1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Spyaxe--Falcon--kotisivua ei voi asettaa, -logit lisätty

Discussion in 'Virukset ja haittaohjelmat' started by tiqruli, Mar 13, 2006.

Page 2 of 4
  1. tiqruli

    tiqruli Member

    Joined:
    Jan 2, 2006
    Messages:
    68
    Likes Received:
    0
    Trophy Points:
    16
    Ilmeisesti tilanne on yhä se, että virusta pukkaa eikä kotisivua voi asettaa. Olen nyt muualla, kuin ko. tietokoneen luona, joten etänä yritän avullanne koneen kanssa auttaa. Ongelma on, että sisko ei löydä sitä karanteeni-osaa Nortonista, tai löysi, mutta siellä ei ole ilmeisesti painiketta tai valintaa, jolla karanteeni tyhjennetään, tai hän ei sitä ole löytänyt. Noita järjestelmän palatuksien poistoja ei ole tehty vielä.
     
    tiqruli, Mar 16, 2006
    #21
  2. blade81

    blade81 Active member

    Joined:
    Jul 28, 2003
    Messages:
    1,287
    Likes Received:
    0
    Trophy Points:
    66
    blade81, Mar 16, 2006
    #22
  3. blade81

    blade81 Active member

    Joined:
    Jul 28, 2003
    Messages:
    1,287
    Likes Received:
    0
    Trophy Points:
    66
    Mites on tiqruli tämän tapauksen laita? Ongelma vielä jäljellä?
     
    blade81, Mar 19, 2006
    #23
  4. tiqruli

    tiqruli Member

    Joined:
    Jan 2, 2006
    Messages:
    68
    Likes Received:
    0
    Trophy Points:
    16
    Kone oli rauhassa viikonlopun, kukaan ei ollut kotona.. Kunhan koneeseen on kokeiltu nuo kaksi viimeisintä ohjetta, palaan asiaan, että auttoiko vai ei.
     
    tiqruli, Mar 19, 2006
    #24
  5. tiqruli

    tiqruli Member

    Joined:
    Jan 2, 2006
    Messages:
    68
    Likes Received:
    0
    Trophy Points:
    16
    Tulimme siihen tulokseen, että olen turha välikäsi tässä asiassa. Koneen omistaja kirjautui käyttäjäksi, tunnus on ipetzi, ja hän jatkaa keskustelua tässä samassa viestiketjussa. Ongelma ei ole siis vieläkään hävinnyt. Tiqruli out... =)
     
    tiqruli, Mar 20, 2006
    #25
  6. ipetzi

    ipetzi Regular member

    Joined:
    Mar 20, 2006
    Messages:
    133
    Likes Received:
    0
    Trophy Points:
    26
    no niin, nyt olen itse täällä. niin siis, kotisivua ei saa vieläkään vaihdettua, en yhtään tiedä mistä löytyy normanin karanteeni, normanin sivustosta ei ollut apua. ja toi järjestelmän palautus jutun tyhjennys kuulostaa pahalta, haittoja?
     
    ipetzi, Mar 20, 2006
    #26
  7. ipetzi

    ipetzi Regular member

    Joined:
    Mar 20, 2006
    Messages:
    133
    Likes Received:
    0
    Trophy Points:
    26
    nyt löytyis kansio normanin alta "Qtn" ja sen alla on bin ja qtn kansiot ja binistä löytyi .dll tiedostoja sekä ntqn sovellus. onks nämä niitä karanteenissa olevia tiedostoja? siis ne .dll päätteiset.
     
    ipetzi, Mar 20, 2006
    #27
  8. blade81

    blade81 Active member

    Joined:
    Jul 28, 2003
    Messages:
    1,287
    Likes Received:
    0
    Trophy Points:
    66
    Hei! Voisit koittaa poistaa tiedostot tuolta Qtn-kansion alla olevasta qtn-kansiosta. Järjestelmänpalautuksen pois ottamisen väliaikaisesti ei pitäisi aiheuttaa vaaraa.
     
    blade81, Mar 20, 2006
    #28
  9. ipetzi

    ipetzi Regular member

    Joined:
    Mar 20, 2006
    Messages:
    133
    Likes Received:
    0
    Trophy Points:
    26
    tyhjensin sen.
     
    Last edited: Mar 20, 2006
    ipetzi, Mar 20, 2006
    #29
  10. blade81

    blade81 Active member

    Joined:
    Jul 28, 2003
    Messages:
    1,287
    Likes Received:
    0
    Trophy Points:
    66
    Ok. Kun olet ottanut tuon järjestelmänpalautuksen pois (ja käynnistänyt uudelleen), lähetä tuore hjt-loki. Katsotaan sitten miten edetään.
     
    Last edited: Mar 20, 2006
    blade81, Mar 20, 2006
    #30
  11. ipetzi

    ipetzi Regular member

    Joined:
    Mar 20, 2006
    Messages:
    133
    Likes Received:
    0
    Trophy Points:
    26
    tässä vaiheessa on varmaan hyvä kysyä miten se otetaan pois ja silleen :)
     
    ipetzi, Mar 20, 2006
    #31
  12. blade81

    blade81 Active member

    Joined:
    Jul 28, 2003
    Messages:
    1,287
    Likes Received:
    0
    Trophy Points:
    66
    blade81, Mar 20, 2006
    #32
  13. ipetzi

    ipetzi Regular member

    Joined:
    Mar 20, 2006
    Messages:
    133
    Likes Received:
    0
    Trophy Points:
    26
    Logfile of HijackThis v1.99.1
    Scan saved at 21:01:28, on 20.3.2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Norman\bin\ZLH.EXE
    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    C:\D-Tools\daemon.exe
    C:\Documents and Settings\Timo Reijonen\Työpöytä\carita\winamp\winampa.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Documents and Settings\Timo Reijonen\Työpöytä\carita\EWIDO\ewido anti-malware\ewidoctrl.exe
    C:\Documents and Settings\Timo Reijonen\Työpöytä\carita\EWIDO\ewido anti-malware\ewidoguard.exe
    C:\Norman\Bin\Zanda.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Norman\Nvc\BIN\NIP.EXE
    C:\WINDOWS\system32\wdfmgr.exe
    C:\Norman\Nvc\BIN\NVCSCHED.EXE
    C:\Norman\bin\NJEEVES.EXE
    C:\Norman\Nvc\BIN\nipsvc.exe
    C:\Norman\Nvc\bin\nvcoas.exe
    C:\WINDOWS\System32\alg.exe
    C:\Norman\Nvc\bin\cclaw.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\hjt\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll (file missing)
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\D-Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [WinampAgent] C:\Documents and Settings\Timo Reijonen\Työpöytä\carita\winamp\winampa.exe
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
    O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - https://www.gamespyid.com/alaunch.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
    O23 - Service: ewido security suite control - ewido networks - C:\Documents and Settings\Timo Reijonen\Työpöytä\carita\EWIDO\ewido anti-malware\ewidoctrl.exe
    O23 - Service: ewido security suite guard - ewido networks - C:\Documents and Settings\Timo Reijonen\Työpöytä\carita\EWIDO\ewido anti-malware\ewidoguard.exe
    O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN\nipsvc.exe
    O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE
    O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\Bin\Zanda.exe
    O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe
    O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\Norman\Nvc\BIN\NVCSCHED.EXE
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

     
    ipetzi, Mar 20, 2006
    #33
  14. blade81

    blade81 Active member

    Joined:
    Jul 28, 2003
    Messages:
    1,287
    Likes Received:
    0
    Trophy Points:
    66
    Loki on puhdas. Aloitussivun asettaminen ei tietenkään onnistu vieläkään?

    EDIT:
    Oliskohan mahdollista, että olet Spysweeperillä lukinnu kotisivun? Löytyy Spysweeperistä kohdasta spy sweeper -> shield ja Internet explorer
     
    Last edited: Mar 20, 2006
    blade81, Mar 20, 2006
    #34
  15. ipetzi

    ipetzi Regular member

    Joined:
    Mar 20, 2006
    Messages:
    133
    Likes Received:
    0
    Trophy Points:
    26
    no tuota tuota.. kotisivu tosiaan tuli takas (poistin spysweeperin koska oli vain trial).. niin, enää ei ois ku niistä troijalaisista asiaa, ´saako ne vaan olla koneella, vai ovatko haitallisiakin?
     
    ipetzi, Mar 20, 2006
    #35
  16. blade81

    blade81 Active member

    Joined:
    Jul 28, 2003
    Messages:
    1,287
    Likes Received:
    0
    Trophy Points:
    66
    Kyllä ne ois hyvä poistaa. Kokeilehan ajella vikasietotilassa Ewidolla kone läpi (ohjetta ketjussa aiemmin) ja postaa sen tulokset sitten tänne.
     
    blade81, Mar 20, 2006
    #36
  17. ipetzi

    ipetzi Regular member

    Joined:
    Mar 20, 2006
    Messages:
    133
    Likes Received:
    0
    Trophy Points:
    26
    ---------------------------------------------------------
    ewido anti-malware - Scan report
    ---------------------------------------------------------

    + Created on: 8:03:53, 22.3.2006
    + Report-Checksum: DE3BA8A6

    + Scan result:

    C:\Documents and Settings\Timo Reijonen\Cookies\timo reijonen@advertising[1].txt -> TrackingCookie.Advertising : Ignored
    C:\Documents and Settings\Timo Reijonen\Cookies\timo reijonen@atdmt[2].txt -> TrackingCookie.Atdmt : Ignored
    C:\Documents and Settings\Timo Reijonen\Cookies\timo reijonen@bluestreak[1].txt -> TrackingCookie.Bluestreak : Cleaned with backup
    C:\Documents and Settings\Timo Reijonen\Cookies\timo reijonen@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned with backup
    C:\Documents and Settings\Timo Reijonen\Cookies\timo reijonen@casalemedia[2].txt -> TrackingCookie.Casalemedia : Cleaned with backup
    C:\Documents and Settings\Timo Reijonen\Cookies\timo reijonen@counter6.sextracker[1].txt -> TrackingCookie.Sextracker : Cleaned with backup
    C:\Documents and Settings\Timo Reijonen\Cookies\timo reijonen@cs.sexcounter[2].txt -> TrackingCookie.Sexcounter : Cleaned with backup
    C:\Documents and Settings\Timo Reijonen\Cookies\timo reijonen@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned with backup
    C:\Documents and Settings\Timo Reijonen\Cookies\timo reijonen@fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned with backup
    C:\Documents and Settings\Timo Reijonen\Cookies\timo reijonen@hotlog[1].txt -> TrackingCookie.Hotlog : Cleaned with backup
    C:\Documents and Settings\Timo Reijonen\Cookies\timo reijonen@image.masterstats[1].txt -> TrackingCookie.Masterstats : Cleaned with backup
    C:\Documents and Settings\Timo Reijonen\Cookies\timo reijonen@media.fastclick[2].txt -> TrackingCookie.Fastclick : Cleaned with backup
    C:\Documents and Settings\Timo Reijonen\Cookies\timo reijonen@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned with backup
    C:\Documents and Settings\Timo Reijonen\Cookies\timo reijonen@perf.overture[1].txt -> TrackingCookie.Overture : Cleaned with backup
    C:\Documents and Settings\Timo Reijonen\Cookies\timo reijonen@servedby.advertising[2].txt -> TrackingCookie.Advertising : Cleaned with backup
    C:\Documents and Settings\Timo Reijonen\Cookies\timo reijonen@sextracker[2].txt -> TrackingCookie.Sextracker : Cleaned with backup
    C:\Documents and Settings\Timo Reijonen\Cookies\timo reijonen@sportingnews.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup
    C:\Documents and Settings\Timo Reijonen\Cookies\timo reijonen@spylog[1].txt -> TrackingCookie.Spylog : Cleaned with backup
    C:\Documents and Settings\Timo Reijonen\Cookies\timo reijonen@tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned with backup
    C:\Documents and Settings\Timo Reijonen\Cookies\timo reijonen@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Cleaned with backup
    C:\Documents and Settings\Timo Reijonen\Cookies\timo reijonen@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Cleaned with backup
    C:\Documents and Settings\Timo Reijonen\Cookies\timo reijonen@zedo[1].txt -> TrackingCookie.Zedo : Cleaned with backup


    ::Report End
     
    ipetzi, Mar 21, 2006
    #37
  18. blade81

    blade81 Active member

    Joined:
    Jul 28, 2003
    Messages:
    1,287
    Likes Received:
    0
    Trophy Points:
    66
    Ewido löysi pelkkiä evästeitä. Tarkoitatko noilla edellisessä viestissä mainitsemillasi troijalaisilla niitä Normanin karanteenissa olevia vai joitakin muita?
     
    blade81, Mar 21, 2006
    #38
  19. blade81

    blade81 Active member

    Joined:
    Jul 28, 2003
    Messages:
    1,287
    Likes Received:
    0
    Trophy Points:
    66
    Ipetzi,

    Mikä on tämän tapauksen tilanne? Vieläkö on ongelmia?
     
    blade81, Mar 26, 2006
    #39
  20. ipetzi

    ipetzi Regular member

    Joined:
    Mar 20, 2006
    Messages:
    133
    Likes Received:
    0
    Trophy Points:
    26
    siis normanin karanteeniin siirtämiä viruksia tarkoitin. tuntus löytävän joka viidespäivä uuden viruksen...
     
    ipetzi, Mar 26, 2006
    #40
Page 2 of 4

Share This Page