|
|
|
Keskustelualueet
Keskustelualueet
|
|
|
HJT Logi
|
|
|
inky89
Newbie
|
26. toukokuuta 2008 @ 14:21 |
Linkki tähän viestiin
|
Eli Winkkari alkanu mesoamaan monen ohjelman asennuksessa "This installation package could not be opened. Verify that the package exists and that you can access it, blablabla"
HJT Logi:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:15:55, on 26.5.2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\CTHELPER.EXE
C:\Windows\System32\CTXFIHLP.EXE
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Windows\System32\CTXFISPI.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\system32\conime.exe
D:\Softat\mIRC\mirc.exe
C:\Program Files\uTorrent\uTorrent.exe
D:\Softat\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/sh...ash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Creative ALchemy AL6 Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Unknown owner - C:\Program Files\Common Files\LogiShrd\Bluetooth\LBTServ.exe (file missing)
--
End of file - 4708 bytes
|
|
Hujo
Suspended permanently
|
26. toukokuuta 2008 @ 14:26 |
Linkki tähän viestiin
|
1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
combofix1
combofix2
2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
===========
Lataa Malwarebytes' Anti-Malware työpöydällesi.
1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
8. Lähetä lokin sisältö seuraavassa viestissäsi.
Voiko tietsikka koskaan toimia?
|
|
inky89
Newbie
|
26. toukokuuta 2008 @ 14:35 |
Linkki tähän viestiin
|
Combofix Log:
ComboFix 08-05-25.4 - inky` 2008-05-26 14:28:20.1 - NTFSx86
Microsoft® Windows Vista? Ultimate 6.0.6000.0.1252.1.1033.18.1980 [GMT 3:00]
Running from: C:\Users\inky`\Desktop\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((( Files Created from 2008-04-26 to 2008-05-26 )))))))))))))))))))))))))))))))
.
2008-05-26 14:25 . 2008-05-26 14:25 <DIR> d-------- C:\VundoFix Backups
2008-05-26 14:15 . 2008-05-26 14:15 <DIR> d-------- C:\Program Files\Trend Micro
2008-05-25 21:36 . 2008-05-25 21:37 <DIR> d-------- C:\Program Files\Java
2008-05-25 21:36 . 2008-05-25 21:36 <DIR> d-------- C:\Program Files\Common Files\Java
2008-05-25 21:20 . 2008-05-25 21:20 <DIR> d-------- C:\Program Files\Logitech
2008-05-25 21:20 . 2008-05-02 02:39 170,512 --a------ C:\Windows\System32\kemutb.dll
2008-05-25 21:20 . 2008-05-02 02:39 145,936 --a------ C:\Windows\System32\KemUtil.dll
2008-05-25 21:20 . 2008-05-02 02:40 117,264 --a------ C:\Windows\System32\KemWnd.dll
2008-05-25 21:20 . 2008-05-02 02:40 84,496 --a------ C:\Windows\System32\KemXML.dll
2008-05-25 14:47 . 2008-05-25 14:47 0 --a------ C:\Windows\nsreg.dat
2008-05-25 10:06 . 2008-05-24 23:14 <DIR> d-------- C:\Windows\Panther
2008-05-25 10:06 . 2008-05-25 10:06 <DIR> d--hs---- C:\Boot
2008-05-25 10:06 . 2008-01-09 01:32 443,912 -rahs---- C:\bootmgr
2008-05-25 10:06 . 2008-05-25 10:06 8,192 -ra-s---- C:\BOOTSECT.BAK
2008-05-25 10:05 . 2008-05-25 10:05 <DIR> d-------- C:\Windows\System32\OEM
2008-05-25 10:05 . 2007-03-16 19:40 59 -ra------ C:\Windows\DELL_VERSION
2008-05-25 02:13 . 2008-05-25 02:13 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
2008-05-25 02:11 . 2008-05-25 02:11 <DIR> d-------- C:\Windows\PCHEALTH
2008-05-25 02:05 . 2008-05-25 02:05 <DIR> d-------- C:\ProgramData\WLInstaller
2008-05-25 02:05 . 2008-05-25 02:11 <DIR> d-------- C:\Program Files\Windows Live
2008-05-25 02:05 . 2008-05-25 02:11 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2008-05-25 01:36 . 2008-05-25 01:36 <DIR> d-------- C:\Program Files\Winamp
2008-05-25 01:33 . 2008-05-25 01:33 <DIR> d-------- C:\Windows\System32\Macromed
2008-05-25 01:21 . 2008-05-25 02:59 1,080 --a------ C:\Windows\System32\settingsbkup.sfm
2008-05-25 01:21 . 2008-05-25 02:59 1,080 --a------ C:\Windows\System32\settings.sfm
2008-05-25 00:20 . 2008-05-25 00:20 <DIR> d-------- C:\Program Files\uTorrent
2008-05-25 00:17 . 2008-05-26 08:51 <DIR> d-------- C:\Windows\System32\drivers\Avg
2008-05-25 00:17 . 2008-05-25 00:17 <DIR> d-------- C:\ProgramData\Creative Labs
2008-05-25 00:17 . 2008-05-25 00:17 <DIR> d-------- C:\ProgramData\avg8
2008-05-25 00:17 . 2008-05-25 00:17 <DIR> d-------- C:\Program Files\AVG
2008-05-25 00:17 . 2008-05-25 00:17 96,520 --a------ C:\Windows\System32\drivers\avgldx86.sys
2008-05-25 00:17 . 2008-05-25 00:17 67,080 --a------ C:\Windows\System32\drivers\avgwfpx.sys
2008-05-25 00:17 . 2008-05-25 00:17 10,520 --a------ C:\Windows\System32\avgrsstx.dll
2008-05-25 00:03 . 2008-05-25 00:03 <DIR> d-------- C:\ProgramData\ATI
2008-05-25 00:00 . 2008-05-25 00:00 0 --a------ C:\Windows\ativpsrm.bin
2008-05-24 23:59 . 2008-05-25 02:59 55,300 --a------ C:\Windows\System32\BMXStateBkp-{00000001-00000000-00000001-00001102-00000005-00311102}.rfx
2008-05-24 23:59 . 2008-05-25 02:59 55,300 --a------ C:\Windows\System32\BMXState-{00000001-00000000-00000001-00001102-00000005-00311102}.rfx
2008-05-24 23:59 . 2008-05-25 02:59 788 --a------ C:\Windows\System32\DVCState-{00000001-00000000-00000001-00001102-00000005-00311102}.rfx
2008-05-24 23:54 . 2008-05-24 23:54 944,184 --a------ C:\Windows\System32\winload.exe
2008-05-24 23:54 . 2008-05-24 23:54 620,088 --a------ C:\Windows\System32\ci.dll
2008-05-24 23:54 . 2008-05-24 23:54 371,712 --a------ C:\Windows\System32\srcore.dll
2008-05-24 23:54 . 2008-05-24 23:54 313,856 --a------ C:\Windows\System32\rstrui.exe
2008-05-24 23:54 . 2008-05-24 23:54 40,960 --a------ C:\Windows\System32\srclient.dll
2008-05-24 23:54 . 2008-05-24 23:54 19,000 --a------ C:\Windows\System32\kd1394.dll
2008-05-24 23:54 . 2008-05-24 23:54 16,384 --a------ C:\Windows\System32\srdelayed.exe
2008-05-24 23:54 . 2008-05-24 23:54 7,168 --a------ C:\Windows\System32\f3ahvoas.dll
2008-05-24 23:54 . 2008-05-24 23:54 6,656 --a------ C:\Windows\System32\kbd106n.dll
2008-05-24 23:53 . 2008-05-24 23:53 2,027,008 --a------ C:\Windows\System32\win32k.sys
2008-05-24 23:53 . 2008-05-24 23:53 296,448 --a------ C:\Windows\System32\gdi32.dll
2008-05-24 23:53 . 2008-05-24 23:53 83,968 --a------ C:\Windows\System32\dnsrslvr.dll
2008-05-24 23:53 . 2008-05-24 23:53 53,760 --a------ C:\Windows\System32\drivers\hdaudbus.sys
2008-05-24 23:53 . 2008-05-24 23:53 24,576 --a------ C:\Windows\System32\dnscacheugc.exe
2008-05-24 23:37 . 2008-05-24 23:37 <DIR> d-------- C:\Program Files\OpenAL
2008-05-24 23:37 . 2008-05-24 23:37 413,696 --a------ C:\Windows\System32\wrap_oal.dll
2008-05-24 23:37 . 2008-05-24 23:37 110,592 --a------ C:\Windows\System32\OpenAL32.dll
2008-05-24 23:37 . 2007-02-26 15:24 94,208 --a------ C:\Windows\System32\cttele32.dll
2008-05-24 23:35 . 2008-05-24 23:37 <DIR> d-------- C:\Windows\System32\Data
2008-05-24 23:35 . 2007-08-28 10:22 108,544 --a------ C:\Windows\System32\APOMngr.DLL
2008-05-24 23:35 . 2007-05-28 11:28 69,120 --a------ C:\Windows\System32\CmdRtr.DLL
2008-05-24 23:35 . 2008-02-20 20:59 11,776 --a------ C:\Windows\INRES.DLL
2008-05-24 23:35 . 2008-02-20 20:58 10,240 --a------ C:\Windows\CTDCRES.DLL
2008-05-24 23:35 . 2008-02-20 20:58 3,072 --a------ C:\Windows\CTXFIRES.DLL
2008-05-24 23:35 . 2008-05-24 23:35 87 -rah----- C:\Windows\ctfile.rfc
2008-05-24 23:34 . 2008-05-25 00:18 <DIR> d-------- C:\ProgramData\Creative
2008-05-24 23:33 . 2008-05-24 23:38 <DIR> d-------- C:\Program Files\Creative
2008-05-24 23:33 . 2008-05-24 23:33 <DIR> d-------- C:\Program Files\Common Files\Creative Labs Shared
2008-05-24 23:33 . 2000-05-22 16:58 647,872 --------- C:\Windows\System32\Mscomct2.ocx
2008-05-24 23:33 . 2006-10-06 14:17 53,248 --------- C:\Windows\Ctregrun.exe
2008-05-24 23:32 . 2008-05-25 21:31 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2008-05-24 23:31 . 2008-05-25 21:38 <DIR> d--hs---- C:\Windows\Installer
2008-05-24 23:31 . 2008-05-24 23:31 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2008-05-24 23:31 . 2008-05-24 23:35 <DIR> d-------- C:\Program Files\ATI Technologies
2008-05-24 23:30 . 2008-05-25 00:15 <DIR> d-------- C:\Program Files\ATI
2008-05-24 23:30 . 2008-05-24 23:30 <DIR> d-------- C:\ATI
2008-05-24 23:23 . 2006-11-02 13:23 <DIR> dr------- C:\Users\inky`\Videos
2008-05-24 23:23 . 2006-11-02 13:23 <DIR> d-------- C:\Users\inky`\Saved Games
2008-05-24 23:23 . 2006-11-02 13:23 <DIR> dr------- C:\Users\inky`\Pictures
2008-05-24 23:23 . 2006-11-02 13:23 <DIR> dr------- C:\Users\inky`\Music
2008-05-24 23:23 . 2006-11-02 13:23 <DIR> dr------- C:\Users\inky`\Links
2008-05-24 23:23 . 2008-05-25 02:14 <DIR> dr------- C:\Users\inky`\Downloads
2008-05-24 23:23 . 2008-05-25 02:12 <DIR> dr------- C:\Users\inky`\Documents
2008-05-24 23:23 . 2008-05-25 20:19 <DIR> dr------- C:\Users\inky`\Contacts
2008-05-24 23:23 . 2008-05-24 23:26 <DIR> d--h----- C:\Users\inky`\AppData
2008-05-24 23:23 . 2008-05-25 02:12 <DIR> d-------- C:\Users\inky`
2008-05-24 23:23 . 2007-03-17 14:41 171,136 -rahs---- C:\grldr
2008-05-24 23:22 . 2008-05-24 23:22 1,712,984 --a------ C:\Windows\System32\wuaueng.dll
2008-05-24 23:22 . 2008-05-24 23:22 1,524,224 --a------ C:\Windows\System32\wucltux.dll
2008-05-24 23:22 . 2008-05-24 23:22 53,080 --a------ C:\Windows\System32\wuauclt.exe
2008-05-24 23:22 . 2008-05-24 23:22 43,352 --a------ C:\Windows\System32\wups2.dll
2008-05-24 23:21 . 2008-05-24 23:21 549,720 --a------ C:\Windows\System32\wuapi.dll
2008-05-24 23:21 . 2008-05-24 23:21 80,896 --a------ C:\Windows\System32\wudriver.dll
2008-05-24 23:21 . 2008-05-24 23:21 33,624 --a------ C:\Windows\System32\wups.dll
2008-05-24 23:20 . 2008-05-24 23:20 163,000 --a------ C:\Windows\System32\wuwebv.dll
2008-05-24 23:20 . 2008-05-24 23:20 31,232 --a------ C:\Windows\System32\wuapp.exe
2008-05-24 23:19 . 2008-05-24 23:19 <DIR> dr------- C:\Windows\System32\config\systemprofile\Contacts
2008-05-24 23:09 . 2008-05-24 23:40 <DIR> d-------- C:\Windows\Debug
2008-05-12 19:30 . 2008-05-12 19:30 3,592,704 --a------ C:\Windows\System32\drivers\atikmdag.sys
2008-05-12 18:56 . 2008-05-12 18:56 397,312 --a------ C:\Windows\System32\ATIDEMGX.dll
2008-05-12 18:55 . 2008-05-12 18:55 327,680 --a------ C:\Windows\System32\atipdlxx.dll
2008-05-12 18:55 . 2008-05-12 18:55 266,240 --a------ C:\Windows\System32\Ati2evxx.dll
2008-05-12 18:55 . 2008-05-12 18:55 262,144 --a------ C:\Windows\System32\Oemdspif.dll
2008-05-12 18:55 . 2008-05-12 18:55 159,744 --a------ C:\Windows\System32\atitmmxx.dll
2008-05-12 18:55 . 2008-05-12 18:55 43,520 --a------ C:\Windows\System32\ati2edxx.dll
2008-05-12 18:53 . 2008-05-12 18:53 675,840 --a------ C:\Windows\System32\Ati2evxx.exe
2008-05-12 18:40 . 2008-05-12 18:40 3,101,184 --a------ C:\Windows\System32\atiumdag.dll
2008-05-12 18:26 . 2008-05-12 18:26 9,994,240 --a------ C:\Windows\System32\atioglxx.dll
2008-05-12 18:23 . 2008-05-12 18:23 4,291,584 --a------ C:\Windows\System32\atiumdva.dll
2008-05-12 18:23 . 2008-05-12 18:23 3,107,788 --a------ C:\Windows\System32\atiumdva.dat
2008-05-12 18:11 . 2008-05-12 18:11 48,640 --a------ C:\Windows\System32\amdpcom32.dll
2008-05-12 18:11 . 2008-05-12 18:11 19,968 --a------ C:\Windows\System32\atiadlxx.dll
2008-05-12 17:56 . 2008-05-12 17:56 49,152 --a------ C:\Windows\System32\drivers\ati2erec.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-24 20:59 --------- d-----w C:\Program Files\Windows Mail
2008-05-24 20:51 826,368 ----a-w C:\Windows\System32\wininet.dll
2008-05-24 20:51 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-05-24 20:51 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-05-24 20:51 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-05-24 20:12 174 --sha-w C:\Program Files\desktop.ini
2008-04-01 22:28 2,102,272 ----a-w C:\Windows\System32\x264vfw.dll
2008-03-31 21:25 682,496 ----a-w C:\Windows\System32\divx.dll
2008-03-28 17:41 7,680 ----a-w C:\Windows\System32\ff_vfw.dll
2008-03-21 20:30 3,596,288 ----a-w C:\Windows\System32\qt-dx331.dll
2008-03-21 20:28 81,920 ----a-w C:\Windows\System32\dpl100.dll
2008-03-06 00:38 90,112 ----a-w C:\Windows\System32\atibrtmon.exe
.
------- Sigcheck -------
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WindowsWelcomeCenter"="oobefldr.dll" [2006-11-02 15:32 2159104 C:\Windows\System32\oobefldr.dll]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 12:17 61440]
"CTHelper"="CTHELPER.EXE" [2008-02-20 20:58 19456 C:\Windows\System32\CTHELPER.EXE]
"CTxfiHlp"="CTXFIHLP.EXE" [2008-02-20 20:58 19968 C:\Windows\System32\CTXFIHLP.EXE]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-05-25 00:17 1177368]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [ ]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3fhg"= mp3fhg.acm
"msacm.divxa32"= divxa32.acm
"VIDC.X264"= x264vfw.dll
"VIDC.HFYU"= huffyuv.dll
"vidc.i263"= i263_32.drv
"VIDC.YV12"= yv12vfw.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{7A836FAB-E509-4E58-A926-CF0E4AF45733}"= C:\Program Files\AVG\AVG8\avgupd.exe:avgupd.exe
"{06C41711-FC5B-4AED-837A-59361AFD16B0}"= C:\Program Files\AVG\AVG8\avgemc.exe:avgemc.exe
"TCP Query User{C5090224-566D-454A-BA49-73373E17C2F8}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{68984D55-C2E7-4104-AD73-CF81F667FF9F}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent
"TCP Query User{6096F784-CA90-4A6E-8A30-6CD846646448}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{06CB24B4-E039-4220-BD1A-60AFA82FCFBD}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{AB9CECE8-DA8F-44D6-A096-3798197ABD20}C:\\users\\inky`\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\ucl3l6rj\\installer-70353-849fi-mirc[1].exe"= UDP:C:\users\inky`\appdata\local\microsoft\windows\temporary internet files\content.ie5\ucl3l6rj\installer-70353-849fi-mirc[1].exe:installer-70353-849fi-mirc[1].exe
"UDP Query User{D5AD5A00-9C6F-4094-B01B-2C7A9C253EB8}C:\\users\\inky`\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\ucl3l6rj\\installer-70353-849fi-mirc[1].exe"= TCP:C:\users\inky`\appdata\local\microsoft\windows\temporary internet files\content.ie5\ucl3l6rj\installer-70353-849fi-mirc[1].exe:installer-70353-849fi-mirc[1].exe
"{0141360B-2E24-4DCC-88E2-7FC9475D33CF}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{7E7F271A-CC4C-4C8D-B23D-3CDBC56B11D0}D:\\softat\\mirc\\mirc.exe"= UDP:D:\softat\mirc\mirc.exe:mIRC
"UDP Query User{A5912C22-560E-48B0-8890-9A214F31891C}D:\\softat\\mirc\\mirc.exe"= TCP:D:\softat\mirc\mirc.exe:mIRC
"TCP Query User{185FE238-7B11-4DC1-A619-B601E97839CC}D:\\softat\\mozilla firefox\\firefox.exe"= UDP:D:\softat\mozilla firefox\firefox.exe:Firefox
"UDP Query User{FF410F6F-2B36-4894-82E8-F403178F8CBE}D:\\softat\\mozilla firefox\\firefox.exe"= TCP:D:\softat\mozilla firefox\firefox.exe:Firefox
"TCP Query User{7E8A7E30-C705-4ADD-B6A4-C0A15CC07440}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{B7F96841-DF10-4B7C-A53D-48DEEECBC7A7}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
R1 AvgLdx86;AVG AVI Loader Driver x86;C:\Windows\system32\Drivers\avgldx86.sys [2008-05-25 00:17]
R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-05-25 00:17]
R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-05-25 00:17]
R2 CTAudSvcService;Creative Audio Service;C:\Program Files\Creative\Shared Files\CTAudSvc.exe [2008-03-07 19:24]
R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2008-05-12 19:30]
R3 AvgWfpX;AVG8 Firewall Driver x86;C:\Windows\system32\Drivers\avgwfpx.sys [2008-05-25 00:17]
R3 ha20x2k;Creative 20X HAL Driver;C:\Windows\system32\drivers\ha20x2k.sys [2008-02-25 09:44]
R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk60x86.sys [2006-11-02 10:30]
S3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;"C:\Program Files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe" [2008-05-24 23:33]
*Newly Created Service* - CATCHME
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-26 14:30:02
Windows 6.0.6000 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
C:\Windows\TEMP\66c3cbc9-3c8e-49f1-a108-9712dfacd617.tmp 0 bytes
**************************************************************************
.
Completion time: 2008-05-26 14:32:03
ComboFix-quarantined-files.txt 2008-05-26 11:30:58
Pre-Run: 96,904,327,168 bytes free
Post-Run: 97,105,690,624 bytes free
Malwarebytes ajaa läpi tällä hetkellä.. tulee logi hetken kuluttua..
203 --- E O F --- 2008-05-24 23:59:00
|
|
inky89
Newbie
|
26. toukokuuta 2008 @ 14:48 |
Linkki tähän viestiin
|
|
Malwarebytes' Anti-Malware 1.12
Tietokantaversio: 788
Tarkistustyyppi: Täysi tarkistus (C:\|D:\|)
Tarkistetut kohteet: 93194
Kulunut aika: 14 minute(s), 21 second(s)
Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 0
Saastuneita rekisteriarvoja: 0
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 0
Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)
Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriavaimia:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriarvoja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)
Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)
Saastuneita tiedostoja:
(Haitallisia kohteita ei löydetty)
|
|
Hujo
Suspended permanently
|
26. toukokuuta 2008 @ 14:59 |
Linkki tähän viestiin
|
Lataa Atribunen ATF Cleaner
Ohjeet;
Tupla-klikkaa ATF-Cleaner.exe käynnistääksesi ohjelman.Main:n alla valitse: Select All
Klikkaa Empty Selected valintaa.
Jos käytät FireFoxia selaimenasi Klikkaa Firefox yläpuolelta ja valitse: Select All
Klikkaa Empty Selected valintaa.
HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy.
Jos käytät Operaa selaimenasiKlikkaa Opera yläpuolelta ja valitse: Select All
Klikkaa Empty Selected valintaa taas.
HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy.
Klikkaa Exit päävalikosta sulkeaksesi ohjelman.
Teknistä tukea tulee jos tupla-klikkaat sähköpostiosoitetta joka sijaitsee jokaisen menun alapuolella kyseisessä työkalussa. (Huomatkaa että se tuki on sitten englanniksi)
Voiko tietsikka koskaan toimia?
|
|
roope77
Suspended due to non-functional email address
|
27. toukokuuta 2008 @ 14:33 |
Linkki tähän viestiin
|
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:21:30, on 27.5.2080
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsgk32st.exe
C:\Program Files\Elisa Tietoturvapalvelu\Common\FSMA32.EXE
C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\FSGK32.EXE
C:\Program Files\Elisa Tietoturvapalvelu\Common\FSMB32.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Elisa Tietoturvapalvelu\Common\FCH32.EXE
C:\Program Files\Elisa Tietoturvapalvelu\Common\FAMEH32.EXE
C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsqh.exe
C:\Program Files\Elisa Tietoturvapalvelu\FSAUA\program\fsaua.exe
C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fssm32.exe
C:\Program Files\Elisa Tietoturvapalvelu\FWES\Program\fsdfwd.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Elisa Tietoturvapalvelu\FSAUA\program\fsus.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Elisa Tietoturvapalvelu\Common\FSM32.EXE
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Elisa\Avustaja\Elisa.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\Elisa Tietoturvapalvelu\FSGUI\fsguidll.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Reader\Reader_sl.exe
D:\roope\steam.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsav32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.atcomet.com/b/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Elisa Avustaja Plugin - {DB87CDE1-EF9C-44EB-A42F-6D0B3C72C516} - C:\Program Files\Elisa\Avustaja\IEFixItNowPlugin.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Elisa Tietoturvapalvelu\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Elisa Tietoturvapalvelu\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [Elisa Avustaja] "C:\Program Files\Elisa\Avustaja\Elisa.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DVMedia] E:\\Resource\AutoRerun.exe E:\
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Microsoft Update] livemessenger.com
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Steam] "d:\roope\steam.exe" -silent
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-21-2025429265-725345543-1834134010-1003\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Omistaja')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &D&ownload &with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Avaa uuteen etuvälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/230?97d0bd91d64c48ffa2da8ee0fe11d307
O8 - Extra context menu item: Avaa uuteen taustavälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/229?97d0bd91d64c48ffa2da8ee0fe11d307
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\Office\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - D:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - D:\Titan Poker\casino.exe
O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - D:\Titan Poker\casino.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Office\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://D:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll/206 (file missing)
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Sol...wn.cab56986.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab56907.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/flashax.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O21 - SSODL: printers - {6E56B36C-6B29-490A-B545-DE4463D583A4} - libwinets.dll (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corporation - C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Elisa Tietoturvapalvelu\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Elisa Tietoturvapalvelu\FWES\Program\fsdfwd.exe
O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Elisa Tietoturvapalvelu\Common\FSMA32.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
--
End of file - 10813 bytes
|
|
Mainos
|
|
|
|
Hujo
Suspended permanently
|
27. toukokuuta 2008 @ 14:47 |
Linkki tähän viestiin
|
Lataa SmitfraudFix (c) S!Ri
Pura sisältö (kansio nimeltä SmitfraudFix) työpöydällesi:
Avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
Valitse optio #1 - Search kirjoittamalla 1 ja painamalla "Enter"; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa).
Postita ponnahtava rapport ? muistion sisältö viestiketjuusi.
Löytyy myös C:\rapport.txt
Huomaa : process.exe filun tunnistaa jotkut Anti-virus ohjelmat
(AntiVir, Dr.Web, Kaspersky) "Haittakaluna"; se ei ole virus, vaan ohjelma joka pysäyttää prosesseja.
A/V ohjelmat eivät pysty tunnistamaan hyvän ja pahan käytön tälläisten ohjelmian väliltä,
silloin ne saattavat varoittaa käyttäjää.
================
Lataa MsnCleaner.zip
"Pura tiedosto työpöydälle, älä käytä sitä vielä.
"Käynnistä kone Vikasietotilaan
"Tuplaklikkaa MsnCleaner.exe
"Paina Analyze nappia.
"Jos löytyy tartuntoja, paina Deleted nappia.
"Käynnistä kone normaalisti ja lähetä C:\MsnCleaner.txt raportti viestiketjuusi.
Voiko tietsikka koskaan toimia?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 27. toukokuuta 2008 @ 14:52
|
|
