Logfile of HijackThis v1.99.1 Scan saved at 08:14, on 25.5.2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\SYSTEM32\Ati2evxx.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\services.exe C:\WINDOWS\system32\VTTimer.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE C:\Program Files\FileZilla Server\FileZilla Server.exe C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe C:\PROGRA~1\VLPOY-~1\NETIKK~1\app\pppoeservice.exe C:\Program Files\Common Files\Acronis\Malware Shield\psh_svc.exe C:\WINDOWS\system32\r_server.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\PeerGuardian2\pg2.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Documents and Settings\Janne\Omat tiedostot\Turhat roinat\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\fservice.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: CAdBlocker Object - {E24AD748-155E-4254-B674-4EDF86E7E1DF} - C:\Program Files\Acronis\PrivacyExpert\Blocker.dll O4 - HKLM\..\Run: [VTTimer] VTTimer.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\F-Secure Internet Security\FSGUI\FSSW.EXE" /reboot O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - Global Startup: F-Secure Anti-Virus 2006.lnk = C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\F-Secure Internet Security\Anti-Spyware\blockpopups.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.pcpitstop.com/pestscan/pestscan.cab O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - https://scan.safety.live.com/resource/download/scanner/en-us/wlscbase3401.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1134748462192 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) - http://secure2.comned.com/signuptemplates/securelogin-devel.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4672/mcfscan.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{6A4FC8D3-2218-4990-AE9F-EE6CF757CC2E}: NameServer = 62.148.192.130 62.148.192.154 O20 - AppInit_DLLs: , O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: F-Secure Anti-Virus 2006 (BackWeb Plug-in - 4476822) - F-Secure Internet Security 2005 - C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe O23 - Service: FileZilla Server FTP server (FileZilla Server) - FileZilla Project - C:\Program Files\FileZilla Server\FileZilla Server.exe O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE O23 - Service: PPPoE Service (PPPoEService) - Unknown owner - C:\PROGRA~1\VLPOY-~1\NETIKK~1\app\pppoeservice.exe O23 - Service: Acronis Malware Shield Service (psh_svc) - Unknown owner - C:\Program Files\Common Files\Acronis\Malware Shield\psh_svc.exe O23 - Service: Remote Administrator Service (r_server) - Unknown owner - C:\WINDOWS\system32\r_server.exe" /service (file missing) O23 - Service: Sygate Personal Firewall (SmcService) - Unknown owner - C:\Program Files\Sygate\SPF\smc.exe (file missing) O23 - Service: WTScheduler - Unknown owner - C:\Program Files\WinTask\Bin\SchedSrv.exe Kone ihan paskana, viruksen torjuntaa ei saa päälle/palomuuria joudun käyttää peerguardiania, jotta pääsin ees tänne asti. pliide auttakaa, ja en viitti formatakkaa kun on niin paljon tietoa koneella, kiitos jo valmiiksi!!
Siellä on Backdoor.Prorat 1. Lataa http://swandog46.geekstogo.com/avenger.zip The Avenger (c) työpöydällesi. [*]Klikkaa Avenger.zip filua avataksesi sen. [*]Pura Avenger.exe työpöydällesi. 2. Kopioi kaikki teksti mustalla lainausboksissa alapuolella tyhjälle muistiolle: Huomaa: yläpuolella oleva skripti on luotu erityisesti tälle käyttäjälle. Jos et ole tämä henkilö, ÄLÄ seuraa näitä ohjeita koska ne voisivat pilata koneesi toimintoja. 3. Nyt, aukaise The Avenger tupla-klikkaamalla sen kuvaketta pöydälläsi. [*]"Script file to execute" alapuolelta valitse "Input Script Manually". [*]Nyt klikkaa suurennuslasin kuvaa joka avaa uuden ikkunan nimeltä "View/edit script". [*] Liitä se teksti jonka kopioit muistioon, tähän ikkunaan. [*] Klikkaa Done. [*] Nyt klikkaa [vihreää valoa aloittaaksesi skriptin. [*] Klikkaa "Yes" kun tulee kaksi varoitusboksia. Avenger tekee automaattisesti seuraavat: [*] Käynnistää koneesi. [*] Käynnistyksen yhteydessä, se lyhyesti avaa mustan komentoikkunan työpöydällesi, tämä on normaalia. [*] Käynnistyksen jälkeen, se luo lokitiedoston jonka pitäisi aueta Avengerin tekojen tuloksena. Tämän lokin tiedostopolku on C:\avenger.txt [*] Avenger on myös tehnyt varmuuskopion kaikista tiedostoista jne.. jotka pyysit sen poistaa, ja on pakannut ja siirtänyt ne zip filuihin polussa C:\avenger\backup.zip. 5. Kopioi ja liitä kaikki sisältö tiedostosta avenger.txt vastaukseesi tuoreen HJT-lokin mukana].
Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\vcggsusf ******************* Script file located at: \??\C:\Documents and Settings\psucwffm.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: File C:\WINDOWS\services.exe deleted successfully. File C:\WINDOWS\system32\fservice.exe deleted successfully. File C:\WINDOWS\system32\Main.exe not found! Deletion of file C:\WINDOWS\system32\Main.exe failed! Could not process line: C:\WINDOWS\system32\Main.exe Status: 0xc0000034 File C:\WINDOWS\system32\Loader.exe not found! Deletion of file C:\WINDOWS\system32\Loader.exe failed! Could not process line: C:\WINDOWS\system32\Loader.exe Status: 0xc0000034 File C:\WINDOWS\system32\Msmsg.exe not found! Deletion of file C:\WINDOWS\system32\Msmsg.exe failed! Could not process line: C:\WINDOWS\system32\Msmsg.exe Status: 0xc0000034 File C:\WINDOWS\system32\Winserv.dll not found! Deletion of file C:\WINDOWS\system32\Winserv.dll failed! Could not process line: C:\WINDOWS\system32\Winserv.dll Status: 0xc0000034 File C:\WINDOWS\system32\Sservice.exe not found! Deletion of file C:\WINDOWS\system32\Sservice.exe failed! Could not process line: C:\WINDOWS\system32\Sservice.exe Status: 0xc0000034 File C:\WINDOWS\Winlogon.exe not found! Deletion of file C:\WINDOWS\Winlogon.exe failed! Could not process line: C:\WINDOWS\Winlogon.exe Status: 0xc0000034 File C:\WINDOWS\system32\wininv.dll not found! Deletion of file C:\WINDOWS\system32\wininv.dll failed! Could not process line: C:\WINDOWS\system32\wininv.dll Status: 0xc0000034 File C:\WINDOWS\system32\winkey.dll deleted successfully. File -------------------------------------------------------------------------------- not found! Deletion of file -------------------------------------------------------------------------------- failed! Could not process line: -------------------------------------------------------------------------------- Status: 0xc0000034 Completed script processing. ******************* Finished! Terminate. Tossa ton logi, ja tässä vielä hijachthisin: Logfile of HijackThis v1.99.1 Scan saved at 09:04, on 25.5.2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\SYSTEM32\Ati2evxx.exe C:\WINDOWS\services.exe C:\WINDOWS\system32\VTTimer.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\SYSTEM32\notepad.exe C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe C:\PROGRA~1\VLPOY-~1\NETIKK~1\app\pppoeservice.exe C:\Program Files\Common Files\Acronis\Malware Shield\psh_svc.exe C:\WINDOWS\system32\r_server.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe C:\WINDOWS\explorer.exe C:\Program Files\PeerGuardian2\pg2.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Documents and Settings\Janne\Omat tiedostot\Turhat roinat\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\fservice.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: CAdBlocker Object - {E24AD748-155E-4254-B674-4EDF86E7E1DF} - C:\Program Files\Acronis\PrivacyExpert\Blocker.dll O4 - HKLM\..\Run: [VTTimer] VTTimer.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\F-Secure Internet Security\FSGUI\FSSW.EXE" /reboot O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - Global Startup: F-Secure Anti-Virus 2006.lnk = C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\F-Secure Internet Security\Anti-Spyware\blockpopups.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.pcpitstop.com/pestscan/pestscan.cab O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - https://scan.safety.live.com/resource/download/scanner/en-us/wlscbase3401.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1134748462192 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) - http://secure2.comned.com/signuptemplates/securelogin-devel.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4672/mcfscan.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{6A4FC8D3-2218-4990-AE9F-EE6CF757CC2E}: NameServer = 62.148.192.130 62.148.192.154 O20 - AppInit_DLLs: , O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: F-Secure Anti-Virus 2006 (BackWeb Plug-in - 4476822) - F-Secure Internet Security 2005 - C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe O23 - Service: FileZilla Server FTP server (FileZilla Server) - FileZilla Project - C:\Program Files\FileZilla Server\FileZilla Server.exe O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE O23 - Service: PPPoE Service (PPPoEService) - Unknown owner - C:\PROGRA~1\VLPOY-~1\NETIKK~1\app\pppoeservice.exe O23 - Service: Acronis Malware Shield Service (psh_svc) - Unknown owner - C:\Program Files\Common Files\Acronis\Malware Shield\psh_svc.exe O23 - Service: Remote Administrator Service (r_server) - Unknown owner - C:\WINDOWS\system32\r_server.exe" /service (file missing) O23 - Service: Sygate Personal Firewall (SmcService) - Unknown owner - C:\Program Files\Sygate\SPF\smc.exe (file missing) O23 - Service: WTScheduler - Unknown owner - C:\Program Files\WinTask\Bin\SchedSrv.exe Muuta korjattavaa? Ja palomuuri / Viruksentorjunta ei käynnisty. Taitaa olla netskyn tekosia, koska Noadware 4.0 sanoo että services.exe tiedostossa se olisi, mutta ei mikään ohjelma sitä kyllä löydä. :/
Juu, ei se lähtenyt. Täällä on örkki -> C:\WINDOWS\services.exe Sanon tämän jo tässä vaiheessa: Koneellasi on todella paha örkki ja suosittelen ensisijaisesti ainoastaan formatointia! Tämä siksi, että konetta ei välttämättä saada ensinnäkään puhtaaksi. Itse formatoisin heti, jos tuo olis koneessa. Onko nämä asennettu itse? O23 - Service: FileZilla Server FTP server (FileZilla Server) - FileZilla Project - C:\Program Files\FileZilla Server\FileZilla Server.exe O23 - Service: Remote Administrator Service (r_server) - Unknown owner - C:\WINDOWS\system32\r_server.exe" /service (file missing) Jos ei, niin todennäköisesti koneellasi pyörii ftp-serveri, joka lähettää samaa pöpöä ympäri maailmaa. Hae,asenna ja päivitä ewido -> http://keskustelu.afterdawn.com/thread_view.cfm/269186 Käynnistä vikasietotilaan (F8 käynnistyksen yhteydessä) Skannaa ewidolla, anna poistaa mitä löytää ja tallenna raportti. Käynnistä uudelleen ja lähetä ewidon raportti. Tee myös tämä: Lataa http://www.bleepingcomputer.com/files/oldtimer/WinPFind.zip WinPFind työpöydällesi. Pura tiedoston WinPFind.zip sisältö (kansio WinPFind) C aseman juureen. Mene sitten kansioon C:\WinPFind ja tuplaklikkaa tiedostoa WinPFind.exe, ohjelma käynnistyy. Paina Start Scan-painiketta ja odota kunnes skannaus on valmis. Ohjelma skannaa todella suuren määrään tiedostoja etsien vastaavuutta haittaohjelmille tyypillisiin tiedostoihin, joten ole kärsivällinen ja anna ohjelman skannata. Skannaus saattaa kestää jopa yli 30 minuuttia. Kun skannaus on valmis, ohjelma näyttää skannaustuloksen. Paina Copy to Clipboard-painiketta, tulos kopioituu leikepöydälle. Avaa sitten Muistio ja liitä tulos siihen, tallenna dokumentti työpöydälle nimellä WinPFind-loki. Liitä sitten tämän dokumentin sisältö viestiketjuusi.
On nämä itse asennettuja, tuli XAMPIN mukana, ja toi toinen on radminista osa jota olen joskus tesminyt, juuh laitan logit kunhan kerkeen varmaa tänään viiden maissa saan ne.
Noniin, tässä ewidon raportti: --------------------------------------------------------- ewido anti-malware - Scan report --------------------------------------------------------- + Created on: 05:18, 26.5.2006 + Report-Checksum: 192C6AF5 + Scan result: C:\WINDOWS\system32\winkey.dll_tobedeleted -> Backdoor.Prorat.19.ah : Cleaned with backup C:\WINDOWS\system32\reginv.dll_tobedeleted -> Backdoor.Prorat.19.i : Cleaned with backup C:\Documents and Settings\All Users\Application Data\AntiSpyInfo\services.exe.q_2CF5A31_q -> Backdoor.Prorat.19.i : Cleaned with backup C:\Documents and Settings\All Users\Application Data\AntiSpyInfo\services.exe.q_2CF5A31_q.old -> Backdoor.Prorat.19.i : Cleaned with backup C:\Documents and Settings\All Users\Application Data\AntiSpyInfo\gfgf.exe.q_3F3CA20A_q -> Proxy.VB.j : Cleaned with backup C:\Documents and Settings\Janne\Työpöytä\ss.2.2.0\cgi\setup.cgi -> Backdoor.SubSeven.22.a : Cleaned with backup C:\Documents and Settings\Janne\Työpöytä\ss.2.2.0\cgi\subseven.cgi -> Backdoor.SubSeven.22.a : Cleaned with backup C:\Documents and Settings\Janne\Cookies\janne@yadro[1].txt -> TrackingCookie.Yadro : Cleaned with backup C:\Documents and Settings\Janne\Cookies\janne@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup :mozilla.15:C:\Documents and Settings\Janne\Application Data\Mozilla\Firefox\Profiles\40i2pyh1.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup :mozilla.16:C:\Documents and Settings\Janne\Application Data\Mozilla\Firefox\Profiles\40i2pyh1.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned with backup :mozilla.17:C:\Documents and Settings\Janne\Application Data\Mozilla\Firefox\Profiles\40i2pyh1.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned with backup :mozilla.46:C:\Documents and Settings\Janne\Application Data\Mozilla\Firefox\Profiles\40i2pyh1.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup :mozilla.47:C:\Documents and Settings\Janne\Application Data\Mozilla\Firefox\Profiles\40i2pyh1.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup :mozilla.48:C:\Documents and Settings\Janne\Application Data\Mozilla\Firefox\Profiles\40i2pyh1.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup C:\Documents and Settings\Janne\Omat tiedostot\Vastaanotetut tiedostot\server.rar/server.exe -> Backdoor.Prorat.19.i : Cleaned with backup C:\Documents and Settings\Janne\Omat tiedostot\Vastaanotetut tiedostot\NBSvr.rar/NBSvr.exe -> Backdoor.Netbus.20.c : Cleaned with backup C:\Documents and Settings\Janne\Omat tiedostot\Vastaanotetut tiedostot\gfgf.rar/gfgf.exe -> Proxy.VB.j : Cleaned with backup C:\Documents and Settings\Janne\Omat tiedostot\Vastaanotetut tiedostot\mr. undectetable.zip/Mr. Undectetable/Mr. Undectetable.exe -> Dropper.Delf.ph : Cleaned with backup ::Report End WinPfindin raportti: WARNING: not all files found by this scanner are bad. Consult with a knowledgable person before proceeding. If you see a message in the titlebar saying "Not responding..." you can ignore it. Windows somethimes displays this message due to the high volume of disk I/O. As long as the hard disk light is flashing, the program is still working properly. »»»»»»»»»»»»»»»»» Windows OS and Versions »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Product Name: Microsoft Windows XP Current Build: Service Pack 2 Current Build Number: 2600 Internet Explorer Version: 6.0.2900.2180 »»»»»»»»»»»»»»»»» Checking Selected Standard Folders »»»»»»»»»»»»»»»»»»»» Checking %SystemDrive% folder... Checking %ProgramFilesDir% folder... Checking %WinDir% folder... Checking %System% folder... PEC2 9.10.2001 13:00:00 41113 C:\WINDOWS\SYSTEM32\dfrg.msc winsync 9.10.2001 13:00:00 1309184 C:\WINDOWS\SYSTEM32\wbdbase.deu aspack 14.9.2004 13:11:38 701952 C:\WINDOWS\SYSTEM32\ntdll.dll Umonitor 14.9.2004 13:11:56 661504 C:\WINDOWS\SYSTEM32\rasdlg.dll aspack 22.7.2005 19:59:04 2319568 C:\WINDOWS\SYSTEM32\d3dx9_27.dll aspack 18.3.2005 17:19:58 2337488 C:\WINDOWS\SYSTEM32\d3dx9_25.dll aspack 31.1.2006 20:27:52 53248 C:\WINDOWS\SYSTEM32\suppdll.dll aspack 26.5.2005 15:34:52 2297552 C:\WINDOWS\SYSTEM32\d3dx9_26.dll aspack 5.12.2005 18:09:18 2323664 C:\WINDOWS\SYSTEM32\d3dx9_28.dll UPX! 22.5.2006 14:53:36 156418048 C:\WINDOWS\SYSTEM32\mscache.sys UPX! 28.1.2006 0:38:10 503296 C:\WINDOWS\SYSTEM32\aswBoot.exe aspack 2.2.2006 18:42:38 1211904 C:\WINDOWS\SYSTEM32\Incinerator.dll PECompact2 8.2.2006 7:23:40 4513120 C:\WINDOWS\SYSTEM32\MRT.exe aspack 8.2.2006 7:23:40 4513120 C:\WINDOWS\SYSTEM32\MRT.exe aspack 25.5.2006 17:59:52 13312 C:\WINDOWS\SYSTEM32\winkey.dll_tobedeleted PTech 4.11.2005 16:27:24 534280 C:\WINDOWS\SYSTEM32\LegitCheckControl.DLL Checking %System%\Drivers folder and sub-folders... Items found in C:\WINDOWS\SYSTEM32\drivers\etc\hosts Checking the Windows folder and sub-folders for system and hidden files within the last 60 days... 26.5.2006 11:53:40 S 2048 C:\WINDOWS\bootstat.dat 26.5.2006 12:17:42 H 1024 C:\WINDOWS\system32\config\system.LOG 26.5.2006 12:14:26 H 1024 C:\WINDOWS\system32\config\software.LOG 26.5.2006 11:56:46 H 1024 C:\WINDOWS\system32\config\default.LOG 26.5.2006 12:02:00 H 1024 C:\WINDOWS\system32\config\SAM.LOG 26.5.2006 12:04:46 H 1024 C:\WINDOWS\system32\config\SECURITY.LOG 10.5.2006 15:35:12 H 1024 C:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG 4.4.2006 20:35:58 HS 24 C:\WINDOWS\system32\Microsoft\Protect\S-1-5-18\User\Preferred 4.4.2006 20:35:58 HS 388 C:\WINDOWS\system32\Microsoft\Protect\S-1-5-18\User\24549eed-d376-49ea-b7a7-3e3729d4c449 6.5.2006 20:02:32 H 81 C:\WINDOWS\system32\GroupPolicy\Adm\admfiles.ini 25.5.2006 23:20:34 HS 67 C:\WINDOWS\temp\Temporary Internet Files\Content.IE5\desktop.ini 25.5.2006 23:20:34 HS 67 C:\WINDOWS\temp\Temporary Internet Files\Content.IE5\W2CP1RNE\desktop.ini 25.5.2006 23:20:34 HS 67 C:\WINDOWS\temp\Temporary Internet Files\Content.IE5\B2UKPUXW\desktop.ini 25.5.2006 23:20:34 HS 67 C:\WINDOWS\temp\Temporary Internet Files\Content.IE5\YPHXM4P3\desktop.ini 25.5.2006 23:20:34 HS 67 C:\WINDOWS\temp\Temporary Internet Files\Content.IE5\BNYE9BJK\desktop.ini 25.5.2006 23:20:34 HS 113 C:\WINDOWS\temp\Sivuhistoria\History.IE5\desktop.ini 26.5.2006 11:53:42 S 64 C:\WINDOWS\CSC\00000001 25.5.2006 19:31:04 S 64 C:\WINDOWS\CSC\csc1.tmp 26.5.2006 11:53:42 S 64 C:\WINDOWS\CSC\00000002 26.5.2006 11:53:42 H 6 C:\WINDOWS\Tasks\SA.DAT Checking for CPL files... Microsoft Corporation 9.10.2001 13:00:00 188416 C:\WINDOWS\SYSTEM32\main.cpl Microsoft Corporation 9.10.2001 13:00:00 35840 C:\WINDOWS\SYSTEM32\ncpa.cpl Microsoft Corporation 9.10.2001 13:00:00 37376 C:\WINDOWS\SYSTEM32\nwc.cpl Microsoft Corporation 9.10.2001 13:00:00 28160 C:\WINDOWS\SYSTEM32\telephon.cpl Microsoft Corporation 14.9.2004 13:12:10 135168 C:\WINDOWS\SYSTEM32\desk.cpl Microsoft Corporation 14.9.2004 13:12:08 549888 C:\WINDOWS\SYSTEM32\appwiz.cpl Microsoft Corporation 14.9.2004 13:12:10 110592 C:\WINDOWS\SYSTEM32\bthprops.cpl Microsoft Corporation 14.9.2004 13:12:10 80384 C:\WINDOWS\SYSTEM32\firewall.cpl Microsoft Corporation 14.9.2004 13:12:10 154624 C:\WINDOWS\SYSTEM32\hdwwiz.cpl Microsoft Corporation 14.9.2004 13:12:10 359424 C:\WINDOWS\SYSTEM32\inetcpl.cpl Microsoft Corporation 14.9.2004 13:12:10 129536 C:\WINDOWS\SYSTEM32\intl.cpl Microsoft Corporation 14.9.2004 13:12:10 380416 C:\WINDOWS\SYSTEM32\irprops.cpl Microsoft Corporation 14.9.2004 13:12:10 68608 C:\WINDOWS\SYSTEM32\joy.cpl Microsoft Corporation 14.9.2004 13:12:10 620032 C:\WINDOWS\SYSTEM32\mmsys.cpl Microsoft Corporation 14.9.2004 13:12:10 25600 C:\WINDOWS\SYSTEM32\netsetup.cpl Microsoft Corporation 14.9.2004 13:12:10 256000 C:\WINDOWS\SYSTEM32\nusrmgr.cpl Microsoft Corporation 14.9.2004 13:12:10 32768 C:\WINDOWS\SYSTEM32\odbccp32.cpl Microsoft Corporation 14.9.2004 13:12:10 115200 C:\WINDOWS\SYSTEM32\powercfg.cpl Microsoft Corporation 14.9.2004 13:12:10 299008 C:\WINDOWS\SYSTEM32\sysdm.cpl Microsoft Corporation 14.9.2004 13:12:10 93696 C:\WINDOWS\SYSTEM32\timedate.cpl Microsoft Corporation 14.9.2004 13:12:10 148480 C:\WINDOWS\SYSTEM32\wscui.cpl Labtec Inc. 12.2.2004 16:59:12 151552 C:\WINDOWS\SYSTEM32\CamCpl.cpl Microsoft Corporation 14.9.2004 15:12:08 70144 C:\WINDOWS\SYSTEM32\access.cpl Microsoft Corporation 26.5.2005 4:16:30 174872 C:\WINDOWS\SYSTEM32\wuaucpl.cpl Sun Microsystems, Inc. 10.11.2005 13:03:50 49265 C:\WINDOWS\SYSTEM32\jpicpl32.cpl 19.11.1999 13:54:12 155648 C:\WINDOWS\SYSTEM32\PPPoEService.cpl Microsoft Corporation 14.9.2004 13:12:10 32768 C:\WINDOWS\SYSTEM32\dllcache\odbccp32.cpl Microsoft Corporation 14.9.2004 15:12:08 70144 C:\WINDOWS\SYSTEM32\dllcache\access.cpl Microsoft Corporation 14.9.2004 13:12:08 549888 C:\WINDOWS\SYSTEM32\dllcache\appwiz.cpl Microsoft Corporation 9.10.2001 13:00:00 37376 C:\WINDOWS\SYSTEM32\dllcache\nwc.cpl Microsoft Corporation 14.9.2004 15:12:10 135168 C:\WINDOWS\SYSTEM32\dllcache\desk.cpl Microsoft Corporation 14.9.2004 13:12:10 80384 C:\WINDOWS\SYSTEM32\dllcache\firewall.cpl Microsoft Corporation 14.9.2004 13:12:10 154624 C:\WINDOWS\SYSTEM32\dllcache\hdwwiz.cpl Microsoft Corporation 14.9.2004 13:12:10 359424 C:\WINDOWS\SYSTEM32\dllcache\inetcpl.cpl Microsoft Corporation 14.9.2004 13:12:10 129536 C:\WINDOWS\SYSTEM32\dllcache\intl.cpl Microsoft Corporation 9.10.2001 13:00:00 188416 C:\WINDOWS\SYSTEM32\dllcache\main.cpl Microsoft Corporation 14.9.2004 13:12:10 620032 C:\WINDOWS\SYSTEM32\dllcache\mmsys.cpl Microsoft Corporation 14.9.2004 13:12:10 68608 C:\WINDOWS\SYSTEM32\dllcache\joy.cpl Microsoft Corporation 9.10.2001 13:00:00 35840 C:\WINDOWS\SYSTEM32\dllcache\ncpa.cpl Microsoft Corporation 14.9.2004 13:12:10 115200 C:\WINDOWS\SYSTEM32\dllcache\powercfg.cpl Microsoft Corporation 14.9.2004 13:12:10 25600 C:\WINDOWS\SYSTEM32\dllcache\netsetup.cpl Microsoft Corporation 14.9.2004 13:12:10 155648 C:\WINDOWS\SYSTEM32\dllcache\sapi.cpl Microsoft Corporation 14.9.2004 13:12:10 256000 C:\WINDOWS\SYSTEM32\dllcache\nusrmgr.cpl Microsoft Corporation 14.9.2004 13:12:10 299008 C:\WINDOWS\SYSTEM32\dllcache\sysdm.cpl Microsoft Corporation 9.10.2001 13:00:00 28160 C:\WINDOWS\SYSTEM32\dllcache\telephon.cpl Microsoft Corporation 14.9.2004 13:12:10 93696 C:\WINDOWS\SYSTEM32\dllcache\timedate.cpl Microsoft Corporation 14.9.2004 13:12:10 148480 C:\WINDOWS\SYSTEM32\dllcache\wscui.cpl Microsoft Corporation 26.5.2005 4:16:30 174872 C:\WINDOWS\SYSTEM32\dllcache\wuaucpl.cpl »»»»»»»»»»»»»»»»» Checking Selected Startup Folders »»»»»»»»»»»»»»»»»»»»» Checking files in %ALLUSERSPROFILE%\Startup folder... 16.12.2005 17:22:54 HS 84 C:\Documents and Settings\All Users\Käynnistä-valikko\Ohjelmat\Käynnistys\desktop.ini 26.5.2006 11:55:58 937 C:\Documents and Settings\All Users\Käynnistä-valikko\Ohjelmat\Käynnistys\F-Secure Anti-Virus 2006.lnk Checking files in %ALLUSERSPROFILE%\Application Data folder... 6.3.2006 19:28:04 305 C:\Documents and Settings\All Users\Application Data\addr_file.html 16.12.2005 17:10:50 HS 62 C:\Documents and Settings\All Users\Application Data\desktop.ini Checking files in %USERPROFILE%\Startup folder... 16.12.2005 17:22:54 HS 84 C:\Documents and Settings\Janne\Käynnistä-valikko\Ohjelmat\Käynnistys\desktop.ini Checking files in %USERPROFILE%\Application Data folder... 11.1.2006 16:38:28 1559 C:\Documents and Settings\Janne\Application Data\AdobeDLM.log 16.12.2005 17:10:50 HS 62 C:\Documents and Settings\Janne\Application Data\desktop.ini 11.1.2006 16:38:28 0 C:\Documents and Settings\Janne\Application Data\dm.ini »»»»»»»»»»»»»»»»» Checking Selected Registry Keys »»»»»»»»»»»»»»»»»»»»»»» [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] SV1 = [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] [HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers] HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Erasext {8BE13461-936F-11D1-A87D-444553540000} = C:\Program Files\Eraser\erasext.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\ewido {57BD36D7-CE32-4600-9B1C-1A0C47EFC02E} = C:\Program Files\ewido anti-malware\context.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Offline Files {750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With {09799AFB-AD67-11d1-ABCD-00C04FC30936} = %SystemRoot%\system32\SHELL32.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With EncryptionMenu {A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\PrivShellExt {60CE0473-50F7-417B-A10F-6921827B9CA8} = C:\Program Files\Acronis\PrivacyExpert\PrivShellExt.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\WinRAR {B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{23814B80-52A2-11d0-BC1A-004095606CB9} F-Secure = C:\Program Files\F-Secure Internet Security\Common\fpshx.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8} Käynnistä-valikon nasta = %SystemRoot%\system32\SHELL32.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers] HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\Erasext {8BE13461-936F-11D1-A87D-444553540000} = C:\Program Files\Eraser\erasext.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\PrivexShellExt {60CE0473-50F7-417B-A10F-6921827B9CA8} = C:\Program Files\Acronis\PrivacyExpert\PrivShellExt.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR {B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\{23814B80-52A2-11d0-BC1A-004095606CB9} F-Secure = C:\Program Files\F-Secure Internet Security\Common\fpshx.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers] HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EncryptionMenu {A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ewido {57BD36D7-CE32-4600-9B1C-1A0C47EFC02E} = C:\Program Files\ewido anti-malware\context.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Offline Files {750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Sharing {f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} = ntshrui.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinRAR {B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers] HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{0D2E74C4-3C34-11d2-A27E-00C04FC30871} = %SystemRoot%\system32\SHELL32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F01-7B1C-11d1-838f-0000F80461CF} = %SystemRoot%\system32\SHELL32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F02-7B1C-11d1-838f-0000F80461CF} = %SystemRoot%\system32\SHELL32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{66742402-F9B9-11D1-A202-0000F81FEDEE} = %SystemRoot%\system32\SHELL32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{F9DB5320-233E-11D1-9F84-707F02C10627} = C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll [HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} AcroIEHlprObj Class = C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} SSVHelper Class = C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E24AD748-155E-4254-B674-4EDF86E7E1DF} CAdBlocker Object = C:\Program Files\Acronis\PrivacyExpert\Blocker.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376} &Päivän vihje = %SystemRoot%\system32\shdocvw.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{08B0E5C0-4FCB-11CF-AAA5-00401C608501} MenuText = Sun Java Console : C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{300DB664-75B5-47c0-8B45-A44ACCF73C00} ButtonText = IE-suojaus : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{FB5F1910-F110-11d2-BB9E-00C04F795683} ButtonText = Messenger : C:\Program Files\Messenger\msmsgs.exe [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{21569614-B795-46B1-85F4-E737A8DC09AD} Shell Search Band = %SystemRoot%\system32\browseui.dll HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{EFA24E61-B078-11D0-89E4-00C04FC9E26E} Favorites Band = %SystemRoot%\system32\shdocvw.dll HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{EFA24E62-B078-11D0-89E4-00C04FC9E26E} History Band = %SystemRoot%\system32\shdocvw.dll [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser {01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Lähiosoite : %SystemRoot%\system32\browseui.dll HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser {01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Lähiosoite : %SystemRoot%\system32\browseui.dll {0E5CBF21-D15F-11D0-8301-00AA005B4383} = &Linkit : %SystemRoot%\system32\SHELL32.dll {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} = : {EF99BD32-C1FB-11D2-892F-0090271D4F88} = Yahoo! Toolbar : [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] VTTimer VTTimer.exe SunJavaUpdateSched C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe DAEMON Tools "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 ATICCC "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay F-Secure Manager "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash F-Secure TNB "C:\Program Files\F-Secure Internet Security\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW F-Secure Startup Wizard "C:\Program Files\F-Secure Internet Security\FSGUI\FSSW.EXE" /reboot JeticoPFStartup "C:\Program Files\Jetico\Jetico Personal Firewall\fwsrv.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] IMAIL Installed = MAPI Installed = MSFS Installed = [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] msnmsgr "C:\Program Files\MSN Messenger\msnmsgr.exe" /background MSMSGS "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\run] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\services HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\KernelFaultCheck key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item dumprep 0 -k hkey HKLM command %systemroot%\system32\dumprep 0 -k inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item dumprep 0 -k hkey HKLM command %systemroot%\system32\dumprep 0 -k inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\NetBuster key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item NetBuster hkey HKLM command C:\DOCUME~1\Janne\LOCALS~1\Temp\Rar$EX00.437\NetBuster.exe inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item NetBuster hkey HKLM command C:\DOCUME~1\Janne\LOCALS~1\Temp\Rar$EX00.437\NetBuster.exe inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\state system.ini 0 win.ini 0 bootini 0 services 0 startup 2 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run DirectX For Microsoft® Windows C:\WINDOWS\system32\fservice.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum {BDEADF00-C265-11D0-BCED-00A0C90AB50F} = C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL {6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} = {0DF44EAA-FF21-4412-828E-260A8728E7F1} = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system dontdisplaylastusername 0 legalnoticecaption legalnoticetext shutdownwithoutlogon 1 undockwithoutlogon 1 DisableTaskMgr 0 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies] HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ActiveDesktop NoChangingWallPaper 0 NoAddingComponents 0 NoComponents 0 NoDeletingComponents 0 NoEditingComponents 0 NoCloseDragDropBands 0 NoMovingBands 0 NoHTMLWallPaper 1 HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer NoDriveTypeAutoRun 145 NoActiveDesktop 0 NoSaveSettings 0 ClassicShell 0 NoThemesTab 0 HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System DisableTaskMgr 0 NoDispAppearancePage 0 NoColorChoice 0 NoSizeChoice 0 NoDispBackgroundPage 0 NoDispScrSavPage 0 NoDispCPL 0 NoVisualStyleChoice 0 NoDispSettingsPage 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] PostBootReminder {7849596a-48ea-486e-8937-a2a3009f31a9} = %SystemRoot%\system32\SHELL32.dll CDBurn {fbeb8a05-beee-4442-804e-409d6c4515e9} = %SystemRoot%\system32\SHELL32.dll WebCheck {E6FB5E20-DE35-11CF-9C87-00AA005127ED} = %SystemRoot%\system32\webcheck.dll SysTray {35CEC8A3-2BE6-11D2-8773-92E220524153} = C:\WINDOWS\system32\stobject.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] UserInit = C:\WINDOWS\system32\userinit.exe, Shell = Explorer.exe C:\WINDOWS\system32\fservice.exe System = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent = Ati2evxx.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain = crypt32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet = cryptnet.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll = cscdll.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp = wlnotify.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule = wlnotify.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy = sclgntfy.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn = WlNotify.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv = wlnotify.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon = wlnotify.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path Debugger = ntsd -d [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] AppInit_DLLs , »»»»»»»»»»»»»»»»»»»»»»»» Scan Complete »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» WinPFind v1.4.1 - Log file written to "WinPFind.Txt" in the WinPFind folder. Scan completed on 26.5.2006 12:18:21 Hijackthis: Logfile of HijackThis v1.99.1 Scan saved at 05:25, on 26.5.2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\SYSTEM32\Ati2evxx.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\system32\VTTimer.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE C:\Program Files\Jetico\Jetico Personal Firewall\fwsrv.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE C:\Program Files\FileZilla Server\FileZilla Server.exe C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE C:\PROGRA~1\VLPOY-~1\NETIKK~1\app\pppoeservice.exe C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE C:\Program Files\Common Files\Acronis\Malware Shield\psh_svc.exe C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe C:\Program Files\F-Secure Internet Security\Anti-Virus\fsrw.exe C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe C:\PROGRA~1\F-SECU~1\ANTI-S~1\fsaw.exe C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\system32\NOTEPAD.EXE C:\Documents and Settings\Janne\Omat tiedostot\Turhat roinat\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: CAdBlocker Object - {E24AD748-155E-4254-B674-4EDF86E7E1DF} - C:\Program Files\Acronis\PrivacyExpert\Blocker.dll O4 - HKLM\..\Run: [VTTimer] VTTimer.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\F-Secure Internet Security\FSGUI\FSSW.EXE" /reboot O4 - HKLM\..\Run: [JeticoPFStartup] "C:\Program Files\Jetico\Jetico Personal Firewall\fwsrv.exe" O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - Global Startup: F-Secure Anti-Virus 2006.lnk = C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\F-Secure Internet Security\Anti-Spyware\blockpopups.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.pcpitstop.com/pestscan/pestscan.cab O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - https://scan.safety.live.com/resource/download/scanner/en-us/wlscbase3401.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1134748462192 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) - http://secure2.comned.com/signuptemplates/securelogin-devel.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4672/mcfscan.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{6A4FC8D3-2218-4990-AE9F-EE6CF757CC2E}: NameServer = 62.148.192.130 62.148.192.154 O20 - AppInit_DLLs: , O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: F-Secure Anti-Virus 2006 (BackWeb Plug-in - 4476822) - F-Secure Internet Security 2005 - C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe O23 - Service: FileZilla Server FTP server (FileZilla Server) - FileZilla Project - C:\Program Files\FileZilla Server\FileZilla Server.exe O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE O23 - Service: PPPoE Service (PPPoEService) - Unknown owner - C:\PROGRA~1\VLPOY-~1\NETIKK~1\app\pppoeservice.exe O23 - Service: Acronis Malware Shield Service (psh_svc) - Unknown owner - C:\Program Files\Common Files\Acronis\Malware Shield\psh_svc.exe O23 - Service: Remote Administrator Service (r_server) - Unknown owner - C:\WINDOWS\system32\r_server.exe" /service (file missing) O23 - Service: Sygate Personal Firewall (SmcService) - Unknown owner - C:\Program Files\Sygate\SPF\smc.exe (file missing) O23 - Service: WTScheduler - Unknown owner - C:\Program Files\WinTask\Bin\SchedSrv.exe
Edelleen olen sitä mieltä että format c: Sen verran pahaa tavaraa (backdooreja, keyloggereita) näkyy kaikissa lokeissa, että melko mun mielestä turha lähteä tuota putsaamaan. Ei tulis kuitenkaan puhtaaksi.
Juu, ei se lähtenyt. Täällä on örkki -> C:\WINDOWS\SERVICES.exe Sanon tämän jo tässä vaiheessa: Koneellasi on todella paha örkki ja suosittelen ensisijaisesti ainoastaan formatointia! Tämä siksi, että konetta ei välttämättä saada ensinnäkään puhtaaksi. Itse formatoisin heti, jos tuo olis koneessa. <----------------------------------------------------------------------- sen verran että tuo ei ole todellakaan ole mikään haitta ongelma se on ihan normaali, minun koneellakin on se ja kaikkien minun tutuitten. Minun koneella on Adware.Look2Me, WebHancer, Targetsaver, Cool/webSearcg 6, Win32.p2p-Worm.Alcan.a ja koneellani on f-secure 2005 ja se havaitsee ongelmat mutta ei poista niitä lopullisesti MIKÄ NEUVVOKSI??? Ja minun konettani ei voi formatoida.
@Zoose: Sinun koneellasi on: C:\WINDOWS\system32\services.exe kolehdin koneella on tuon lisäksi. C:\WINDOWS\services.exe Kaksi hiukan eri asiaa, toinen on örkki ja toinen windowsin oma tiedosto Eli sillä hakemistolla on väliä, ylempi Windowsin oma tiedosto ja alempi Backdoor.Proratin tiedosto. Ja omaan ongelmaasi: Luo uusi viestiketju ja lähetä HjT-loki, ohjeet -> http://keskustelu.afterdawn.com/thread_view.cfm/316714
