1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Onko DNA "Nettiturva oikeesti vaan P*S*A?

Discussion in 'Virukset ja haittaohjelmat' started by EskoCruu, May 26, 2006.

  1. Sebu92

    Sebu92 Active member

    Joined:
    Oct 15, 2005
    Messages:
    2,778
    Likes Received:
    0
    Trophy Points:
    66
    Aina oppii uutta. :D
     
  2. EskoCruu

    EskoCruu Guest

    Tietääkö kukaan mistä johtuu että mun kone sammuu aina vartin välein?.. Ei oo eka kerta kun niin käy, heti ku mul on SP2 niin kone sammuilee?!
     
  3. Sebu92

    Sebu92 Active member

    Joined:
    Oct 15, 2005
    Messages:
    2,778
    Likes Received:
    0
    Trophy Points:
    66
    Sammuuko se siis tarkalleen vartin välein vai noin vartin välein? Voi olla jonkun viruksen ansiota. Simahtaako se vain vai sammuuko niinkuin normaalistikin?
     
  4. EskoCruu

    EskoCruu Guest

    Noin vartin välein, siis sammuu ja menee takas päälle..siks mul on windows iha sekasin nyt..
     
  5. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Taitaa olla kyse siitä, että koneessa oli pöpöjä ennen SP2:sen asennusta(ainakin pari siihen viittaavaa juttua näkyi lokissa). SP2:sta ei saa koskaan asentaa saastuneeseen koneeseen tai tulos voi olla pahimmassa tapauksessa jopa format c:! Ensin kone puhtaaksi ja sitten siihen SP2. Toki muitakin vaihtoehtoja on.

    EDIT: Eli suosittelen, että poistat SP2:sen, skannaat koneen vaikka sillä Dna nettiturvalla + ewidolla -> http://keskustelu.afterdawn.com/thread_view.cfm/269186
    ja lähetät niiden raportit tänne.
     
    Last edited: May 28, 2006
  6. EskoCruu

    EskoCruu Guest

    ---------------------------------------------------------
    ewido anti-malware - Scan report
    ---------------------------------------------------------

    + Created on: 22:38:18, 28.5.2006
    + Report-Checksum: 7AB6C13C

    + Scan result:

    C:\Documents and Settings\joni\Cookies\joni@atdmt[1].txt -> TrackingCookie.Atdmt : Cleaned with backup
    C:\Documents and Settings\joni\Cookies\joni@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned with backup
    C:\Documents and Settings\joni\Cookies\joni@com[1].txt -> TrackingCookie.Com : Cleaned with backup
    C:\Documents and Settings\joni\Cookies\joni@burstnet[1].txt -> TrackingCookie.Burstnet : Cleaned with backup
    C:\Documents and Settings\joni\Cookies\joni@rotator.adjuggler[1].txt -> TrackingCookie.Adjuggler : Cleaned with backup
    C:\Documents and Settings\joni\Cookies\joni@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Cleaned with backup
    C:\Documents and Settings\joni\Cookies\joni@komtrack[2].txt -> TrackingCookie.Komtrack : Cleaned with backup
    C:\Documents and Settings\joni\Cookies\joni@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned with backup
    C:\Documents and Settings\joni\Cookies\joni@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
    C:\Documents and Settings\joni\Cookies\joni@microsofteup.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup
    C:\Documents and Settings\joni\Cookies\joni@2o7[2].txt -> TrackingCookie.2o7 : Cleaned with backup
    C:\Documents and Settings\joni\Cookies\joni@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned with backup
    C:\Documents and Settings\joni\Cookies\joni@fastclick[2].txt -> TrackingCookie.Fastclick : Cleaned with backup


    ::Report End

    ^^ tos on toi raportti..
     
  7. aaxxeell

    aaxxeell Regular member

    Joined:
    Jul 28, 2005
    Messages:
    2,145
    Likes Received:
    0
    Trophy Points:
    46
    Tuossa ei sinänsä mitään pahaa, liekö niin että tuo HJT-loki on vanha? eli oletko sen jälkeen formatoinut konetta?
     
  8. EskoCruu

    EskoCruu Guest

    Siis mä formasin koneeni 25.6.06 ja sen jälkeen mä pistin ton HjT lokin tänne..
     
  9. EskoCruu

    EskoCruu Guest

    Logfile of HijackThis v1.99.1
    Scan saved at 18:43:04, on 29.5.2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS.0\System32\smss.exe
    C:\WINDOWS.0\system32\winlogon.exe
    C:\WINDOWS.0\system32\services.exe
    C:\WINDOWS.0\system32\lsass.exe
    C:\WINDOWS.0\system32\svchost.exe
    C:\WINDOWS.0\System32\svchost.exe
    C:\Program Files\DigitalPersona\Bin\DPWinLct.exe
    C:\WINDOWS.0\system32\spoolsv.exe
    C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\ISafe.exe
    C:\Program Files\DigitalPersona\Bin\DpHost.exe
    C:\Program Files\ewido anti-malware\ewidoctrl.exe
    C:\WINDOWS.0\System32\nvsvc32.exe
    C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\VetMsg.exe
    C:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe
    C:\WINDOWS.0\Explorer.EXE
    C:\Program Files\Microsoft IntelliType Pro\type32.exe
    C:\Program Files\Microsoft IntelliPoint\point32.exe
    C:\Program Files\DigitalPersona\Bin\DPAgnt.exe
    C:\WINDOWS.0\system32\RunDLL32.exe
    C:\Program Files\CA\eTrust Internet Security Suite\caissdt.exe
    C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVTray.exe
    C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVRID.exe
    C:\WINDOWS.0\system32\ctfmon.exe
    C:\WINDOWS.0\system32\rundll32.exe
    C:\Program Files\WinZip\WZQKPICK.EXE
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS.0\system32\devldr32.exe
    C:\Documents and Settings\joni\Työpöytä\Pikakuvakkeet\HijackThis_v1.99.1.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://irc-galleria.net/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
    O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
    O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
    O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
    O4 - HKLM\..\Run: [DPAgnt] C:\Program Files\DigitalPersona\Bin\DPAgnt.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS.0\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [CaISSDT] "C:\Program Files\CA\eTrust Internet Security Suite\caissdt.exe"
    O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVTray.exe"
    O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVRID.exe"
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1148580459465
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O20 - Winlogon Notify: DPWLN - C:\WINDOWS.0\System32\DPWLEvHd.dll
    O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\ISafe.exe
    O23 - Service: Windows XP FUS Manager (DPFUSMgr) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe
    O23 - Service: Biometric Authentication Service (DpHost) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DpHost.exe
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS.0\System32\nvsvc32.exe
    O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\VetMsg.exe


    Tolta toi näyttää nyt..^^
     
    Last edited by a moderator: May 29, 2006
  10. pkaksp

    pkaksp Moderator Staff Member

    Joined:
    Jan 10, 2005
    Messages:
    12,231
    Likes Received:
    53
    Trophy Points:
    128
    EskoCruu käyttää sitten jatkossa sitä edit nappulaa. Eli ei tehdä noita tuplaviestejä kiitos.
     
  11. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Niin siis eTrust ei poista mitään DNA Nettiturvaa :) Eikä mikään muu virustorjuntaohjelma poista tietääkseni toista.

    Otetaan se DNA Nettiturva kuitenkin pois, jos haluat:

    Fixaa nämä (do a system scan only, merkkaa ja paina fix checked):

    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\dna Nettiturva\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\dna Nettiturva\TNB\TNBUtil.exe" /CHECKALL
    O4 - HKLM\..\Run: [1337 virus] explore.exe
    O4 - HKLM\..\RunServices: [1337 virus] explore.exe
    O23 - Service: dna Nettiturva (BackWeb Client - 4653381) - Unknown owner - C:\PROGRA~1\DNANET~1\backweb\4653381\Program\SERVIC~1.EXE (file missing)
    O23 - Service: F-Secure Authentication Agent (FSAA) - Unknown owner - C:\Program Files\dna Nettiturva\Common\FSAA.EXE (file missing)
    O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\dna Nettiturva\backweb\4653381\program\fsbwsys.exe
    O23 - Service: F-Secure Distributed Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\dna Nettiturva\DFW\Program\fsdfwd.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\dna Nettiturva\Common\FSMA32.EXE


    Sitten

    käynnistä -> suorita

    Kirjoita siihen:

    sc stop FSAA ja ok
    sc delete FSAA ja ok
    sc stop FSDFWD ja ok
    sc delete FSDFWD ja ok
    sc stop FSMA ja ok
    sc delete FSMA ja ok
    sc stop "BackWeb Client - 4653381" ja ok
    sc delete "BackWeb Client - 4653381" ja ok.

    Poista:

    C:\Program Files\dna Nettiturva
    explore.exe (etsi etsi-toiminnolla)

    Käynnistä uudelleen ja lähetä uusi HjT-loki.
     
  12. EskoCruu

    EskoCruu Guest

    Sori :)
     
  13. EskoCruu

    EskoCruu Guest

    Tuli ongelmii ton C:\Program Files\dna Nettiturva Kanssa...ei voi poista sitä..sanoo näin " Ei voida poistaa Admin.pub:" käyttövirheen vuoksi..jotenkin tollai..
     
  14. pkaksp

    pkaksp Moderator Staff Member

    Joined:
    Jan 10, 2005
    Messages:
    12,231
    Likes Received:
    53
    Trophy Points:
    128
    Kokeiles nyt sitä ediittiä, ei voi kovin vaikeaa olla. Kirjoitit taas tuplat vaikka just niistä huomautin. Seuraavasta pääset jäähylle sitä opiskelemaan.
     
  15. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Poista se kansio vikasietotilassa sitten.
     
  16. EskoCruu

    EskoCruu Guest

    Jaahas..no mites mä siihen vikasietotilaan pääsen? Yleensä pääsen vaan sillon kun kone on tiltannu..
     
    Last edited by a moderator: May 29, 2006
  17. teppoI

    teppoI Moderator Staff Member

    Joined:
    Apr 30, 2005
    Messages:
    4,166
    Likes Received:
    4
    Trophy Points:
    48
    Boottaa kone ja paina F8. Loput varmaan osaatkin.
     
  18. EskoCruu

    EskoCruu Guest

    Do diih nyt mä sain poistettua sen vikasietotilassa, ja loki näyttää tältä

    Logfile of HijackThis v1.99.1
    Scan saved at 20:07:32, on 29.5.2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS.0\System32\smss.exe
    C:\WINDOWS.0\system32\winlogon.exe
    C:\WINDOWS.0\system32\services.exe
    C:\WINDOWS.0\system32\lsass.exe
    C:\WINDOWS.0\system32\svchost.exe
    C:\WINDOWS.0\System32\svchost.exe
    C:\Program Files\DigitalPersona\Bin\DPWinLct.exe
    C:\WINDOWS.0\system32\spoolsv.exe
    C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\ISafe.exe
    C:\Program Files\DigitalPersona\Bin\DpHost.exe
    C:\WINDOWS.0\System32\nvsvc32.exe
    C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\VetMsg.exe
    C:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe
    C:\WINDOWS.0\Explorer.EXE
    C:\Program Files\Microsoft IntelliType Pro\type32.exe
    C:\Program Files\Microsoft IntelliPoint\point32.exe
    C:\Program Files\DigitalPersona\Bin\DPAgnt.exe
    C:\WINDOWS.0\system32\RunDLL32.exe
    C:\Program Files\CA\eTrust Internet Security Suite\caissdt.exe
    C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVTray.exe
    C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVRID.exe
    C:\WINDOWS.0\system32\ctfmon.exe
    C:\WINDOWS.0\system32\rundll32.exe
    C:\Program Files\WinZip\WZQKPICK.EXE
    C:\WINDOWS.0\system32\devldr32.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\joni\Työpöytä\Pikakuvakkeet\HijackThis_v1.99.1.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://irc-galleria.net/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
    O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
    O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
    O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
    O4 - HKLM\..\Run: [DPAgnt] C:\Program Files\DigitalPersona\Bin\DPAgnt.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS.0\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [CaISSDT] "C:\Program Files\CA\eTrust Internet Security Suite\caissdt.exe"
    O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVTray.exe"
    O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVRID.exe"
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1148580459465
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O20 - Winlogon Notify: DPWLN - C:\WINDOWS.0\System32\DPWLEvHd.dll
    O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\ISafe.exe
    O23 - Service: Windows XP FUS Manager (DPFUSMgr) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe
    O23 - Service: Biometric Authentication Service (DpHost) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DpHost.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS.0\System32\nvsvc32.exe
    O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\VetMsg.exe

     
  19. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Nyt näyttäis olevan Dna Nettiturva poissa :) Rekisterin voisit vielä putsata vaikka ccleanerilla tai easycleanerilla, koska siitä jäi rekisterimerkintöjä.
     
  20. EskoCruu

    EskoCruu Guest

    ..selvä..ja kiitos ajastas ja avustas :)

    Ja tuli tos muuten mieleen et onks välii että onko kovo tiedostojärjestelmässä NTFS tai FAT32 ? ja mitä noi ylipäätänsä meinaa?
     
    Last edited by a moderator: May 29, 2006

Share This Page