olen yrittänyt vähän kaikkea cwshredderillä ja hijackthis ja spybot-search ja ad-awarella ja about busterilla ja myös pattaya sivujen ohjeita noudattaen vikasietotilassa. aina tulee uudelleen joku hakusivulta näyttävä sivu.Logfile of HijackThis v1.98.2
Scan saved at 19:55:19, on 16.9.2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
F:\Uusi kansio\smc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Documents and Settings\lena\Työpöytä\HijackThis uusin.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:NavigationFailure
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:NavigationFailure
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:NavigationFailure
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:NavigationFailure
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:NavigationFailure
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {09277B74-6F40-41B8-A362-9410E3E51F36} - C:\WINDOWS\System32\jjjfh.dll
O4 - HKLM\..\Run: [zSPGuard] f:\ohjelmia\spguard\spguard.exe /s
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O18 - Filter: text/html - {E4CFA277-B1B4-429C-9BDC-AE85AA2F0CDE} - C:\WINDOWS\System32\jjjfh.dll
O18 - Filter: text/plain - {E4CFA277-B1B4-429C-9BDC-AE85AA2F0CDE} - C:\WINDOWS\System32\jjjfh.dll
kiitos etukäteen avusta!!
Scan saved at 19:55:19, on 16.9.2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
F:\Uusi kansio\smc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Documents and Settings\lena\Työpöytä\HijackThis uusin.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:NavigationFailure
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:NavigationFailure
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:NavigationFailure
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:NavigationFailure
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:NavigationFailure
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {09277B74-6F40-41B8-A362-9410E3E51F36} - C:\WINDOWS\System32\jjjfh.dll
O4 - HKLM\..\Run: [zSPGuard] f:\ohjelmia\spguard\spguard.exe /s
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O18 - Filter: text/html - {E4CFA277-B1B4-429C-9BDC-AE85AA2F0CDE} - C:\WINDOWS\System32\jjjfh.dll
O18 - Filter: text/plain - {E4CFA277-B1B4-429C-9BDC-AE85AA2F0CDE} - C:\WINDOWS\System32\jjjfh.dll
kiitos etukäteen avusta!!
Vastaukset 10
Vanhimmat
spy sweeper tai sit tämmöinen kuin bazooka. spy sweeperiä suositteelen
Oletko ite poistellu riviä tuolta logista?
Lataa tosta FINDnFIX
http://downloads.subratam.org/FINDnFIX.exe
Tuplaklikkaa sitä FINDnFIX.exe:tä,niin se asentaa koneelle kansion nimeltä FINDnFIX.
Avaa se FINDnFIX kansio ja tuplaklikkaa !LOG!.bat kohtaa ja anna sen rauhassa etsiä.
Kun se on valmis niin tulee LOG.txt esiin,liitä se logi tänne.
The new DLLs have been loaded:
C:\WINDOWS\system32\dsound.dll
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_5.2.2.1_x-ww_468466a5\dxmrtp.dll
C:\WINDOWS\system32\RTCRES.dll
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Networking.RtcDll_6595b64144ccf1df_5.2.2.1_x-ww_d6bd8b93\rtcdll.dll
To disable DLL Authentication go to the security tab under the Tools, Options menu.
File Version : 6.2.0137
File Description : MSN Messenger
File Path : C:\Program Files\MSN Messenger\msnmsgr.exe
Process ID : 0xD90 (Heximal) 3472 (Decimal)
Connection origin : remote initiated
Protocol : TCP
Local Address : 80.221.242.243
Local Port : 1510 (MVX-LM - Midland Valley Exploration Ltd. Lic. Man.)
Remote Name :
Remote Address : 207.46.106.91
Remote Port : 1863
Ethernet packet details:
Ethernet II (Packet Length: 82)
Destination: 00-0c-6e-2d-b1-79
Source: 00-0f-35-bf-00-54
Type: IP (0x0800)
Internet Protocol
Version: 4
Header Length: 20 bytes
Flags:
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset:0
Time to live: 115
Protocol: 0x6 (TCP - Transmission Control Protocol)
Header checksum: 0xf540 (Correct)
Source: 207.46.106.91
Destination: 80.221.242.243
Transmission Control Protocol (TCP)
Source port: 1863
Destination port: 1510
Sequence number: 3633495706
Acknowledgment number: 3602740779
Header length: 20
Flags:
0... .... = Congestion Window Reduce (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 1... = Push: Set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Checksum: 0x1825 (Correct)
Data (28 Bytes)
Binary dump of the packet:
0000: 00 0C 6E 2D B1 79 00 0F : 35 BF 00 54 08 00 45 00 | ..n-.y..5..T..E.
0010: 00 44 89 64 00 00 73 06 : 40 F5 CF 2E 6A 5B 50 DD | [email protected][P.
0020: F2 F3 07 47 05 E6 D8 92 : BE 9A D6 BD 76 2B 50 18 | ...G........v+P.
0030: 44 65 25 18 00 00 43 48 : 4C 20 30 20 32 38 36 33 | De%...CHL 0 2863
0040: 36 31 32 31 36 37 35 33 : 37 35 32 33 30 30 35 31 | 6121675375230051
0050: 0D 0A : | ..
sitten aukeilee koko ajan jotain ilmoituksia en ymmärrä!!
Mikä lista tuo on?
Pistä tänne se FINDnFIX logi.
Fri 17 Sep 04 13:47:29
»»»»»»»»»»»»»»»»»»***LOG!***(*updated *9/1*)»»»»»»»»»»»»»»»»
*System:
Microsoft Windows XP Home Edition 5.1 Service Pack 1 (Build 2600)
*IE version:
6.0.2800.1106 SP1-Q330994-Q824145-Q832894-Q837009-Q831167-Q823353-Q867801
MS-DOSin versio 5.00.500
*command.com test passed!
__________________________________
!!*Creating backups...!!
(*Backup already exist!)
13:47:28,85 pe 17.09.2004
__________________________________
*Local time:
17. syyskuuta 2004 (17.9.2004)
13:47, Normaaliaika
*Uptime:
13:47:30 up 0 days, 0:15:45
*Path:
C:\FINDnFIX
----------------------------------------------------
»»Member of...: ("ADMIN" logon group match required!)
User is a member of group ËLEN\Ei mitään.
User is a member of group \Kaikki.
User is a member of group BUILTIN\Järjestelmänvalvojat.
User is a member of group BUILTIN\Käyttäjät.
User is a member of group \PAIKALLINEN.
User is a member of group NT-HALLINTA\VUOROVAIKUTTEINEN.
User is a member of group NT-HALLINTA\Vahvistetut käyttäjät.
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
User: [ËLEN\Elena], is a member of:
ËLEN\Ei mitään
\Everyone
Running in WORKSTATION MODE.
SystemDrive is C:
SystemRoot is C:\WINDOWS
Logon Domain is ÓLEN
Administrator's Name is Elena
Computer Name is ÓLEN
LOGON SERVER is \\ÓLEN
»»»»»»»»»»»»»»»»»»*** Note! ***»»»»»»»»»»»»»»»»
The list will produce a small database of files that will match certain criteria.
Ex: read only files, s/h files, last modified date. size, etc.
The filters provided and registry scan should match the
corresponding file(s) listed.
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Unless the file match the entire criteria, it should not be pointed to remove
without attempting to confirm it's nature!
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
At times there could be several (legit) files flagged, and/or duplicate culprit file(s)!
If in doubt, always search the file(s) and properties according to criteria!
The file(s) found should be moved to \FINDnFIX\"junkxxx" Subfolder
______________________________________________________________________________
***YOU NEED TO DISABLE YOUR ACTIVE ANTI VIRUS PROTECTION TO AVOID CONFLICTS!***
______________________________________________________________________________
......Scanning for file(s)...
*Note! The list(s) may include legitimate files!
»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»
»»»»» (*1*) »»»»» .........
»»Read access error(s)...
C:\WINDOWS\SYSTEM32\CTLMO.DLL File read error
\\?\C:\WINDOWS\System32\CTLMO.DLL File read error
»»»»» (*2*) »»»»»........
CTLMO.DLL Can't Open!
»»»»» (*3*) »»»»»........
C:\WINDOWS\SYSTEM32\
ctlmo.dll Wed 21 Apr 2004 19.07.46 A...R 57 344 56,00 K
1 item found: 1 file, 0 directories.
Total of file sizes: 57 344 bytes 56,00 K
unknown/hidden files...
No matches found.
»»»»» (*4*) »»»»».........
Sniffing..........
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.
Sniffed -> C:\WINDOWS\SYSTEM32\CTLMO.DLL
SNiF 1.34 statistics
Matching files : 1 Amount in bytes : 57344
Directories searched : 1 Commands executed : 0
Masks sniffed for: *.DLL
»»»»»(*5*)»»»»»
¯ Access denied ® ..................... CTLMO.DLL .....57344 21.04.2004
»»»»»(*6*)»»»»»
fgrep: can't open input C:\WINDOWS\SYSTEM32\CTLMO.DLL
»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»
»»»»»Search by size...
*List of files and specs according to 'size' :
*Note: Not all files listed here are infected, but *may include* the
name and spces of the offending file...
___________________________________________________________________________
Path: C:\WINDOWS\SYSTEM32 Including: *.DLL
136. Ctlmo Dll 57,344 . . R . A 4-21-04 7:07 pm
____________________________________________________________________________
*By size and date...
C:\WINDOWS\SYSTEM32\
ctlmo.dll Wed 21 Apr 2004 19.07.46 A...R 57 344 56,00 K
1 item found: 1 file, 0 directories.
Total of file sizes: 57 344 bytes 56,00 K
No matches found.
No matches found.
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.
Sniffed -> C:\WINDOWS\SYSTEM32\CTLMO.DLL
SNiF 1.34 statistics
Matching files : 1 Amount in bytes : 57344
Directories searched : 1 Commands executed : 0
Masks sniffed for: *.DLL
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.
SNiF 1.34 statistics
Matching files : 0 Amount in bytes : 0
Directories searched : 1 Commands executed : 0
Masks sniffed for: *.DLL
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.
SNiF 1.34 statistics
Matching files : 0 Amount in bytes : 0
Directories searched : 1 Commands executed : 0
Masks sniffed for: *.DLL
»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»
BHO search and other files...
fgrep: can't open input C:\WINDOWS\SYSTEM32\CTLMO.DLL
No matches found.
No matches found.
*sp.html found in temp folder:
--a-- - - - - - 7,976 09-17-2004 sp.html
File: CRC-32 : 93866C48MD5 : CE5B5B5B DFD4A959 9F4A95C7 6FA46BD2
*Filter keys search...
REGDMP: Unable to open key 'HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/html' (2)
--(*text/html Subkey was NOT FOUND!)--
REGDMP: Unable to open key 'HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/plain' (2)
--(*text/plain Subkey was NOT FOUND!)--
»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»
»»Size of Windows key:
(*Default-450 *No AppInit-398 *fake(infected)-448,504,512...)
Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 450
»»Checking for AppInit_DLLs (empty) value...
________________________________
!"AppInit_DLLs"=""!
Value does not match
________________________________
»»Comparing *saved* key with *original*...
REGDIFF 2.1 - Freeware written by Gerson Kurz (http://www.p-nand-q.com)
Comparing File #1 (Keys1\winkey.reg) with File #2 (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows).
Value "AppInit_DLLs" in key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" has different lengths (1 vs 30)
»»Dumping Values........
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DeviceNotSelectedTimeout SZ 15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota DWORD 00002710
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Spooler SZ yes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\swapdisk SZ
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\TransmissionRetryTimeout SZ 300
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERProcessHandleQuota DWORD 00002710
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs SZ
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
DeviceNotSelectedTimeout = 15
GDIProcessHandleQuota = REG_DWORD 0x00002710
Spooler = yes
swapdisk =
TransmissionRetryTimeout = 300
USERProcessHandleQuota = REG_DWORD 0x00002710
AppInit_DLLs = (*** MISSING TRAILING NULL CHARACTER ***)
»»Security settings for 'Windows' key:
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
(ID-NI) ALLOW Read BUILTIN\K„ytt„j„t
(ID-IO) ALLOW Read BUILTIN\K„ytt„j„t
(ID-NI) ALLOW Full access BUILTIN\J„rjestelm„nvalvojat
(ID-IO) ALLOW Full access BUILTIN\J„rjestelm„nvalvojat
(ID-NI) ALLOW Full access NT-HALLINTA\SYSTEM
(ID-IO) ALLOW Full access NT-HALLINTA\SYSTEM
(ID-IO) ALLOW Full access LUOJA-OMISTAJA
Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
Read BUILTIN\K„ytt„j„t
Full access BUILTIN\J„rjestelm„nvalvojat
Full access NT-HALLINTA\SYSTEM
»»Performing string scan....
00001150: vk UDeviceNotSelecte
00001190:dTimeout 1 5 ( h vk ' zGDIProce
000011D0:ssHandleQuota" 3 0 0 =t vk Spooler2
00001210: y e s _ vk 5swapdisk h
00001250: X vk . TransmissionRetryTimeout vk
00001290: ' USERProcessHandleQuota h X
000012D0: vk < AppInit_DLLs j C : \ W I N
00001310:D O W S \ S y s t e m 3 2 \ c t l m o . d l l *
00001350:p 0 *" ling-
00001390: p *" - 3
Siis tee tämä nyt kaikessa rauhassa äläkä hätäile.
Sammuta Norttonin Auto-Protect
Tän seuraavan operaation aikana kone käynnistyy uudestaan.
Jos sulla on jotain extraa siinä auki,niin sammuta jo valmiiks.
Aukase FINDnFIX kansio
Sitte aukaset sen KEYS1 kansion
Tuplaklikkaa FIX.bat kohtaa ja kone käynnistyy uudestaan.
Kun kone on käynnistynny uudestaan,niin etsi tuo CTLMO.DLL ja klikkaa sitä ja valitse valikosta LEIKKAA.
Sen jälkeen meet sinne FINDnFIX kansioon ja avaat sen junkxxx kansion ja liität sen fiilun sinne ja jos kysyy jotain niin vastaa Ok.
Sen jälken klikkaat sitä RESTORE.bat kohtaa ja sieltä tulee log2.txt logi.
Liitä se logi sitte tänne.
Fri 17 Sep 04 16:08:06
»»»»»»»»»»»»»»»»»»***LOG2!(*updated *9/1*)***»»»»»»»»»»»»»»»»
*System:
Microsoft Windows XP Home Edition 5.1 Service Pack 1 (Build 2600)
*IE version:
6.0.2800.1106 SP1-Q330994-Q824145-Q832894-Q837009-Q831167-Q823353-Q867801
___________________________________________
!!Restoring backups!!
Error: Käyttö estetty.
Error: Käyttö estetty.
16:08:05,15 pe 17.09.2004
___________________________________________
*Local time:
17. syyskuuta 2004 (17.9.2004)
16:08, Normaaliaika
*Uptime:
16:08:08 up 0 days, 0:05:46
*path:
C:\FINDnFIX
Running in WORKSTATION MODE.
SystemDrive is C:
SystemRoot is C:\WINDOWS
Logon Domain is ÓLEN
Administrator's Name is Elena
Computer Name is ÓLEN
LOGON SERVER is \\ÓLEN
------------------------------------------
This log will confirm if the file was successfully moved, and/or
the right file was selected...
Scanning for file(s) in System32...
»»»»»»» (1) »»»»»»»
»»»»»»» (2) »»»»»»»
»»»»»»» (3) »»»»»»»
No matches found.
Unknown/hidden files...
No matches found.
»»»»»»» (4) »»»»»»»
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.
SNiF 1.34 statistics
Matching files : 0 Amount in bytes : 0
Directories searched : 1 Commands executed : 0
Masks sniffed for: *.DLL
»»»»»(5)»»»»»
»»»»»(6)»»»»»
»»»»»»» Search by size And Date...
*List of files specs according to size:
*Note: Not all files listed here are infected!
____________________________________________________________________________
Path: C:\WINDOWS\SYSTEM32 Including: *.DLL
____________________________________________________________________________
No matches found.
No matches found.
No matches found.
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.
SNiF 1.34 statistics
Matching files : 0 Amount in bytes : 0
Directories searched : 1 Commands executed : 0
Masks sniffed for: *.DLL
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.
SNiF 1.34 statistics
Matching files : 0 Amount in bytes : 0
Directories searched : 1 Commands executed : 0
Masks sniffed for: *.DLL
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.
SNiF 1.34 statistics
Matching files : 0 Amount in bytes : 0
Directories searched : 1 Commands executed : 0
Masks sniffed for: *.DLL
»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»
BHO search and other files...
No matches found.
No matches found.
No matches found.
--*sp.html in temp folder was NOT FOUND!--
*Filter keys search...
REGDMP: Unable to open key 'HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/html' (2)
--(*text/html Subkey was NOT FOUND!)--
REGDMP: Unable to open key 'HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/plain' (2)
--(*text/plain Subkey was NOT FOUND!)--
»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»
»»»*»»» Scanning for moved file... »»»*»»»
No matches found.
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.
SNiF 1.34 statistics
Matching files : 0 Amount in bytes : 0
Directories searched : 1 Commands executed : 0
Masks sniffed for: *.*
fgrep: no files found for C:\FINDNFIX\JUNKXXX\*.*
Analyzer v1.36 by Boogie Copyright (C) 1997 ESP Team
Files: C:\FINDNFIX\JUNKXXX\*.*
Ä
Ä
Volume: None * DDIR * 4:08 pm | Fri, 9-17-04
Ser #: 040D-2FEB DOS Ver. 5.00 0% Used space
Path: C:\FINDNFIX\JUNKXXX All files selected
No files found.
No. of files: 0 | List size: 0
Disk size: 976.5 M | Actual spc: 0
Bytes free: 976.5 M | Conserved space: 0
Tiedostoa ei l”ydy - C:\FINDnFIX\junkxxx\*.*
CHK-SAFE.EXE Ver 2.51 by Bill Lambdin Don Peters and Robert Bullock.
MD5 Message Digest Algorithm by RSA Data Security, Inc.
File name Size Date Time MD5 Hash
________________________________________________________________________
CRC-Cyclic Redundancy Checker, Version 1.20, 08-Feb-92, rtk
C:\FINDNFIX\JUNKXXX
No files found
#######################################################
*Known files are...
--------------------
File: ((56k; (57,344 bytes)
CRC-32 : D5C9FB2E
MD5 : C185B36F 9969D3A6 D2122BA7 CBC02249
--------------------
File: ((35k; (35,840 bytes)
CRC-32 : 33081C8B
MD5 : 1DE9A8E2 4C826006 7A479B09 577D9CAE
--------------------
File: ((21k; (21,504 bytes)
CRC-32 : 2258F59E
MD5 : EFEE2CB3 B342A351 51802356 9637F8E6
#######################################################
»»Permissions:
ERROR: Tiedostoja ei ole enempää.
Directory "C:\FINDnFIX\junkxxx\."
Permissions:
Type Flags Inh. Mask Gen. Std. File Group or User
======= ======== ==== ======== ==== ==== ==== ================
Allow 00000003 tco- 001F01FF ---- DSPO rw+x NT-HALLINTA\SYSTEM
Allow 0000000B -co- 10000000 ---A ---- ---- \LUOJA-OMISTAJA
Allow 00000003 tco- 001F01FF ---- DSPO rw+x BUILTIN\Järjestelmänvalvojat
Allow 00000002 tc-- 00000004 ---- ---- --+- BUILTIN\Käyttäjät
Allow 00000002 tc-- 00000002 ---- ---- -w-- BUILTIN\Käyttäjät
Allow 00000003 tco- 001200A9 ---- -S-- r--x BUILTIN\Käyttäjät
Allow 00000000 t--- 001F01FF ---- DSPO rw+x ËLEN\Elena
Allow 00000013 tco- 001F01FF ---- DSPO rw+x BUILTIN\Järjestelmänvalvojat
Allow 00000013 tco- 001F01FF ---- DSPO rw+x NT-HALLINTA\SYSTEM
Allow 00000010 t--- 001F01FF ---- DSPO rw+x ËLEN\Elena
Allow 0000001B -co- 10000000 ---A ---- ---- \LUOJA-OMISTAJA
Allow 00000013 tco- 001200A9 ---- -S-- r--x BUILTIN\Käyttäjät
Allow 00000012 tc-- 00000004 ---- ---- --+- BUILTIN\Käyttäjät
Allow 00000012 tc-- 00000002 ---- ---- -w-- BUILTIN\Käyttäjät
Owner: ËLEN\Elena
Primary Group: ËLEN\Ei mitään
Directory "C:\FINDnFIX\junkxxx\.."
Permissions:
Type Flags Inh. Mask Gen. Std. File Group or User
======= ======== ==== ======== ==== ==== ==== ================
Allow 00000003 tco- 001F01FF ---- DSPO rw+x BUILTIN\Järjestelmänvalvojat
Allow 00000003 tco- 001F01FF ---- DSPO rw+x NT-HALLINTA\SYSTEM
Allow 00000000 t--- 001F01FF ---- DSPO rw+x ËLEN\Elena
Allow 0000000B -co- 10000000 ---A ---- ---- \LUOJA-OMISTAJA
Allow 00000003 tco- 001200A9 ---- -S-- r--x BUILTIN\Käyttäjät
Allow 00000002 tc-- 00000004 ---- ---- --+- BUILTIN\Käyttäjät
Allow 00000002 tc-- 00000002 ---- ---- -w-- BUILTIN\Käyttäjät
Owner: ËLEN\Elena
Primary Group: ËLEN\Ei mitään
»»Size of Windows key:
(*Default-450 *No AppInit-398 *fake(infected)-448,504,512...)
Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 452
»»Checking for AppInit_DLLs (empty) value...
________________________________
!"AppInit_DLLs"=""!
Value Matches
________________________________
»»Comparing *saved* key with *original*...
REGDIFF 2.1 - Freeware written by Gerson Kurz (http://www.p-nand-q.com)
Comparing File #1 (Keys1\winkey.reg) with File #2 (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows).
No differences found.
»»Dumping Values:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DeviceNotSelectedTimeout SZ 15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota DWORD 00002710
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Spooler SZ yes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\swapdisk SZ
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\TransmissionRetryTimeout SZ 300
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERProcessHandleQuota DWORD 00002710
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs SZ
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
DeviceNotSelectedTimeout = 15
GDIProcessHandleQuota = REG_DWORD 0x00002710
Spooler = yes
swapdisk =
TransmissionRetryTimeout = 300
USERProcessHandleQuota = REG_DWORD 0x00002710
AppInit_DLLs =
»»Security settings for 'Windows' key:
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
(ID-NI) ALLOW Read BUILTIN\K„ytt„j„t
(ID-IO) ALLOW Read BUILTIN\K„ytt„j„t
(ID-NI) ALLOW Full access BUILTIN\J„rjestelm„nvalvojat
(ID-IO) ALLOW Full access BUILTIN\J„rjestelm„nvalvojat
(ID-NI) ALLOW Full access NT-HALLINTA\SYSTEM
(ID-IO) ALLOW Full access NT-HALLINTA\SYSTEM
(ID-NI) ALLOW Full access ÓLEN\Elena
(ID-IO) ALLOW Full access LUOJA-OMISTAJA
Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
Read BUILTIN\K„ytt„j„t
Full access BUILTIN\J„rjestelm„nvalvojat
Full access NT-HALLINTA\SYSTEM
Full access ÓLEN\Elena
00001150: ;+ = Mx m ;+
00001190: = Mx m ;+ vk S DeviceNotSelecte
000011D0:dTimeout 1 5 l l vk ' UGDIProce
00001210:ssHandleQuotaout 3 0 0 ' vk P zSpoolere
00001250: y e s ( vk swapdisk 0
00001290:` vk 5TransmissionRetryTimeout vk
000012D0: ' dlUSERProcessHandleQuota 0 `
00001310: vk ysAppInit_DLLs
00001350:
00001390:
000013D0: M (D PM
00001410: O PD D ,P
00001450:xD (D LQ D PD
00001490: lR D xD S D D
000014D0: T E D
00001510: U H w D pM V
00001550:
---------- NEWWIN.TXT
ysAppInit_DLLs¨à
--------------
--------------
$011C0: DeviceNotSelectedTimeout
$01207: UGDIProcessHandleQuotaout
$012B0: TransmissionRetryTimeout
$012DE: dlUSERProcessHandleQuota
$0132E: ysAppInit_DLLs
--------------
--------------
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.1515_x-ww_7bb98b8a\
WLFChange
FTWARE\Microsoft\OLEAUT
mmdlg_SetRGBColor
--------------
--------------
d.... 0 Sep 17 12:42 .
d.... 0 Sep 17 12:42 ..
2 files found occupying -1024 bytes
===============================================================================
0 bytes 0 cps
Files: 0 Records: 0 Matches: 0 Elapsed Time: 00:00:00.01
VDIR v1.00
Path: C:\FINDNFIX\JUNKXXX\*.*
---------------------------------------+---------------------------------------
. 09-17-:4 12:42|.. 09-17-:4 12:42
---------------------------------------+---------------------------------------
2 files totaling 0 bytes consuming 0 bytes of disk space.
17299968 bytes available on Drive C: No volume label
...File dump...
Detecting...
C:\FINDnFIX\junkxxx
Finished Detecting...
=========================================
0 C:\FINDnFIX\junkxxx (DIR Total)
Owner No. Files Total Size
=========================================
________________________________________________________________________________
***THE FIX IS NOT COMPATIBLE WITH EARLIER;UNPATCHED VERSIONS OF WIN2K'(SP3 and BELLOW)'
AND/OR LAX OF SECURITY UPDATES AND SERVICE PACKS FOR ALL PLATFORMS!
MINIMAL REQUIREMENTS INCLUDE:
_________XP HOME/PRO; SP1; IE6/SP1
_________2K/SP4; IE6/SP1
________________________________________________________________________________
»»»»»»»»*** www10.brinkster.com/expl0iter/freeatlast/FNF/ ***»»»»»»»
Fri 17 Sep 04 16:08:47
-----END-----
jokos tämä on oikea
Eikö tuon CTLMO.DLL:än siirto onnistunnu sinne junkxxx kansioon?
Kerros mitä tapahtu.
noudatin ohjeita ja tei uudestaan eilöytynyt CTLMO.DLL:llää ollenkaan! jos tarkoitit win etsi työkalua? Täytyy yrittää vielä kerran jos ei auta niin pitää vaihtaa käyttöjärjestelmä johonkin muuhun kuin mikrosoftin tuotteeseen!
No putsaa kone Cwshredderillä ja pistä uus Hijack logi tänne.