Kunnossa?

Guutti22.12.2004 klo 19.48

Logfile of HijackThis v1.99.0
Scan saved at 19:46:00, on 22.12.2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
E:\Kaikki\virustorjuntaa\AVGUARD.EXE
E:\Kaikki\virustorjuntaa\AVWUPSRV.EXE
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\atiptaxx.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S09IC1.EXE
E:\Kaikki\virustorjuntaa\AVGNT.EXE
C:\Program Files\Windows ServeAd\WinServAd.exe
C:\Program Files\Windows ServeAd\WinServSuit.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
E:\GetRight\getright.exe
E:\GetRight\getright.exe
E:\bolo sälää\mIRC\mirc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - Default URLSearchHook is missing
O2 - BHO: Search Relevancy - {1D7E3B41-23CE-469B-BE1B-A64B877923E1} - C:\PROGRA~1\SEARCH~1\SEARCH~2.DLL
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - E:\GetRight\xx2gr.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\SPYBOT~1.1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.0002.1001\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.2001.0001\fi\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.2001.0001\fi\msntb.dll
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [EPSON Stylus C44 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S09IC1.EXE /P23 "EPSON Stylus C44 Series" /O6 "USB002" /M "Stylus C44"
O4 - HKLM\..\Run: [AVGCtrl] E:\Kaikki\virustorjuntaa\AVGNT.EXE /min
O4 - HKLM\..\Run: [Windows ServeAd] C:\Program Files\Windows ServeAd\WinServAd.exe
O4 - HKCU\..\Run: [EPSON Stylus C44 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C44 Series" /M "Stylus C44"
O4 - Global Startup: Microsoft Office.lnk.disabled
O4 - Global Startup: GetRight - Tray Icon.lnk = E:\GetRight\getright.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Download with GetRight - E:\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - E:\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - E:\AIM\aim.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .pif: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O12 - Plugin for .png: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .tiff: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/ClickYesToContinue/ie/bridge-c18.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/bcd48c18cb7498/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{00FB289C-2A42-4D62-B629-28CAED77D16B}: NameServer = 212.83.96.242 212.83.96.250
O17 - HKLM\System\CS2\Services\Tcpip\..\{00FB289C-2A42-4D62-B629-28CAED77D16B}: NameServer = 212.83.96.242 212.83.96.250
O23 - Service: AntiVir Service - H BEDV Datentechnik GmbH - E:\Kaikki\virustorjuntaa\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - Unknown - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AntiVir Update - H BEDV Datentechnik GmbH, Germany - E:\Kaikki\virustorjuntaa\AVWUPSRV.EXE
O23 - Service: Loogisen levyn hallinnan valvontapalvelu - Unknown - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: EPSON Printer Status Agent2 - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: Tapahtumaloki - Unknown - C:\WINDOWS\system32\services.exe
O23 - Service: CD-levyjen kirjoittamisen IMAPI COM -palvelu - Unknown - C:\WINDOWS\System32\imapi.exe
O23 - Service: NetMeeting etätyöpöydän jakaminen - Unknown - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: Verkon DDE - Unknown - C:\WINDOWS\system32\netdde.exe
O23 - Service: Verkon DDE DSDM - Unknown - C:\WINDOWS\system32\netdde.exe
O23 - Service: Plug and Play - Unknown - C:\WINDOWS\system32\services.exe
O23 - Service: Etätyöpöydän ohjeen istunnonhallinta - Unknown - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Älykortti-apuohjelma - Unknown - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Älykortti - Unknown - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Resurssilokit ja -hälytykset - Unknown - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Telnet - Unknown - C:\WINDOWS\System32\tlntsvr.exe
O23 - Service: Aseman tilannevedos - Unknown - C:\WINDOWS\System32\vssvc.exe
O23 - Service: WMI resurssisovitin - Unknown - C:\WINDOWS\System32\wbem\wmiapsrv.exe

7414

Äänestä

Vastaukset 7

Vanhimmat

Juu22.12.2004 klo 19.51

Koitetaan,jos tällä onnistuis paremmin

Lataa tosta FINDnFIX

http://downloads.subratam.org/FINDnFIX.exe

Tuplaklikkaa sitä FINDnFIX.exe:tä,niin se asentaa koneelle kansion nimeltä FINDnFIX.
Avaa se FINDnFIX kansio ja tuplaklikkaa !LOG!.bat kohtaa ja anna sen rauhassa etsiä.
Kun se on valmis niin tulee LOG.txt esiin,liitä se logi tänne.

Äänestä

Guutti22.12.2004 klo 23.04
tällaisen se antoi ulos
C:\WINDOWS\SYSTEM32\WSTDECOD.DLL
Mitä sieltä olisi pitänyt tulla?
Äänestä
Juu22.12.2004 klo 23.22
Guutti kirjoitti:
tällaisen se antoi ulos
C:\WINDOWS\SYSTEM32\WSTDECOD.DLL
Mitä sieltä olisi pitänyt tulla?
No suurinpiirtein tollanen logi ois pitänny tulla.
Tuliko jotain virheilmoituksia vai?

Thu 23 Sep 04 16:35:54

»»»»»»»»»»»»»»»»»»***LOG!***(*updated *9/1*)»»»»»»»»»»»»»»»»

*System:
Microsoft Windows 2000 Professional 5.0 Service Pack 4 (Build 2195)
*IE version:
6.0.2600.0000

The type of the file system is NTFS.

MS-DOS Version 5.00.500

*command.com test passed!

__________________________________
!!*Creating backups...!!

The operation completed successfully
16:35:53,71 to 23.09.2004
__________________________________

*Local time:
23. syyskuuta 2004 (23.09.2004)
16:35, FLE Daylight Time
*Uptime:
16:35:57 up 0 days, 1:23:20

*Path:
C:\FINDnFIX
----------------------------------------------------
»»Member of...: ("ADMIN" logon + group match required!)

User is a member of group ELOMATIC\Domain Users.
User is a member of group \Everyone.
User is a member of group BUILTIN\Administrators.
User is a member of group BUILTIN\Users.
User is a member of group NT AUTHORITY\INTERACTIVE.
User is a member of group NT AUTHORITY\Authenticated Users.
User is a member of group \LOCAL.
User is a member of group ELOMATIC\EloProjekt.
User is a member of group ELOMATIC\VT-kirj-4krs.
User is a member of group ELOMATIC\Laiva-sähkö.
User is a member of group ELOMATIC\After_logon.
User is a member of group ELOMATIC\AcadUsers.
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Group BUILTIN\Administrators matches list.
Group BUILTIN\Users matches list.

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

User: [ELOMATIC\jollila], is a member of:

ELOMATIC\AcadUsers
ELOMATIC\After_logon
ELOMATIC\Domain Users
ELOMATIC\EloProjekt
\Everyone
ELOMATIC\Laiva-sähkö
BUILTIN\Users

SystemDrive is C:
SystemRoot is C:\WINNT
Logon Domain is ELOMATIC
Administrator's Name is jollila
Computer Name is LA5369
LOGON SERVER is \\TKUHST6

»»»»»»»»»»»»»»»»»»*** Note! ***»»»»»»»»»»»»»»»»
The list will produce a small database of files that will match certain criteria.
Ex: read only files, s/h files, last modified date. size, etc.
The filters provided and registry scan should match the
corresponding file(s) listed.
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Unless the file match the entire criteria, it should not be pointed to remove
without attempting to confirm it's nature!
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
At times there could be several (legit) files flagged, and/or duplicate culprit file(s)!
If in doubt, always search the file(s) and properties according to criteria!

The file(s) found should be moved to \FINDnFIX\"junkxxx" Subfolder

______________________________________________________________________________
***YOU NEED TO DISABLE YOUR ACTIVE ANTI VIRUS PROTECTION TO AVOID CONFLICTS!***
______________________________________________________________________________

......Scanning for file(s)...
*Note! The list(s) may include legitimate files!
»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»

»»»»» (*1*) »»»»» .........
»»Read access error(s)...

C:\WINNT\SYSTEM32\CTL.DLL +++ File read error
\\?\C:\WINNT\System32\CTL.DLL +++ File read error

»»»»» (*2*) »»»»»........
CTL.DLL Can't Open!
DSCTL.DLL Can't Open!
IUCTL.DLL Can't Open!

»»»»» (*3*) »»»»»........

C:\WINNT\SYSTEM32\
ctl.dll Fri 18 Jun 2004 12.57.56 A...R 57 344 56,00 K

1 item found: 1 file, 0 directories.
Total of file sizes: 57 344 bytes 56,00 K

unknown/hidden files...

No matches found.

»»»»» (*4*) »»»»».........
Sniffing..........
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

Sniffed -> C:\WINNT\SYSTEM32\CTL.DLL
SNiF 1.34 statistics

Matching files : 1 Amount in bytes : 57344
Directories searched : 1 Commands executed : 0

Masks sniffed for: *.DLL

»»»»»(*5*)»»»»»
¯ Access denied ® ..................... CTL.DLL .....57344 18.06.2004

»»»»»(*6*)»»»»»
fgrep: can't open input C:\WINNT\SYSTEM32\CTL.DLL
fgrep: can't open input C:\WINNT\SYSTEM32\DSCTL.DLL
fgrep: can't open input C:\WINNT\SYSTEM32\IUCTL.DLL

»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»
»»»»»Search by size...
*List of files and specs according to 'size' :
*Note: Not all files listed here are infected, but *may include* the
name and spces of the offending file...
___________________________________________________________________________
Path: C:\WINNT\SYSTEM32 Including: *.DLL

119. Ctl Dll 57,344 . . R . A 6-18-04 12:57 pm

____________________________________________________________________________
*By size and date...

C:\WINNT\SYSTEM32\
ctl.dll Fri 18 Jun 2004 12.57.56 A...R 57 344 56,00 K

1 item found: 1 file, 0 directories.
Total of file sizes: 57 344 bytes 56,00 K

No matches found.

No matches found.

Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

Sniffed -> C:\WINNT\SYSTEM32\CTL.DLL
SNiF 1.34 statistics

Matching files : 1 Amount in bytes : 57344
Directories searched : 1 Commands executed : 0

Masks sniffed for: *.DLL
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

SNiF 1.34 statistics

Matching files : 0 Amount in bytes : 0
Directories searched : 1 Commands executed : 0

Masks sniffed for: *.DLL
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

SNiF 1.34 statistics

Matching files : 0 Amount in bytes : 0
Directories searched : 1 Commands executed : 0

Masks sniffed for: *.DLL

»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»

BHO search and other files...

fgrep: can't open input C:\WINNT\SYSTEM32\CTL.DLL
fgrep: can't open input C:\WINNT\SYSTEM32\DSCTL.DLL
**File C:\WINNT\SYSTEM32\HNGFGA.DLL
000020E4: 25 25 25 30 32 78 00 00 . 00 00 00 00 C0 82 05 B3 %%%02x.. ....À‚.³
fgrep: can't open input C:\WINNT\SYSTEM32\IUCTL.DLL

No matches found.

"C:\WINNT\system32\"
hngfga.dll 23 Sep 2004 31744 "hngfga.dll"

1 item found: 1 file, 0 directories.
Total of file sizes: 31 744 bytes 31,00 K

*sp.html found in temp folder:
--a-- - - - - - 7,976 09-23-2004 sp.html
File:

CRC-32 : 93866C48

MD5 : CE5B5B5B DFD4A959 9F4A95C7 6FA46BD2

*Filter keys search...
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/html
CLSID = {663C69DF-11FF-4436-9FDD-24B054DA428C}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/plain
CLSID = {663C69DF-11FF-4436-9FDD-24B054DA428C}

»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»
»»Size of Windows key:
(*Default-450 *No AppInit-398 *fake(infected)-448,504,512...)

Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 448

»»Checking for AppInit_DLLs (empty) value...
________________________________
!"AppInit_DLLs"=""!

Value does not match
________________________________

»»Comparing *saved* key with *original*...

REGDIFF 2.1 - Freeware written by Gerson Kurz (http://www.p-nand-q.com)

Comparing File #1 (Keys1\winkey.reg) with File #2 (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows).

Value "AppInit_DLLs" in key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" has different lengths (1 vs 26)

»»Dumping Values........
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DeviceNotSelectedTimeout SZ 15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota DWORD 00002710
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Spooler SZ yes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\swapdisk SZ
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\TransmissionRetryTimeout SZ 90
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERProcessHandleQuota DWORD 00002710
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs SZ

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
DeviceNotSelectedTimeout = 15
GDIProcessHandleQuota = REG_DWORD 0x00002710
Spooler = yes
swapdisk =
TransmissionRetryTimeout = 90
USERProcessHandleQuota = REG_DWORD 0x00002710
AppInit_DLLs = (*** MISSING TRAILING NULL CHARACTER ***)

»»Security settings for 'Windows' key:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
(NI) ALLOW Read BUILTIN\Users
(IO) ALLOW Read BUILTIN\Users
(NI) ALLOW Read BUILTIN\Power Users
(IO) ALLOW Read BUILTIN\Power Users
(NI) ALLOW Full access BUILTIN\Administrators
(IO) ALLOW Full access BUILTIN\Administrators
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access BUILTIN\Administrators
(IO) ALLOW Full access CREATOR OWNER

Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
Read BUILTIN\Users
Read BUILTIN\Power Users
Full access BUILTIN\Administrators
Full access NT AUTHORITY\SYSTEM

»»Performing string scan....
00001150: ?
00001190: H x
000011D0: vk s DeviceNotSelectedTimeout 1 5 `
00001210: vk ' o GDIProcessHandleQuota 3 vk
00001250: h 0 Spooler y e s x 4 vk E
00001290:swapdisk vk o TransmissionRetryTimeout 9 0
000012D0: ` vk ' C USERProcessHandleQuota0 vk
00001310:4 0 s AppInit_DLLs2 \ C : \ W I N N T \ s y s t e
00001350:m 3 2 \ c t l . d l l b
00001390:
000013D0:
00001410:
00001450:
00001490:
000014D0:
00001510:
00001550:
00001590:
000015D0:

---------- WIN.TXT
AppInit_DLLs2
--------------
--------------
$011E8: DeviceNotSelectedTimeout
$01230: GDIProcessHandleQuota
$012B0: TransmissionRetryTimeout
$012F0: USERProcessHandleQuota0
$01320: AppInit_DLLs2
--------------
--------------
C:\WINNT\system32\ctl.dll
--------------
--------------
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"DeviceNotSelectedTimeout"="15"
"GDIProcessHandleQuota"=dword:00002710
"Spooler"="yes"
"swapdisk"=""
"TransmissionRetryTimeout"="90"
"USERProcessHandleQuota"=dword:00002710
"AppInit_DLLs"=""

.............
A handle was successfully obtained for the
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows key.
This key has 0 subkeys.
The AppInitDLLs value exists and reports as 52 bytes, including the 2 for string termination.

[AppInitDLLs]
Ansi string : "C:\WINNT\system32\ctl.dll"
0000 43 00 3a 00 5c 00 57 00 49 00 4e 00 4e 00 54 00 | C.:.\.W.I.N.N.T.
0010 5c 00 73 00 79 00 73 00 74 00 65 00 6d 00 33 00 | \.s.y.s.t.e.m.3.
0020 32 00 5c 00 63 00 74 00 6c 00 2e 00 64 00 6c 00 | 2.\.c.t.l...d.l.
0030 6c 00 00 00 | l...
-----------------------

»»»»»»Backups list...»»»»»»
16:37:47 up 0 days, 1:25:09
-----------------------
Thu 23 Sep 04 16:37:47

C:\FINDNFIX\
keyback.hiv Thu 23 Sep 2004 16.35.54 A.... 8 192 8,00 K

1 item found: 1 file, 0 directories.
Total of file sizes: 8 192 bytes 8,00 K

C:\FINDNFIX\KEYS1\
winkey.reg Thu 23 Sep 2004 16.35.56 A.... 287 0,28 K

1 item found: 1 file, 0 directories.
Total of file sizes: 287 bytes 0,28 K

*Temp backups...

"C:\Documents and Settings\JOllila\Local Settings\Temp\Backs2\"
keyback2.hi_ 23 Sep 2004 8192 "keyback2.hi_"
winkey2.re_ 23 Sep 2004 287 "winkey2.re_"

2 items found: 2 files, 0 directories.
Total of file sizes: 8 479 bytes 8,28 K
-D---- JUNKXXX 00000000 16:35.56 23/09/2004
A----- STARTIT .BAT 00000060 16:35.56 23/09/2004

________________________________________________________________________________
***THE FIX IS NOT COMPATIBLE WITH EARLIER;UNPATCHED VERSIONS OF WIN2K'(SP3 and BELLOW)'
AND/OR LAX OF SECURITY UPDATES AND SERVICE PACKS FOR ALL PLATFORMS!
MINIMAL REQUIREMENTS INCLUDE:
_________XP HOME/PRO; SP1; IE6/SP1
_________2K/SP4; IE6/SP1
________________________________________________________________________________
»»»»»*** www10.brinkster.com/expl0iter/freeatlast/FNF/ ***»»»»»
-----END------
Thu 23 Sep 04 16:37:48

Äänestä
Guutti23.12.2004 klo 18.18
Juu kirjoitti:
No suurinpiirtein tollanen logi ois pitänny tulla.
Tuliko jotain virheilmoituksia vai?

Thu 23 Sep 04 16:35:54

»»»»»»»»»»»»»»»»»»***LOG!***(*updated *9/1*)»»»»»»»»»»»»»»»»

*System:
Microsoft Windows 2000 Professional 5.0 Service Pack 4 (Build 2195)
*IE version:
6.0.2600.0000

The type of the file system is NTFS.

MS-DOS Version 5.00.500

*command.com test passed!

__________________________________
!!*Creating backups...!!

The operation completed successfully
16:35:53,71 to 23.09.2004
__________________________________

*Local time:
23. syyskuuta 2004 (23.09.2004)
16:35, FLE Daylight Time
*Uptime:
16:35:57 up 0 days, 1:23:20

*Path:
C:\FINDnFIX
----------------------------------------------------
»»Member of...: ("ADMIN" logon + group match required!)

User is a member of group ELOMATIC\Domain Users.
User is a member of group \Everyone.
User is a member of group BUILTIN\Administrators.
User is a member of group BUILTIN\Users.
User is a member of group NT AUTHORITY\INTERACTIVE.
User is a member of group NT AUTHORITY\Authenticated Users.
User is a member of group \LOCAL.
User is a member of group ELOMATIC\EloProjekt.
User is a member of group ELOMATIC\VT-kirj-4krs.
User is a member of group ELOMATIC\Laiva-sähkö.
User is a member of group ELOMATIC\After_logon.
User is a member of group ELOMATIC\AcadUsers.
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Group BUILTIN\Administrators matches list.
Group BUILTIN\Users matches list.

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

User: [ELOMATIC\jollila], is a member of:

ELOMATIC\AcadUsers
ELOMATIC\After_logon
ELOMATIC\Domain Users
ELOMATIC\EloProjekt
\Everyone
ELOMATIC\Laiva-sähkö
BUILTIN\Users

SystemDrive is C:
SystemRoot is C:\WINNT
Logon Domain is ELOMATIC
Administrator's Name is jollila
Computer Name is LA5369
LOGON SERVER is \\TKUHST6

»»»»»»»»»»»»»»»»»»*** Note! ***»»»»»»»»»»»»»»»»
The list will produce a small database of files that will match certain criteria.
Ex: read only files, s/h files, last modified date. size, etc.
The filters provided and registry scan should match the
corresponding file(s) listed.
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Unless the file match the entire criteria, it should not be pointed to remove
without attempting to confirm it's nature!
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
At times there could be several (legit) files flagged, and/or duplicate culprit file(s)!
If in doubt, always search the file(s) and properties according to criteria!

The file(s) found should be moved to \FINDnFIX\"junkxxx" Subfolder

______________________________________________________________________________
***YOU NEED TO DISABLE YOUR ACTIVE ANTI VIRUS PROTECTION TO AVOID CONFLICTS!***
______________________________________________________________________________

......Scanning for file(s)...
*Note! The list(s) may include legitimate files!
»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»

»»»»» (*1*) »»»»» .........
»»Read access error(s)...

C:\WINNT\SYSTEM32\CTL.DLL +++ File read error
\\?\C:\WINNT\System32\CTL.DLL +++ File read error

»»»»» (*2*) »»»»»........
CTL.DLL Can't Open!
DSCTL.DLL Can't Open!
IUCTL.DLL Can't Open!

»»»»» (*3*) »»»»»........

C:\WINNT\SYSTEM32\
ctl.dll Fri 18 Jun 2004 12.57.56 A...R 57 344 56,00 K

1 item found: 1 file, 0 directories.
Total of file sizes: 57 344 bytes 56,00 K

unknown/hidden files...

No matches found.

»»»»» (*4*) »»»»».........
Sniffing..........
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

Sniffed -> C:\WINNT\SYSTEM32\CTL.DLL
SNiF 1.34 statistics

Matching files : 1 Amount in bytes : 57344
Directories searched : 1 Commands executed : 0

Masks sniffed for: *.DLL

»»»»»(*5*)»»»»»
¯ Access denied ® ..................... CTL.DLL .....57344 18.06.2004

»»»»»(*6*)»»»»»
fgrep: can't open input C:\WINNT\SYSTEM32\CTL.DLL
fgrep: can't open input C:\WINNT\SYSTEM32\DSCTL.DLL
fgrep: can't open input C:\WINNT\SYSTEM32\IUCTL.DLL

»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»
»»»»»Search by size...
*List of files and specs according to 'size' :
*Note: Not all files listed here are infected, but *may include* the
name and spces of the offending file...
___________________________________________________________________________
Path: C:\WINNT\SYSTEM32 Including: *.DLL

119. Ctl Dll 57,344 . . R . A 6-18-04 12:57 pm

____________________________________________________________________________
*By size and date...

C:\WINNT\SYSTEM32\
ctl.dll Fri 18 Jun 2004 12.57.56 A...R 57 344 56,00 K

1 item found: 1 file, 0 directories.
Total of file sizes: 57 344 bytes 56,00 K

No matches found.

No matches found.

Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

Sniffed -> C:\WINNT\SYSTEM32\CTL.DLL
SNiF 1.34 statistics

Matching files : 1 Amount in bytes : 57344
Directories searched : 1 Commands executed : 0

Masks sniffed for: *.DLL
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

SNiF 1.34 statistics

Matching files : 0 Amount in bytes : 0
Directories searched : 1 Commands executed : 0

Masks sniffed for: *.DLL
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

SNiF 1.34 statistics

Matching files : 0 Amount in bytes : 0
Directories searched : 1 Commands executed : 0

Masks sniffed for: *.DLL

»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»

BHO search and other files...

fgrep: can't open input C:\WINNT\SYSTEM32\CTL.DLL
fgrep: can't open input C:\WINNT\SYSTEM32\DSCTL.DLL
**File C:\WINNT\SYSTEM32\HNGFGA.DLL
000020E4: 25 25 25 30 32 78 00 00 . 00 00 00 00 C0 82 05 B3 %%%02x.. ....À‚.³
fgrep: can't open input C:\WINNT\SYSTEM32\IUCTL.DLL

No matches found.

"C:\WINNT\system32\"
hngfga.dll 23 Sep 2004 31744 "hngfga.dll"

1 item found: 1 file, 0 directories.
Total of file sizes: 31 744 bytes 31,00 K

*sp.html found in temp folder:
--a-- - - - - - 7,976 09-23-2004 sp.html
File:

CRC-32 : 93866C48

MD5 : CE5B5B5B DFD4A959 9F4A95C7 6FA46BD2

*Filter keys search...
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/html
CLSID = {663C69DF-11FF-4436-9FDD-24B054DA428C}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/plain
CLSID = {663C69DF-11FF-4436-9FDD-24B054DA428C}

»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»
»»Size of Windows key:
(*Default-450 *No AppInit-398 *fake(infected)-448,504,512...)

Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 448

»»Checking for AppInit_DLLs (empty) value...
________________________________
!"AppInit_DLLs"=""!

Value does not match
________________________________

»»Comparing *saved* key with *original*...

REGDIFF 2.1 - Freeware written by Gerson Kurz (http://www.p-nand-q.com)

Comparing File #1 (Keys1\winkey.reg) with File #2 (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows).

Value "AppInit_DLLs" in key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" has different lengths (1 vs 26)

»»Dumping Values........
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DeviceNotSelectedTimeout SZ 15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota DWORD 00002710
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Spooler SZ yes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\swapdisk SZ
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\TransmissionRetryTimeout SZ 90
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERProcessHandleQuota DWORD 00002710
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs SZ

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
DeviceNotSelectedTimeout = 15
GDIProcessHandleQuota = REG_DWORD 0x00002710
Spooler = yes
swapdisk =
TransmissionRetryTimeout = 90
USERProcessHandleQuota = REG_DWORD 0x00002710
AppInit_DLLs = (*** MISSING TRAILING NULL CHARACTER ***)

»»Security settings for 'Windows' key:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
(NI) ALLOW Read BUILTIN\Users
(IO) ALLOW Read BUILTIN\Users
(NI) ALLOW Read BUILTIN\Power Users
(IO) ALLOW Read BUILTIN\Power Users
(NI) ALLOW Full access BUILTIN\Administrators
(IO) ALLOW Full access BUILTIN\Administrators
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access BUILTIN\Administrators
(IO) ALLOW Full access CREATOR OWNER

Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
Read BUILTIN\Users
Read BUILTIN\Power Users
Full access BUILTIN\Administrators
Full access NT AUTHORITY\SYSTEM

»»Performing string scan....
00001150: ?
00001190: H x
000011D0: vk s DeviceNotSelectedTimeout 1 5 `
00001210: vk ' o GDIProcessHandleQuota 3 vk
00001250: h 0 Spooler y e s x 4 vk E
00001290:swapdisk vk o TransmissionRetryTimeout 9 0
000012D0: ` vk ' C USERProcessHandleQuota0 vk
00001310:4 0 s AppInit_DLLs2 \ C : \ W I N N T \ s y s t e
00001350:m 3 2 \ c t l . d l l b
00001390:
000013D0:
00001410:
00001450:
00001490:
000014D0:
00001510:
00001550:
00001590:
000015D0:

---------- WIN.TXT
AppInit_DLLs2
--------------
--------------
$011E8: DeviceNotSelectedTimeout
$01230: GDIProcessHandleQuota
$012B0: TransmissionRetryTimeout
$012F0: USERProcessHandleQuota0
$01320: AppInit_DLLs2
--------------
--------------
C:\WINNT\system32\ctl.dll
--------------
--------------
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"DeviceNotSelectedTimeout"="15"
"GDIProcessHandleQuota"=dword:00002710
"Spooler"="yes"
"swapdisk"=""
"TransmissionRetryTimeout"="90"
"USERProcessHandleQuota"=dword:00002710
"AppInit_DLLs"=""

.............
A handle was successfully obtained for the
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows key.
This key has 0 subkeys.
The AppInitDLLs value exists and reports as 52 bytes, including the 2 for string termination.

[AppInitDLLs]
Ansi string : "C:\WINNT\system32\ctl.dll"
0000 43 00 3a 00 5c 00 57 00 49 00 4e 00 4e 00 54 00 | C.:.\.W.I.N.N.T.
0010 5c 00 73 00 79 00 73 00 74 00 65 00 6d 00 33 00 | \.s.y.s.t.e.m.3.
0020 32 00 5c 00 63 00 74 00 6c 00 2e 00 64 00 6c 00 | 2.\.c.t.l...d.l.
0030 6c 00 00 00 | l...
-----------------------

»»»»»»Backups list...»»»»»»
16:37:47 up 0 days, 1:25:09
-----------------------
Thu 23 Sep 04 16:37:47

C:\FINDNFIX\
keyback.hiv Thu 23 Sep 2004 16.35.54 A.... 8 192 8,00 K

1 item found: 1 file, 0 directories.
Total of file sizes: 8 192 bytes 8,00 K

C:\FINDNFIX\KEYS1\
winkey.reg Thu 23 Sep 2004 16.35.56 A.... 287 0,28 K

1 item found: 1 file, 0 directories.
Total of file sizes: 287 bytes 0,28 K

*Temp backups...

"C:\Documents and Settings\JOllila\Local Settings\Temp\Backs2\"
keyback2.hi_ 23 Sep 2004 8192 "keyback2.hi_"
winkey2.re_ 23 Sep 2004 287 "winkey2.re_"

2 items found: 2 files, 0 directories.
Total of file sizes: 8 479 bytes 8,28 K
-D---- JUNKXXX 00000000 16:35.56 23/09/2004
A----- STARTIT .BAT 00000060 16:35.56 23/09/2004

________________________________________________________________________________
***THE FIX IS NOT COMPATIBLE WITH EARLIER;UNPATCHED VERSIONS OF WIN2K'(SP3 and BELLOW)'
AND/OR LAX OF SECURITY UPDATES AND SERVICE PACKS FOR ALL PLATFORMS!
MINIMAL REQUIREMENTS INCLUDE:
_________XP HOME/PRO; SP1; IE6/SP1
_________2K/SP4; IE6/SP1
________________________________________________________________________________
»»»»»*** www10.brinkster.com/expl0iter/freeatlast/FNF/ ***»»»»»
-----END------
Thu 23 Sep 04 16:37:48

Kun ei tullut mitään. Ei virhe tiedotuksia, ei logia... täytyy kai yrittää uudestaan. Kauanko siinä suurinpiirtein menee aikaa, jotta logi tulee?
Äänestä
Juu23.12.2004 klo 18.34
Guutti kirjoitti:
Kun ei tullut mitään. Ei virhe tiedotuksia, ei logia... täytyy kai yrittää uudestaan. Kauanko siinä suurinpiirtein menee aikaa, jotta logi tulee?
Kun tuplaklikkaa sitä !LOG!.Bat kohtaa,niin pitäs aueta semmonen pieni violetin värinen pikkuikkuna ja se aika joka siinä menee,ennenku se logi tulee,niin vaihtelee aika paljon.
Koitin ite ja mulla meni melekeen 5 min.
Äänestä
Guutti23.12.2004 klo 21.21
Juu kirjoitti:
Kun tuplaklikkaa sitä !LOG!.Bat kohtaa,niin pitäs aueta semmonen pieni violetin värinen pikkuikkuna ja se aika joka siinä menee,ennenku se logi tulee,niin vaihtelee aika paljon.
Koitin ite ja mulla meni melekeen 5 min.
Muutamaan otteeseen testannut. Se violetin värinen ikkuna kyllä aukeaa ja kovin se hakee, jossain välissä se muuttuu siniseksi ja jää siihen. Sitten ei enää tapahdu mitään... Ekalla kerralla jaksoin odottaa puolituntia, ei mitään. Toisella kerralla reilun tunnin, ei mitään. Kolmas kerta n. 2tuntia, eikä vieläkään mitään.
Äänestä
Juu23.12.2004 klo 23.29
Guutti kirjoitti:
Muutamaan otteeseen testannut. Se violetin värinen ikkuna kyllä aukeaa ja kovin se hakee, jossain välissä se muuttuu siniseksi ja jää siihen. Sitten ei enää tapahdu mitään... Ekalla kerralla jaksoin odottaa puolituntia, ei mitään. Toisella kerralla reilun tunnin, ei mitään. Kolmas kerta n. 2tuntia, eikä vieläkään mitään.
No sitte se jostain syystä ei toimi sun koneella.
Sitte sen piilotiedoston poistoon joutuu käyttää ohjelmaa nimeltään Registrar Lite ja sen käytöstä mulla ei ole kokemuksia ja en tiedä miten sillä poistetaan,joten paras kun pistät sen sun login tolle palstalle,niin ne siellä antaa ohjeet miten se poistetaan.
Pistä sen Hijack login mukaan se DllComparen logi,niin ne näkee,että mukana on piilotiedosto.

http://www.bleepingcomputer.com/forums/forum22.html
Äänestä

Odottaa vastausta

Näihin keskusteluihin ei ole vielä vastattu. Ole ensimmäinen.

Ilmoitukset

Kunnossa?

Muut lukivat myös

Vastaukset 7

Odottaa vastausta

Luetuimmat keskustelut

Kommentoi aloitusta

Ilmoita asiaton sisältö

Ilmoitus lähetetty

Jaa keskustelu