1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

ärsyttävät mainokset!!auttakaa!!!(hjt)

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by snowboy, Dec 9, 2006.

Page 2 of 3
  1. snowboy

    snowboy Member

    Joined:
    Dec 9, 2006
    Messages:
    24
    Likes Received:
    0
    Trophy Points:
    11
    @MasteRi Myöhäistä... Norman kansot on poistettu... lisäohjeita...

    @-kemisti- Nyt on nuo muut kuin toolsit poistettu koska niitä ei löytynyt...
     
    snowboy, Dec 13, 2006
    #21
  2. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    @MasteRi: Jos Hujo haluaa sen poistaa sillä tavalla niin en mahda sille mitään... Normanille on oma poistotyökalunsa myös.

    @snowboy: Vielä ongelmia?
     
    -kemisti-, Dec 13, 2006
    #22
  3. snowboy

    snowboy Member

    Joined:
    Dec 9, 2006
    Messages:
    24
    Likes Received:
    0
    Trophy Points:
    11
    ongelmia on vieläkin mutta ne ongelmat on vain toisella koneen käyttäjällä (koneella on kaksi eri käyttäjää).nyt mainokset pomppii vain siellä toisen käyttäjän puolella ei minun puolella????
     
    snowboy, Dec 13, 2006
    #23
  4. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Lähetä sitten sen toisen käyttäjän puolelta HjT-loki.
     
    -kemisti-, Dec 13, 2006
    #24
  5. snowboy

    snowboy Member

    Joined:
    Dec 9, 2006
    Messages:
    24
    Likes Received:
    0
    Trophy Points:
    11
    Logfile of HijackThis v1.99.1
    Scan saved at 20:00:18, on 13.12.2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.5730.0011)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Sygate\SPF\smc.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\ATI-CPanel\atiptaxx.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    C:\Program Files\Creative\Shared Files\CAMTRAY.EXE
    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\system32\CTsvcCDA.EXE
    C:\WINDOWS\System32\svchost.exe
    c:\progra~1\intern~1\iexplore.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\HJT\Skanneri.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.fi/0SEFIFI/SAOS01?FORM=TOOLBR
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fi/0SEFIFI/SAOS01?FORM=TOOLBR
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja Kopteri
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Program Files\Creative\Shared Files\CAMTRAY.EXE
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [Flap Part] C:\DOCUME~1\Jaana\APPLIC~1\ELSEIN~1\owns phone.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: HP Image Zone -pikakäynnistys.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZCxdm341YYFI
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O14 - IERESET.INF: START_PAGE_URL=http://www.kopteri.net/
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

     
    snowboy, Dec 13, 2006
    #25
  6. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Loppihan se siellä.

    Poista ohjauspaneelista:

    MyWebSearch tms.

    Lataa NoLoptyöpöydällesi yhdestä seuraavista linkeistä...
    Linkki 1
    Linkki 2
    Linkki 3
    [*]Sulje kaikki ohjelmat, koska tämä vaihe vaatii uudelleenkäynnistyksen
    [*]Tuplaklikkaa NoLop.exe ajaaksesi sen
    [*] Kun skannaus on valmis, sinua pyydetään käynnistämään kone uudestaan, jos infektio löytyy. Klikkaa OK
    [*] Klikkaa "REBOOT"-painiketta.
    [*] NoLopin pitäisi antaa viesti. Jos ei, tuplaklikkaa ohjelmaa ja se valmistuu. Lähetä C:\NoLop.log-tiedoston sisältö uuden HijackThis-lokin kera.
    -- Jos saat seuraavan virheen, "mscomctl.ocx or one of its dependencies are not correctly registered," lataamscomctl.ocx ja tallenna se system32-hakemistoosi (yleensä c:\Windows\system32). Tämän jälkeen aja ohjelma uudestaan.
     
    -kemisti-, Dec 13, 2006
    #26
  7. snowboy

    snowboy Member

    Joined:
    Dec 9, 2006
    Messages:
    24
    Likes Received:
    0
    Trophy Points:
    11
    ei löytynyt mitään pöpöö!!??hjt:
    Logfile of HijackThis v1.99.1
    Scan saved at 20:48:33, on 13.12.2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.5730.0011)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Sygate\SPF\smc.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\ATI-CPanel\atiptaxx.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    C:\Program Files\Creative\Shared Files\CAMTRAY.EXE
    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\system32\CTsvcCDA.EXE
    C:\WINDOWS\System32\svchost.exe
    c:\progra~1\intern~1\iexplore.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\HJT\Skanneri.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.fi/0SEFIFI/SAOS01?FORM=TOOLBR
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fi/0SEFIFI/SAOS01?FORM=TOOLBR
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja Kopteri
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Program Files\Creative\Shared Files\CAMTRAY.EXE
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
    O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [Flap Part] C:\DOCUME~1\Jaana\APPLIC~1\ELSEIN~1\owns phone.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: HP Image Zone -pikakäynnistys.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O14 - IERESET.INF: START_PAGE_URL=http://www.kopteri.net/
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

     
    snowboy, Dec 13, 2006
    #27
  8. snowboy

    snowboy Member

    Joined:
    Dec 9, 2006
    Messages:
    24
    Likes Received:
    0
    Trophy Points:
    11
    lataa mscomctl.ocx.tota hommaa kokeilin niin avast antivirus ilmoitti että se löysi jonkun "cwin32" haittaohjelman(mainosohjelma) tai jotain???
     
    snowboy, Dec 13, 2006
    #28
  9. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Löysi tai ei, niin lokin se varmaan teki (nolop ei löydä kaikkia lopin hakemistoja). Lähetä se tänne.

    mscomctl.ocx-juttu on avast!:in väärä hälytys, jos sellaista herjaa.
     
    Last edited: Dec 13, 2006
    -kemisti-, Dec 13, 2006
    #29
  10. snowboy

    snowboy Member

    Joined:
    Dec 9, 2006
    Messages:
    24
    Likes Received:
    0
    Trophy Points:
    11
    NoLop! Log by Skate_Punk_21

    Please Note: any existing old logs will have now been renamed to NoLop!OLD.log

    Fix running from: C:\Documents and Settings\Jaana\Työpöytä
    [13.12.2006]
    [20:44:47]

    ---Infection Files Found/Removed---
    NO INFECTION FILES FOUND - Cleaning Aborted.

    ---Listing AppData sub directories---

    C:\Documents and Settings\All Users\Application Data\Adobe
    C:\Documents and Settings\All Users\Application Data\Ahead
    C:\Documents and Settings\All Users\Application Data\Apple Computer
    C:\Documents and Settings\All Users\Application Data\Bin -- EMPTY Directory
    C:\Documents and Settings\All Users\Application Data\Google
    C:\Documents and Settings\All Users\Application Data\Hp
    C:\Documents and Settings\All Users\Application Data\Loud Bird Style Byte
    C:\Documents and Settings\All Users\Application Data\Messenger Plus!
    C:\Documents and Settings\All Users\Application Data\Microsoft
    C:\Documents and Settings\All Users\Application Data\Msn6
    C:\Documents and Settings\All Users\Application Data\Od2
    C:\Documents and Settings\All Users\Application Data\Quicktime
    C:\Documents and Settings\All Users\Application Data\Skype -- EMPTY Directory
    C:\Documents and Settings\All Users\Application Data\Symantec
    C:\Documents and Settings\All Users\Application Data\Thunk Browse Anti Frag
    C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
    C:\Documents and Settings\All Users\Application Data\Windows Live Toolbar
    C:\Documents and Settings\Ari\Application Data\Adobe
    C:\Documents and Settings\Ari\Application Data\Adobeum -- EMPTY Directory
    C:\Documents and Settings\Ari\Application Data\Apple Computer
    C:\Documents and Settings\Ari\Application Data\Arcsoft
    C:\Documents and Settings\Ari\Application Data\Creative
    C:\Documents and Settings\Ari\Application Data\F-secure
    C:\Documents and Settings\Ari\Application Data\Google
    C:\Documents and Settings\Ari\Application Data\Help -- EMPTY Directory
    C:\Documents and Settings\Ari\Application Data\Identities
    C:\Documents and Settings\Ari\Application Data\Intervideo
    C:\Documents and Settings\Ari\Application Data\Kazaa Lite
    C:\Documents and Settings\Ari\Application Data\Lavasoft
    C:\Documents and Settings\Ari\Application Data\Macromedia
    C:\Documents and Settings\Ari\Application Data\Microsoft
    C:\Documents and Settings\Ari\Application Data\Mozilla
    C:\Documents and Settings\Ari\Application Data\Msn6
    C:\Documents and Settings\Ari\Application Data\Od2
    C:\Documents and Settings\Ari\Application Data\Registry Cleaner
    C:\Documents and Settings\Ari\Application Data\Skype
    C:\Documents and Settings\Ari\Application Data\Spamblocker -- EMPTY Directory
    C:\Documents and Settings\Ari\Application Data\Sun
    C:\Documents and Settings\Ari\Application Data\Talkback
    C:\Documents and Settings\Ari\Application Data\Thunderbird
    C:\Documents and Settings\Default User\Application Data\Identities
    C:\Documents and Settings\Default User\Application Data\Microsoft
    C:\Documents and Settings\Jaana\Application Data\Adobe
    C:\Documents and Settings\Jaana\Application Data\Adobeum -- EMPTY Directory
    C:\Documents and Settings\Jaana\Application Data\Ahead
    C:\Documents and Settings\Jaana\Application Data\Apple Computer
    C:\Documents and Settings\Jaana\Application Data\Arcsoft
    C:\Documents and Settings\Jaana\Application Data\Creative
    C:\Documents and Settings\Jaana\Application Data\Elseintra
    C:\Documents and Settings\Jaana\Application Data\F-secure
    C:\Documents and Settings\Jaana\Application Data\Google
    C:\Documents and Settings\Jaana\Application Data\Help
    C:\Documents and Settings\Jaana\Application Data\Identities
    C:\Documents and Settings\Jaana\Application Data\Intervideo
    C:\Documents and Settings\Jaana\Application Data\Kazaa Lite
    C:\Documents and Settings\Jaana\Application Data\Lavasoft
    C:\Documents and Settings\Jaana\Application Data\Macromedia
    C:\Documents and Settings\Jaana\Application Data\Microsoft
    C:\Documents and Settings\Jaana\Application Data\Mozilla
    C:\Documents and Settings\Jaana\Application Data\Msn6
    C:\Documents and Settings\Jaana\Application Data\Od2
    C:\Documents and Settings\Jaana\Application Data\Raptisoft
    C:\Documents and Settings\Jaana\Application Data\Registry Cleaner
    C:\Documents and Settings\Jaana\Application Data\Skype
    C:\Documents and Settings\Jaana\Application Data\Spamblocker -- EMPTY Directory
    C:\Documents and Settings\Jaana\Application Data\Spamblockerutility
    C:\Documents and Settings\Jaana\Application Data\Sun
    C:\Documents and Settings\Jaana\Application Data\Symantec
    C:\Documents and Settings\Jaana\Application Data\Talkback
    C:\Documents and Settings\Jaana\Application Data\Thunderbird
    C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Microsoft
    C:\Documents and Settings\Järjestelmänvalvoja.pesso\Application Data\Identities
    C:\Documents and Settings\Järjestelmänvalvoja.pesso\Application Data\Microsoft
    C:\Documents and Settings\Localservice\Application Data\Microsoft
    C:\Documents and Settings\Networkservice\Application Data\Microsoft
     
    snowboy, Dec 13, 2006
    #30
  11. Hujo

    Hujo Guest

    Niin ... käyttäjä oli varmaan poistanut normannin lisää poista sovelutuksesta sitten oli vain serverin pahanen koneella ja norman kansio. Eikun pois, että nuppi tutisee. :)

     
    Hujo, Dec 13, 2006
    #31
  12. snowboy

    snowboy Member

    Joined:
    Dec 9, 2006
    Messages:
    24
    Likes Received:
    0
    Trophy Points:
    11
    vieläkö löytyy ohjeita.tuntuu olevan sitkee vaiva!!
     
    snowboy, Dec 13, 2006
    #32
  13. MasteRi

    MasteRi Member

    Joined:
    Dec 12, 2006
    Messages:
    13
    Likes Received:
    0
    Trophy Points:
    11
    Doh minä en jaksa alkaa väittelemään henkilöiden kanssa tuosta.
    tuossa on pikkuisen väärin ohjattu kumminkin nytten.
    pisteleppä minulle mailia: master2@kotinet.com niin neuvon heti alusta loppuun asti ja varmatoimisesti kun nyt kerta alalla töissä olen ja tietohallinta tietoturva jne. puolella :)
     
    MasteRi, Dec 13, 2006
    #33
  14. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    @MasteRi: Varmaan tiedät, että ei sähköpostiosoitteita foorumille? Ja toiseksi, annapa hoitaa jo kerran aloitettu asia loppuun... Osaan kyllä asiani, niinkun vaikka allekirjoituksesta käy ilmi. Kokemusta on tästä hommasta 1,5 v.

    @snowboy:

    Fixiin:

    O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
    O4 - HKCU\..\Run: [Flap Part] C:\DOCUME~1\Jaana\APPLIC~1\ELSEIN~1\owns phone.exe

    Käynnistä vikasietotilaan ja poista:

    C:\Documents and Settings\All Users\Application Data\Loud Bird Style Byte
    C:\Documents and Settings\All Users\Application Data\Thunk Browse Anti Frag
    C:\Documents and Settings\Jaana\Application Data\Elseintra
    C:\PROGRA~1\MYWEBS~1

    Tyhjennä roskis.

    Käynnistä uudelleen ja lähetä uusi HjT-loki.
     
    Last edited: Dec 13, 2006
    -kemisti-, Dec 13, 2006
    #34
  15. MasteRi

    MasteRi Member

    Joined:
    Dec 12, 2006
    Messages:
    13
    Likes Received:
    0
    Trophy Points:
    11
    haasta oikeuteen, 1,5 v ei riitä lähellekkään. Tehkää sitten mitä lystäätte tai neuvokaa väärin. eipähän ole minun vastuulla ainakaan
     
    MasteRi, Dec 13, 2006
    #35
  16. Hujo

    Hujo Guest

    @-kemisti- Tuossa on tuo Windows Defenderja !AVG Anti-Spyware Guard päällä. Kun samoja poistetaan kokoajan.


    Tuokin Fixsiin ;)
    R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)

    @MasteRi Otas nyt aivan rauhallisesti vain.
    Kyllä tämä tästä selviää kun tuo käyttäjä tekee ohjeen mukaan.
    Vai tykkääkö vain Provota?
     
    Last edited by a moderator: Dec 13, 2006
    Hujo, Dec 13, 2006
    #36
  17. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    @MasteRi: Jos kyse on edelleen siitä Normanin poistosta, niin sanoin jo että Hujo poisti sen vähän "erilaisella" tavalla, joka ei ehkä ollu kaikkien taiteen sääntöjen mukainen. Omissa fixeissäni tuskin on huomauttamista... Olen tähän päivään mennessä putsannut tuhansia koneita niin koti- kun ulkomaillakin ja kuulun käytännössä kaikkien alan suurimpien ulkomaalaisten foorumeiden henkilökuntaan -> tiedän kyllä mitä teen.

    @Hujo: Hyvä huomio, aivot ei ole täysin vireessä näin aamusta :)

    @snowboy: Tee myös nämä:

    Avaa Windows Defender.
    Klikkaa Tools ja General Settings.
    Selaa alas ja ota rasti pois Turn on real-time protection (recommended)-kohdasta.
    Tämän jälkeen klikkaa Save ja sulje Windows Defender

    Avaa AVG anti-spyware

    Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa
    "Resident shield is", muuta tila active:sta inactive:ksi
     
    Last edited: Dec 13, 2006
    -kemisti-, Dec 13, 2006
    #37
  18. MasteRi

    MasteRi Member

    Joined:
    Dec 12, 2006
    Messages:
    13
    Likes Received:
    0
    Trophy Points:
    11
    Hänen mokansa silloin, pahoittelen jos jossakin vaiheessa tunsit olosi syytetyksi.
    Mitä tuohon kokemukseen jne, niin aika jännä, että 1,5v nuita hommia ja nuin isoissa saappaissa. Itse kun tehnyt jotain 10v näitä hommia ja vasta noissa askelissa itse olen jne... ettei nyt vain vähän yli lipsahtanut.. :)
     
    MasteRi, Dec 13, 2006
    #38
  19. MasteRi

    MasteRi Member

    Joined:
    Dec 12, 2006
    Messages:
    13
    Likes Received:
    0
    Trophy Points:
    11
    "kaikkien alan suurimpien ulkomaalaisten foorumeiden henkilökuntaan "

    aa no eipä mitään. itse en foorumeilla vaikuta. vaan ihan oikeessa työelämässä siis. niinkuin normaalisti.
    isossa konsernissa jne...
    jotkut ovat foorumilla isoja jotkut norm. työelämässä..
    siinä samalla tasolla mutta minulla se on internetin ulkopuolella tuo "työ"
     
    MasteRi, Dec 13, 2006
    #39
  20. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    @MasteRi: En mahda asialle itse mitään, jos olen sinne päässyt... Sinnehän pääsee kun käy HjT-koulun ulkomailla.

    Luulen, että seuraavat foorumit sanovat jotain sinullekin:
    BleepingComputer
    Castlecops
    GeeksToGo

    Tämän aiheen jauhaminen loppuu osaltani tähän.
     
    -kemisti-, Dec 13, 2006
    #40
Page 2 of 3

Share This Page