped
C:\Program Files\Norton AntiVirus\Quarantine\652148FC.dll Infected: Trojan-Spy.Win32.Agent.ir skipped
C:\Program Files\Norton AntiVirus\Quarantine\652472F9.exe/EXE-file Infected: Trojan-Spy.Win32.Agent.ir skipped
C:\Program Files\Norton AntiVirus\Quarantine\652472F9.exe Embedded EXE: infected - 1 skipped
C:\Program Files\Norton AntiVirus\Quarantine\652472F9.exe UPX: infected - 1 skipped
C:\Program Files\Norton AntiVirus\Quarantine\652472F9.exe CryptFF: infected - 1 skipped
C:\Program Files\Norton AntiVirus\Quarantine\6A3819CA.dll Infected: Trojan-Spy.Win32.BZub.in skipped
C:\Program Files\Norton AntiVirus\Quarantine\70B36AA9.dll Infected: Trojan-Spy.Win32.BZub.in skipped
C:\Program Files\Norton AntiVirus\Quarantine\75DA5CE9.exe Infected: Backdoor.Win32.Small.na skipped
C:\Program Files\Norton AntiVirus\Quarantine\761E4E9E.exe Infected: Trojan-Downloader.Win32.Small.ekr skipped
C:\Program Files\Norton AntiVirus\Quarantine\7797452C.exe Infected: Trojan-Spy.Win32.BZub.in skipped
C:\QooBox\Quarantine\C\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.dll.vir Infected: Trojan-PSW.Win32.Agent.lu skipped
C:\QooBox\Quarantine\C\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00002.dll.vir Infected: Trojan-PSW.Win32.Sinowal.m skipped
C:\QooBox\Quarantine\C\WINDOWS\as.exe.vir Infected: Trojan.Win32.Pakes skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\abnmgopq.exe.vir Infected: Trojan-Spy.Win32.BZub.jr skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{126D3530-07FC-4613-B536-7E448B284647}\RP734\A0200513.exe Infected: Trojan.Win32.Agent.alw skipped
C:\System Volume Information\_restore{126D3530-07FC-4613-B536-7E448B284647}\RP734\A0200525.dll Infected: Trojan-PSW.Win32.Agent.lu skipped
C:\System Volume Information\_restore{126D3530-07FC-4613-B536-7E448B284647}\RP734\A0200526.dll Infected: Trojan-PSW.Win32.Sinowal.m skipped
C:\System Volume Information\_restore{126D3530-07FC-4613-B536-7E448B284647}\RP735\A0200586.exe Infected: Trojan.Win32.Pakes skipped
C:\System Volume Information\_restore{126D3530-07FC-4613-B536-7E448B284647}\RP735\A0200587.exe Infected: Trojan-Spy.Win32.BZub.jr skipped
C:\System Volume Information\_restore{126D3530-07FC-4613-B536-7E448B284647}\RP735\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Internet Logs\ALLU-QPXEF5WQSG.ldb Object is locked skipped
C:\WINDOWS\Internet Logs\fwdbglog.txt Object is locked skipped
C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped
C:\WINDOWS\Internet Logs\IAMDB.RDB Object is locked skipped
C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{E000ADC4-867C-4192-AF1A-1D3EC862BD3C}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped
C:\WINDOWS\system32\config\OSession.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\ZLT0413e.TMP Object is locked skipped
C:\WINDOWS\Temp\ZLT0415e.TMP Object is locked skipped
C:\WINDOWS\update.html Suspicious: Packed.Win32.Morphine.a skipped
C:\WINDOWS\update2.html Suspicious: Packed.Win32.Morphine.a skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
F:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
F:\System Volume Information\_restore{126D3530-07FC-4613-B536-7E448B284647}\RP735\change.log Object is locked skipped
G:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
G:\System Volume Information\_restore{126D3530-07FC-4613-B536-7E448B284647}\RP735\change.log Object is locked skipped
H:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
H:\System Volume Information\_restore{126D3530-07FC-4613-B536-7E448B284647}\RP735\change.log Object is locked skipped
I:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
I:\System Volume Information\_restore{126D3530-07FC-4613-B536-7E448B284647}\RP735\change.log Object is locked skipped
Scan process completed.
|
|
albertto
Junior Member
|
28. kesäkuuta 2007 @ 21:37 |
Linkki tähän viestiin
|
.. ja HjT loki...
Logfile of HijackThis v1.99.1
Scan saved at 1:36:43, on 29.6.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\ULI5289\ALi5289.exe
C:\Program Files\ULI5289\JMAP5289.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\allu\Työpöytä\voimailu videot\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ALi5289] C:\Program Files\ULI5289\ALi5289.exe
O4 - HKLM\..\Run: [JMAP5289] C:\Program Files\ULI5289\JMAP5289.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8
O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4CCA4E80-9259-11D9-AC6E-444553544200} (FixController Control) - http://h30155.www3.hp.com/ediags/dd/inst...llMgr_v01_5.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by109fd.bay109.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdat...b?1122481745233
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupd...b?1133517372306
O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} (F-Secure Online Scanner) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect -palvelu (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
|
|
Mainos
|
|
|
|
Auttaja
Suspended permanently
|
30. kesäkuuta 2007 @ 16:00 |
Linkki tähän viestiin
|
Ajetaanpas blacklightia.
Lataa ja tallenna Blacklight työpöydällesi;
Tupla-klikkaa fsbl.exe, hyväksy sopimus, klikkaa -> Scan, sitten -> Next
Näet listan kaikesta mitä löytyi. Työpöydällesi myös ilmestyy loki jonka nimi on fsbl.xxxxxxx.log (xxxxxxx;n tilalla on luultavimmin numeroita).
Kopioi ja liitä tämä loki seuraavaan vastaukseesi. Älä valitse "Rename" optiota vielä! Haluamme nähdä login ensin, koska hyviä tiedostoja saattaa olla mukana, kuten "wbemtest.exe".
|
|
