1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Your computer is infected!

Discussion in 'Virukset ja haittaohjelmat' started by Palle00, Jan 24, 2006.

Page 2 of 2
  1. Zipp2

    Zipp2 Regular member

    Joined:
    Sep 30, 2005
    Messages:
    376
    Likes Received:
    0
    Trophy Points:
    26
    Hae Ewido

    http://www.ewido.net/en/download/

    asenna ja päivitä se.

    Ota AboutBuster

    http://www.malwarebytes.org/AboutBuster.zip

    pura se omaan kansioon vaikka työpöydälle

    Merkkaa nuo sulje selain ja paina Fix checked

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\djscp.dll/sp.html#54688%
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\djscp.dll/sp.html#54688%
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\djscp.dll/sp.html#54688%
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\djscp.dll/sp.html#54688%
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\djscp.dll/sp.html#54688%
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\djscp.dll/sp.html#54688%
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\djscp.dll/sp.html#54688%
    R3 - Default URLSearchHook is missing
    O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,NewDotNetStartup -s
    O4 - HKLM\..\Run: [33C.tmp] C:\DOCUME~1\KARISA~1\LOCALS~1\Temp\33C.tmp.exe
    O4 - HKLM\..\Run: [33D.tmp] C:\DOCUME~1\KARISA~1\LOCALS~1\Temp\33D.tmp.exe
    O4 - HKLM\..\Run: [33C.tmp.exe] C:\DOCUME~1\KARISA~1\LOCALS~1\Temp\33C.tmp.exe
    O4 - HKLM\..\Run: [33D.tmp.exe] C:\DOCUME~1\KARISA~1\LOCALS~1\Temp\33D.tmp.exe
    O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
    O4 - Startup: PowerReg Scheduler.exe
    O23 - Service: Network Security Service (NSS) ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\msfa32.exe (file missing)


    Käynnistä sitte vikasietotilassa ja poista jos löytyy

    C:\WINDOWS\djscp.dll
    C:\winstall.exe

    Sitte avaa AboutBuster ja putsaa sillä 2 kertaa.
    Sen jälkeen scannaa ja putsaa Ewidolla ja säästä logi.
    Käynnistä sitte normalisti ja uus hijack logi ja Ewidon logi.
    Korjataan sitte tuo 010 rivi.





     
    Zipp2, Jan 25, 2006
    #21
  2. CoDn00b

    CoDn00b Member

    Joined:
    Dec 27, 2005
    Messages:
    60
    Likes Received:
    0
    Trophy Points:
    16
    Niin siis käynnistän vikasietotilassa ja katson löytyykö nämä ja sitten poistan ne?

    C:\WINDOWS\djscp.dll
    C:\winstall.exe
     
    Last edited: Jan 25, 2006
    CoDn00b, Jan 25, 2006
    #22
  3. Zipp2

    Zipp2 Regular member

    Joined:
    Sep 30, 2005
    Messages:
    376
    Likes Received:
    0
    Trophy Points:
    26
    Joo sitte ku tuo on tehty

    Hae Ewido

    http://www.ewido.net/en/download/

    asenna ja päivitä se.

    Ota AboutBuster

    http://www.malwarebytes.org/AboutBuster.zip

    pura se omaan kansioon vaikka työpöydälle

    Merkkaa nuo sulje selain ja paina Fix checked

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\djscp.dll/sp.html#54688%
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\djscp.dll/sp.html#54688%
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\djscp.dll/sp.html#54688%
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\djscp.dll/sp.html#54688%
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\djscp.dll/sp.html#54688%
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\djscp.dll/sp.html#54688%
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\djscp.dll/sp.html#54688%
    R3 - Default URLSearchHook is missing
    O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,NewDotNetStartup -s
    O4 - HKLM\..\Run: [33C.tmp] C:\DOCUME~1\KARISA~1\LOCALS~1\Temp\33C.tmp.exe
    O4 - HKLM\..\Run: [33D.tmp] C:\DOCUME~1\KARISA~1\LOCALS~1\Temp\33D.tmp.exe
    O4 - HKLM\..\Run: [33C.tmp.exe] C:\DOCUME~1\KARISA~1\LOCALS~1\Temp\33C.tmp.exe
    O4 - HKLM\..\Run: [33D.tmp.exe] C:\DOCUME~1\KARISA~1\LOCALS~1\Temp\33D.tmp.exe
    O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
    O4 - Startup: PowerReg Scheduler.exe
    O23 - Service: Network Security Service (NSS) ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\msfa32.exe (file missing)


     
    Last edited: Jan 25, 2006
    Zipp2, Jan 25, 2006
    #23
  4. CoDn00b

    CoDn00b Member

    Joined:
    Dec 27, 2005
    Messages:
    60
    Likes Received:
    0
    Trophy Points:
    16
    Tuon C:\winstall.exe onnistuin poistamaan,mutta C:\WINDOWS\djscp.dll tiedostoa en löytänyt. Se ei varmastikaan haittaa?
     
    CoDn00b, Jan 25, 2006
    #24
  5. Zipp2

    Zipp2 Regular member

    Joined:
    Sep 30, 2005
    Messages:
    376
    Likes Received:
    0
    Trophy Points:
    26
    Ei niin jos kaikki on tehty niin lähetä ne logit.
     
    Zipp2, Jan 25, 2006
    #25
  6. CoDn00b

    CoDn00b Member

    Joined:
    Dec 27, 2005
    Messages:
    60
    Likes Received:
    0
    Trophy Points:
    16
    Siinä on ne molemmat nyt.


    ---------------------------------------------------------
    ewido anti-malware - Scan report
    ---------------------------------------------------------

    + Created on: 22:05:45, 25.1.2006
    + Report-Checksum: BC64E486

    + Scan result:

    No infected objects found.


    ::Report End




    Logfile of HijackThis v1.99.1
    Scan saved at 22:06:24, on 25.1.2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\Elisa Tietoturvapalvelu\Common\FSM32.EXE
    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    D:\Program Files\iTunesHelper.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\Program Files\Hewlett-Packard\AiO\hp psc 700 series\Bin\hpobrt07.exe
    C:\Program Files\WinZip\WZQKPICK.EXE
    C:\PROGRA~1\ELISAT~1\backweb\4119343\Program\SERVIC~1.EXE
    C:\Program Files\ewido anti-malware\ewidoctrl.exe
    C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsgk32st.exe
    C:\Program Files\Elisa Tietoturvapalvelu\backweb\4119343\program\fsbwsys.exe
    C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\FSGK32.EXE
    C:\Program Files\Elisa Tietoturvapalvelu\backweb\4119343\Program\fspex.exe
    C:\Program Files\Elisa Tietoturvapalvelu\Common\FSMA32.EXE
    C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fssm32.exe
    C:\Program Files\Elisa Tietoturvapalvelu\Common\FSMB32.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Logitech\MouseWare\system\em_exec.exe
    C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe
    C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Elisa Tietoturvapalvelu\Common\FCH32.EXE
    C:\Program Files\Elisa Tietoturvapalvelu\Common\FAMEH32.EXE
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsav32.exe
    C:\Program Files\Elisa Tietoturvapalvelu\FWES\Program\fsdfwd.exe
    C:\Program Files\Elisa Tietoturvapalvelu\FSGUI\fsguiexe.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\ewido anti-malware\SecuritySuite.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Documents and Settings\Kari Sainio\Työpöytä\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Elisa Tietoturvapalvelu\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Elisa Tietoturvapalvelu\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\Elisa Tietoturvapalvelu\FSGUI\FSSW.EXE" /reboot
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunesHelper.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - Global Startup: HPAiODevice(hp psc 700 series) - 1.lnk = C:\Program Files\Hewlett-Packard\AiO\hp psc 700 series\Bin\hpobrt07.exe
    O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O10 - Broken Internet access because of LSP provider 'c:\program files\newdotnet\newdotnet6_38.dll' missing
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1096820812109
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O23 - Service: Elisa Tietoturvapalvelu (BackWeb Client - 4119343) - Unknown owner - C:\PROGRA~1\ELISAT~1\backweb\4119343\Program\SERVIC~1.EXE
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
    O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsgk32st.exe
    O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Elisa Tietoturvapalvelu\backweb\4119343\program\fsbwsys.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Elisa Tietoturvapalvelu\FWES\Program\fsdfwd.exe
    O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Elisa Tietoturvapalvelu\Common\FSMA32.EXE
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
     
    CoDn00b, Jan 25, 2006
    #26
  7. Zipp2

    Zipp2 Regular member

    Joined:
    Sep 30, 2005
    Messages:
    376
    Likes Received:
    0
    Trophy Points:
    26
    Ota tuo

    http://www.cexx.org/LSPFix.exe

    avaa ja täppi kohtaan I know what I´m doing
    sitte siirrä tuo oikealle puolelle ja paina Finish

    newdotnet6_38.dll

    sitte on ok ei muuta näy.
     
    Zipp2, Jan 25, 2006
    #27
  8. CoDn00b

    CoDn00b Member

    Joined:
    Dec 27, 2005
    Messages:
    60
    Likes Received:
    0
    Trophy Points:
    16
    Mitä ihmettä?! Nyt ei popuppia tuu mutta taustakuvaksi tuli sinisellä taustalla lukeva teksti "SPYWARE INFECTION" "Your system is infected with spyware.Windows recommends you to use a spyware removal tool to prevent loss of important data and increase system prefomance.Using this system before having it cleaned from spyware threats is highly discouraged."
     
    CoDn00b, Jan 25, 2006
    #28
  9. Zipp2

    Zipp2 Regular member

    Joined:
    Sep 30, 2005
    Messages:
    376
    Likes Received:
    0
    Trophy Points:
    26
    En tiedä suomenkielisiä nimiä mutta katos tuolta

    Control Panel > Display > Desktop > Customize Desktop > Web

    jos siellä näkyy jotain Security niin poista se.
     
    Zipp2, Jan 25, 2006
    #29
  10. CoDn00b

    CoDn00b Member

    Joined:
    Dec 27, 2005
    Messages:
    60
    Likes Received:
    0
    Trophy Points:
    16
    eip ole :(
     
    CoDn00b, Jan 25, 2006
    #30
  11. spertti

    spertti Active member

    Joined:
    Jun 1, 2005
    Messages:
    1,222
    Likes Received:
    0
    Trophy Points:
    66
    Tässä sama suomeksi

    Klikkaa työpöydällä oikealla hiiren nappulalla -> ominaisuudet -> työpöytä -> mukauta työpöytää -> web-välilehti.
    Katso, jos siellä on jotain security-juttua, niin poista se. Jos siellä näkyy jotain muuta outoa, niin kerro myös siitä.
     
    spertti, Jan 25, 2006
    #31
  12. spertti

    spertti Active member

    Joined:
    Jun 1, 2005
    Messages:
    1,222
    Likes Received:
    0
    Trophy Points:
    66
    No sitten varmaankin tämä seuraavaksi

    Hae täältä -> http://www.billsway.com/vbspage/ registry search tool ja tee haku "desktop.html":llä. Jos antivirus herjaa, anna ajaa.

    Jos ei löydy, tee haku hakusanalla warnhp.html.

    Lähetä registry searchin tulokset.



     
    spertti, Jan 25, 2006
    #32
  13. Edille

    Edille Regular member

    Joined:
    Jun 11, 2013
    Messages:
    342
    Likes Received:
    0
    Trophy Points:
    26
    kannattaa ajaa ad-awarella kans läpi kone
     
    Edille, Feb 11, 2006
    #33
Page 2 of 2

Share This Page