Viirus tai haittaohjelma pääsiyllättämään! Apuja!

Discussion in 'Virukset ja haittaohjelmat' started by Enoxol, Feb 20, 2006.

Page 1 of 2
  1. Enoxol

    Enoxol Regular member

    Joined:
    Nov 6, 2005
    Messages:
    280
    Likes Received:
    0
    Trophy Points:
    26
    Elikkäs tällasta kivaa pääs käymään, että avasin tietokoneeni ja ilokseni taustakuvani oli muuttunut kokonaan punaiseksi minkä keskellä oli musta palkki jonka sisällä vilkkui joku teksti tähän tyyliin:

    Error: spyware
    pla pla pla

    Sitten huomasin että viiruksentorjunta ohjelmani oli hävinnyt mystisesti..

    No sitten mä asensin viiruksen torjunta ohjelmani takaisin, pyöritin sen 3 kertaa, ad-awaren 3 kertaa, spybotin 3kertaa ja lopuksi vielä ewidolla kerran.. Poistin kaikki mitä noi löys ja käynnistin koneen uusiksi.

    Sitten se mun taustakuva oli muuttunut kokonaan valkoiseksi ja välkkyy välillä harmaana!

    Pyöritin vielä kaikki edellämainitsemat ohjelmat kerran mutta ne ei löytänyt enään mitään..

    Taustakuvaa ei voi vaihtaa ohjauspaneelin kautta ja jos painan hiiren oikeeta nappia "taustakuvanpäällä" ja meen siitä:--> Ominaisuudet..

    Näkyy tässäkohtaan vaan yksi välilehti "Yleiset" ja siinä lukee seuraavaa:

    Protokolla: File Protocol

    Tyyppi: HTML File

    Yhteys: Ei salattu

    Osoite: file://C:\WINNT\desktop.html
    (URL)

    Koko, Luotu ja Muokattu: näissä lukee -> Ei käytettävissä

    Ei mun ei C aseman Winnt kansiosta löydy mitään desktop juttua...

    [bold]Elikkäs onko yhtään kenelläkään hajuakaan mikä tää juttu on mikä mun koneeseen on iskenyt ja miten saan sen helvettiin koneestani??[/bold]

    kaikki apu arvostettua,(pää räjähtää ilman)
     
    Enoxol, Feb 20, 2006
    #1
  2. mawdrgn

    mawdrgn Regular member

    Joined:
    Jan 2, 2006
    Messages:
    469
    Likes Received:
    0
    Trophy Points:
    26

    Lähetä HjT-loki, ohjelman saat täältä -> http://koti.mbnet.fi/pattaya1/HijackThis.exe .
    Tallenna hakemistoon c:\hjt\, käynnistä, klikkaa do a system scan and save logfile ja lähetä loki tänne niin kattellaan mitä löytyy.

     
    mawdrgn, Feb 20, 2006
    #2
  3. Enoxol

    Enoxol Regular member

    Joined:
    Nov 6, 2005
    Messages:
    280
    Likes Received:
    0
    Trophy Points:
    26
    Logfile of HijackThis v1.99.1
    Scan saved at 23:24:45, on 20.2.2006
    Platform: Windows 2000 SP4 (WinNT 5.00.2195)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINNT\System32\smss.exe
    C:\WINNT\system32\winlogon.exe
    C:\WINNT\system32\services.exe
    C:\WINNT\system32\lsass.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\system32\spoolsv.exe
    C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    C:\WINNT\system32\svchost.exe
    C:\Program Files\tappeluohjelmat\ewido anti-malware\ewidoctrl.exe
    C:\Program Files\tappeluohjelmat\ewido anti-malware\ewidoguard.exe
    C:\WINNT\system32\regsvc.exe
    C:\WINNT\system32\MSTask.exe
    C:\WINNT\system32\ZoneLabs\vsmon.exe
    C:\WINNT\Explorer.EXE
    C:\WINNT\System32\WBEM\WinMgmt.exe
    C:\WINNT\system32\svchost.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
    C:\Program Files\Winamp\Winampa.exe
    C:\WINNT\system32\internat.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
    C:\WINNT\system32\wuauclt.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINNT\system32\notepad.exe
    C:\hjt\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    O1 - Hosts: localhost 127.0.0.1
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\tappeluohjelmat\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
    O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
    O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
    O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
    O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
    O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
    O4 - HKCU\..\Run: [internat.exe] internat.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [µTorrent] "C:\Program Files\Asennus ohjelmat\utorrent.exe"
    O4 - Global Startup: BTTray.lnk = C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {11010101-1001-1111-1000-110112345678} - mk:mad:mSItSTORE:Mhtml:FiLE://C:\html.mHT!http://205.177.122.27/docs/xxx/html.chm::/html.exe
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{4AA87B62-49D1-43A0-9AE7-3F7ACB7A028D}: NameServer = 85.255.116.117,85.255.112.190
    O18 - Protocol: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINNT\system32\btxppanel.dll
    O23 - Service: AntiVir Scheduler (AntiVirScheduler) - H+BEDV Datentechnik GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\tappeluohjelmat\ewido anti-malware\ewidoctrl.exe
    O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\tappeluohjelmat\ewido anti-malware\ewidoguard.exe
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe

     
    Enoxol, Feb 20, 2006
    #3
  4. Enoxol

    Enoxol Regular member

    Joined:
    Nov 6, 2005
    Messages:
    280
    Likes Received:
    0
    Trophy Points:
    26
    [bold]Elikkäs tollasta piperrystä sieltä tuli....

    En tiedä onko tästä mitään apua mutta...
    Tossa ala puolella on samanlaista pieperrystä jos painan tosta taustan kohalla oikeeta hiirennappia -> siitä valitsen: "näytä lähdekoodi"

    siis sitten tulee tollasta:[/bold]

    <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
    <!----
    ***** This file is automatically generated by Microsoft Windows 2000 *****
    --------><HTML><HEAD>
    <META http-equiv=Content-Type content="text/html; charset=windows-1252"></HEAD>
    <BODY
    style="BORDER-RIGHT: medium none; BORDER-TOP: medium none; BORDER-LEFT: medium none; BORDER-BOTTOM: medium none"
    bottomMargin=0 bgColor=#3a6ea5 leftMargin=0 background="" topMargin=0
    rightMargin=0>
    <DIV
    style="LEFT: 0px; WIDTH: 1280px; POSITION: absolute; TOP: 0px; HEIGHT: 1024px"><IMG
    style="LEFT: 0px; WIDTH: 100%; POSITION: absolute; TOP: 0px; HEIGHT: 100%" cache
    src="file:///C:/WINNT/Prairie%20Wind.bmp"> </DIV><IFRAME id=0
    style="BACKGROUND: none transparent scroll repeat 0% 0%; LEFT: 0px; WIDTH: 1280px; POSITION: absolute; TOP: 1px; HEIGHT: 995px"
    name=DeskMovrW marginWidth=0 marginHeight=0 src="file:///C:/WINNT/desktop.html"
    frameBorder=0 scrolling=no subscribed_url="C:\WINNT\desktop.html"
    resizeable=""> </IFRAME>
    <OBJECT id=ActiveDesktopMover
    style="LEFT: 0px; VISIBILITY: hidden; WIDTH: 0px; POSITION: absolute; TOP: 0px; HEIGHT: 0px; container: positioned; zIndex: 5"
    classid=clsid:72267F6A-A6F9-11D0-BC94-00C04FB67863></OBJECT>
    <OBJECT id=ActiveDesktopMoverW
    style="Z-INDEX: -1; LEFT: -1px; VISIBILITY: hidden; WIDTH: 1282px; POSITION: absolute; TOP: 0px; HEIGHT: 997px; container: positioned"
    classid=clsid:72267F6A-A6F9-11D0-BC94-00C04FB67863></OBJECT>
    </BODY></HTML>
     
    Last edited: Feb 20, 2006
    Enoxol, Feb 20, 2006
    #4
  5. mawdrgn

    mawdrgn Regular member

    Joined:
    Jan 2, 2006
    Messages:
    469
    Likes Received:
    0
    Trophy Points:
    26
    Joo nyt on päässyt joku kaappaamaan koneesi Valko-Venäjältä käsin.

    Ja CoolWebSearch-örkki sinne on kanssa päässyt.

    Laitanpa sanan eteenpäin eräälle, joka tietää mitä tehdä enemmän kuin minä :)

    Just hang on!
     
    mawdrgn, Feb 20, 2006
    #5
  6. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    WareOut se siellä.

    Hae fixwareout -> http://downloads.subratam.org/Fixwareout.exe
    Tallenna johonkin hakemistoon ja käynnistä se. Seuraa ohjeita, käynnistä kone uudestaan kun fixi pyytää sitä. Fixi avaa HjT:n.

    Fixaa silloin nämä(do a system scan only, merkkaa ja paina fix checked):

    O1 - Hosts: localhost 127.0.0.1
    O16 - DPF: {11010101-1001-1111-1000-110112345678} - mk:mad:mSItSTORE:Mhtml:FiLE://C:\html.mHT!http://205.177.122.27/docs/xxx/html.chm::/html.exe
    O17 - HKLM\System\CCS\Services\Tcpip\..\{4AA87B62-49D1-43A0-9AE7-3F7ACB7A028D}: NameServer = 85.255.116.117,85.255.112.190

    Päivitä ewido, älä skannaa vielä.

    Käynnistä vikasietotilaan (F8 käynnistyksen yhteydessä)

    Skannaa ewidolla ohjeen mukaan ja tallenna raportti

    Lähetä uusi HjT-loki, ewidon raportti ja C:\fixwareout\report.txt-tiedoston sisältö tänne.
     
    Last edited: Feb 20, 2006
    -kemisti-, Feb 20, 2006
    #6
  7. Enoxol

    Enoxol Regular member

    Joined:
    Nov 6, 2005
    Messages:
    280
    Likes Received:
    0
    Trophy Points:
    26
    Avas tällasen hjt-lokin toi fixwareout:

    Fixwareout ver 1.003
    Last edited 2/15/2006
    Post this report in the forums please

    Reg Entries that were deleted
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\repiwoh
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\ypszr
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\daolnwodi
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\putesprpgd
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\lavinraCputeS
    ...

    PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.

    »»»»» Search by size and names...

    »»»»» Misc files

    »»»»» Checking for older varients covered by the Rem3 tool

    [bold]Edit: ->[/bold]

    Miten fixaa? Tolla ohjelmalla?
     
    Last edited: Feb 21, 2006
    Enoxol, Feb 21, 2006
    #7
  8. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    HjT:llä hyvinkin. Avaa HijackThis, klikkaa do a system scan only, merkkaa nämä ja paina fix checked:

    O1 - Hosts: localhost 127.0.0.1
    O16 - DPF: {11010101-1001-1111-1000-110112345678} - mk:mad:mSItSTORE:Mhtml:FiLE://C:\html.mHT!http://205.177.122.27/docs/xxx/html.chm::/html.exe
    O17 - HKLM\System\CCS\Services\Tcpip\..\{4AA87B62-49D1-43A0-9AE7-3F7ACB7A028D}: NameServer = 85.255.116.117,85.255.112.190

    Sitten aja se ewido vikasiedossa ja tallenna raportti

    Lähetä uusi HjT-loki ja ewidon raportti.
     
    -kemisti-, Feb 21, 2006
    #8
  9. Enoxol

    Enoxol Regular member

    Joined:
    Nov 6, 2005
    Messages:
    280
    Likes Received:
    0
    Trophy Points:
    26
    Mulla ei oo tota ekaa siellä ollenkaan... alkaa tosta:

    [bold]O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx[/bold]

    Teen nyt kuitenkin ton loppuun... tässä välissä...

    Kysy haluunko tehä back upin, mut en tehny.... eikä sit tapahtunu mitään... oisko pitäny??
    =)
     
    Last edited: Feb 21, 2006
    Enoxol, Feb 21, 2006
    #9
  10. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Ei backupit ole tarpeen, jos et ole vaan fixannut vääriä rivejä :) Jos olet, niin voi olla, että tulee äitiä ikävä jos niitä ei ole.
     
    -kemisti-, Feb 21, 2006
    #10
  11. Enoxol

    Enoxol Regular member

    Joined:
    Nov 6, 2005
    Messages:
    280
    Likes Received:
    0
    Trophy Points:
    26
    [bold]Ok! xD
    No niin alapuolella siis uusi hjt-loki:[/bold]

    Logfile of HijackThis v1.99.1
    Scan saved at 20:40:17, on 21.2.2006
    Platform: Windows 2000 SP4 (WinNT 5.00.2195)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINNT\System32\smss.exe
    C:\WINNT\system32\winlogon.exe
    C:\WINNT\system32\services.exe
    C:\WINNT\system32\lsass.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\system32\spoolsv.exe
    C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    C:\WINNT\system32\svchost.exe
    C:\Program Files\tappeluohjelmat\ewido anti-malware\ewidoctrl.exe
    C:\Program Files\tappeluohjelmat\ewido anti-malware\ewidoguard.exe
    C:\WINNT\system32\regsvc.exe
    C:\WINNT\system32\MSTask.exe
    C:\WINNT\system32\ZoneLabs\vsmon.exe
    C:\WINNT\Explorer.EXE
    C:\WINNT\System32\WBEM\WinMgmt.exe
    C:\WINNT\system32\svchost.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
    C:\Program Files\Winamp\Winampa.exe
    C:\WINNT\system32\internat.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\Asennus ohjelmat\utorrent.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
    C:\WINNT\system32\wuauclt.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\hjt\HijackThis.exe

    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\tappeluohjelmat\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
    O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
    O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
    O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
    O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
    O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
    O4 - HKCU\..\Run: [internat.exe] internat.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [µTorrent] "C:\Program Files\Asennus ohjelmat\utorrent.exe"
    O4 - Global Startup: BTTray.lnk = C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {11010101-1001-1111-1000-110112345678} - mk:mad:mSItSTORE:Mhtml:FiLE://C:\html.mHT!http://205.177.122.27/docs/xxx/html.chm::/html.exe
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{4AA87B62-49D1-43A0-9AE7-3F7ACB7A028D}: NameServer = 85.255.116.117,85.255.112.190
    O18 - Protocol: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINNT\system32\btxppanel.dll
    O23 - Service: AntiVir Scheduler (AntiVirScheduler) - H+BEDV Datentechnik GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\tappeluohjelmat\ewido anti-malware\ewidoctrl.exe
    O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\tappeluohjelmat\ewido anti-malware\ewidoguard.exe
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe

    [bold]Ja tämän alapuolella siis se ewidon raportti..[/bold]

    ---------------------------------------------------------
    ewido anti-malware - Scan report
    ---------------------------------------------------------

    + Created on: 20:11:59, 21.2.2006
    + Report-Checksum: 5D084884

    + Scan result:

    :mozilla.17:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\5pbs9w6u.default\cookies.txt -> TrackingCookie.Cqcounter : Cleaned without backup
    :mozilla.21:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\5pbs9w6u.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned without backup
    :mozilla.22:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\5pbs9w6u.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned without backup
    :mozilla.23:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\5pbs9w6u.default\cookies.txt -> TrackingCookie.2o7 : Cleaned without backup
    :mozilla.24:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\5pbs9w6u.default\cookies.txt -> TrackingCookie.Masterstats : Cleaned without backup
    :mozilla.33:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\5pbs9w6u.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned without backup
    :mozilla.34:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\5pbs9w6u.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned without backup
    :mozilla.35:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\5pbs9w6u.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned without backup
    :mozilla.36:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\5pbs9w6u.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned without backup
    :mozilla.37:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\5pbs9w6u.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned without backup
    :mozilla.38:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\5pbs9w6u.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned without backup
    :mozilla.39:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\5pbs9w6u.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned without backup
    :mozilla.40:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\5pbs9w6u.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned without backup
    :mozilla.54:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\5pbs9w6u.default\cookies.txt -> TrackingCookie.Addynamix : Cleaned without backup
    C:\Documents and Settings\Administrator\Cookies\administrator@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned without backup



    ::Report End
     
    Enoxol, Feb 21, 2006
    #11
  12. Enoxol

    Enoxol Regular member

    Joined:
    Nov 6, 2005
    Messages:
    280
    Likes Received:
    0
    Trophy Points:
    26
    Mitäs nyt sitten neuvoksi....? Oliko siinä mitään ihmeellistä, että ei ollu sitä "01: host" juttua ollenkaan siinä fixaus vaiheessa?
     
    Enoxol, Feb 21, 2006
    #12
  13. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    HjT-loki on ok eikä ewidokaan löytänyt mitään kummallista.

    Fixawareout varmaan poisti jo sen rivin

    Katso, jos ohjauspaneelissa on RazeSpyware. Jos on, poista se.

    Seuraavaksi:

    Hae täältä -> http://www.billsway.com/vbspage/ registry search tool ja tee haku "desktop.html":llä. Jos antivirus herjaa, anna ajaa.

    Lähetä registry searchin tulokset.
     
    -kemisti-, Feb 21, 2006
    #13
  14. Enoxol

    Enoxol Regular member

    Joined:
    Nov 6, 2005
    Messages:
    280
    Likes Received:
    0
    Trophy Points:
    26
    REGEDIT4
    ; RegSrch.vbs © Bill James

    ; Registry search results for string "desktop.html" 21.2.2006 22:10:05

    ; NOTE: This file will be deleted when you close WordPad.
    ; You must manually save this file to a new location if you want to refer to it again later.
    ; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)


    [HKEY_USERS\S-1-5-21-1844237615-1957994488-1343024091-500\Software\Microsoft\Internet Explorer\Desktop\Components\0]
    "Source"="C:\\WINNT\\desktop.html"

    [HKEY_USERS\S-1-5-21-1844237615-1957994488-1343024091-500\Software\Microsoft\Internet Explorer\Desktop\Components\0]
    "SubscribedURL"="C:\\WINNT\\desktop.html"

    [HKEY_USERS\S-1-5-21-1844237615-1957994488-1343024091-500\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}\FilesNamedMRU]
    "000"="desktop.html"
     
    Last edited: Feb 21, 2006
    Enoxol, Feb 21, 2006
    #14
  15. Enoxol

    Enoxol Regular member

    Joined:
    Nov 6, 2005
    Messages:
    280
    Likes Received:
    0
    Trophy Points:
    26
    hmm.. Tuossa tulokset... =)
     
    Enoxol, Feb 21, 2006
    #15
  16. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Juu, en ole aina koneen ääressä :)

    Tehdääs näin:

    Ota ensin rekisteristä näin varmuuskopio:

    Suorita -> regedit -> ok. Sitten Tiedosto -> Vie. Kirjoita sille joku nimi ja sitten Tallenna(ja laita muistiin, mihin tallensit sen).

    Sitten tallenna tämä alla oleva tekstinpätkä nimellä fix.reg vaikka muistiossa ja vaikka työpöydälle (tallennusmuoto kaikki tiedostot)

    Tuplaklikkaa ja paina kyllä ja ok. Käynnistä kone uudelleen. Auttoiko?
     
    -kemisti-, Feb 21, 2006
    #16
  17. Enoxol

    Enoxol Regular member

    Joined:
    Nov 6, 2005
    Messages:
    280
    Likes Received:
    0
    Trophy Points:
    26
    Heh, =) Ei se käynyt mielessäkään...

    Meni sen verran ohi toi, että "suorita" millä?
    Älä menetä hermojas.. =)
     
    Enoxol, Feb 22, 2006
    #17
  18. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Siis käynnistä -> suorita -> regedit -> ok.
     
    -kemisti-, Feb 23, 2006
    #18
  19. Enoxol

    Enoxol Regular member

    Joined:
    Nov 6, 2005
    Messages:
    280
    Likes Received:
    0
    Trophy Points:
    26
    Jaa, jaa... Sori... Mulla kun on win 2000 enkuks niin en heti tajunnut...

    Koitan fixailla... =)
     
    Enoxol, Feb 23, 2006
    #19
  20. Enoxol

    Enoxol Regular member

    Joined:
    Nov 6, 2005
    Messages:
    280
    Likes Received:
    0
    Trophy Points:
    26
    [bold]Juu kyllä auttoi ja paljon!
    Nyt toimii kone ainakin näin nopeasti katsottuna taas kunnossa, eikä löytäny adawaret sun muutkaan pahemmin mitään erikoista..

    ewido löys kyllä 7 jotain juttuja jotka poistin, tossa raportti siitä:[/bold]

    ---------------------------------------------------------
    ewido anti-malware - Scan report
    ---------------------------------------------------------

    + Created on: 20:01:11, 23.2.2006
    + Report-Checksum: CE9FCDE9

    + Scan result:

    :mozilla.12:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\5pbs9w6u.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
    :mozilla.13:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\5pbs9w6u.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
    :mozilla.14:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\5pbs9w6u.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
    :mozilla.15:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\5pbs9w6u.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
    :mozilla.16:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\5pbs9w6u.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
    :mozilla.28:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\5pbs9w6u.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup
    :mozilla.29:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\5pbs9w6u.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup


    ::Report End


    [bold]Ja sit suoritin sillä hjt-llä sen skannauksen ja tossa myös sen "tulokset":[/bold]
    [bold]Ihan vaan siksi nää tähän laitoin, että jos voisit vielä nopee kattoo, että kaikki on nyt varmasti kunnossa..[/bold]

    Logfile of HijackThis v1.99.1
    Scan saved at 21:01:03, on 23.2.2006
    Platform: Windows 2000 SP4 (WinNT 5.00.2195)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINNT\System32\smss.exe
    C:\WINNT\system32\winlogon.exe
    C:\WINNT\system32\services.exe
    C:\WINNT\system32\lsass.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\system32\spoolsv.exe
    C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    C:\WINNT\system32\svchost.exe
    C:\Program Files\tappeluohjelmat\ewido anti-malware\ewidoctrl.exe
    C:\Program Files\tappeluohjelmat\ewido anti-malware\ewidoguard.exe
    C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
    C:\WINNT\system32\regsvc.exe
    C:\WINNT\system32\MSTask.exe
    C:\WINNT\system32\ZoneLabs\vsmon.exe
    C:\WINNT\Explorer.EXE
    C:\WINNT\System32\WBEM\WinMgmt.exe
    C:\WINNT\system32\svchost.exe
    C:\Program Files\F-Secure\BackWeb\7681197\Program\F-Secure Automatic Update.exe
    C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
    C:\Program Files\Winamp\Winampa.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\WINNT\system32\internat.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\Asennus ohjelmat\utorrent.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    C:\Program Files\WinZip\WZQKPICK.EXE
    C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
    C:\WINNT\system32\wuauclt.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\hjt\HijackThis.exe

    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\tappeluohjelmat\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
    O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
    O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
    O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
    O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
    O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    O4 - HKCU\..\Run: [internat.exe] internat.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [µTorrent] "C:\Program Files\Asennus ohjelmat\utorrent.exe"
    O4 - Global Startup: BTTray.lnk = C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {11010101-1001-1111-1000-110112345678} - mk:mad:mSItSTORE:Mhtml:FiLE://C:\html.mHT!http://205.177.122.27/docs/xxx/html.chm::/html.exe
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{4AA87B62-49D1-43A0-9AE7-3F7ACB7A028D}: NameServer = 85.255.116.117,85.255.112.190
    O18 - Protocol: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINNT\system32\btxppanel.dll
    O23 - Service: AntiVir Scheduler (AntiVirScheduler) - H+BEDV Datentechnik GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\tappeluohjelmat\ewido anti-malware\ewidoctrl.exe
    O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\tappeluohjelmat\ewido anti-malware\ewidoguard.exe
    O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe

    [bold]No, kiitoksia nyt kovasti vain tästä vaivasta!![/bold]
    [​IMG]
     
    Last edited: Feb 23, 2006
    Enoxol, Feb 23, 2006
    #20
Page 1 of 2

Share This Page