Logfile of HijackThis v1.98.2
Scan saved at 10:14:34, on 26.10.2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\COMMON\FSMA32.EXE
C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\COMMON\FSMB32.EXE
C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\COMMON\FCH32.EXE
C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\BACKWEB\4476822\PROGRAM\FSBWSYS.EXE
C:\WINDOWS\SYSTEM\DEVLDR16.EXE
C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\BACKWEB\4476822\PROGRAM\FSPEX.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\COMMON\FAMEH32.EXE
C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\ANTI-VIRUS\FSGK32.EXE
C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\FWES\PROGRAM\FSDFWD.EXE
C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\ANTI-VIRUS\FSSM32.EXE
C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\ANTI-VIRUS\FSAV32.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\COMMON\FSM32.EXE
C:\OHJELMATIEDOSTOT\YHTEISET TIEDOSTOT\REAL\UPDATE_OB\EVNTSVC.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\FSGUI\FSGUIEXE.EXE
C:\OHJELMATIEDOSTOT\HJT\HIJACKTHIS.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/sb/*http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/sp/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://webmail.saunalahti.fi/wm2/?d=1042802783955
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://saunalahti.fi
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/su/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: (no name) - {00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file)
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\OHJELMATIEDOSTOT\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_5_5_0.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\OHJELMATIEDOSTOT\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_5_5_0.DLL
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [F-Secure TNB] "C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [F-Secure Manager] "C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TkBellExe] C:\Ohjelmatiedostot\Yhteiset tiedostot\Real\Update_OB\evntsvc.exe -osboot
O4 - HKLM\..\Run: [MpsOn] C:\WINDOWS\SYSTEM\MpsOn.exe
O4 - HKLM\..\Run: [devldr16.exe] C:\WINDOWS\SYSTEM\devldr16.exe
O4 - HKLM\..\RunServices: [F-Secure Management Agent] C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\Common\FSMA32.EXE
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\OHJELM~1\MICROS~1\OFFICE10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O12 - Plugin for .inp: C:\OHJELM~1\INTERN~1\PLUGINS\npincplg.dll
O12 - Plugin for .m3u: C:\OHJELM~1\INTERN~1\PLUGINS\npqtplugin6.dll
O14 - IERESET.INF: START_PAGE_URL=http://saunalahti.fi
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} (F-Secure Online Scanner) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: cpcScanner - http://www.crucial.com/controls/cpcScanner.cab
Scan saved at 10:14:34, on 26.10.2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\COMMON\FSMA32.EXE
C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\COMMON\FSMB32.EXE
C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\COMMON\FCH32.EXE
C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\BACKWEB\4476822\PROGRAM\FSBWSYS.EXE
C:\WINDOWS\SYSTEM\DEVLDR16.EXE
C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\BACKWEB\4476822\PROGRAM\FSPEX.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\COMMON\FAMEH32.EXE
C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\ANTI-VIRUS\FSGK32.EXE
C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\FWES\PROGRAM\FSDFWD.EXE
C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\ANTI-VIRUS\FSSM32.EXE
C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\ANTI-VIRUS\FSAV32.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\COMMON\FSM32.EXE
C:\OHJELMATIEDOSTOT\YHTEISET TIEDOSTOT\REAL\UPDATE_OB\EVNTSVC.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\FSGUI\FSGUIEXE.EXE
C:\OHJELMATIEDOSTOT\HJT\HIJACKTHIS.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/sb/*http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/sp/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://webmail.saunalahti.fi/wm2/?d=1042802783955
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://saunalahti.fi
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/su/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: (no name) - {00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file)
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\OHJELMATIEDOSTOT\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_5_5_0.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\OHJELMATIEDOSTOT\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_5_5_0.DLL
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [F-Secure TNB] "C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [F-Secure Manager] "C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TkBellExe] C:\Ohjelmatiedostot\Yhteiset tiedostot\Real\Update_OB\evntsvc.exe -osboot
O4 - HKLM\..\Run: [MpsOn] C:\WINDOWS\SYSTEM\MpsOn.exe
O4 - HKLM\..\Run: [devldr16.exe] C:\WINDOWS\SYSTEM\devldr16.exe
O4 - HKLM\..\RunServices: [F-Secure Management Agent] C:\OHJELMATIEDOSTOT\F-SECURE INTERNET SECURITY\Common\FSMA32.EXE
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\OHJELM~1\MICROS~1\OFFICE10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O12 - Plugin for .inp: C:\OHJELM~1\INTERN~1\PLUGINS\npincplg.dll
O12 - Plugin for .m3u: C:\OHJELM~1\INTERN~1\PLUGINS\npqtplugin6.dll
O14 - IERESET.INF: START_PAGE_URL=http://saunalahti.fi
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} (F-Secure Online Scanner) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: cpcScanner - http://www.crucial.com/controls/cpcScanner.cab
Vastaukset 3
Vanhimmat
Voi hitsi ku oot vetänny ravatin tiukalle.
Merkkaa nuo sulje selain ja muut avoimet ikkunat ja paina FIX checked
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/sb/*http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/sp/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/su/*http://www.yahoo.com
R3 - URLSearchHook: (no name) - {00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file)
Jos et tiedä tai tunnista tota
O4 - HKLM\..\Run: [MpsOn] C:\WINDOWS\SYSTEM\MpsOn.exe
Niin scannaa se tuolla ja kerro mitä se scanneri sano siittä
http://virusscan.jotti.dhs.org/
..se sano.. hijackin ajan myöhemmin.
Service load:
0% 100%
File: MPSON.EXE
Status:
OK
Packers detected:
None
AntiVir
No viruses found (1.35 seconds taken)
Avast
No viruses found (4.66 seconds taken)
BitDefender
No viruses found (3.07 seconds taken)
ClamAV
No viruses found (2.88 seconds taken)
Dr.Web
No viruses found (4.44 seconds taken)
F-Prot Antivirus
No viruses found (0.37 seconds taken)
Kaspersky Anti-Virus
No viruses found (5.12 seconds taken)
mks_vir
No viruses found (1.58 seconds taken)
NOD32
No viruses found (2.29 seconds taken)
Norman Virus Control
No viruses found (3.20 seconds taken)
Statistics
Last piece of malware found was Win32/Webus.C in New Folder3.zip, detected by:
Scanner Malware name Time taken
AntiVir X 2.62 seconds
Avast X 9.19 seconds
BitDefender X 33.19 seconds
ClamAV X 5.94 seconds
Dr.Web Trojan.Proxy.106 9.17 seconds
F-Prot Antivirus X 0.73 seconds
Kaspersky Anti-Virus X 4.55 seconds
mks_vir Win32.4 1.82 seconds
NOD32 Win32/Webus.C 5.13 seconds
Norman Virus Control X 7.05 seconds
Service statistics:
966 files (728 of those unique) have been uploaded & scanned since 26/10/2004, the day of the last database purge.
274 of those 728 files contained a virus or any other form of malware.
This page has been visited 2707 times in this time period.
This service managed to spot 8 pieces of malware no vendor used knew about at the time of uploading.
The service also warned against 90 suspicious files without any help from scanner results.
However, 7 files reported to be OK were found out to be malware later (this is checked daily).
As far as can be told, all this together makes this service 99.04% accurate. However, since it is very well possible malware has been uploaded no scanner knows about at this time, this number is to be taken with a proper amount of skepticism.
Most popular malware:
Rank Malware name Uploaded Last known filename
1 backdoor.sdbot.gen 14 times SndMon32.exe
2 backdoor.agobot.3.gen 9 times spvsper32.exe
3 behaveslike:win32.explorerhijack 8 times cashtest[1].exe
4 win32.p2p.spybot.gen 7 times vpc32.exe
5 win32:trojan-gen. {other} 5 times server.exe
6 trojan.startpage.pc 5 times startpage.exe
7 backdoor.whackgf.a 5 times whack.exe
8 bds/picharad 5 times winset32.exe
9 tr/dldr.small.lx 4 times MSMSGSVC.exe
10 backdoor.subseven.215 4 times Bitdefender 8.0 standard keygen
11 trojan.wootbot-52 4 times lsass2.exe
12 trojan.downloader.swizzor.ca 3 times Clockstupid.exe
13 win32.hllw.mybot 3 times winmplayer.exe
14 trojan.forbot-2 3 times msdev.exe
15 backdoor.win32.rbot.gen 3 times kb17.exe
Elikkäs tuo MPSON.EXE ei näköjään ole mikään örkkylä.