Rekisteröidy

Ilmoitukset

Ladataan…

    Näytä kaikki

    tässä logi, katoppa sitä?

    Logfile of HijackThis v1.99.1
    Scan saved at 23:50:27, on 19.4.2005
    Platform: Windows 2000 SP2 (WinNT 5.00.2195)
    MSIE: Internet Explorer v5.00 SP2 (5.00.2920.0000)

    Running processes:
    C:\WINNT\System32\smss.exe
    C:\WINNT\system32\winlogon.exe
    C:\WINNT\system32\services.exe
    C:\WINNT\system32\lsass.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\system32\spoolsv.exe
    C:\Program Files\AVPersonal\AVWUPSRV.EXE
    C:\WINNT\System32\svchost.exe
    C:\WINNT\System32\nvsvc32.exe
    C:\WINNT\system32\regsvc.exe
    C:\WINNT\system32\MSTask.exe
    C:\WINNT\system32\stisvc.exe
    C:\WINNT\system32\ZoneLabs\vsmon.exe
    C:\WINNT\System32\WBEM\WinMgmt.exe
    C:\WINNT\System32\mspmspsv.exe
    C:\WINNT\system32\rundll32.exe
    C:\WINNT\Explorer.EXE
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\WINNT\System32\internat.exe
    C:\Program Files\DC \DCPlusPlus.exe
    C:\hijack\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
    O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
    O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [ap9h4qmo] C:\WINNT\System32\ap9h4qmo.exe
    O4 - HKCU\..\Run: [internat.exe] internat.exe
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar3.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar3.dll/cmcache.html
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar3.dll/cmsimilar.html
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} (F-Secure Online Scanner) - http://support.f-secure.com/ols/fscax.cab
    O20 - Winlogon Notify: Uninstall - C:\WINNT\system32\m464lejq1hoe.dll
    O23 - Service: AntiVir Update (AVWUpSrv) - H BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
    O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe
    9565
    Äänestä

    Muut lukivat myös

    Vastaukset 9

    Vanhimmat

    Sulje selaimet ja muut ikkunat ,merkkaa tämä rivi ja Fix selected:
    O4 - HKLM\..\Run: [ap9h4qmo] C:\WINNT\System32\ap9h4qmo.exe

    Laita uusi logi restartin jälkeen.

    Äänestä

    • Logfile of HijackThis v1.99.1
      Scan saved at 0:23:26, on 20.4.2005
      Platform: Windows 2000 SP2 (WinNT 5.00.2195)
      MSIE: Internet Explorer v5.00 SP2 (5.00.2920.0000)

      Running processes:
      C:\WINNT\System32\smss.exe
      C:\WINNT\system32\winlogon.exe
      C:\WINNT\system32\services.exe
      C:\WINNT\system32\lsass.exe
      C:\WINNT\system32\svchost.exe
      C:\WINNT\system32\spoolsv.exe
      C:\Program Files\AVPersonal\AVWUPSRV.EXE
      C:\WINNT\System32\svchost.exe
      C:\WINNT\System32\nvsvc32.exe
      C:\WINNT\system32\regsvc.exe
      C:\WINNT\system32\MSTask.exe
      C:\WINNT\system32\stisvc.exe
      C:\WINNT\system32\ZoneLabs\vsmon.exe
      C:\WINNT\System32\WBEM\WinMgmt.exe
      C:\WINNT\System32\mspmspsv.exe
      C:\WINNT\system32\rundll32.exe
      C:\WINNT\Explorer.EXE
      C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
      C:\WINNT\System32\internat.exe
      C:\Program Files\DC \DCPlusPlus.exe
      C:\WINNT\System32\mdm.exe
      C:\hijack\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
      O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
      O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
      O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
      O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
      O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
      O4 - HKCU\..\Run: [internat.exe] internat.exe
      O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar3.dll/cmbacklinks.html
      O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar3.dll/cmcache.html
      O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar3.dll/cmsimilar.html
      O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
      O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} (F-Secure Online Scanner) - http://support.f-secure.com/ols/fscax.cab
      O20 - Winlogon Notify: Uninstall - C:\WINNT\system32\m464lejq1hoe.dll
      O23 - Service: AntiVir Update (AVWUpSrv) - H BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
      O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
      O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
      O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe

      Äänestä

    • tämä kirjoitti:

      Logfile of HijackThis v1.99.1
      Scan saved at 0:23:26, on 20.4.2005
      Platform: Windows 2000 SP2 (WinNT 5.00.2195)
      MSIE: Internet Explorer v5.00 SP2 (5.00.2920.0000)

      Running processes:
      C:\WINNT\System32\smss.exe
      C:\WINNT\system32\winlogon.exe
      C:\WINNT\system32\services.exe
      C:\WINNT\system32\lsass.exe
      C:\WINNT\system32\svchost.exe
      C:\WINNT\system32\spoolsv.exe
      C:\Program Files\AVPersonal\AVWUPSRV.EXE
      C:\WINNT\System32\svchost.exe
      C:\WINNT\System32\nvsvc32.exe
      C:\WINNT\system32\regsvc.exe
      C:\WINNT\system32\MSTask.exe
      C:\WINNT\system32\stisvc.exe
      C:\WINNT\system32\ZoneLabs\vsmon.exe
      C:\WINNT\System32\WBEM\WinMgmt.exe
      C:\WINNT\System32\mspmspsv.exe
      C:\WINNT\system32\rundll32.exe
      C:\WINNT\Explorer.EXE
      C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
      C:\WINNT\System32\internat.exe
      C:\Program Files\DC \DCPlusPlus.exe
      C:\WINNT\System32\mdm.exe
      C:\hijack\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
      O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
      O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
      O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
      O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
      O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
      O4 - HKCU\..\Run: [internat.exe] internat.exe
      O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar3.dll/cmbacklinks.html
      O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar3.dll/cmcache.html
      O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar3.dll/cmsimilar.html
      O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
      O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} (F-Secure Online Scanner) - http://support.f-secure.com/ols/fscax.cab
      O20 - Winlogon Notify: Uninstall - C:\WINNT\system32\m464lejq1hoe.dll
      O23 - Service: AntiVir Update (AVWUpSrv) - H BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
      O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
      O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
      O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe

      Netistä löytyi tuo sama outo .dll ja siellä puhdistuksen epäonnistuttua alettiin epäillä VX2 troijalaista.Sen poistotyökalu löytyis tuolta:
      http://www.greyknight17.com/spy/VX2FinderNT.exe

      Tarkoitan tätä riviä:
      O20 - Winlogon Notify: Uninstall - C:\WINNT\system32\m464lejq1hoe.dll
      Tapaus löytyy tuolta:
      http://forums.techguy.org/history/t-350762.html

      On paljon mahdollista, ettei tuo poistu pelkästään fixaamalla tuo rivi, tuo satunnaisesti nimetty .dll pitää saada deletoitua.
      Sen poistamiseen voi käyttää Hijackthisissä olevaa
      "Delete a file on Reboot"-toimintoa.
      Lyhyt ohje:Normaalin skannausikkunan oikeassa laidassa on Config..
      Sitten Misc Tools,
      Ja sieltä jo löytyy "Delete a file on reboot.."

      Tai sitten Killbox nimistä vastaavanlaista poistotyökalua.
      Jälkimmäisen ohjeita löydät tästä pitkästä ketjusta:
      http://www.thetechguide.com/forum/index.php?showtopic=15949

      Tässä vaiheessa ehdottaisin, että odotat nimimerkki Juu:n astumista kehiin. Hänellä on pitkä ja monipuolinen kokemus näistä siivouksista.
      Voit tietysti kokeilla noilla mun ohjeilla,mutta en ole satavarma lähteekö örkki.
      Ehkä epäonnistuneesta poistoyrityksestä ei ole muuta seurausta, kuin tuon poistettavan tiedoston nimen muuttuminen, prosessi pitää sitä yllä.
      Samalla rivillä logissa oletan sen esiintyvän, jos se palaa. Päätä sinä.

      Äänestä

    • tämä kirjoitti:

      Logfile of HijackThis v1.99.1
      Scan saved at 0:23:26, on 20.4.2005
      Platform: Windows 2000 SP2 (WinNT 5.00.2195)
      MSIE: Internet Explorer v5.00 SP2 (5.00.2920.0000)

      Running processes:
      C:\WINNT\System32\smss.exe
      C:\WINNT\system32\winlogon.exe
      C:\WINNT\system32\services.exe
      C:\WINNT\system32\lsass.exe
      C:\WINNT\system32\svchost.exe
      C:\WINNT\system32\spoolsv.exe
      C:\Program Files\AVPersonal\AVWUPSRV.EXE
      C:\WINNT\System32\svchost.exe
      C:\WINNT\System32\nvsvc32.exe
      C:\WINNT\system32\regsvc.exe
      C:\WINNT\system32\MSTask.exe
      C:\WINNT\system32\stisvc.exe
      C:\WINNT\system32\ZoneLabs\vsmon.exe
      C:\WINNT\System32\WBEM\WinMgmt.exe
      C:\WINNT\System32\mspmspsv.exe
      C:\WINNT\system32\rundll32.exe
      C:\WINNT\Explorer.EXE
      C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
      C:\WINNT\System32\internat.exe
      C:\Program Files\DC \DCPlusPlus.exe
      C:\WINNT\System32\mdm.exe
      C:\hijack\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
      O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
      O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
      O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
      O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
      O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
      O4 - HKCU\..\Run: [internat.exe] internat.exe
      O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar3.dll/cmbacklinks.html
      O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar3.dll/cmcache.html
      O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar3.dll/cmsimilar.html
      O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
      O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} (F-Secure Online Scanner) - http://support.f-secure.com/ols/fscax.cab
      O20 - Winlogon Notify: Uninstall - C:\WINNT\system32\m464lejq1hoe.dll
      O23 - Service: AntiVir Update (AVWUpSrv) - H BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
      O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
      O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
      O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe

      Katotaas tolla ota tosta L2mfix

      http://www.downloads.subratam.org/l2mfix.exe

      Säästä se työpöydälle ja tuplaklikkaa sitä ja ensin Accept ja sitte Install
      Työpöydälle ilmestyy l2mfix kansio.
      Avaa se ja tuplaklikkaa l2mfix.bat
      Valitse kohta 1 eli näppäät ykkösen ja Enter
      Anna sen scannata valmiiks ja pistä ulostuleva logi tänne.

      Äänestä

    • Juu kirjoitti:

      Katotaas tolla ota tosta L2mfix

      http://www.downloads.subratam.org/l2mfix.exe

      Säästä se työpöydälle ja tuplaklikkaa sitä ja ensin Accept ja sitte Install
      Työpöydälle ilmestyy l2mfix kansio.
      Avaa se ja tuplaklikkaa l2mfix.bat
      Valitse kohta 1 eli näppäät ykkösen ja Enter
      Anna sen scannata valmiiks ja pistä ulostuleva logi tänne.

      L2MFIX find log 1.03
      These are the registry keys present
      **********************************************************************************
      Winlogon/notify:
      Windows Registry Editor Version 5.00

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
      "Asynchronous"=dword:00000000
      "Impersonate"=dword:00000000
      "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
      6c,00,00,00
      "Logoff"="ChainWlxLogoffEvent"

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
      "Asynchronous"=dword:00000000
      "Impersonate"=dword:00000000
      "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
      6c,00,6c,00,00,00
      "Logoff"="CryptnetWlxLogoffEvent"

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
      "DLLName"="cscdll.dll"
      "Logon"="WinlogonLogonEvent"
      "Logoff"="WinlogonLogoffEvent"
      "ScreenSaver"="WinlogonScreenSaverEvent"
      "Startup"="WinlogonStartupEvent"
      "Shutdown"="WinlogonShutdownEvent"
      "StartShell"="WinlogonStartShellEvent"
      "Impersonate"=dword:00000000
      "Asynchronous"=dword:00000001

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\MediaContentIndex]
      "Asynchronous"=dword:00000000
      "DllName"="C:\\WINNT\\system32\\mvl2l93o1.dll"
      "Impersonate"=dword:00000000
      "Logon"="WinLogon"
      "Logoff"="WinLogoff"
      "Shutdown"="WinShutdown"

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
      "Logoff"="WLEventLogoff"
      "Impersonate"=dword:00000000
      "Asynchronous"=dword:00000001
      "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
      6c,00,6c,00,00,00

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
      "DLLName"="WlNotify.dll"
      "Lock"="SensLockEvent"
      "Logon"="SensLogonEvent"
      "Logoff"="SensLogoffEvent"
      "Safe"=dword:00000001
      "MaxWait"=dword:00000258
      "StartScreenSaver"="SensStartScreenSaverEvent"
      "StopScreenSaver"="SensStopScreenSaverEvent"
      "Startup"="SensStartupEvent"
      "Shutdown"="SensShutdownEvent"
      "StartShell"="SensStartShellEvent"
      "Unlock"="SensUnlockEvent"
      "Impersonate"=dword:00000001
      "Asynchronous"=dword:00000001

      **********************************************************************************
      useragent:
      Windows Registry Editor Version 5.00

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
      "{3890431A-3558-E548-ED6E-C50008072F60}"=""

      **********************************************************************************
      Shell Extension key:
      Windows Registry Editor Version 5.00

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
      "{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet"
      "{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management"
      "{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page"
      "{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page"
      "{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing"
      "{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
      "{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension"
      "{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension"
      "{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension"
      "{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page"
      "{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
      "{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension"
      "{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects"
      "{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management"
      "{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management"
      "{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression"
      "{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension"
      "{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
      "{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu"
      "{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
      "{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
      "{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
      "{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile"
      "{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page"
      "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing"
      "{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
      "{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
      "{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension"
      "{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension"
      "{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network and Dial-up Connections"
      "{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
      "{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
      "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks"
      "{1A9BA3A0-143A-11CF-8350-444553540000}"="Shell Favorite Folder"
      "{20D04FE0-3AEA-1069-A2D8-08002B30309D}"="My Computer"
      "{86747AC0-42A0-1069-A2E6-08002B30309D}"="Briefcase Folder"
      "{0AFACED1-E828-11D1-9187-B532F1E9575D}"="Folder Shortcut"
      "{12518493-00B2-11d2-9FA5-9E3420524153}"="Mounted Volume"
      "{21B22460-3AEA-1069-A2DC-08002B30309D}"="File Property Page Extension"
      "{B091E540-83E3-11CF-A713-0020AFD79762}"="File Types Page"
      "{FBF23B41-E3F0-101B-8488-00AA003E56F8}"="MIME File Types Hook"
      "{C2FBB630-2971-11d1-A18C-00C04FD75D13}"="Microsoft CopyTo Service"
      "{C2FBB631-2971-11d1-A18C-00C04FD75D13}"="Microsoft MoveTo Service"
      "{13709620-C279-11CE-A49E-444553540000}"="Shell Automation Service"
      "{62112AA1-EBE4-11cf-A5FB-0020AFE7292D}"="Shell Automation Folder View"
      "{4622AD11-FF23-11d0-8D34-00A0C90F2719}"="Start Menu"
      "{7BA4C740-9E81-11CF-99D3-00AA004AE837}"="Microsoft SendTo Service"
      "{D969A300-E7FF-11d0-A93B-00A0C90F2719}"="Microsoft New Object Service"
      "{09799AFB-AD67-11d1-ABCD-00C04FC30936}"="Open With Context Menu Handler"
      "{3FC0B520-68A9-11D0-8D77-00C04FD70822}"="Display Control Panel HTML Extensions"
      "{75048700-EF1F-11D0-9888-006097DEACF9}"="ActiveDesktop"
      "{6D5313C0-8C62-11D1-B2CD-006097DF8C11}"="Folder Options Property Page Extension"
      "{57651662-CE3E-11D0-8D77-00C04FC99D61}"="CmdFileIcon"
      "{4657278A-411B-11d2-839A-00C04FD918D0}"="Shell Drag and Drop helper"
      "{A470F8CF-A1E8-4f65-8335-227475AA5C46}"="Add encryption item to context menus in explorer"
      "{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
      "{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
      "{568804CA-CBD7-11d0-9816-00C04FD91972}"="Menu Shell Folder"
      "{5b4dae26-b807-11d0-9815-00c04fd91972}"="Menu Band"
      "{8278F931-2A3E-11d2-838F-00C04FD918D0}"="Tracking Shell Menu"
      "{E13EF4E4-D2F2-11d0-9816-00C04FD91972}"="Menu Site"
      "{ECD4FC4F-521C-11D0-B792-00A0C90312E1}"="Menu Desk Bar"
      "{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
      "{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Merge Shell Folder"
      "{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
      "{D82BE2B0-5764-11D0-A96E-00C04FD705A2}"="IShellFolderBand"
      "{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
      "{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Microsoft SearchBand"
      "{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
      "{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
      "{0E5CBF21-D15F-11d0-8301-00AA005B4383}"="&Links"
      "{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
      "{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address"
      "{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
      "{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
      "{7487cd30-f71a-11d0-9ea7-00805f714772}"="Thumbnail Image"
      "{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
      "{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
      "{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
      "{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
      "{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
      "{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
      "{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
      "{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
      "{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
      "{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
      "{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
      "{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
      "{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
      "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
      "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
      "{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
      "{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
      "{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
      "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
      "{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen"
      "{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
      "{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
      "{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
      "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
      "{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
      "{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
      "{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
      "{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
      "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
      "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
      "{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
      "{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
      "{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
      "{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
      "{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
      "{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
      "{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
      "{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
      "{8BEBB290-52D0-11D0-B7F4-00C04FD706EC}"="Thumbnails"
      "{EAB841A0-9550-11CF-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
      "{1AEB1360-5AFC-11D0-B806-00C04FD706EC}"="Office Graphics Filters Thumbnail Extractor"
      "{9DBD2C50-62AD-11D0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
      "{500202A0-731E-11D0-B829-00C04FD706EC}"="LNK file thumbnail interface delegator"
      "{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
      "{0B124F8C-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
      "{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
      "{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
      "{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
      "{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
      "{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
      "{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
      "{fe1290f0-cfbd-11cf-a330-00aa00c16e65}"="Directory Namespace"
      "{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
      "{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
      "{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
      "{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
      "{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
      "{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
      "{450D8FBA-AD25-11D0-98A8-0800361B1103}"="MyDocs Folder"
      "{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
      "{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
      "{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
      "{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
      "{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
      "{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
      "{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
      "{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
      "{1CDB2949-8F65-4355-8456-263E7C208A5D}"="Resurssienhallinta"
      "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}"="Desktop Explorer Menu"
      "{BB7DF450-F119-11CD-8465-00AA00425D90}"="Microsoft Access Custom Icon Handler"
      "{59850401-6664-101B-B21C-00AA004BA90B}"="Microsoft Office Nitojan Pura nidonta"
      "{8FF88D21-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.2 Context Menu Shell Extension"
      "{8FF88D25-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.2 DragDrop Shell Extension"
      "{8FF88D27-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.2 Context Menu Shell Extension"
      "{8FF88D23-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.2 Property Sheet Shell Extension"
      "{E0249E26-145E-41D2-919E-AD4A6F3777D6}"=""

      **********************************************************************************
      HKEY ROOT CLASSIDS:
      Windows Registry Editor Version 5.00

      [HKEY_CLASSES_ROOT\CLSID\{E0249E26-145E-41D2-919E-AD4A6F3777D6}]
      @=""

      [HKEY_CLASSES_ROOT\CLSID\{E0249E26-145E-41D2-919E-AD4A6F3777D6}\Implemented Categories]
      @=""

      [HKEY_CLASSES_ROOT\CLSID\{E0249E26-145E-41D2-919E-AD4A6F3777D6}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
      @=""

      [HKEY_CLASSES_ROOT\CLSID\{E0249E26-145E-41D2-919E-AD4A6F3777D6}\InprocServer32]
      @="C:\\WINNT\\system32\\nmrsnl.dll"
      "ThreadingModel"="Apartment"

      **********************************************************************************
      Files Found are not all bad files:

      C:\WINNT\SYSTEM32\
      e2jm0c~1.dll Fri 15 Apr 2005 9.15.38 ..S.R 233 770 228,29 K
      fp4q03~1.dll Mon 14 Mar 2005 17.16.28 ..S.R 233 279 227,81 K
      i2240c~1.dll Fri 8 Apr 2005 22.13.16 ..S.R 233 634 228,16 K
      i6420g~1.dll Tue 29 Mar 2005 23.40.32 ..S.R 232 736 227,28 K
      ipetcfg.dll Sun 13 Mar 2005 7.18.46 ..S.R 232 736 227,28 K
      jtj607~1.dll Wed 20 Apr 2005 12.40.10 ..S.R 234 812 229,31 K
      mvl2l9~1.dll Wed 20 Apr 2005 12.34.48 ..S.R 234 195 228,70 K
      nmrsnl.dll Wed 20 Apr 2005 12.40.12 ..S.R 234 195 228,70 K
      npwrsko.dll Fri 8 Apr 2005 22.13.16 ..S.R 233 212 227,75 K
      o2ro0c~1.dll Tue 29 Mar 2005 9.14.16 ..S.R 234 136 228,65 K
      sbncui.dll Wed 20 Apr 2005 12.24.14 ..S.R 235 452 229,93 K
      shcfiles.dll Mon 18 Apr 2005 8.35.18 ..S.R 234 510 229,01 K
      vsdata.dll Wed 26 Jan 2005 5.22.16 A.... 75 536 73,77 K
      vsinit.dll Wed 26 Jan 2005 5.22.28 A.... 124 688 121,77 K
      vsmonapi.dll Wed 26 Jan 2005 5.22.36 A.... 108 312 105,77 K
      vspubapi.dll Wed 26 Jan 2005 5.22.40 A.... 198 424 193,77 K
      vsregexp.dll Wed 26 Jan 2005 5.22.44 A.... 71 448 69,77 K
      vsutil.dll Wed 26 Jan 2005 5.22.56 A.... 354 064 345,77 K
      vsxml.dll Wed 26 Jan 2005 5.23.04 A.... 100 112 97,77 K
      zlcomm.dll Wed 26 Jan 2005 5.23.24 A.... 75 536 73,77 K
      zlcommdb.dll Wed 26 Jan 2005 5.23.28 A.... 67 352 65,77 K

      21 items found: 21 files (12 H/S), 0 directories.
      Total of file sizes: 3 982 139 bytes 3,80 M
      Locate .tmp files:

      No matches found.
      **********************************************************************************
      Directory Listing of system files:
      Volume in drive C is ASEMA
      Volume Serial Number is DC76-BC15

      Directory of C:\WINNT\System32

      20.04.2005 12:40 234ÿ195 nmrsnl.dll
      20.04.2005 12:40 234ÿ812 jtj6071se.dll
      20.04.2005 12:34 234ÿ195 mvl2l93o1.dll
      20.04.2005 12:24 235ÿ452 sbncui.dll
      18.04.2005 08:35 234ÿ510 shcfiles.dll
      15.04.2005 09:15 233ÿ770 e2jm0c11ef.dll
      08.04.2005 22:13 233ÿ212 npwrsko.dll
      08.04.2005 22:13 233ÿ634 i2240cfqef2e0.dll
      29.03.2005 23:40 232ÿ736 i6420ghoe64c0.dll
      29.03.2005 09:14 234ÿ136 o2ro0c93ef.dll
      14.03.2005 17:16 233ÿ279 fp4q03h5e.dll
      13.03.2005 07:18 232ÿ736 ipetcfg.dll
      05.03.2005 13:06 dllcache
      12 File(s) 2ÿ806ÿ667 bytes
      1 Dir(s) 1ÿ097ÿ906ÿ176 bytes free

      Äänestä

    • se on kirjoitti:

      L2MFIX find log 1.03
      These are the registry keys present
      **********************************************************************************
      Winlogon/notify:
      Windows Registry Editor Version 5.00

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
      "Asynchronous"=dword:00000000
      "Impersonate"=dword:00000000
      "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
      6c,00,00,00
      "Logoff"="ChainWlxLogoffEvent"

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
      "Asynchronous"=dword:00000000
      "Impersonate"=dword:00000000
      "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
      6c,00,6c,00,00,00
      "Logoff"="CryptnetWlxLogoffEvent"

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
      "DLLName"="cscdll.dll"
      "Logon"="WinlogonLogonEvent"
      "Logoff"="WinlogonLogoffEvent"
      "ScreenSaver"="WinlogonScreenSaverEvent"
      "Startup"="WinlogonStartupEvent"
      "Shutdown"="WinlogonShutdownEvent"
      "StartShell"="WinlogonStartShellEvent"
      "Impersonate"=dword:00000000
      "Asynchronous"=dword:00000001

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\MediaContentIndex]
      "Asynchronous"=dword:00000000
      "DllName"="C:\\WINNT\\system32\\mvl2l93o1.dll"
      "Impersonate"=dword:00000000
      "Logon"="WinLogon"
      "Logoff"="WinLogoff"
      "Shutdown"="WinShutdown"

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
      "Logoff"="WLEventLogoff"
      "Impersonate"=dword:00000000
      "Asynchronous"=dword:00000001
      "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
      6c,00,6c,00,00,00

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
      "DLLName"="WlNotify.dll"
      "Lock"="SensLockEvent"
      "Logon"="SensLogonEvent"
      "Logoff"="SensLogoffEvent"
      "Safe"=dword:00000001
      "MaxWait"=dword:00000258
      "StartScreenSaver"="SensStartScreenSaverEvent"
      "StopScreenSaver"="SensStopScreenSaverEvent"
      "Startup"="SensStartupEvent"
      "Shutdown"="SensShutdownEvent"
      "StartShell"="SensStartShellEvent"
      "Unlock"="SensUnlockEvent"
      "Impersonate"=dword:00000001
      "Asynchronous"=dword:00000001

      **********************************************************************************
      useragent:
      Windows Registry Editor Version 5.00

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
      "{3890431A-3558-E548-ED6E-C50008072F60}"=""

      **********************************************************************************
      Shell Extension key:
      Windows Registry Editor Version 5.00

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
      "{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet"
      "{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management"
      "{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page"
      "{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page"
      "{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing"
      "{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
      "{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension"
      "{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension"
      "{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension"
      "{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page"
      "{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
      "{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension"
      "{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects"
      "{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management"
      "{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management"
      "{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression"
      "{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension"
      "{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
      "{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu"
      "{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
      "{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
      "{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
      "{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile"
      "{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page"
      "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing"
      "{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
      "{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
      "{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension"
      "{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension"
      "{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network and Dial-up Connections"
      "{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
      "{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
      "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks"
      "{1A9BA3A0-143A-11CF-8350-444553540000}"="Shell Favorite Folder"
      "{20D04FE0-3AEA-1069-A2D8-08002B30309D}"="My Computer"
      "{86747AC0-42A0-1069-A2E6-08002B30309D}"="Briefcase Folder"
      "{0AFACED1-E828-11D1-9187-B532F1E9575D}"="Folder Shortcut"
      "{12518493-00B2-11d2-9FA5-9E3420524153}"="Mounted Volume"
      "{21B22460-3AEA-1069-A2DC-08002B30309D}"="File Property Page Extension"
      "{B091E540-83E3-11CF-A713-0020AFD79762}"="File Types Page"
      "{FBF23B41-E3F0-101B-8488-00AA003E56F8}"="MIME File Types Hook"
      "{C2FBB630-2971-11d1-A18C-00C04FD75D13}"="Microsoft CopyTo Service"
      "{C2FBB631-2971-11d1-A18C-00C04FD75D13}"="Microsoft MoveTo Service"
      "{13709620-C279-11CE-A49E-444553540000}"="Shell Automation Service"
      "{62112AA1-EBE4-11cf-A5FB-0020AFE7292D}"="Shell Automation Folder View"
      "{4622AD11-FF23-11d0-8D34-00A0C90F2719}"="Start Menu"
      "{7BA4C740-9E81-11CF-99D3-00AA004AE837}"="Microsoft SendTo Service"
      "{D969A300-E7FF-11d0-A93B-00A0C90F2719}"="Microsoft New Object Service"
      "{09799AFB-AD67-11d1-ABCD-00C04FC30936}"="Open With Context Menu Handler"
      "{3FC0B520-68A9-11D0-8D77-00C04FD70822}"="Display Control Panel HTML Extensions"
      "{75048700-EF1F-11D0-9888-006097DEACF9}"="ActiveDesktop"
      "{6D5313C0-8C62-11D1-B2CD-006097DF8C11}"="Folder Options Property Page Extension"
      "{57651662-CE3E-11D0-8D77-00C04FC99D61}"="CmdFileIcon"
      "{4657278A-411B-11d2-839A-00C04FD918D0}"="Shell Drag and Drop helper"
      "{A470F8CF-A1E8-4f65-8335-227475AA5C46}"="Add encryption item to context menus in explorer"
      "{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
      "{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
      "{568804CA-CBD7-11d0-9816-00C04FD91972}"="Menu Shell Folder"
      "{5b4dae26-b807-11d0-9815-00c04fd91972}"="Menu Band"
      "{8278F931-2A3E-11d2-838F-00C04FD918D0}"="Tracking Shell Menu"
      "{E13EF4E4-D2F2-11d0-9816-00C04FD91972}"="Menu Site"
      "{ECD4FC4F-521C-11D0-B792-00A0C90312E1}"="Menu Desk Bar"
      "{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
      "{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Merge Shell Folder"
      "{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
      "{D82BE2B0-5764-11D0-A96E-00C04FD705A2}"="IShellFolderBand"
      "{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
      "{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Microsoft SearchBand"
      "{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
      "{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
      "{0E5CBF21-D15F-11d0-8301-00AA005B4383}"="&Links"
      "{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
      "{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address"
      "{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
      "{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
      "{7487cd30-f71a-11d0-9ea7-00805f714772}"="Thumbnail Image"
      "{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
      "{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
      "{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
      "{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
      "{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
      "{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
      "{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
      "{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
      "{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
      "{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
      "{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
      "{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
      "{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
      "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
      "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
      "{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
      "{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
      "{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
      "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
      "{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen"
      "{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
      "{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
      "{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
      "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
      "{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
      "{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
      "{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
      "{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
      "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
      "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
      "{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
      "{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
      "{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
      "{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
      "{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
      "{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
      "{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
      "{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
      "{8BEBB290-52D0-11D0-B7F4-00C04FD706EC}"="Thumbnails"
      "{EAB841A0-9550-11CF-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
      "{1AEB1360-5AFC-11D0-B806-00C04FD706EC}"="Office Graphics Filters Thumbnail Extractor"
      "{9DBD2C50-62AD-11D0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
      "{500202A0-731E-11D0-B829-00C04FD706EC}"="LNK file thumbnail interface delegator"
      "{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
      "{0B124F8C-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
      "{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
      "{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
      "{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
      "{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
      "{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
      "{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
      "{fe1290f0-cfbd-11cf-a330-00aa00c16e65}"="Directory Namespace"
      "{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
      "{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
      "{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
      "{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
      "{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
      "{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
      "{450D8FBA-AD25-11D0-98A8-0800361B1103}"="MyDocs Folder"
      "{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
      "{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
      "{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
      "{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
      "{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
      "{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
      "{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
      "{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
      "{1CDB2949-8F65-4355-8456-263E7C208A5D}"="Resurssienhallinta"
      "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}"="Desktop Explorer Menu"
      "{BB7DF450-F119-11CD-8465-00AA00425D90}"="Microsoft Access Custom Icon Handler"
      "{59850401-6664-101B-B21C-00AA004BA90B}"="Microsoft Office Nitojan Pura nidonta"
      "{8FF88D21-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.2 Context Menu Shell Extension"
      "{8FF88D25-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.2 DragDrop Shell Extension"
      "{8FF88D27-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.2 Context Menu Shell Extension"
      "{8FF88D23-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.2 Property Sheet Shell Extension"
      "{E0249E26-145E-41D2-919E-AD4A6F3777D6}"=""

      **********************************************************************************
      HKEY ROOT CLASSIDS:
      Windows Registry Editor Version 5.00

      [HKEY_CLASSES_ROOT\CLSID\{E0249E26-145E-41D2-919E-AD4A6F3777D6}]
      @=""

      [HKEY_CLASSES_ROOT\CLSID\{E0249E26-145E-41D2-919E-AD4A6F3777D6}\Implemented Categories]
      @=""

      [HKEY_CLASSES_ROOT\CLSID\{E0249E26-145E-41D2-919E-AD4A6F3777D6}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
      @=""

      [HKEY_CLASSES_ROOT\CLSID\{E0249E26-145E-41D2-919E-AD4A6F3777D6}\InprocServer32]
      @="C:\\WINNT\\system32\\nmrsnl.dll"
      "ThreadingModel"="Apartment"

      **********************************************************************************
      Files Found are not all bad files:

      C:\WINNT\SYSTEM32\
      e2jm0c~1.dll Fri 15 Apr 2005 9.15.38 ..S.R 233 770 228,29 K
      fp4q03~1.dll Mon 14 Mar 2005 17.16.28 ..S.R 233 279 227,81 K
      i2240c~1.dll Fri 8 Apr 2005 22.13.16 ..S.R 233 634 228,16 K
      i6420g~1.dll Tue 29 Mar 2005 23.40.32 ..S.R 232 736 227,28 K
      ipetcfg.dll Sun 13 Mar 2005 7.18.46 ..S.R 232 736 227,28 K
      jtj607~1.dll Wed 20 Apr 2005 12.40.10 ..S.R 234 812 229,31 K
      mvl2l9~1.dll Wed 20 Apr 2005 12.34.48 ..S.R 234 195 228,70 K
      nmrsnl.dll Wed 20 Apr 2005 12.40.12 ..S.R 234 195 228,70 K
      npwrsko.dll Fri 8 Apr 2005 22.13.16 ..S.R 233 212 227,75 K
      o2ro0c~1.dll Tue 29 Mar 2005 9.14.16 ..S.R 234 136 228,65 K
      sbncui.dll Wed 20 Apr 2005 12.24.14 ..S.R 235 452 229,93 K
      shcfiles.dll Mon 18 Apr 2005 8.35.18 ..S.R 234 510 229,01 K
      vsdata.dll Wed 26 Jan 2005 5.22.16 A.... 75 536 73,77 K
      vsinit.dll Wed 26 Jan 2005 5.22.28 A.... 124 688 121,77 K
      vsmonapi.dll Wed 26 Jan 2005 5.22.36 A.... 108 312 105,77 K
      vspubapi.dll Wed 26 Jan 2005 5.22.40 A.... 198 424 193,77 K
      vsregexp.dll Wed 26 Jan 2005 5.22.44 A.... 71 448 69,77 K
      vsutil.dll Wed 26 Jan 2005 5.22.56 A.... 354 064 345,77 K
      vsxml.dll Wed 26 Jan 2005 5.23.04 A.... 100 112 97,77 K
      zlcomm.dll Wed 26 Jan 2005 5.23.24 A.... 75 536 73,77 K
      zlcommdb.dll Wed 26 Jan 2005 5.23.28 A.... 67 352 65,77 K

      21 items found: 21 files (12 H/S), 0 directories.
      Total of file sizes: 3 982 139 bytes 3,80 M
      Locate .tmp files:

      No matches found.
      **********************************************************************************
      Directory Listing of system files:
      Volume in drive C is ASEMA
      Volume Serial Number is DC76-BC15

      Directory of C:\WINNT\System32

      20.04.2005 12:40 234ÿ195 nmrsnl.dll
      20.04.2005 12:40 234ÿ812 jtj6071se.dll
      20.04.2005 12:34 234ÿ195 mvl2l93o1.dll
      20.04.2005 12:24 235ÿ452 sbncui.dll
      18.04.2005 08:35 234ÿ510 shcfiles.dll
      15.04.2005 09:15 233ÿ770 e2jm0c11ef.dll
      08.04.2005 22:13 233ÿ212 npwrsko.dll
      08.04.2005 22:13 233ÿ634 i2240cfqef2e0.dll
      29.03.2005 23:40 232ÿ736 i6420ghoe64c0.dll
      29.03.2005 09:14 234ÿ136 o2ro0c93ef.dll
      14.03.2005 17:16 233ÿ279 fp4q03h5e.dll
      13.03.2005 07:18 232ÿ736 ipetcfg.dll
      05.03.2005 13:06 dllcache
      12 File(s) 2ÿ806ÿ667 bytes
      1 Dir(s) 1ÿ097ÿ906ÿ176 bytes free

      Jos sulla on jotain extraa siinä auki,niin sammuta jo valmiiks,koska kone käynnistyy uudestaan suraavassa operaatiossa.

      Avaa l2mfix kansio ja tuplaklikkaa l2mfix.bat
      valitse kohta 2 eli näppäät 2 ja Enter
      Sitte paina vaan jotain näppäintä ja kone käynnistyy vissiin uudestaan.
      Kun kone on käynnistynny uudestaan,niin se jatkaa scannausta ja kun se on valmis,niin tulee taas logi ulos.
      Pistä se logi tänne ja uus Hijack logi.

      Äänestä

    • Juu kirjoitti:

      Jos sulla on jotain extraa siinä auki,niin sammuta jo valmiiks,koska kone käynnistyy uudestaan suraavassa operaatiossa.

      Avaa l2mfix kansio ja tuplaklikkaa l2mfix.bat
      valitse kohta 2 eli näppäät 2 ja Enter
      Sitte paina vaan jotain näppäintä ja kone käynnistyy vissiin uudestaan.
      Kun kone on käynnistynny uudestaan,niin se jatkaa scannausta ja kun se on valmis,niin tulee taas logi ulos.
      Pistä se logi tänne ja uus Hijack logi.

      Logfile of HijackThis v1.99.1
      Scan saved at 13:20:25, on 20.4.2005
      Platform: Windows 2000 SP2 (WinNT 5.00.2195)
      MSIE: Internet Explorer v5.00 SP2 (5.00.2920.0000)

      Running processes:
      C:\WINNT\System32\smss.exe
      C:\WINNT\system32\winlogon.exe
      C:\WINNT\system32\services.exe
      C:\WINNT\system32\lsass.exe
      C:\WINNT\system32\svchost.exe
      C:\WINNT\system32\spoolsv.exe
      C:\Program Files\AVPersonal\AVWUPSRV.EXE
      C:\WINNT\System32\svchost.exe
      C:\WINNT\System32\nvsvc32.exe
      C:\WINNT\system32\regsvc.exe
      C:\WINNT\system32\MSTask.exe
      C:\WINNT\system32\stisvc.exe
      C:\WINNT\system32\ZoneLabs\vsmon.exe
      C:\WINNT\System32\WBEM\WinMgmt.exe
      C:\WINNT\System32\mspmspsv.exe
      C:\WINNT\System32\mdm.exe
      C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
      C:\WINNT\System32\internat.exe
      C:\WINNT\explorer.exe
      C:\WINNT\system32\NOTEPAD.EXE
      C:\WINNT\system32\notepad.exe
      C:\hijack\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
      O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
      O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
      O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
      O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
      O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
      O4 - HKCU\..\Run: [internat.exe] internat.exe
      O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar3.dll/cmbacklinks.html
      O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar3.dll/cmcache.html
      O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar3.dll/cmsimilar.html
      O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
      O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} (F-Secure Online Scanner) - http://support.f-secure.com/ols/fscax.cab
      O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
      O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
      O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
      O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe






      -----------------------------------------------





      L2Mfix 1.03

      Running From:
      C:\temp\virusohjelmat\l2mix\l2mfix



      RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
      Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
      This program is Freeware, use it on your own risk!

      Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
      (NI) ALLOW Full access    NT AUTHORITY\SYSTEM
      (IO) ALLOW Full access    NT AUTHORITY\SYSTEM
      (ID-NI) ALLOW Read    BUILTIN\Users
      (ID-IO) ALLOW Read    BUILTIN\Users
      (ID-NI) ALLOW Read    BUILTIN\Power Users
      (ID-IO) ALLOW Read    BUILTIN\Power Users
      (ID-NI) ALLOW Full access    BUILTIN\Administrators
      (ID-IO) ALLOW Full access    BUILTIN\Administrators
      (ID-NI) ALLOW Full access    NT AUTHORITY\SYSTEM
      (ID-IO) ALLOW Full access    NT AUTHORITY\SYSTEM
      (ID-IO) ALLOW Full access    CREATOR OWNER



      Setting registry permissions:


      RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
      Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
      This program is Freeware, use it on your own risk!


      Denying C(CI) access for predefined group "Administrators"
      - adding new ACCESS DENY entry


      Registry Permissions set too:

      RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
      Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
      This program is Freeware, use it on your own risk!

      Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
      (CI) DENY --C-------    BUILTIN\Administrators
      (NI) ALLOW Full access    NT AUTHORITY\SYSTEM
      (IO) ALLOW Full access    NT AUTHORITY\SYSTEM
      (ID-NI) ALLOW Read    BUILTIN\Users
      (ID-IO) ALLOW Read    BUILTIN\Users
      (ID-NI) ALLOW Read    BUILTIN\Power Users
      (ID-IO) ALLOW Read    BUILTIN\Power Users
      (ID-NI) ALLOW Full access    BUILTIN\Administrators
      (ID-IO) ALLOW Full access    BUILTIN\Administrators
      (ID-NI) ALLOW Full access    NT AUTHORITY\SYSTEM
      (ID-IO) ALLOW Full access    NT AUTHORITY\SYSTEM
      (ID-IO) ALLOW Full access    CREATOR OWNER



      Setting up for Reboot


      Starting Reboot!

      C:\temp\virusohjelmat\l2mix\l2mfix
      System Rebooted!

      Running From:
      C:\temp\virusohjelmat\l2mix\l2mfix

      killing explorer and rundll32.exe

      Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
      Copyright(C) 2002-2003 [email protected]
      Killing PID 844 'explorer.exe'
      Killing PID 844 'explorer.exe'
      Error 0x5 : Access is denied.


      Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
      Copyright(C) 2002-2003 [email protected]
      Killing PID 988 'rundll32.exe'

      Scanning First Pass. Please Wait!

      First Pass Completed

      Second Pass Scanning

      Second pass Completed!
      Backing Up: C:\WINNT\system32\e2jm0c11ef.dll
      1 file(s) copied.
      Backing Up: C:\WINNT\system32\fp4q03h5e.dll
      1 file(s) copied.
      Backing Up: C:\WINNT\system32\i2240cfqef2e0.dll
      1 file(s) copied.
      Backing Up: C:\WINNT\system32\i6420ghoe64c0.dll
      1 file(s) copied.
      Backing Up: C:\WINNT\system32\impromon.dll
      1 file(s) copied.
      Backing Up: C:\WINNT\system32\ipetcfg.dll
      1 file(s) copied.
      Backing Up: C:\WINNT\system32\jtj6071se.dll
      1 file(s) copied.
      Backing Up: C:\WINNT\system32\nmrsnl.dll
      1 file(s) copied.
      Backing Up: C:\WINNT\system32\npwrsko.dll
      1 file(s) copied.
      Backing Up: C:\WINNT\system32\o2ro0c93ef.dll
      1 file(s) copied.
      Backing Up: C:\WINNT\system32\sbncui.dll
      1 file(s) copied.
      Backing Up: C:\WINNT\system32\shcfiles.dll
      1 file(s) copied.
      deleting: C:\WINNT\system32\e2jm0c11ef.dll
      Successfully Deleted: C:\WINNT\system32\e2jm0c11ef.dll
      deleting: C:\WINNT\system32\fp4q03h5e.dll
      Successfully Deleted: C:\WINNT\system32\fp4q03h5e.dll
      deleting: C:\WINNT\system32\i2240cfqef2e0.dll
      Successfully Deleted: C:\WINNT\system32\i2240cfqef2e0.dll
      deleting: C:\WINNT\system32\i6420ghoe64c0.dll
      Successfully Deleted: C:\WINNT\system32\i6420ghoe64c0.dll
      deleting: C:\WINNT\system32\impromon.dll
      Successfully Deleted: C:\WINNT\system32\impromon.dll
      deleting: C:\WINNT\system32\ipetcfg.dll
      Successfully Deleted: C:\WINNT\system32\ipetcfg.dll
      deleting: C:\WINNT\system32\jtj6071se.dll
      Successfully Deleted: C:\WINNT\system32\jtj6071se.dll
      deleting: C:\WINNT\system32\nmrsnl.dll
      Successfully Deleted: C:\WINNT\system32\nmrsnl.dll
      deleting: C:\WINNT\system32\npwrsko.dll
      Successfully Deleted: C:\WINNT\system32\npwrsko.dll
      deleting: C:\WINNT\system32\o2ro0c93ef.dll
      Successfully Deleted: C:\WINNT\system32\o2ro0c93ef.dll
      deleting: C:\WINNT\system32\sbncui.dll
      Successfully Deleted: C:\WINNT\system32\sbncui.dll
      deleting: C:\WINNT\system32\shcfiles.dll
      Successfully Deleted: C:\WINNT\system32\shcfiles.dll


      Zipping up files for submission:
      adding: e2jm0c11ef.dll (92 bytes security) (deflated 5%)
      adding: fp4q03h5e.dll (92 bytes security) (deflated 4%)
      adding: i2240cfqef2e0.dll (92 bytes security) (deflated 5%)
      adding: i6420ghoe64c0.dll (92 bytes security) (deflated 4%)
      adding: impromon.dll (92 bytes security) (deflated 5%)
      adding: ipetcfg.dll (92 bytes security) (deflated 4%)
      adding: jtj6071se.dll (92 bytes security) (deflated 5%)
      adding: nmrsnl.dll (92 bytes security) (deflated 5%)
      adding: npwrsko.dll (92 bytes security) (deflated 4%)
      adding: o2ro0c93ef.dll (92 bytes security) (deflated 5%)
      adding: sbncui.dll (92 bytes security) (deflated 5%)
      adding: shcfiles.dll (92 bytes security) (deflated 5%)
      adding: clear.reg (92 bytes security) (deflated 22%)
      adding: echo.reg (92 bytes security) (deflated 9%)
      adding: direct.txt (92 bytes security) (deflated 3%)
      adding: lo2.txt (92 bytes security) (deflated 80%)
      adding: readme.txt (92 bytes security) (deflated 49%)
      adding: report.txt (92 bytes security) (deflated 65%)
      adding: test.txt (92 bytes security) (deflated 72%)
      adding: test2.txt (92 bytes security) (stored 0%)
      adding: test3.txt (92 bytes security) (stored 0%)
      adding: test5.txt (92 bytes security) (stored 0%)
      adding: xfind.txt (92 bytes security) (deflated 65%)
      adding: backregs/E0249E26-145E-41D2-919E-AD4A6F3777D6.reg (92 bytes security) (deflated 70%)
      adding: backregs/shell.reg (92 bytes security) (deflated 75%)

      Restoring Registry Permissions:


      RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
      Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
      This program is Freeware, use it on your own risk!


      Revoking access for predefined group "Administrators"
      Inherited ACE can not be revoked here!
      Inherited ACE can not be revoked here!


      Registry permissions set too:

      RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
      Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
      This program is Freeware, use it on your own risk!

      Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
      (NI) ALLOW Full access    NT AUTHORITY\SYSTEM
      (IO) ALLOW Full access    NT AUTHORITY\SYSTEM
      (NI) ALLOW Full access    NT AUTHORITY\SYSTEM
      (IO) ALLOW Full access    NT AUTHORITY\SYSTEM
      (ID-NI) ALLOW Read    BUILTIN\Users
      (ID-IO) ALLOW Read    BUILTIN\Users
      (ID-NI) ALLOW Read    BUILTIN\Power Users
      (ID-IO) ALLOW Read    BUILTIN\Power Users
      (ID-NI) ALLOW Full access    BUILTIN\Administrators
      (ID-IO) ALLOW Full access    BUILTIN\Administrators
      (ID-NI) ALLOW Full access    NT AUTHORITY\SYSTEM
      (ID-IO) ALLOW Full access    NT AUTHORITY\SYSTEM
      (ID-IO) ALLOW Full access    CREATOR OWNER


      Restoring Sedebugprivilege:

      Granting SeDebugPrivilege to Administrators ... successful

      deleting local copy: e2jm0c11ef.dll
      deleting local copy: fp4q03h5e.dll
      deleting local copy: i2240cfqef2e0.dll
      deleting local copy: i6420ghoe64c0.dll
      deleting local copy: impromon.dll
      deleting local copy: ipetcfg.dll
      deleting local copy: jtj6071se.dll
      deleting local copy: nmrsnl.dll
      deleting local copy: npwrsko.dll
      deleting local copy: o2ro0c93ef.dll
      deleting local copy: sbncui.dll
      deleting local copy: shcfiles.dll

      The following Is the Current Export of the Winlogon notify key:
      ****************************************************************************
      Windows Registry Editor Version 5.00

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
      "Asynchronous"=dword:00000000
      "Impersonate"=dword:00000000
      "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
      6c,00,00,00
      "Logoff"="ChainWlxLogoffEvent"

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
      "Asynchronous"=dword:00000000
      "Impersonate"=dword:00000000
      "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
      6c,00,6c,00,00,00
      "Logoff"="CryptnetWlxLogoffEvent"

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
      "DLLName"="cscdll.dll"
      "Logon"="WinlogonLogonEvent"
      "Logoff"="WinlogonLogoffEvent"
      "ScreenSaver"="WinlogonScreenSaverEvent"
      "Startup"="WinlogonStartupEvent"
      "Shutdown"="WinlogonShutdownEvent"
      "StartShell"="WinlogonStartShellEvent"
      "Impersonate"=dword:00000000
      "Asynchronous"=dword:00000001

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
      "Logoff"="WLEventLogoff"
      "Impersonate"=dword:00000000
      "Asynchronous"=dword:00000001
      "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
      6c,00,6c,00,00,00

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
      "DLLName"="WlNotify.dll"
      "Lock"="SensLockEvent"
      "Logon"="SensLogonEvent"
      "Logoff"="SensLogoffEvent"
      "Safe"=dword:00000001
      "MaxWait"=dword:00000258
      "StartScreenSaver"="SensStartScreenSaverEvent"
      "StopScreenSaver"="SensStopScreenSaverEvent"
      "Startup"="SensStartupEvent"
      "Shutdown"="SensShutdownEvent"
      "StartShell"="SensStartShellEvent"
      "Unlock"="SensUnlockEvent"
      "Impersonate"=dword:00000001
      "Asynchronous"=dword:00000001


      The following are the files found:
      ****************************************************************************
      C:\WINNT\system32\e2jm0c11ef.dll
      C:\WINNT\system32\fp4q03h5e.dll
      C:\WINNT\system32\i2240cfqef2e0.dll
      C:\WINNT\system32\i6420ghoe64c0.dll
      C:\WINNT\system32\impromon.dll
      C:\WINNT\system32\ipetcfg.dll
      C:\WINNT\system32\jtj6071se.dll
      C:\WINNT\system32\nmrsnl.dll
      C:\WINNT\system32\npwrsko.dll
      C:\WINNT\system32\o2ro0c93ef.dll
      C:\WINNT\system32\sbncui.dll
      C:\WINNT\system32\shcfiles.dll

      Registry Entries that were Deleted:
      Please verify that the listing looks ok.
      If there was something deleted wrongly there are backups in the backreg folder.
      ****************************************************************************
      REGEDIT4

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
      "{E0249E26-145E-41D2-919E-AD4A6F3777D6}"=-
      [-HKEY_CLASSES_ROOT\CLSID\{E0249E26-145E-41D2-919E-AD4A6F3777D6}]
      REGEDIT4

      [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
      ****************************************************************************
      Desktop.ini Contents:
      ****************************************************************************
      ****************************************************************************
      





      Logfile of HijackThis v1.99.1
      Scan saved at 13:20:25, on 20.4.2005
      Platform: Windows 2000 SP2 (WinNT 5.00.2195)
      MSIE: Internet Explorer v5.00 SP2 (5.00.2920.0000)

      Running processes:
      C:\WINNT\System32\smss.exe
      C:\WINNT\system32\winlogon.exe
      C:\WINNT\system32\services.exe
      C:\WINNT\system32\lsass.exe
      C:\WINNT\system32\svchost.exe
      C:\WINNT\system32\spoolsv.exe
      C:\Program Files\AVPersonal\AVWUPSRV.EXE
      C:\WINNT\System32\svchost.exe
      C:\WINNT\System32\nvsvc32.exe
      C:\WINNT\system32\regsvc.exe
      C:\WINNT\system32\MSTask.exe
      C:\WINNT\system32\stisvc.exe
      C:\WINNT\system32\ZoneLabs\vsmon.exe
      C:\WINNT\System32\WBEM\WinMgmt.exe
      C:\WINNT\System32\mspmspsv.exe
      C:\WINNT\System32\mdm.exe
      C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
      C:\WINNT\System32\internat.exe
      C:\WINNT\explorer.exe
      C:\WINNT\system32\NOTEPAD.EXE
      C:\WINNT\system32\notepad.exe
      C:\hijack\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
      O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
      O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
      O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
      O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
      O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
      O4 - HKCU\..\Run: [internat.exe] internat.exe
      O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar3.dll/cmbacklinks.html
      O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar3.dll/cmcache.html
      O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar3.dll/cmsimilar.html
      O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
      O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} (F-Secure Online Scanner) - http://support.f-secure.com/ols/fscax.cab
      O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
      O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
      O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
      O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe

      Äänestä

    • se on kirjoitti:

      Logfile of HijackThis v1.99.1
      Scan saved at 13:20:25, on 20.4.2005
      Platform: Windows 2000 SP2 (WinNT 5.00.2195)
      MSIE: Internet Explorer v5.00 SP2 (5.00.2920.0000)

      Running processes:
      C:\WINNT\System32\smss.exe
      C:\WINNT\system32\winlogon.exe
      C:\WINNT\system32\services.exe
      C:\WINNT\system32\lsass.exe
      C:\WINNT\system32\svchost.exe
      C:\WINNT\system32\spoolsv.exe
      C:\Program Files\AVPersonal\AVWUPSRV.EXE
      C:\WINNT\System32\svchost.exe
      C:\WINNT\System32\nvsvc32.exe
      C:\WINNT\system32\regsvc.exe
      C:\WINNT\system32\MSTask.exe
      C:\WINNT\system32\stisvc.exe
      C:\WINNT\system32\ZoneLabs\vsmon.exe
      C:\WINNT\System32\WBEM\WinMgmt.exe
      C:\WINNT\System32\mspmspsv.exe
      C:\WINNT\System32\mdm.exe
      C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
      C:\WINNT\System32\internat.exe
      C:\WINNT\explorer.exe
      C:\WINNT\system32\NOTEPAD.EXE
      C:\WINNT\system32\notepad.exe
      C:\hijack\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
      O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
      O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
      O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
      O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
      O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
      O4 - HKCU\..\Run: [internat.exe] internat.exe
      O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar3.dll/cmbacklinks.html
      O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar3.dll/cmcache.html
      O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar3.dll/cmsimilar.html
      O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
      O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} (F-Secure Online Scanner) - http://support.f-secure.com/ols/fscax.cab
      O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
      O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
      O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
      O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe






      -----------------------------------------------





      L2Mfix 1.03

      Running From:
      C:\temp\virusohjelmat\l2mix\l2mfix



      RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
      Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
      This program is Freeware, use it on your own risk!

      Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
      (NI) ALLOW Full access    NT AUTHORITY\SYSTEM
      (IO) ALLOW Full access    NT AUTHORITY\SYSTEM
      (ID-NI) ALLOW Read    BUILTIN\Users
      (ID-IO) ALLOW Read    BUILTIN\Users
      (ID-NI) ALLOW Read    BUILTIN\Power Users
      (ID-IO) ALLOW Read    BUILTIN\Power Users
      (ID-NI) ALLOW Full access    BUILTIN\Administrators
      (ID-IO) ALLOW Full access    BUILTIN\Administrators
      (ID-NI) ALLOW Full access    NT AUTHORITY\SYSTEM
      (ID-IO) ALLOW Full access    NT AUTHORITY\SYSTEM
      (ID-IO) ALLOW Full access    CREATOR OWNER



      Setting registry permissions:


      RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
      Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
      This program is Freeware, use it on your own risk!


      Denying C(CI) access for predefined group "Administrators"
      - adding new ACCESS DENY entry


      Registry Permissions set too:

      RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
      Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
      This program is Freeware, use it on your own risk!

      Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
      (CI) DENY --C-------    BUILTIN\Administrators
      (NI) ALLOW Full access    NT AUTHORITY\SYSTEM
      (IO) ALLOW Full access    NT AUTHORITY\SYSTEM
      (ID-NI) ALLOW Read    BUILTIN\Users
      (ID-IO) ALLOW Read    BUILTIN\Users
      (ID-NI) ALLOW Read    BUILTIN\Power Users
      (ID-IO) ALLOW Read    BUILTIN\Power Users
      (ID-NI) ALLOW Full access    BUILTIN\Administrators
      (ID-IO) ALLOW Full access    BUILTIN\Administrators
      (ID-NI) ALLOW Full access    NT AUTHORITY\SYSTEM
      (ID-IO) ALLOW Full access    NT AUTHORITY\SYSTEM
      (ID-IO) ALLOW Full access    CREATOR OWNER



      Setting up for Reboot


      Starting Reboot!

      C:\temp\virusohjelmat\l2mix\l2mfix
      System Rebooted!

      Running From:
      C:\temp\virusohjelmat\l2mix\l2mfix

      killing explorer and rundll32.exe

      Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
      Copyright(C) 2002-2003 [email protected]
      Killing PID 844 'explorer.exe'
      Killing PID 844 'explorer.exe'
      Error 0x5 : Access is denied.


      Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
      Copyright(C) 2002-2003 [email protected]
      Killing PID 988 'rundll32.exe'

      Scanning First Pass. Please Wait!

      First Pass Completed

      Second Pass Scanning

      Second pass Completed!
      Backing Up: C:\WINNT\system32\e2jm0c11ef.dll
      1 file(s) copied.
      Backing Up: C:\WINNT\system32\fp4q03h5e.dll
      1 file(s) copied.
      Backing Up: C:\WINNT\system32\i2240cfqef2e0.dll
      1 file(s) copied.
      Backing Up: C:\WINNT\system32\i6420ghoe64c0.dll
      1 file(s) copied.
      Backing Up: C:\WINNT\system32\impromon.dll
      1 file(s) copied.
      Backing Up: C:\WINNT\system32\ipetcfg.dll
      1 file(s) copied.
      Backing Up: C:\WINNT\system32\jtj6071se.dll
      1 file(s) copied.
      Backing Up: C:\WINNT\system32\nmrsnl.dll
      1 file(s) copied.
      Backing Up: C:\WINNT\system32\npwrsko.dll
      1 file(s) copied.
      Backing Up: C:\WINNT\system32\o2ro0c93ef.dll
      1 file(s) copied.
      Backing Up: C:\WINNT\system32\sbncui.dll
      1 file(s) copied.
      Backing Up: C:\WINNT\system32\shcfiles.dll
      1 file(s) copied.
      deleting: C:\WINNT\system32\e2jm0c11ef.dll
      Successfully Deleted: C:\WINNT\system32\e2jm0c11ef.dll
      deleting: C:\WINNT\system32\fp4q03h5e.dll
      Successfully Deleted: C:\WINNT\system32\fp4q03h5e.dll
      deleting: C:\WINNT\system32\i2240cfqef2e0.dll
      Successfully Deleted: C:\WINNT\system32\i2240cfqef2e0.dll
      deleting: C:\WINNT\system32\i6420ghoe64c0.dll
      Successfully Deleted: C:\WINNT\system32\i6420ghoe64c0.dll
      deleting: C:\WINNT\system32\impromon.dll
      Successfully Deleted: C:\WINNT\system32\impromon.dll
      deleting: C:\WINNT\system32\ipetcfg.dll
      Successfully Deleted: C:\WINNT\system32\ipetcfg.dll
      deleting: C:\WINNT\system32\jtj6071se.dll
      Successfully Deleted: C:\WINNT\system32\jtj6071se.dll
      deleting: C:\WINNT\system32\nmrsnl.dll
      Successfully Deleted: C:\WINNT\system32\nmrsnl.dll
      deleting: C:\WINNT\system32\npwrsko.dll
      Successfully Deleted: C:\WINNT\system32\npwrsko.dll
      deleting: C:\WINNT\system32\o2ro0c93ef.dll
      Successfully Deleted: C:\WINNT\system32\o2ro0c93ef.dll
      deleting: C:\WINNT\system32\sbncui.dll
      Successfully Deleted: C:\WINNT\system32\sbncui.dll
      deleting: C:\WINNT\system32\shcfiles.dll
      Successfully Deleted: C:\WINNT\system32\shcfiles.dll


      Zipping up files for submission:
      adding: e2jm0c11ef.dll (92 bytes security) (deflated 5%)
      adding: fp4q03h5e.dll (92 bytes security) (deflated 4%)
      adding: i2240cfqef2e0.dll (92 bytes security) (deflated 5%)
      adding: i6420ghoe64c0.dll (92 bytes security) (deflated 4%)
      adding: impromon.dll (92 bytes security) (deflated 5%)
      adding: ipetcfg.dll (92 bytes security) (deflated 4%)
      adding: jtj6071se.dll (92 bytes security) (deflated 5%)
      adding: nmrsnl.dll (92 bytes security) (deflated 5%)
      adding: npwrsko.dll (92 bytes security) (deflated 4%)
      adding: o2ro0c93ef.dll (92 bytes security) (deflated 5%)
      adding: sbncui.dll (92 bytes security) (deflated 5%)
      adding: shcfiles.dll (92 bytes security) (deflated 5%)
      adding: clear.reg (92 bytes security) (deflated 22%)
      adding: echo.reg (92 bytes security) (deflated 9%)
      adding: direct.txt (92 bytes security) (deflated 3%)
      adding: lo2.txt (92 bytes security) (deflated 80%)
      adding: readme.txt (92 bytes security) (deflated 49%)
      adding: report.txt (92 bytes security) (deflated 65%)
      adding: test.txt (92 bytes security) (deflated 72%)
      adding: test2.txt (92 bytes security) (stored 0%)
      adding: test3.txt (92 bytes security) (stored 0%)
      adding: test5.txt (92 bytes security) (stored 0%)
      adding: xfind.txt (92 bytes security) (deflated 65%)
      adding: backregs/E0249E26-145E-41D2-919E-AD4A6F3777D6.reg (92 bytes security) (deflated 70%)
      adding: backregs/shell.reg (92 bytes security) (deflated 75%)

      Restoring Registry Permissions:


      RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
      Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
      This program is Freeware, use it on your own risk!


      Revoking access for predefined group "Administrators"
      Inherited ACE can not be revoked here!
      Inherited ACE can not be revoked here!


      Registry permissions set too:

      RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
      Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
      This program is Freeware, use it on your own risk!

      Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
      (NI) ALLOW Full access    NT AUTHORITY\SYSTEM
      (IO) ALLOW Full access    NT AUTHORITY\SYSTEM
      (NI) ALLOW Full access    NT AUTHORITY\SYSTEM
      (IO) ALLOW Full access    NT AUTHORITY\SYSTEM
      (ID-NI) ALLOW Read    BUILTIN\Users
      (ID-IO) ALLOW Read    BUILTIN\Users
      (ID-NI) ALLOW Read    BUILTIN\Power Users
      (ID-IO) ALLOW Read    BUILTIN\Power Users
      (ID-NI) ALLOW Full access    BUILTIN\Administrators
      (ID-IO) ALLOW Full access    BUILTIN\Administrators
      (ID-NI) ALLOW Full access    NT AUTHORITY\SYSTEM
      (ID-IO) ALLOW Full access    NT AUTHORITY\SYSTEM
      (ID-IO) ALLOW Full access    CREATOR OWNER


      Restoring Sedebugprivilege:

      Granting SeDebugPrivilege to Administrators ... successful

      deleting local copy: e2jm0c11ef.dll
      deleting local copy: fp4q03h5e.dll
      deleting local copy: i2240cfqef2e0.dll
      deleting local copy: i6420ghoe64c0.dll
      deleting local copy: impromon.dll
      deleting local copy: ipetcfg.dll
      deleting local copy: jtj6071se.dll
      deleting local copy: nmrsnl.dll
      deleting local copy: npwrsko.dll
      deleting local copy: o2ro0c93ef.dll
      deleting local copy: sbncui.dll
      deleting local copy: shcfiles.dll

      The following Is the Current Export of the Winlogon notify key:
      ****************************************************************************
      Windows Registry Editor Version 5.00

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
      "Asynchronous"=dword:00000000
      "Impersonate"=dword:00000000
      "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
      6c,00,00,00
      "Logoff"="ChainWlxLogoffEvent"

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
      "Asynchronous"=dword:00000000
      "Impersonate"=dword:00000000
      "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
      6c,00,6c,00,00,00
      "Logoff"="CryptnetWlxLogoffEvent"

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
      "DLLName"="cscdll.dll"
      "Logon"="WinlogonLogonEvent"
      "Logoff"="WinlogonLogoffEvent"
      "ScreenSaver"="WinlogonScreenSaverEvent"
      "Startup"="WinlogonStartupEvent"
      "Shutdown"="WinlogonShutdownEvent"
      "StartShell"="WinlogonStartShellEvent"
      "Impersonate"=dword:00000000
      "Asynchronous"=dword:00000001

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
      "Logoff"="WLEventLogoff"
      "Impersonate"=dword:00000000
      "Asynchronous"=dword:00000001
      "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
      6c,00,6c,00,00,00

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
      "DLLName"="WlNotify.dll"
      "Lock"="SensLockEvent"
      "Logon"="SensLogonEvent"
      "Logoff"="SensLogoffEvent"
      "Safe"=dword:00000001
      "MaxWait"=dword:00000258
      "StartScreenSaver"="SensStartScreenSaverEvent"
      "StopScreenSaver"="SensStopScreenSaverEvent"
      "Startup"="SensStartupEvent"
      "Shutdown"="SensShutdownEvent"
      "StartShell"="SensStartShellEvent"
      "Unlock"="SensUnlockEvent"
      "Impersonate"=dword:00000001
      "Asynchronous"=dword:00000001


      The following are the files found:
      ****************************************************************************
      C:\WINNT\system32\e2jm0c11ef.dll
      C:\WINNT\system32\fp4q03h5e.dll
      C:\WINNT\system32\i2240cfqef2e0.dll
      C:\WINNT\system32\i6420ghoe64c0.dll
      C:\WINNT\system32\impromon.dll
      C:\WINNT\system32\ipetcfg.dll
      C:\WINNT\system32\jtj6071se.dll
      C:\WINNT\system32\nmrsnl.dll
      C:\WINNT\system32\npwrsko.dll
      C:\WINNT\system32\o2ro0c93ef.dll
      C:\WINNT\system32\sbncui.dll
      C:\WINNT\system32\shcfiles.dll

      Registry Entries that were Deleted:
      Please verify that the listing looks ok.
      If there was something deleted wrongly there are backups in the backreg folder.
      ****************************************************************************
      REGEDIT4

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
      "{E0249E26-145E-41D2-919E-AD4A6F3777D6}"=-
      [-HKEY_CLASSES_ROOT\CLSID\{E0249E26-145E-41D2-919E-AD4A6F3777D6}]
      REGEDIT4

      [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
      ****************************************************************************
      Desktop.ini Contents:
      ****************************************************************************
      ****************************************************************************
      





      Logfile of HijackThis v1.99.1
      Scan saved at 13:20:25, on 20.4.2005
      Platform: Windows 2000 SP2 (WinNT 5.00.2195)
      MSIE: Internet Explorer v5.00 SP2 (5.00.2920.0000)

      Running processes:
      C:\WINNT\System32\smss.exe
      C:\WINNT\system32\winlogon.exe
      C:\WINNT\system32\services.exe
      C:\WINNT\system32\lsass.exe
      C:\WINNT\system32\svchost.exe
      C:\WINNT\system32\spoolsv.exe
      C:\Program Files\AVPersonal\AVWUPSRV.EXE
      C:\WINNT\System32\svchost.exe
      C:\WINNT\System32\nvsvc32.exe
      C:\WINNT\system32\regsvc.exe
      C:\WINNT\system32\MSTask.exe
      C:\WINNT\system32\stisvc.exe
      C:\WINNT\system32\ZoneLabs\vsmon.exe
      C:\WINNT\System32\WBEM\WinMgmt.exe
      C:\WINNT\System32\mspmspsv.exe
      C:\WINNT\System32\mdm.exe
      C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
      C:\WINNT\System32\internat.exe
      C:\WINNT\explorer.exe
      C:\WINNT\system32\NOTEPAD.EXE
      C:\WINNT\system32\notepad.exe
      C:\hijack\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
      O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
      O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
      O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
      O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
      O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
      O4 - HKCU\..\Run: [internat.exe] internat.exe
      O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar3.dll/cmbacklinks.html
      O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar3.dll/cmcache.html
      O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar3.dll/cmsimilar.html
      O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
      O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} (F-Secure Online Scanner) - http://support.f-secure.com/ols/fscax.cab
      O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
      O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
      O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
      O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe

      Hyvin meni,puhasta on.

      Äänestä

    • Juu kirjoitti:

      Hyvin meni,puhasta on.

      jep

      Äänestä

    Odottaa vastausta

    Näihin keskusteluihin ei ole vielä vastattu. Ole ensimmäinen.

    Luetuimmat keskustelut

    Kommentoi aloitusta

    hölökyn kölökyn kirjoitti:

    Logfile of HijackThis v1.99.1
    Scan saved at 23:50:27, on 19.4.2005
    Platform: Windows 2000 SP2 (WinNT 5.00.2195)
    MSIE: Internet Explorer v5.00 SP2 (5.00.2920.0000)

    Running processes:
    C:\WINNT\System32\smss.exe
    C:\WINNT\system32\winlogon.exe
    C:\WINNT\system32\services.exe
    C:\WINNT\system32\lsass.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\system32\spoolsv.exe
    C:\Program Files\AVPersonal\AVWUPSRV.EXE
    C:\WINNT\System32\svchost.exe
    C:\WINNT\System32\nvsvc32.exe
    C:\WINNT\system32\regsvc.exe
    C:\WINNT\system32\MSTask.exe
    C:\WINNT\system32\stisvc.exe
    C:\WINNT\system32\ZoneLabs\vsmon.exe
    C:\WINNT\System32\WBEM\WinMgmt.exe
    C:\WINNT\System32\mspmspsv.exe
    C:\WINNT\system32\rundll32.exe
    C:\WINNT\Explorer.EXE
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\WINNT\System32\internat.exe
    C:\Program Files\DC \DCPlusPlus.exe
    C:\hijack\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
    O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
    O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [ap9h4qmo] C:\WINNT\System32\ap9h4qmo.exe
    O4 - HKCU\..\Run: [internat.exe] internat.exe
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar3.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar3.dll/cmcache.html
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar3.dll/cmsimilar.html
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} (F-Secure Online Scanner) - http://support.f-secure.com/ols/fscax.cab
    O20 - Winlogon Notify: Uninstall - C:\WINNT\system32\m464lejq1hoe.dll
    O23 - Service: AntiVir Update (AVWUpSrv) - H BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
    O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe

    Anonyymi
    5000

    Ilmoita asiaton sisältö

    • Sisältää materiaalia, joka on loukkaavaa, herjaavaa, rasistista, uhkailevaa tai ahdistelevaa.

    • Materiaali sisältää nimiä, yhteystietoja tai muita henkilökohtaisia tietoja. Julkisuuden henkilöistä, julkisissa viroissa toimivista ihmisistä sekä yritysten vastuuhenkilöistä saa keskustella työhön liittyen. Myös yksityiselämään liittyvistä asioista voi keskustella siltä osin, kuin niistä on julkisesti kerrottu.

    • Sisältää lapsille haitallista tai heiltä kiellettyä materiaalia. Seksuaalinen sisältö on sallittua aiheeseen tarkoitetuilla palstoilla, joiden ikäraja on 18 vuotta.

    • Lainvastaista sisältöä voi olla mm. yksityiselämää loukkaavan tiedon levitys, kiihottaminen kansanryhmää vastaan, laiton uhkaaminen, alaikäisiin liittyvä seksuaalinen sisältö/grooming, petokset, identiteettivarkaudet, kunnianloukkaukset ja tekijänoikeusrikkomukset.

    • Sisältö ei liity palstan tai keskusteluketjun aiheeseen.

    • Viesti ei ole suomea tai ruotsia (pl. International Forums), se sisältää mainontaa, se sisältää tekijänoikeuksin suojattua materiaalia, se on massapostitus tai jokin muu syy.

    Jaa keskustelu