1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Hjt-loki ja virusongelmia

Discussion in 'Virukset ja haittaohjelmat' started by H8Virus, Sep 30, 2005.

Page 2 of 5
  1. Zipp2

    Zipp2 Regular member

    Joined:
    Sep 30, 2005
    Messages:
    376
    Likes Received:
    0
    Trophy Points:
    26
    Vielä se on siellä.
    Ota tosta RKFiles

    http://skads.org/special/rkfiles.zip

    Pura se vaikka työpöydälle ja sitte tuplaklikkaa RKFiles.bat
    Anna sen scannata valmiiks ja lähetä sen logi. (c:\log.txt)
    Siinä menee jonku aikaa ku se scannaa,älä hermostu.


     
    Zipp2, Oct 1, 2005
    #21
  2. H8Virus

    H8Virus Regular member

    Joined:
    Sep 30, 2005
    Messages:
    114
    Likes Received:
    0
    Trophy Points:
    26
    C:\Documents and Settings\NC\Ty”p”yt„

    PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
    Files Found in system Folder............
    ------------------------
    C:\WINDOWS\system32\dfrg.msc: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAwGpEc213
    C:\WINDOWS\system32\DivX.dll: PEC2
    C:\WINDOWS\system32\dfrg.msc: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAwGpEc213
    C:\WINDOWS\system32\DivX.dll: PEC2

    Files Found in all users startup Folder............
    ------------------------
    Files Found in all users windows Folder............
    ------------------------
    Finished
    bye
     
    H8Virus, Oct 1, 2005
    #22
  3. Zipp2

    Zipp2 Regular member

    Joined:
    Sep 30, 2005
    Messages:
    376
    Likes Received:
    0
    Trophy Points:
    26
    Ei näy mitään tossa.
    Löytääkö tuo Ewido jotain ku scannaat,päivitä se ensin.
     
    Zipp2, Oct 1, 2005
    #23
  4. H8Virus

    H8Virus Regular member

    Joined:
    Sep 30, 2005
    Messages:
    114
    Likes Received:
    0
    Trophy Points:
    26
    Juu tolla Ewidolla löytyy päivitäin ainakin 50 roskaa, nytkin 66 kappaletta.
     
    H8Virus, Oct 1, 2005
    #24
  5. Zipp2

    Zipp2 Regular member

    Joined:
    Sep 30, 2005
    Messages:
    376
    Likes Received:
    0
    Trophy Points:
    26
    Pistäs sen Ewidon logi,jospa siinä ois jotain.
     
    Zipp2, Oct 1, 2005
    #25
  6. Toymaatti

    Toymaatti Active member

    Joined:
    Feb 4, 2005
    Messages:
    1,038
    Likes Received:
    0
    Trophy Points:
    66
    Taitaa suurin syy ongelmaan olla tuo päivittämätön XP, ainakin SP1 koneelle niin fixi vois onnistua jopa HjT:llä.
     
    Toymaatti, Oct 1, 2005
    #26
  7. H8Virus

    H8Virus Regular member

    Joined:
    Sep 30, 2005
    Messages:
    114
    Likes Received:
    0
    Trophy Points:
    26
    Mitenkäs tuosta Ewidosta saa lokin? Karanteenista en saanut copy/pastettua.

    Entä jos laitan Service pack 1:n niin voiko luottaa siihen ettei mitään tiedostoja katoa? Siellähän sanotaan että pitäisi ottaa varmuuskopiot tiedostoista.
     
    H8Virus, Oct 1, 2005
    #27
  8. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Siinä pitää muistaakseni tallentaa raportti.

    Koskaanhan ei voi olla 100% varma, mutta itse olen päivittänyt XP -> SP1 -> SP2 ilman ongelmia.
     
    -kemisti-, Oct 1, 2005
    #28
  9. H8Virus

    H8Virus Regular member

    Joined:
    Sep 30, 2005
    Messages:
    114
    Likes Received:
    0
    Trophy Points:
    26
    No jos nyt sitten uskaltaisi laittaa sen SP1:n niin katsotaan mitä käy.
     
    H8Virus, Oct 1, 2005
    #29
  10. Zipp2

    Zipp2 Regular member

    Joined:
    Sep 30, 2005
    Messages:
    376
    Likes Received:
    0
    Trophy Points:
    26
    Lähetäs vielä uus SilentRunnes logi,niin näkee onko se ok.
     
    Zipp2, Oct 1, 2005
    #30
  11. Toymaatti

    Toymaatti Active member

    Joined:
    Feb 4, 2005
    Messages:
    1,038
    Likes Received:
    0
    Trophy Points:
    66
    Samoin SP1/2 heittämällä sisälle, eikä mitään ongelmia.
    Voithan ottaa kopion jos on tärkeitä tietoja, toiselle osiolle tai vielä parempi jos toiselle kiintolevylle/rompulle, tai jos tietoa ei ole kovinpaljoa niin korpulle.
    Mutta noita varmuuskopiointi suosituksia annetaan joka paikassa, se varmaan pitäis ottaa silloinkin jos lähtee välillä p**kalle :)
     
    Last edited: Oct 1, 2005
    Toymaatti, Oct 1, 2005
    #31
  12. H8Virus

    H8Virus Regular member

    Joined:
    Sep 30, 2005
    Messages:
    114
    Likes Received:
    0
    Trophy Points:
    26
    Ok, tässä Silent Runner-loki:

    lent Runners.vbs", revision 40.1, http://www.silentrunners.org/
    Operating System: Windows XP
    Output limited to non-default values, except where indicated by "{++}"


    Startup items buried in registry:
    ---------------------------------

    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
    "a-squared" = ""C:\Program Files\a2\a2guard.exe"" [null data]

    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
    "ATIPTA" = "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" ["ATI Technologies, Inc."]
    "Cmaudio" = "RunDll32 cmicnfg.cpl,CMICtrlWnd" [MS]
    "NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
    "SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe" ["Sun Microsystems, Inc."]
    "F-Secure Manager" = ""C:\Program Files\Sonera Tietoturva\Common\FSM32.EXE" /splash" ["F-Secure Corporation"]
    "F-Secure TNB" = ""C:\Program Files\Sonera Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW" ["F-Secure Corporation"]
    "News Service" = ""C:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe"" ["F-Secure Corporation"]
    "SmcService" = "C:\PROGRA~1\Sygate\SPF\smc.exe -startgui" ["Sygate Technologies, Inc."]

    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
    {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]
    -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]

    HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
    "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Display Panning CPL -laajennus"
    -> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found]
    "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal-kuvakkeen tunniste"
    -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
    "{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
    -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\Audiodev.dll" [MS]
    "{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
    -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\Audiodev.dll" [MS]
    "{E0D79304-84BE-11CE-9641-444553540000}" = "WinZip"
    -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
    "{E0D79305-84BE-11CE-9641-444553540000}" = "WinZip"
    -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
    "{E0D79306-84BE-11CE-9641-444553540000}" = "WinZip"
    -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
    "{E0D79307-84BE-11CE-9641-444553540000}" = "WinZip"
    -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
    "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
    -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
    "{AB77609F-2178-4E6F-9C4B-44AC179D937A}" = "a² Context Menu Shell Extension"
    -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\a2\A2CONT~1.DLL" [null data]

    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
    INFECTION WARNING! "{54D9498B-CF93-414F-8984-8CE7FDE0D391}" = "ewido shell guard"
    -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\ewido\security suite\shellhook.dll" ["TODO: <Firmenname>"]

    HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
    INFECTION WARNING! AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]

    HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
    ewido\(Default) = "{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}"
    -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\ewido\security suite\context.dll" ["ewido networks"]
    WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
    -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
    WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
    -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]

    HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
    ewido\(Default) = "{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}"
    -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\ewido\security suite\context.dll" ["ewido networks"]
    WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
    -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
    WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
    -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]

    HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
    a2ContMenu\(Default) = "{AB77609F-2178-4E6F-9C4B-44AC179D937A}"
    -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\a2\A2CONT~1.DLL" [null data]
    WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
    -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
    WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
    -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]


    Active Desktop and Wallpaper:
    -----------------------------

    Active Desktop is disabled at this entry:
    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

    HKCU\Control Panel\Desktop\
    "Wallpaper" = "C:\WINDOWS\Firefox Wallpaper.bmp"


    Startup items in "NC" & "All Users" startup folders:
    ----------------------------------------------------

    C:\Documents and Settings\All Users\Käynnistä-valikko\Ohjelmat\Käynnistys
    "Adobe Reader Speed Launch" -> shortcut to: "C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe" ["Adobe Systems Incorporated"]


    Winsock2 Service Provider DLLs:
    -------------------------------

    Namespace Service Providers

    HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
    000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
    000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
    000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

    Transport Service Providers

    HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
    0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
    %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 17
    %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


    Toolbars, Explorer Bars, Extensions:
    ------------------------------------

    Extensions (Tools menu items, main toolbar menu buttons)

    HKLM\Software\Microsoft\Internet Explorer\Extensions\
    {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
    "MenuText" = "Sun Java Console"
    "CLSIDExtension" = "{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBC}"
    -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll" ["Sun Microsystems, Inc."]

    {FB5F1910-F110-11D2-BB9E-00C04F795683}\
    "ButtonText" = "Messenger"
    "MenuText" = "Windows Messenger"
    "Exec" = "C:\Program Files\Messenger\MSMSGS.EXE" [MS]


    Running Services (Display Name, Service Name, Path {Service DLL}):
    ------------------------------------------------------------------

    Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\System32\Ati2evxx.exe" ["ATI Technologies Inc."]
    ewido security suite control, ewido security suite control, "C:\Program Files\ewido\security suite\ewidoctrl.exe" ["ewido networks"]
    F-Secure Anti-Virus Firewall Daemon, FSDFWD, ""C:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe"" ["F-Secure Corporation"]
    F-Secure Gatekeeper Handler Starter, F-Secure Gatekeeper Handler Starter, ""C:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe"" ["F-Secure Corp."]
    F-Secure Management Agent, FSMA, ""C:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE"" ["F-Secure Corporation"]
    fsbwsys, fsbwsys, ""C:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe"" ["F-Secure Corp."]
    Sonera Tietoturva, BackWeb Plug-in - 4436233, "C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE" [null data]
    Sygate Personal Firewall, SmcService, "C:\Program Files\Sygate\SPF\smc.exe" ["Sygate Technologies, Inc."]
    Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\System32\wdfmgr.exe" [MS]


    ----------
    + This report excludes default entries except where indicated.
    + To see *everywhere* the script checks and *everything* it finds,
    launch it from a command prompt or a shortcut with the -all parameter.
    + To search all directories of local fixed drives for DESKTOP.INI
    DLL launch points and all Registry CLSIDs for dormant Explorer Bars,
    use the -supp parameter or answer "No" at the first message box.
    ---------- (total run time: 55 seconds, including 18 seconds for message boxes)
     
    H8Virus, Oct 1, 2005
    #32
  13. Zipp2

    Zipp2 Regular member

    Joined:
    Sep 30, 2005
    Messages:
    376
    Likes Received:
    0
    Trophy Points:
    26
    Ei näy mitään.
    Koska nuo 01 ja 017 rivit on mukana tossa wareout infektiossa,niin aja vielä tuo varalta.

    http://forums.subratam.org/index.php?act=Attach&type=post&id=43811

    Säästä se työpöydälle ja sitte avaa se ja seuraa ohjeita.
    Ku kone käynnistyy uudestaan ja Hijackki avutuu itestään niin merkka ja Fix:saa tuo

    O17 - HKLM\System\CCS\Services\Tcpip\..\{CD20828F-D2A6-46A4-BE12-2CB38C6E8ADD}: NameServer = 69.50.161.132 85.255.112.15


    Ehkä sitte lopuks joudut vielä käynnistään uudestaan,mutta sen näät sitte.
    Kato sitte jos tuo rivi ois vaikka poissa.
    Jos se fixi löytää jotain niin pistä sen logi tänne,niin nähään mitä siellä oli(C:\fixwareout\report.txt)
     
    Last edited: Oct 1, 2005
    Zipp2, Oct 1, 2005
    #33
  14. H8Virus

    H8Virus Regular member

    Joined:
    Sep 30, 2005
    Messages:
    114
    Likes Received:
    0
    Trophy Points:
    26
    Hjt ei käynnistynyt itsestään mutta käynnistin manuaalisesti ja poistin sen 017 rivin (taas) ja käynnistin uudellen koneen ja siellähän se taas oli. Tässä kuitenkin wareout-loki:

    Fixwareout ver 1.002
    Post this report in the forums please

    Reg Entries that were deleted
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\pgtshlld
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\nidnsdr
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\23naelch
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\aplnsftn
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\23rtcdaol
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\refaselif
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\1dedoc
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\llams_ogol
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\repiwh
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\domdnb
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\orcimlh
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\23tsniow
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\14
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\15
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\16
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\17
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\18
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\19
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\20
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\21
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\22
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\smwmd
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\23
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\24
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\25
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\26
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\27
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\28
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\29
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\30
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\31
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\32
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\33
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\34
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\35
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\36
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\37
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\pgtshlld
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\gib_ogol
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\nidnsdr
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\23naelch
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\ytpme
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\23lserspg
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\aplnsftn
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\23rtcdaol
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\putesprpgd
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\refaselif
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\1dedoc
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\llams_ogol
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\repiwh
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\domdnb
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\orcimlh
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\23tsniow

    PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.

    »»»»» Search by size and names...
    C:\WINDOWS\SYSTEM32\WOINST32.EXE

    »»»»» Misc files

    »»»»» Checking for older varients covered by the Rem3 tool
     
    H8Virus, Oct 1, 2005
    #34
  15. Zipp2

    Zipp2 Regular member

    Joined:
    Sep 30, 2005
    Messages:
    376
    Likes Received:
    0
    Trophy Points:
    26
    Olihan siellä pikkasen roskaa.
    Poista tuo vikasietotilassa ja piilotiedostot näkyvissä

    C:\WINDOWS\SYSTEM32\WOINST32.EXE

    jos sitä ei löydy,niin käytä sitä Hijackin Delete a file on reboot toimintoo,niiku aikasemmin jo teit.
    Sitte taas Fix:saa se rivi ja kato jos se pysyy poissa.
     
    Zipp2, Oct 1, 2005
    #35
  16. H8Virus

    H8Virus Regular member

    Joined:
    Sep 30, 2005
    Messages:
    114
    Likes Received:
    0
    Trophy Points:
    26
    No nyt on C:\WINDOWS\SYSTEM32\WOINST32.EXE poistettu, mitä seuraavaksi?
     
    H8Virus, Oct 1, 2005
    #36
  17. Zipp2

    Zipp2 Regular member

    Joined:
    Sep 30, 2005
    Messages:
    376
    Likes Received:
    0
    Trophy Points:
    26
    Poista taas se 017 rivi Hijackillä ja kato jos se pysyy poissa.
     
    Zipp2, Oct 1, 2005
    #37
  18. H8Virus

    H8Virus Regular member

    Joined:
    Sep 30, 2005
    Messages:
    114
    Likes Received:
    0
    Trophy Points:
    26
    Eipä se pysynyt poissa.
     
    H8Virus, Oct 1, 2005
    #38
  19. Zipp2

    Zipp2 Regular member

    Joined:
    Sep 30, 2005
    Messages:
    376
    Likes Received:
    0
    Trophy Points:
    26
    Niin sekö tulee heti takas ku netin aukasee vai?
    Nyt joutuu funtsiin mitä seuraavaks.
     
    Zipp2, Oct 1, 2005
    #39
  20. H8Virus

    H8Virus Regular member

    Joined:
    Sep 30, 2005
    Messages:
    114
    Likes Received:
    0
    Trophy Points:
    26
    Kyllä joo tulee aina takasin kun netin laittaa päälle.
     
    H8Virus, Oct 1, 2005
    #40
Page 2 of 5

Share This Page