1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Hjt-loki ja virusongelmia

Discussion in 'Virukset ja haittaohjelmat' started by H8Virus, Sep 30, 2005.

Page 4 of 5
  1. H8Virus

    H8Virus Regular member

    Joined:
    Sep 30, 2005
    Messages:
    114
    Likes Received:
    0
    Trophy Points:
    26
    Eipä lähtenyt vieläkään se rivi pois.
     
    H8Virus, Oct 2, 2005
    #61
  2. Zipp2

    Zipp2 Regular member

    Joined:
    Sep 30, 2005
    Messages:
    376
    Likes Received:
    0
    Trophy Points:
    26
    Heh...tuntuu olevan lujassa.
    Ajappa vielä se Fixwareout samalla lailla ku eka kerralla ja sitte sen logi tänne jos jotain löyty.
     
    Zipp2, Oct 2, 2005
    #62
  3. nwind

    nwind Regular member

    Joined:
    May 21, 2003
    Messages:
    452
    Likes Received:
    12
    Trophy Points:
    28
    otettu pois...
     
    Last edited: Oct 2, 2005
    nwind, Oct 2, 2005
    #63
  4. Zipp2

    Zipp2 Regular member

    Joined:
    Sep 30, 2005
    Messages:
    376
    Likes Received:
    0
    Trophy Points:
    26
    Tuota tää viestiketju on jo niin pitkä ja sitte jos joku "insinööri " vielä sattuu kattoon tätä tapausta ja siellä välissä on jonku muun logi,niin menee sekasi,joten ota pois tuo logi ja alota oma keskustelu.
     
    Zipp2, Oct 2, 2005
    #64
  5. H8Virus

    H8Virus Regular member

    Joined:
    Sep 30, 2005
    Messages:
    114
    Likes Received:
    0
    Trophy Points:
    26
    No niin eli ajoin Fixwareoutin ja se ei taaskaan avannut sitä Hijackkia. Olin kyllä juuri ennen tuota poistanut sen rivin 017 että johtuuko siitä sitten?
     
    H8Virus, Oct 8, 2005
    #65
  6. Zipp2

    Zipp2 Regular member

    Joined:
    Sep 30, 2005
    Messages:
    376
    Likes Received:
    0
    Trophy Points:
    26
    Kyllä sen Hijackin pitäs vissiin avautua kun vaan maltat oottaa.
    Löysikö se Fixwareout mitään?
     
    Zipp2, Oct 8, 2005
    #66
  7. H8Virus

    H8Virus Regular member

    Joined:
    Sep 30, 2005
    Messages:
    114
    Likes Received:
    0
    Trophy Points:
    26
    Siis siinä tulee niitä "paina OK" juttuja ja painelin niitä mutta ei avannut Hijackkia, ei se mitään löytänyt.
     
    H8Virus, Oct 8, 2005
    #67
  8. Zipp2

    Zipp2 Regular member

    Joined:
    Sep 30, 2005
    Messages:
    376
    Likes Received:
    0
    Trophy Points:
    26
    Jaa ei löytynny mitään...no pannan taas sormi suuhun ja katellaan.
    Palaan asiaan jos löydän apuva.
     
    Zipp2, Oct 8, 2005
    #68
  9. H8Virus

    H8Virus Regular member

    Joined:
    Sep 30, 2005
    Messages:
    114
    Likes Received:
    0
    Trophy Points:
    26
    Ok.
     
    H8Virus, Oct 8, 2005
    #69
  10. Zipp2

    Zipp2 Regular member

    Joined:
    Sep 30, 2005
    Messages:
    376
    Likes Received:
    0
    Trophy Points:
    26
    No niin..nyt sain tollaset ohjeet,kokeile

    In the windows control panel. If you are using Windows XP's Category View, select the Network and Internet Connections category otherwise double click on Network Connections. Then right click on your default connection, usually local area connection for cable and dsl, and left click on properties. Double-click on the Internet Protocol (TCP/IP) item and select the radio dial that says Obtain DNS servers automatically

    Press OK twice to get out of the properties screen and reboot if it asks.
     
    Zipp2, Oct 8, 2005
    #70
  11. H8Virus

    H8Virus Regular member

    Joined:
    Sep 30, 2005
    Messages:
    114
    Likes Received:
    0
    Trophy Points:
    26
    Tehty. Miten tuo nyt sitten vaikuttaa?
     
    H8Virus, Oct 8, 2005
    #71
  12. Zipp2

    Zipp2 Regular member

    Joined:
    Sep 30, 2005
    Messages:
    376
    Likes Received:
    0
    Trophy Points:
    26
    Ei muuta ku kokeile Fix:ta se rivi taas ja käynnistä uudestaan ja kato tilanne.
     
    Zipp2, Oct 8, 2005
    #72
  13. H8Virus

    H8Virus Regular member

    Joined:
    Sep 30, 2005
    Messages:
    114
    Likes Received:
    0
    Trophy Points:
    26
    Eipä auttanut tuokaan. Jätänkö sen asetuksen niinkuin se nyt on?
     
    H8Virus, Oct 8, 2005
    #73
  14. Zipp2

    Zipp2 Regular member

    Joined:
    Sep 30, 2005
    Messages:
    376
    Likes Received:
    0
    Trophy Points:
    26
    Joo kyllä se vissiin saa olla silleen.
    Mikähän sitä riviä piättää?
     
    Zipp2, Oct 8, 2005
    #74
  15. Zipp2

    Zipp2 Regular member

    Joined:
    Sep 30, 2005
    Messages:
    376
    Likes Received:
    0
    Trophy Points:
    26
    Koita scannata kone F-Secure BlackLightillä jos se löytää jotain

    http://www.f-secure.com/blacklight/

    Sammutakko sää selaimen ennekö Fix:saat sen rivin jos et niin tee se.
    Voit myös kokeilla sen Fixausta vikasietotilassa.
    Jos BlackLight löytää jotain ,niin pistä sen logi.
     
    Zipp2, Oct 8, 2005
    #75
  16. ratnunter

    ratnunter Regular member

    Joined:
    Jun 9, 2005
    Messages:
    131
    Likes Received:
    0
    Trophy Points:
    26
    excuse me for barging in..

    voitas koittaa vielä paria juttua ton blacklightin lisäks:
    imuroi winpfind täältä:
    http://www.bleepingcomputer.com/files/winpfind.php
    pura zippi c:\WinPFind kansioon
    buuttaa vikasietoon
    ja tuplaklikkaa WinPFind.exe
    paina nappia start scan
    oota kunnes se kertoo olevansa valmis ja sen loki aukee
    sitte buuttaa takas normaalitilaan ja laita tänne c:\WinPFind\WinPFind.txt:n sisältö

    ja sitte voitas vähä kikkailla silent runnersilla
    tee kansio c:\silentrunners
    imuroi silentrunners.vbs täältä:
    http://www.silentrunners.org/Silent Runners.vbs
    tallenna se kansioon c:\silentrunners

    klikkaa käynnistä> suorita> kirjoita cmd ja paina enter

    sitte kirjoita komentoriville;
    [bold]cd c:\silentrunners[/bold] ja paina enter
    [bold]"silent runners.vbs" -all [/bold] ja paina taas enter

    oota kunnes se sanoo done ja sitte kopsaa sen lokin sisälto tänne
    huomaa et noiden molempien lokit voi olla piiiiiitkiä, voit tarvita usiamman viestin jotta saat kaiken infon tänne

     
    ratnunter, Oct 8, 2005
    #76
  17. H8Virus

    H8Virus Regular member

    Joined:
    Sep 30, 2005
    Messages:
    114
    Likes Received:
    0
    Trophy Points:
    26
    Zipp2: Juu ei sitä riviä näy HjT:ssä silloin kun ei ole nettiyhteys päällä.

    Blacklightilla ei löytynyt mitään mutta WinPfindin loki on tässä:

    WARNING: not all files found by this scanner are bad. Consult with a knowledgable person before proceeding.

    If you see a message in the titlebar saying "Not responding..." you can ignore it. Windows somethimes displays this message due to the high volume of disk I/O. As long as the hard disk light is flashing, the program is still working properly.

    »»»»»»»»»»»»»»»»» Windows OS and Versions »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    Product Name: Microsoft Windows XP Current Build: Current Build Number: 2600
    Internet Explorer Version: 6.0.2600.0000

    »»»»»»»»»»»»»»»»» Checking Selected Standard Folders »»»»»»»»»»»»»»»»»»»»

    Checking %SystemDrive% folder...

    Checking %ProgramFilesDir% folder...

    Checking %WinDir% folder...

    Checking %System% folder...
    PEC2 9.10.2001 15:00:00 41113 C:\WINDOWS\SYSTEM32\dfrg.msc
    PEC2 27.10.2004 1:38:24 716800 C:\WINDOWS\SYSTEM32\DivX.dll
    PECompact2 27.10.2004 1:38:24 716800 C:\WINDOWS\SYSTEM32\DivX.dll
    UPX! 13.1.2005 21:41:48 11254 C:\WINDOWS\SYSTEM32\locate.com
    Umonitor 12.2.2002 23:22:46 634368 C:\WINDOWS\SYSTEM32\rasdlg.dll
    UPX! 20.1.2005 13:47:50 175616 C:\WINDOWS\SYSTEM32\strings.exe
    winsync 9.10.2001 15:00:00 1309184 C:\WINDOWS\SYSTEM32\wbdbase.deu

    Checking %System%\Drivers folder and sub-folders...

    Items found in C:\WINDOWS\SYSTEM32\drivers\etc\hosts


    Checking the Windows folder and sub-folders for system and hidden files within the last 60 days...
    10.10.2005 17:43:12 S 2048 C:\WINDOWS\bootstat.dat
    10.10.2005 17:43:04 H 8192 C:\WINDOWS\system32\config\default.LOG
    10.10.2005 17:43:22 H 1024 C:\WINDOWS\system32\config\SAM.LOG
    10.10.2005 17:43:14 H 12288 C:\WINDOWS\system32\config\SECURITY.LOG
    10.10.2005 17:44:28 H 77824 C:\WINDOWS\system32\config\software.LOG
    10.10.2005 17:43:16 H 827392 C:\WINDOWS\system32\config\system.LOG
    10.10.2005 17:42:20 H 6 C:\WINDOWS\Tasks\SA.DAT

    Checking for CPL files...
    25.5.2004 18:06:58 417792 C:\WINDOWS\SYSTEM32\ac3filter.cpl
    Microsoft Corporation 9.10.2001 15:00:00 67584 C:\WINDOWS\SYSTEM32\access.cpl
    Microsoft Corporation 9.10.2001 15:00:00 558592 C:\WINDOWS\SYSTEM32\appwiz.cpl
    Microsoft Corporation 9.10.2001 15:00:00 130048 C:\WINDOWS\SYSTEM32\desk.cpl
    Microsoft Corporation 9.10.2001 15:00:00 150016 C:\WINDOWS\SYSTEM32\hdwwiz.cpl
    Microsoft Corporation 9.10.2001 15:00:00 295936 C:\WINDOWS\SYSTEM32\inetcpl.cpl
    Microsoft Corporation 9.10.2001 15:00:00 119808 C:\WINDOWS\SYSTEM32\intl.cpl
    Microsoft Corporation 29.8.2002 4:41:00 208896 C:\WINDOWS\SYSTEM32\joy.cpl
    Sun Microsystems, Inc. 4.3.2005 4:36:44 49265 C:\WINDOWS\SYSTEM32\jpicpl32.cpl
    Microsoft Corporation 9.10.2001 15:00:00 188416 C:\WINDOWS\SYSTEM32\main.cpl
    Microsoft Corporation 9.10.2001 15:00:00 561152 C:\WINDOWS\SYSTEM32\mmsys.cpl
    Microsoft Corporation 9.10.2001 15:00:00 35840 C:\WINDOWS\SYSTEM32\ncpa.cpl
    Microsoft Corporation 9.10.2001 15:00:00 256000 C:\WINDOWS\SYSTEM32\nusrmgr.cpl
    Microsoft Corporation 9.10.2001 15:00:00 37376 C:\WINDOWS\SYSTEM32\nwc.cpl
    Microsoft Corporation 9.10.2001 15:00:00 36864 C:\WINDOWS\SYSTEM32\odbccp32.cpl
    Microsoft Corporation 9.10.2001 15:00:00 109568 C:\WINDOWS\SYSTEM32\powercfg.cpl
    Microsoft Corporation 9.10.2001 15:00:00 271360 C:\WINDOWS\SYSTEM32\sysdm.cpl
    Microsoft Corporation 9.10.2001 15:00:00 28160 C:\WINDOWS\SYSTEM32\telephon.cpl
    Microsoft Corporation 9.10.2001 15:00:00 90112 C:\WINDOWS\SYSTEM32\timedate.cpl
    Microsoft Corporation 26.5.2005 4:16:30 174872 C:\WINDOWS\SYSTEM32\wuaucpl.cpl
    Microsoft Corporation 9.10.2001 15:00:00 67584 C:\WINDOWS\SYSTEM32\dllcache\access.cpl
    Microsoft Corporation 9.10.2001 15:00:00 558592 C:\WINDOWS\SYSTEM32\dllcache\appwiz.cpl
    Microsoft Corporation 9.10.2001 15:00:00 130048 C:\WINDOWS\SYSTEM32\dllcache\desk.cpl
    Microsoft Corporation 9.10.2001 15:00:00 150016 C:\WINDOWS\SYSTEM32\dllcache\hdwwiz.cpl
    Microsoft Corporation 9.10.2001 15:00:00 295936 C:\WINDOWS\SYSTEM32\dllcache\inetcpl.cpl
    Microsoft Corporation 9.10.2001 15:00:00 119808 C:\WINDOWS\SYSTEM32\dllcache\intl.cpl
    Microsoft Corporation 29.8.2002 4:41:00 208896 C:\WINDOWS\SYSTEM32\dllcache\joy.cpl
    Microsoft Corporation 9.10.2001 15:00:00 188416 C:\WINDOWS\SYSTEM32\dllcache\main.cpl
    Microsoft Corporation 9.10.2001 15:00:00 561152 C:\WINDOWS\SYSTEM32\dllcache\mmsys.cpl
    Microsoft Corporation 9.10.2001 15:00:00 35840 C:\WINDOWS\SYSTEM32\dllcache\ncpa.cpl
    Microsoft Corporation 9.10.2001 15:00:00 256000 C:\WINDOWS\SYSTEM32\dllcache\nusrmgr.cpl
    Microsoft Corporation 9.10.2001 15:00:00 37376 C:\WINDOWS\SYSTEM32\dllcache\nwc.cpl
    Microsoft Corporation 9.10.2001 15:00:00 36864 C:\WINDOWS\SYSTEM32\dllcache\odbccp32.cpl
    Microsoft Corporation 9.10.2001 15:00:00 109568 C:\WINDOWS\SYSTEM32\dllcache\powercfg.cpl
    Microsoft Corporation 9.10.2001 15:00:00 147456 C:\WINDOWS\SYSTEM32\dllcache\sapi.cpl
    Microsoft Corporation 9.10.2001 15:00:00 271360 C:\WINDOWS\SYSTEM32\dllcache\sysdm.cpl
    Microsoft Corporation 9.10.2001 15:00:00 28160 C:\WINDOWS\SYSTEM32\dllcache\telephon.cpl
    Microsoft Corporation 9.10.2001 15:00:00 90112 C:\WINDOWS\SYSTEM32\dllcache\timedate.cpl

    »»»»»»»»»»»»»»»»» Checking Selected Startup Folders »»»»»»»»»»»»»»»»»»»»»

    Checking files in %ALLUSERSPROFILE%\Startup folder...
    25.5.2005 22:57:18 1757 C:\Documents and Settings\All Users\Käynnistä-valikko\Ohjelmat\Käynnistys\Adobe Reader Speed Launch.lnk
    18.2.2005 16:29:16 HS 84 C:\Documents and Settings\All Users\Käynnistä-valikko\Ohjelmat\Käynnistys\desktop.ini

    Checking files in %ALLUSERSPROFILE%\Application Data folder...
    18.2.2005 16:17:46 HS 62 C:\Documents and Settings\All Users\Application Data\desktop.ini

    Checking files in %USERPROFILE%\Startup folder...
    18.2.2005 16:29:16 HS 84 C:\Documents and Settings\NC\Käynnistä-valikko\Ohjelmat\Käynnistys\desktop.ini

    Checking files in %USERPROFILE%\Application Data folder...
    18.2.2005 16:17:46 HS 62 C:\Documents and Settings\NC\Application Data\desktop.ini

    »»»»»»»»»»»»»»»»» Checking Selected Registry Keys »»»»»»»»»»»»»»»»»»»»»»»

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]

    [HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers]
    HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\ewido
    {57BD36D7-CE32-4600-9B1C-1A0C47EFC02E} = C:\Program Files\ewido\security suite\context.dll
    HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Offline Files
    {750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll
    HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With
    {09799AFB-AD67-11d1-ABCD-00C04FC30936} = %SystemRoot%\system32\SHELL32.dll
    HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With EncryptionMenu
    {A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll
    HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\WinRAR
    {B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll
    HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\WinZip
    {E0D79304-84BE-11CE-9641-444553540000} = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL
    HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{23814B80-52A2-11d0-BC1A-004095606CB9}
    F-Secure = C:\Program Files\Sonera Tietoturva\Common\fpshx.dll
    HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}
    Käynnistä-valikon nasta = %SystemRoot%\system32\SHELL32.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers]
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\a2ContMenu
    {AB77609F-2178-4E6F-9C4B-44AC179D937A} = C:\PROGRA~1\a2\A2CONT~1.DLL
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR
    {B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinZip
    {E0D79304-84BE-11CE-9641-444553540000} = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\{23814B80-52A2-11d0-BC1A-004095606CB9}
    F-Secure = C:\Program Files\Sonera Tietoturva\Common\fpshx.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers]
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EncryptionMenu
    {A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ewido
    {57BD36D7-CE32-4600-9B1C-1A0C47EFC02E} = C:\Program Files\ewido\security suite\context.dll
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Offline Files
    {750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Sharing
    {f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} = ntshrui.dll
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinRAR
    {B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinZip
    {E0D79304-84BE-11CE-9641-444553540000} = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers]
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{0D2E74C4-3C34-11d2-A27E-00C04FC30871}
    = %SystemRoot%\system32\SHELL32.dll
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F01-7B1C-11d1-838f-0000F80461CF}
    = %SystemRoot%\system32\SHELL32.dll
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F02-7B1C-11d1-838f-0000F80461CF}
    = %SystemRoot%\system32\SHELL32.dll
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{66742402-F9B9-11D1-A202-0000F81FEDEE}
    = %SystemRoot%\system32\SHELL32.dll
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{F9DB5320-233E-11D1-9F84-707F02C10627}
    = C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll

    [HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
    AcroIEHlprObj Class = C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars]
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376}
    &Päivän vihje = %SystemRoot%\System32\shdocvw.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar]
    {8E718888-423F-11D2-876E-00A0C9082467} = &Radio : C:\WINDOWS\System32\msdxm.ocx

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions]
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{08B0E5C0-4FCB-11CF-AAA5-00401C608501}
    MenuText = Sun Java Console : C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{FB5F1910-F110-11d2-BB9E-00C04F795683}
    ButtonText = Messenger : C:\Program Files\Messenger\MSMSGS.EXE

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars]
    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478}
    Media-palkki = %SystemRoot%\System32\browseui.dll

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar]
    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser
    {01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Lähiosoite : %SystemRoot%\System32\browseui.dll
    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
    {01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Lähiosoite : %SystemRoot%\System32\browseui.dll
    {0E5CBF21-D15F-11D0-8301-00AA005B4383} = &Linkit : %SystemRoot%\system32\SHELL32.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    ATIPTA C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    Cmaudio RunDll32 cmicnfg.cpl,CMICtrlWnd
    NeroFilterCheck C:\WINDOWS\system32\NeroCheck.exe
    SunJavaUpdateSched C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
    SmcService C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
    F-Secure Manager "C:\Program Files\Sonera Tietoturva\Common\FSM32.EXE" /splash
    F-Secure TNB "C:\Program Files\Sonera Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
    News Service "C:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    a-squared "C:\Program Files\a2\a2guard.exe"

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\run]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum
    {BDEADF00-C265-11D0-BCED-00A0C90AB50F} = C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
    {6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} =
    {0DF44EAA-FF21-4412-828E-260A8728E7F1} =


    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
    dontdisplaylastusername 0
    legalnoticecaption
    legalnoticetext
    shutdownwithoutlogon 1
    undockwithoutlogon 1


    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]

    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
    NoDriveTypeAutoRun 145


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    PostBootReminder {7849596a-48ea-486e-8937-a2a3009f31a9} = %SystemRoot%\system32\SHELL32.dll
    CDBurn {fbeb8a05-beee-4442-804e-409d6c4515e9} = %SystemRoot%\system32\SHELL32.dll
    WebCheck {E6FB5E20-DE35-11CF-9C87-00AA005127ED} = %SystemRoot%\System32\webcheck.dll
    SysTray {35CEC8A3-2BE6-11D2-8773-92E220524153} = C:\WINDOWS\System32\stobject.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    UserInit = C:\WINDOWS\system32\userinit.exe,
    Shell = Explorer.exe
    System =

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent
    = Ati2evxx.dll

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain
    = crypt32.dll

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet
    = cryptnet.dll

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll
    = cscdll.dll

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp
    = wlnotify.dll

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule
    = wlnotify.dll

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy
    = sclgntfy.dll

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn
    = WlNotify.dll

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv
    = wlnotify.dll

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon
    = wlnotify.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path
    Debugger = ntsd -d

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    AppInit_DLLs


    »»»»»»»»»»»»»»»»»»»»»»»» Scan Complete »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    WinPFind v1.4.1 - Log file written to "WinPFind.Txt" in the WinPFind folder.
    Scan completed on 10.10.2005 17:48:55
     
    H8Virus, Oct 10, 2005
    #77
  18. ratnunter

    ratnunter Regular member

    Joined:
    Jun 9, 2005
    Messages:
    131
    Likes Received:
    0
    Trophy Points:
    26
    entä se silent runners loki ?
     
    ratnunter, Oct 10, 2005
    #78
  19. H8Virus

    H8Virus Regular member

    Joined:
    Sep 30, 2005
    Messages:
    114
    Likes Received:
    0
    Trophy Points:
    26
    "silent runners.vbs" -all ja paina taas enter


    Mitenkäs tuo kohta pitäisi kirjoittaa?
     
    H8Virus, Oct 10, 2005
    #79
  20. ratnunter

    ratnunter Regular member

    Joined:
    Jun 9, 2005
    Messages:
    131
    Likes Received:
    0
    Trophy Points:
    26
    hmm ehkä homma hoituu helpoiten siten et:

    klikkaa käynnistä>suorita> kirjoita cmd ja paina enter

    raahaa ja pudota silentrunners.vbs komentorivi ikkunaan, sitte kirjota toi -all parametri ja paina enter
    oota kunnes tulee laatikko joka kertoo et homma on valmis

    valmiissa lokissa pitäs lukee tällasta
    jos ei ni sitte män väärin, saattaa se örkki näkyä tavan lokissakin

    mut laita se loki..

    muuten mun oman koneen Sr_loki on 56kb ajettuna -all parametrillä, jos ei mahdu tänne niin lähetä se emailin liitteenä osoitteeseen illukka[nospam]ATdslr.net
    poista [nospam] ja korvaa AT merkillä @ tietty
    jos joku filu on vielä siellä niin SR lokin pitäis näyttää se
    tai sitten vaan joku sun turvaohjelmista estää ton rivin fiksauksen
    estämällä HJT:ta muokkaamasta rekisteriä

     
    ratnunter, Oct 10, 2005
    #80
Page 4 of 5

Share This Page