pöpöjä, hijackthis (ratkaistu)

Discussion in 'Virukset ja haittaohjelmat' started by onkelma, May 15, 2006.

  1. onkelma

    onkelma Member

    Joined:
    Apr 7, 2005
    Messages:
    70
    Likes Received:
    0
    Trophy Points:
    16
    Taas on pöpöt purreet, auttakaa...
    Ewidolla ajettu sekä registry boosterilla + zone alarmin virus ohjelmalla.

    Logfile of HijackThis v1.99.1
    Scan saved at 1:16:45, on 16.5.2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\SYSTEM32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\ewido anti-malware\ewidoctrl.exe
    C:\WINDOWS\system32\LXSUPMON.EXE
    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    C:\Program Files\MultiRes\MultiRes.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    C:\WINDOWS\system32\ctfmon.exe
    D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\ewido anti-malware\ewidoguard.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\pasi koivu\Työpöytä\virusten poistoon\hijackthis_199\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://elisa.net/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://elisa.net/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - Toimittaja Elisa Internet
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKLM\..\Run: [MultiRes] C:\Program Files\MultiRes\MultiRes.exe
    O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
    O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [Zone Labs Client] D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Uniblue Registry Booster] C:\Program Files\Uniblue\Registry Booster\RegistryBooster.exe /S
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: SMS-viesti - {18BC259E-7404-4A2D-800F-395EC2EDC35F} - http://sms.kolumbus.fi/ (file missing) (HKCU)
    O9 - Extra button: Tuki - {4A6B751C-129B-49B7-9883-555136288A6F} - http://tuki.elisa.net/ (file missing) (HKCU)
    O9 - Extra button: Palvelut - {68532556-E710-4C82-ADB5-7F0EEDDAC1E5} - http://service.kolumbus.fi/ (file missing) (HKCU)
    O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
    O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
    O16 - DPF: {D6E2C70F-C694-4FDB-9283-459FC77FEFE0} (Softers.efOrderX) - https://www.efoto.fi/efOrderX.CAB
    O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
    O20 - Winlogon Notify: winrzf32 - C:\WINDOWS\SYSTEM32\winrzf32.dll
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
    O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
     
    onkelma, May 15, 2006
    #1
  2. jaska2

    jaska2 Member

    Joined:
    Apr 1, 2006
    Messages:
    80
    Likes Received:
    0
    Trophy Points:
    16
    O9 - Extra button: SMS-viesti - {18BC259E-7404-4A2D-800F-395EC2EDC35F} - http://sms.kolumbus.fi/ (file missing) (HKCU)

    O9 - Extra button: Tuki - {4A6B751C-129B-49B7-9883-555136288A6F} - http://tuki.elisa.net/ (file missing) (HKCU)

    O9 - Extra button: Palvelut - {68532556-E710-4C82-ADB5-7F0EEDDAC1E5} - http://service.kolumbus.fi/ (file missing) (HKCU)
    ------------------------
    noi voisit kokeilla vaikka fixata
     
    jaska2, May 15, 2006
    #2
  3. spertti

    spertti Active member

    Joined:
    Jun 1, 2005
    Messages:
    1,222
    Likes Received:
    0
    Trophy Points:
    66
    @jaska2

    Miksi nuo pitäisi mielestäsi fixata?

    Nuo ovat aivan puhtaita rivejä, joiden fixaamisella ei saavuta muuta, kuin sen etteivät ne enää löydy IE:n työkalu valikosta...

    Valitettavasti en itse kerkeä lokia tsekkaamaan, mutta noita ei tosiaankaan tarvitse/kannata fixata.
     
    Last edited: May 15, 2006
    spertti, May 15, 2006
    #3
  4. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    @jaska2 & spertti: Ei noita tosiaan fixata :) File missing O9-kohdassa on HjT:n bugi.

    @onkelma:

    Fixaa HjT:llä (do a system scan only, merkkaa ja paina fix checked):


    O20 - Winlogon Notify: winrzf32 - C:\WINDOWS\SYSTEM32\winrzf32.dll

    Hae KillBox

    http://www.bleepingcomputer.com/files/spyware/KillBox.zip

    Pura,avaa ja täppi kohtaan Delete on Reboot
    Sitte kopioi rivi tosta alapuolelta

    C:\WINDOWS\SYSTEM32\winrzf32.dll

    Sitten KillBoxissa ylhäältä File > Paste from Clipboard
    Valitse "All Files".Sen jälkeen paina Delete (punainen, jossa on valkonen X)
    Vastaa myöntävästi kysymyksiin ja jos kone ei itestään käynnisty uudestaan,niin käynnistä se.

    Päivitä ewido.

    Käynnistä vikasietotilaan (F8 käynnistyksen yhteydessä)

    Skannaa ewidolla, anna poistaa mitä löytää ja tallenna raportti.

    Käynnistä uudelleen ja lähetä ewidon raportti sekä uusi HjT-loki.
     
    -kemisti-, May 15, 2006
    #4
  5. onkelma

    onkelma Member

    Joined:
    Apr 7, 2005
    Messages:
    70
    Likes Received:
    0
    Trophy Points:
    16
    Win32.moisho.e virus puskee läpi kokoajan myös ja yrittää muuttaa selaimen aloitussivua, ko pöpö poistetaan kuitenkin automaattisesti zone alarmin toimesta, mutta jotain siitä jää koska kokoajan tulee uudestaan.

    Edelliset toimenpiteet mitä neuvoit on tehty ja tässä logeja:

    Logfile of HijackThis v1.99.1
    Scan saved at 12:43:00, on 16.5.2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\SYSTEM32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\LXSUPMON.EXE
    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    C:\Program Files\MultiRes\MultiRes.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    C:\Program Files\ewido anti-malware\ewidoctrl.exe
    C:\Program Files\ewido anti-malware\ewidoguard.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\ZoneLabs\isafe.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\dcomcfg.exe
    C:\Documents and Settings\pasi koivu\Työpöytä\virusten poistoon\hijackthis_199\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://elisa.net/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://elisa.net/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - Toimittaja Elisa Internet
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Nothing - {b0398eca-0bcd-4645-8261-5e9dc70248d0} - C:\WINDOWS\system32\hp6A1A.tmp
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKLM\..\Run: [MultiRes] C:\Program Files\MultiRes\MultiRes.exe
    O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [Zone Labs Client] D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Uniblue Registry Booster] C:\Program Files\Uniblue\Registry Booster\RegistryBooster.exe /S
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: SMS-viesti - {18BC259E-7404-4A2D-800F-395EC2EDC35F} - http://sms.kolumbus.fi/ (file missing) (HKCU)
    O9 - Extra button: Tuki - {4A6B751C-129B-49B7-9883-555136288A6F} - http://tuki.elisa.net/ (file missing) (HKCU)
    O9 - Extra button: Palvelut - {68532556-E710-4C82-ADB5-7F0EEDDAC1E5} - http://service.kolumbus.fi/ (file missing) (HKCU)
    O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
    O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
    O16 - DPF: {D6E2C70F-C694-4FDB-9283-459FC77FEFE0} (Softers.efOrderX) - https://www.efoto.fi/efOrderX.CAB
    O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
    O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe



    sekä ewido:

    ---------------------------------------------------------
    ewido anti-malware - Scan report
    ---------------------------------------------------------

    + Created on: 12:36:42, 16.5.2006
    + Report-Checksum: CCB5CC4F

    + Scan result:

    :mozilla.317:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Masterstats : Cleaned with backup
    :mozilla.329:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
    :mozilla.330:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
    :mozilla.331:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
    :mozilla.332:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
    :mozilla.333:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
    :mozilla.341:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Ivwbox : Cleaned with backup
    :mozilla.346:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Spylog : Cleaned with backup
    :mozilla.353:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Targetnet : Cleaned with backup
    :mozilla.364:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Doubleclick : Cleaned with backup
    :mozilla.381:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Valueclick : Cleaned with backup
    :mozilla.389:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Specificclick : Cleaned with backup
    :mozilla.432:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Centrport : Cleaned with backup
    :mozilla.433:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Webtrendslive : Cleaned with backup
    :mozilla.452:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Zedo : Cleaned with backup
    :mozilla.457:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Commission-junction : Cleaned with backup
    :mozilla.458:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Commission-junction : Cleaned with backup
    :mozilla.485:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Onestat : Cleaned with backup
    :mozilla.486:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Onestat : Cleaned with backup
    :mozilla.487:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Onestat : Cleaned with backup
    :mozilla.505:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
    :mozilla.508:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Serving-sys : Cleaned with backup
    :mozilla.509:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Serving-sys : Cleaned with backup
    :mozilla.510:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Serving-sys : Cleaned with backup
    :mozilla.511:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Serving-sys : Cleaned with backup
    :mozilla.530:C:\RECYCLER\NPROTECT\00170504.MOZ -> TrackingCookie.Counted : Cleaned with backup
    :mozilla.222:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Tribalfusion : Cleaned with backup
    :mozilla.224:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Trafic : Cleaned with backup
    :mozilla.279:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Atdmt : Cleaned with backup
    :mozilla.280:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Pointroll : Cleaned with backup
    :mozilla.281:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Pointroll : Cleaned with backup
    :mozilla.282:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Clickzs : Cleaned with backup
    :mozilla.283:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Clickzs : Cleaned with backup
    :mozilla.288:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Adengage : Cleaned with backup
    :mozilla.289:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Adengage : Cleaned with backup
    :mozilla.290:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Adengage : Cleaned with backup
    :mozilla.305:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Clickhype : Cleaned with backup
    :mozilla.320:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Masterstats : Cleaned with backup
    :mozilla.335:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Com : Cleaned with backup
    :mozilla.336:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Com : Cleaned with backup
    :mozilla.339:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
    :mozilla.340:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
    :mozilla.341:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
    :mozilla.351:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Ivwbox : Cleaned with backup
    :mozilla.355:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Spylog : Cleaned with backup
    :mozilla.359:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Targetnet : Cleaned with backup
    :mozilla.374:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Doubleclick : Cleaned with backup
    :mozilla.389:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Web-stat : Cleaned with backup
    :mozilla.390:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Web-stat : Cleaned with backup
    :mozilla.391:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Web-stat : Cleaned with backup
    :mozilla.394:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Valueclick : Cleaned with backup
    :mozilla.404:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Bluestreak : Cleaned with backup
    :mozilla.440:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Centrport : Cleaned with backup
    :mozilla.441:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Webtrendslive : Cleaned with backup
    :mozilla.460:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Zedo : Cleaned with backup
    :mozilla.465:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Commission-junction : Cleaned with backup
    :mozilla.466:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Commission-junction : Cleaned with backup
    :mozilla.493:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Onestat : Cleaned with backup
    :mozilla.494:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Onestat : Cleaned with backup
    :mozilla.495:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Onestat : Cleaned with backup
    :mozilla.513:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
    :mozilla.516:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Serving-sys : Cleaned with backup
    :mozilla.517:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Serving-sys : Cleaned with backup
    :mozilla.518:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Serving-sys : Cleaned with backup
    :mozilla.519:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Serving-sys : Cleaned with backup
    :mozilla.538:C:\RECYCLER\NPROTECT\00170776.MOZ -> TrackingCookie.Counted : Cleaned with backup
    :mozilla.232:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Falkag : Cleaned with backup
    :mozilla.233:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Adserver : Cleaned with backup
    :mozilla.235:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Trafic : Cleaned with backup
    :mozilla.295:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Atdmt : Cleaned with backup
    :mozilla.296:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Pointroll : Cleaned with backup
    :mozilla.297:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Pointroll : Cleaned with backup
    :mozilla.298:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Clickzs : Cleaned with backup
    :mozilla.299:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Clickzs : Cleaned with backup
    :mozilla.305:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Adengage : Cleaned with backup
    :mozilla.306:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Adengage : Cleaned with backup
    :mozilla.307:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Adengage : Cleaned with backup
    :mozilla.324:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Clickhype : Cleaned with backup
    :mozilla.338:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Masterstats : Cleaned with backup
    :mozilla.356:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Com : Cleaned with backup
    :mozilla.357:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Com : Cleaned with backup
    :mozilla.360:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
    :mozilla.361:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
    :mozilla.362:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
    :mozilla.363:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
    :mozilla.364:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
    :mozilla.376:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Ivwbox : Cleaned with backup
    :mozilla.381:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Spylog : Cleaned with backup
    :mozilla.400:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Doubleclick : Cleaned with backup
    :mozilla.414:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Web-stat : Cleaned with backup
    :mozilla.415:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Web-stat : Cleaned with backup
    :mozilla.416:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Web-stat : Cleaned with backup
    :mozilla.419:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Valueclick : Cleaned with backup
    :mozilla.429:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Bluestreak : Cleaned with backup
    :mozilla.465:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Centrport : Cleaned with backup
    :mozilla.466:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Webtrendslive : Cleaned with backup
    :mozilla.485:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Zedo : Cleaned with backup
    :mozilla.490:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Commission-junction : Cleaned with backup
    :mozilla.491:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Commission-junction : Cleaned with backup
    :mozilla.518:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Onestat : Cleaned with backup
    :mozilla.519:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Onestat : Cleaned with backup
    :mozilla.520:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Onestat : Cleaned with backup
    :mozilla.538:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
    :mozilla.541:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Serving-sys : Cleaned with backup
    :mozilla.542:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Serving-sys : Cleaned with backup
    :mozilla.543:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Serving-sys : Cleaned with backup
    :mozilla.544:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Serving-sys : Cleaned with backup
    :mozilla.563:C:\RECYCLER\NPROTECT\00170844.MOZ -> TrackingCookie.Counted : Cleaned with backup
    :mozilla.137:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Statcounter : Cleaned with backup
    :mozilla.138:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Statcounter : Cleaned with backup
    :mozilla.139:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Statcounter : Cleaned with backup
    :mozilla.140:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Statcounter : Cleaned with backup
    :mozilla.141:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Statcounter : Cleaned with backup
    :mozilla.167:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Burstnet : Cleaned with backup
    :mozilla.168:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Burstnet : Cleaned with backup
    :mozilla.178:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
    :mozilla.179:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
    :mozilla.180:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
    :mozilla.181:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
    :mozilla.182:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
    :mozilla.183:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
    :mozilla.184:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
    :mozilla.185:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
    :mozilla.186:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
    :mozilla.187:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
    :mozilla.188:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
    :mozilla.189:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
    :mozilla.190:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
    :mozilla.191:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
    :mozilla.192:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
    :mozilla.193:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
    :mozilla.194:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
    :mozilla.195:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
    :mozilla.196:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
    :mozilla.197:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
    :mozilla.198:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
    :mozilla.199:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
    :mozilla.200:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Sexlist : Cleaned with backup
    :mozilla.208:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
    :mozilla.233:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.247realmedia : Cleaned with backup
    :mozilla.234:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Weborama : Cleaned with backup
    :mozilla.236:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Falkag : Cleaned with backup
    :mozilla.237:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Adserver : Cleaned with backup
    :mozilla.239:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Trafic : Cleaned with backup
    :mozilla.250:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Trafficmp : Cleaned with backup
    :mozilla.253:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Ad-logics : Cleaned with backup
    :mozilla.305:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Atdmt : Cleaned with backup
    :mozilla.306:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Clickzs : Cleaned with backup
    :mozilla.307:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Clickzs : Cleaned with backup
    :mozilla.311:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Adengage : Cleaned with backup
    :mozilla.312:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Adengage : Cleaned with backup
    :mozilla.361:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Com : Cleaned with backup
    :mozilla.364:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
    :mozilla.365:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
    :mozilla.366:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
    :mozilla.367:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
    :mozilla.368:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
    :mozilla.382:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Spylog : Cleaned with backup
    :mozilla.388:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Targetnet : Cleaned with backup
    :mozilla.403:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Doubleclick : Cleaned with backup
    :mozilla.418:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Web-stat : Cleaned with backup
    :mozilla.419:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Web-stat : Cleaned with backup
    :mozilla.420:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Web-stat : Cleaned with backup
    :mozilla.423:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Valueclick : Cleaned with backup
    :mozilla.435:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Bluestreak : Cleaned with backup
    :mozilla.469:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Centrport : Cleaned with backup
    :mozilla.470:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Webtrendslive : Cleaned with backup
    :mozilla.484:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Zedo : Cleaned with backup
    :mozilla.489:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Commission-junction : Cleaned with backup
    :mozilla.490:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Commission-junction : Cleaned with backup
    :mozilla.516:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Onestat : Cleaned with backup
    :mozilla.517:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Onestat : Cleaned with backup
    :mozilla.518:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Onestat : Cleaned with backup
    :mozilla.536:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
    :mozilla.539:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Serving-sys : Cleaned with backup
    :mozilla.540:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Serving-sys : Cleaned with backup
    :mozilla.541:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Serving-sys : Cleaned with backup
    :mozilla.542:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Serving-sys : Cleaned with backup
    :mozilla.561:C:\RECYCLER\NPROTECT\00170944.MOZ -> TrackingCookie.Counted : Cleaned with backup


    ::Report End
     
    onkelma, May 16, 2006
    #5
  6. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Joo, sinne on tullut uutta pöpöä:

    Lataa SmitfraudFix (c) S!Ri
    http://siri.urz.free.fr/Fix/SmitfraudFix.zip
    Pura sisältö (kansio nimeltä SmitfraudFix) työpöydällesi:

    Avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
    Valitse optio #1 - Search kirjoittamalla 1 ja painamalla "Enter"; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa).
    Postita tämän tekstitiedoston sisältö viestiketjuusi.

    Ajoithan muuten varmasti ewidolla "complete system scanin"?
     
    -kemisti-, May 16, 2006
    #6
  7. onkelma

    onkelma Member

    Joined:
    Apr 7, 2005
    Messages:
    70
    Likes Received:
    0
    Trophy Points:
    16
    Kyllä ajoin complete system scanin, tässä tämä uusi smitfraud:

    SmitFraudFix v2.44

    Scan done at 12:55:35.54, ti 16.05.2006
    Run from C:\Documents and Settings\pasi koivu\Ty”p”yt„\SmitfraudFix\SmitfraudFix
    OS: Microsoft Windows XP [versio 5.1.2600]

    »»»»»»»»»»»»»»»»»»»»»»»» C:\


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

    C:\WINDOWS\system32\dcomcfg.exe FOUND !
    C:\WINDOWS\system32\hp????.tmp FOUND !
    C:\WINDOWS\system32\ld????.tmp FOUND !
    C:\WINDOWS\system32\ot.ico FOUND !
    C:\WINDOWS\system32\regperf.exe FOUND !
    C:\WINDOWS\system32\simpole.tlb FOUND !
    C:\WINDOWS\system32\stdole3.tlb FOUND !
    C:\WINDOWS\system32\ts.ico FOUND !
    C:\WINDOWS\system32\1024\ FOUND !

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\pasi koivu\Application Data

    C:\Documents and Settings\pasi koivu\Application Data\Microsoft\Internet Explorer\Quick Launch\SpyFalcon 2.0.lnk FOUND !

    »»»»»»»»»»»»»»»»»»»»»»»» Start Menu

    C:\DOCUME~1\PASIKO~1\KYNNIS~1\SpyFalcon 2.0.lnk FOUND !

    »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\PASIKO~1\Suosikit

    C:\DOCUME~1\PASIKO~1\Suosikit\Antivirus Test Online.url FOUND !

    »»»»»»»»»»»»»»»»»»»»»»»» Desktop


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


    »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


    »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
    "Source"="About:Home"
    "SubscribedURL"="About:Home"
    "FriendlyName"="Nykyinen kotisivu"


    »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
    "{64ba30a2-811a-4597-b0af-d551128be340}"="AppManager"

    [HKEY_CLASSES_ROOT\CLSID\{64ba30a2-811a-4597-b0af-d551128be340}\InProcServer32]
    @="C:\WINDOWS\system32\appmagr.dll"

    [HKEY_CURRENT_USER\Software\Classes\CLSID\{64ba30a2-811a-4597-b0af-d551128be340}\InProcServer32]
    @="C:\WINDOWS\system32\appmagr.dll"


    »»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection


    »»»»»»»»»»»»»»»»»»»»»»»» End

     
    onkelma, May 16, 2006
    #7
  8. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Sitten tuo infektio on tullut ewidon skannin jälkeen, koska ewido olisi poistanut suuren osan siitä.

    Printtaa ohjeet ulos.

    Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi.

    Kun vikasietotilassa, avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
    Valitse optio #2 - Clean kirjoittamalla 2 ja painamalla "Enter" poistaaksesi tarttuneet tiedostot.

    Sinulta kysytään: "Registry cleaning - Do you want to clean the registry ?"; vastaa "Yes" kirjoittamalla Y ja paina "Enter" poistaaksesi työpöydän taustakuvan ja puhdistaaksesi tarttuneet rekisteriavaimet.

    Työkalu tarkistaa jos wininet.dll on tarttunut. Sinua saatetaan pyytää korvaamaan tarttunut .dll (jos löytyy); vastaa "Yes" kirjoittamalla Y ja painamalla "Enter".

    Työkalun saattaa tarvita käynnistää kone uudelleen; jos ei tee niin, käynnistä normaaliin Windowsiin.
    Tekstitiedosto ilmestyy, puhdistusprosessin jäljiltä; kopioi & liitä tämän raportin tulokset vastaukseesi.
    Raportti löytyy paikalliselta levyltäsi, useimmiten C:\rapport.txt.

    Lähetä sen sisältö ja uusi HjT-loki.
     
    -kemisti-, May 16, 2006
    #8
  9. onkelma

    onkelma Member

    Joined:
    Apr 7, 2005
    Messages:
    70
    Likes Received:
    0
    Trophy Points:
    16
    Tässä rapport:

    SmitFraudFix v2.44

    Scan done at 13:10:27.67, ti 16.05.2006
    Run from C:\Documents and Settings\pasi koivu\Ty”p”yt„\SmitfraudFix\SmitfraudFix
    OS: Microsoft Windows XP [versio 5.1.2600]

    »»»»»»»»»»»»»»»»»»»»»»»» Killing process


    »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

    C:\WINDOWS\system32\atmclk.exe Deleted
    C:\WINDOWS\system32\dcomcfg.exe Deleted
    C:\WINDOWS\system32\hp????.tmp Deleted
    C:\WINDOWS\system32\ld????.tmp Deleted
    C:\WINDOWS\system32\ot.ico Deleted
    C:\WINDOWS\system32\regperf.exe Deleted
    C:\WINDOWS\system32\simpole.tlb Deleted
    C:\WINDOWS\system32\stdole3.tlb Deleted
    C:\WINDOWS\system32\ts.ico Deleted
    C:\WINDOWS\system32\1024\ Deleted
    C:\Documents and Settings\pasi koivu\Application Data\Microsoft\Internet Explorer\Quick Launch\SpyFalcon 2.0.lnk Deleted
    C:\DOCUME~1\PASIKO~1\Suosikit\Antivirus Test Online.url Deleted
    C:\DOCUME~1\PASIKO~1\KYNNIS~1\SpyFalcon 2.0.lnk Deleted

    »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


    »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

    Registry Cleaning done.

    »»»»»»»»»»»»»»»»»»»»»»»» End


    sekä hjt:

    Logfile of HijackThis v1.99.1
    Scan saved at 13:19:47, on 16.5.2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\SYSTEM32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\ewido anti-malware\ewidoctrl.exe
    C:\Program Files\ewido anti-malware\ewidoguard.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\system32\ZoneLabs\isafe.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\LXSUPMON.EXE
    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    C:\Program Files\MultiRes\MultiRes.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\pasi koivu\Työpöytä\virusten poistoon\hijackthis_199\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - Toimittaja Elisa Internet
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKLM\..\Run: [MultiRes] C:\Program Files\MultiRes\MultiRes.exe
    O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [Zone Labs Client] D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Uniblue Registry Booster] C:\Program Files\Uniblue\Registry Booster\RegistryBooster.exe /S
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: SMS-viesti - {18BC259E-7404-4A2D-800F-395EC2EDC35F} - http://sms.kolumbus.fi/ (file missing) (HKCU)
    O9 - Extra button: Tuki - {4A6B751C-129B-49B7-9883-555136288A6F} - http://tuki.elisa.net/ (file missing) (HKCU)
    O9 - Extra button: Palvelut - {68532556-E710-4C82-ADB5-7F0EEDDAC1E5} - http://service.kolumbus.fi/ (file missing) (HKCU)
    O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
    O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
    O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    Ja kun koneen käynnistin normaaliin tilaan tuli ilmoitus että järjestelmä on palautunut vakavasta virheestä.
     
    onkelma, May 16, 2006
    #9
  10. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Lokit ovat ok. Kokeilepa käynnistää kone uudestaan ja kerro tuleeko sitä ilmoitusta vielä.
     
    -kemisti-, May 16, 2006
    #10
  11. onkelma

    onkelma Member

    Joined:
    Apr 7, 2005
    Messages:
    70
    Likes Received:
    0
    Trophy Points:
    16
    Ennen uudelleen käynnistystä ajelin vielä päivitetyn spybot s&d:n läpi joka löysi avenue.a, double click ja spy falcon:in jonka ohjelma korjasi.

    Nyt ei tullut mitään virhe ilmoitusta eikä tapahtumienvalvonta lokeissakaan mitään uutta näy.

    Jos tämä on tällä erää selvä, niin kiitos sinulle kemisti aivojen lainasta =)
     
    onkelma, May 16, 2006
    #11
  12. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Heh, ole hyvä :D
     
    -kemisti-, May 16, 2006
    #12
  13. onkelma

    onkelma Member

    Joined:
    Apr 7, 2005
    Messages:
    70
    Likes Received:
    0
    Trophy Points:
    16
    onkelma, May 16, 2006
    #13
  14. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Joo tee Disa-:n ohjeiden mukaan ja tarkista myös prosessorin lämmöt ja ettei prossun/näyttiksen tuulettimessa ole pölyä.
     
    -kemisti-, May 16, 2006
    #14

Share This Page