1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Taustakuva kaapattu spywarella apua!

Discussion in 'Virukset ja haittaohjelmat' started by Symbiotic, Dec 3, 2005.

Page 2 of 2
  1. Iisalmi

    Iisalmi Regular member

    Joined:
    Sep 12, 2004
    Messages:
    563
    Likes Received:
    0
    Trophy Points:
    26
    Vai että vahingossa pornosivulle.. Niinhän me kaikki =D

    Onneks Norttoni on pitänyt kaikken ylimääräisen poissa koneeltani vaikka on "niitäkin" sivuja "muutama" tullut katsottua läpi..
     
    Iisalmi, Dec 5, 2005
    #21
  2. Zipp2

    Zipp2 Regular member

    Joined:
    Sep 30, 2005
    Messages:
    376
    Likes Received:
    0
    Trophy Points:
    26
    Last edited: Dec 5, 2005
    Zipp2, Dec 5, 2005
    #22
  3. Symbiotic

    Symbiotic Regular member

    Joined:
    Dec 3, 2005
    Messages:
    140
    Likes Received:
    0
    Trophy Points:
    26
    Siihen tulee sellanen file mis on ihan RUTOSTI tekstii ei oikee tuu mitää tyylii tallenna levylle
     
    Symbiotic, Dec 5, 2005
    #23
  4. Zipp2

    Zipp2 Regular member

    Joined:
    Sep 30, 2005
    Messages:
    376
    Likes Received:
    0
    Trophy Points:
    26
    Zipp2, Dec 5, 2005
    #24
  5. Symbiotic

    Symbiotic Regular member

    Joined:
    Dec 3, 2005
    Messages:
    140
    Likes Received:
    0
    Trophy Points:
    26
    nyt onnas!!! tossa : "Silent Runners.vbs", revision 41, http://www.silentrunners.org/
    Operating System: Windows XP
    Output limited to non-default values, except where indicated by "{++}"


    Startup items buried in registry:
    ---------------------------------

    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
    "Steam" = ""C:\Program Files\Steam\Steam.exe" -silent" ["Valve Corporation"]
    "MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS]

    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
    "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup" [MS]
    "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
    "NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit" [MS]
    "TkBellExe" = ""C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot" ["RealNetworks, Inc."]
    "DAEMON Tools-1033" = ""D:\Ohjelmat\D-Tools\daemon.exe" -lang 1033" ["DAEMON.S HOME"]
    "AVG7_CC" = "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP" ["GRISOFT, s.r.o."]
     
    Symbiotic, Dec 5, 2005
    #25
  6. Zipp2

    Zipp2 Regular member

    Joined:
    Sep 30, 2005
    Messages:
    376
    Likes Received:
    0
    Trophy Points:
    26
    Älähän hätäile vaan anna sen scannata valmiiks ja sitte vasta kopioi ja lähetä sen logi.
     
    Zipp2, Dec 5, 2005
    #26
  7. Symbiotic

    Symbiotic Regular member

    Joined:
    Dec 3, 2005
    Messages:
    140
    Likes Received:
    0
    Trophy Points:
    26
    siis toi se oliki !!!!! : "Silent Runners.vbs", revision 41, http://www.silentrunners.org/
    Operating System: Windows XP
    Output limited to non-default values, except where indicated by "{++}"


    Startup items buried in registry:
    ---------------------------------

    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
    "Steam" = ""C:\Program Files\Steam\Steam.exe" -silent" ["Valve Corporation"]
    "MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS]

    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
    "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup" [MS]
    "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
    "NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit" [MS]
    "TkBellExe" = ""C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot" ["RealNetworks, Inc."]
    "DAEMON Tools-1033" = ""D:\Ohjelmat\D-Tools\daemon.exe" -lang 1033" ["DAEMON.S HOME"]
    "AVG7_CC" = "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP" ["GRISOFT, s.r.o."]

    HKLM\Software\Microsoft\Active Setup\Installed Components\
    {306D6C21-C1B6-4629-986C-E59E1875B8AF}\(Default) = (no title provided)
    \StubPath = ""C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Messenger\msgsc.dll",ShowIconsUser" [MS]

    HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
    "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Display Panning CPL Extension"
    -> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found]
    "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal Icon Ext"
    -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
    "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
    -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\nvcpl.dll" ["NVIDIA Corporation"]
    "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
    -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\nvcpl.dll" ["NVIDIA Corporation"]
    "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
    -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"]
    "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
    -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"]
    "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
    -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"]
    "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
    -> {CLSID}\InProcServer32\(Default) = "d:\Ohjelmat\WinRAR\rarext.dll" [null data]
    "{E0D79304-84BE-11CE-9641-444553540000}" = "WinZip"
    -> {CLSID}\InProcServer32\(Default) = "D:\OHJELMAT\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
    "{E0D79305-84BE-11CE-9641-444553540000}" = "WinZip"
    -> {CLSID}\InProcServer32\(Default) = "D:\OHJELMAT\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
    "{E0D79306-84BE-11CE-9641-444553540000}" = "WinZip"
    -> {CLSID}\InProcServer32\(Default) = "D:\OHJELMAT\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
    "{E0D79307-84BE-11CE-9641-444553540000}" = "WinZip"
    -> {CLSID}\InProcServer32\(Default) = "D:\OHJELMAT\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
    "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"
    -> {CLSID}\InProcServer32\(Default) = "d:\Ohjelmat\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."]
    "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Shell Extension"
    -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]
    "{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Find Extension"
    -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]

    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
    INFECTION WARNING! "{54D9498B-CF93-414F-8984-8CE7FDE0D391}" = "ewido shell guard"
    -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\ewido\security suite\shellhook.dll" ["TODO: <Firmenname>"]

    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\
    "System" = (value not set)

    HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
    AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"
    -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]
    ewido\(Default) = "{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}"
    -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\ewido\security suite\context.dll" ["ewido networks"]
    WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
    -> {CLSID}\InProcServer32\(Default) = "d:\Ohjelmat\WinRAR\rarext.dll" [null data]
    WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
    -> {CLSID}\InProcServer32\(Default) = "D:\OHJELMAT\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]

    HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
    ewido\(Default) = "{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}"
    -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\ewido\security suite\context.dll" ["ewido networks"]
    WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
    -> {CLSID}\InProcServer32\(Default) = "d:\Ohjelmat\WinRAR\rarext.dll" [null data]
    WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
    -> {CLSID}\InProcServer32\(Default) = "D:\OHJELMAT\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]

    HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
    AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"
    -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]
    WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
    -> {CLSID}\InProcServer32\(Default) = "d:\Ohjelmat\WinRAR\rarext.dll" [null data]
    WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
    -> {CLSID}\InProcServer32\(Default) = "D:\OHJELMAT\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]


    Active Desktop and Wallpaper:
    -----------------------------

    Active Desktop is enabled at this entry:
    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

    HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
    "Wallpaper" = "C:\Documents and Settings\Neli Death\Local Settings\Application Data\Microsoft\Wallpaper1.bmp"

    Active Desktop web content:

    HKCU\Software\Microsoft\Internet Explorer\Desktop\Components\0\
    "FriendlyName" = "Security"
    "Source" = "C:\WINDOWS\desktop.html"
    "SubscribedURL" = "C:\WINDOWS\desktop.html"


    Enabled Screen Saver:
    ---------------------

    HKCU\Control Panel\Desktop\
    "SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS]


    Winsock2 Service Provider DLLs:
    -------------------------------

    Namespace Service Providers

    HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
    000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
    000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
    000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
    000000000004\LibraryPath = "%SystemRoot%\System32\nwprovau.dll" [MS]

    Transport Service Providers

    HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
    0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
    %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 20
    %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


    Running Services (Display Name, Service Name, Path {Service DLL}):
    ------------------------------------------------------------------

    AVG E-mail Scanner, AVGEMS, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe" ["GRISOFT, s.r.o."]
    AVG7 Alert Manager Server, Avg7Alrt, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe" ["GRISOFT, s.r.o."]
    AVG7 Update Service, Avg7UpdSvc, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe" ["GRISOFT, s.r.o."]
    ewido security suite control, ewido security suite control, "C:\Program Files\ewido\security suite\ewidoctrl.exe" ["ewido networks"]
    ewido security suite guard, ewido security suite guard, "C:\Program Files\ewido\security suite\ewidoguard.exe" ["ewido networks"]
    NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\System32\nvsvc32.exe" ["NVIDIA Corporation"]


    ----------
    + This report excludes default entries except where indicated.
    + To see *everywhere* the script checks and *everything* it finds,
    launch it from a command prompt or a shortcut with the -all parameter.
    + To search all directories of local fixed drives for DESKTOP.INI
    DLL launch points and all Registry CLSIDs for dormant Explorer Bars,
    use the -supp parameter or answer "No" at the first message box.
    ---------- (total run time: 83 seconds, including 10 seconds for message boxes)
     
    Symbiotic, Dec 5, 2005
    #27
  8. Zipp2

    Zipp2 Regular member

    Joined:
    Sep 30, 2005
    Messages:
    376
    Likes Received:
    0
    Trophy Points:
    26
    Merkkaa nuo sulje selain ja paina Fix checked

    O17 - HKLM\System\CCS\Services\Tcpip\..\{7D4F0736-1AD4-47B5-8CEE-547A2B02D98E}: NameServer = 85.255.113.91,85.255.112.9
    O17 - HKLM\System\CCS\Services\Tcpip\..\{FFA3E2E0-23CC-4253-8284-6D63AD21A7CD}: NameServer = 85.255.113.91,85.255.112.9


    Sitte koitas kattoo tuolta

    Työpöytä ja ominaisuudet > Desktop > Customize Desktop > Web
    jos siellä näkyy jotain Securityy niin poista se.

    Päivitä se sun Ewido ja putsaa sillä , säästä logi ja pistä tänne jos jotain löyty.
     
    Zipp2, Dec 5, 2005
    #28
  9. Symbiotic

    Symbiotic Regular member

    Joined:
    Dec 3, 2005
    Messages:
    140
    Likes Received:
    0
    Trophy Points:
    26
    Minne mä noi laitan sinne Hjt???
     
    Symbiotic, Dec 5, 2005
    #29
  10. Zipp2

    Zipp2 Regular member

    Joined:
    Sep 30, 2005
    Messages:
    376
    Likes Received:
    0
    Trophy Points:
    26
    Siis scannaat Hijackillä merkkaat ne rivit ja paina Fix checked
     
    Zipp2, Dec 5, 2005
    #30
  11. Symbiotic

    Symbiotic Regular member

    Joined:
    Dec 3, 2005
    Messages:
    140
    Likes Received:
    0
    Trophy Points:
    26
    TEIN SEN !!!! ONNISTU JES JES JES!! KIITOS KIITOS KIITOS TEILLE KAIKKILLE MUAH MUAH½!!!!! :D:D:D:D:D:D:D XDXDXD!!!!!!!!!!!!!
     
    Symbiotic, Dec 5, 2005
    #31
  12. welder

    welder Guest

    Kannattaa pysyä painotuotteissa ja dvd/vhs-formaateissa jos alastomia ihmisiä haluaa välttämättä tirkistellä erinäisissä "akteissa". ;-P
     
    welder, Dec 6, 2005
    #32
  13. venalaine

    venalaine Regular member

    Joined:
    Nov 15, 2004
    Messages:
    893
    Likes Received:
    11
    Trophy Points:
    28
    [bold]Vai että vahingossa pornosivulle.. Niinhän me kaikki =D [/bold]

    No eihän sitä nyt pornosivuille muuten voi joutua kun ihan vahingossa vaan... Itellenikin joskus sattunut moinen vahinko.

    [bold]Kannattaa pysyä painotuotteissa ja dvd/vhs-formaateissa jos alastomia ihmisiä haluaa välttämättä tirkistellä erinäisissä "akteissa". ;-P[/bold]

    Kyllä näin on... Oikea alkuperäinen on kunnon VHS jossa kuvan pitää olla luonnollisesti vähän suttuinen ja nauha niin monesti katsottu että äänet vähän vääristyy jne... Siinä on sitä meininkiä!
     
    Last edited: Dec 6, 2005
    venalaine, Dec 6, 2005
    #33
  14. jokke70

    jokke70 Regular member

    Joined:
    Jan 20, 2005
    Messages:
    380
    Likes Received:
    0
    Trophy Points:
    26
    Veli venalaisen kanssa samaa mieltä.
     
    jokke70, Dec 7, 2005
    #34
  15. pentiumxp

    pentiumxp Guest

    heh :D mites sinne pornosivuille on jouduttu vahingossa xD
     
    pentiumxp, Dec 8, 2005
    #35
Page 2 of 2

Share This Page