Hei!
Lähettin eilen Hijack login ja korjasin virheet, kiitos.
Voisiko joku vilkaista vielä muitakin ongelmia tai olen väärällä palstalla.
1)Käynnistyksen jälkeen tulee virheilmoitus:
mswmc.exe – CLR-virheenkorjauspalvelut
Sovellus on aiheuttanut poikkeuksen, jota ei voitu käsitellä.
Prosessitunnus=0xbc4 (3012), säietunnus=0xbF8 (3064).
Seuraavaksi:
Rekisteröity JIT-virheenkorjaus ei ole käytettävissä. JIT-virheenkorjauksen käynnistäminen seuraavalla komennolla aiheutti virhekoodin 0x2(2). Tarkista tietoneen asetukset.
cord6g.exe !a 0xbc4
2)
Tarkistusohjelmat:
· F-Secure AVP: 6.0.167.6190, 2005-04-25
· F-Secure Libra: 2.01.10, 2005-04-22
· F-Secure Orion: 1.02.33, 2005-04-20
Miksei saa niitä tarkastaa?
· Tiedoston C:\pagefile.sys avaaminen ei onnistu.
· Tiedoston C:\WINDOWS\system32\config\default avaaminen ei onnistu.
· Tiedoston C:\WINDOWS\SoftwareDistribution\EventCache\{5DB18022-586B-48B9-83F4-8DC2ED516366}.bin avaaminen ei onnistu.
· Tiedoston C:\WINDOWS\SoftwareDistribution\EventCache\{BD0A367E-4DC2-4142-B5A0-4BEDC228C11F}.bin avaaminen ei onnistu.
3) eScan AntiVirus Toolkit Utility: ovatko nämä virheet vaarallisia?
ERROR!!! Invalid Entry Microsoft Windows W32 Services = mssw32.exe. Removing it.
ERROR!!! Invalid Entry Mcafee Antivirus Monitoring System32mn = VSStatmn32.exe
ERROR!!! Invalid Entry C:\WINDOWS\system32\vheipwrmt.exe in SYSTEM\CurrentControlSet\Services\*wuauclt.exe...
ERROR!!! Invalid Entry system32\DRIVERS\pcipim.sys in SYSTEM\CurrentControlSet\Services\pcipim...
C:\WINDOWS\system32\WSMCT.0XE.mwt File already Scanned once... not able to clean.
C:\WINDOWS\system32\WTMSC.0XE.mwt File already Scanned once... not able to clean.
ERROR!!! FindFirstFile For C:\3ef21ae0ba5e72f9acac28b6dcc3e3\i386\*.* Failed!!! Reason is Käyttö estetty. (0x5)
ERROR!!! ScanFile fails for C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\Crypto\RSA\MACHIN~1\54BF7A~1
ERROR!!! ScanFile fails for C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\Crypto\RSA\MACHIN~1\67EF4F~1
ERROR!!! ScanFile fails for C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\Crypto\RSA\MACHIN~1\A5479A~1
ERROR!!! ScanFile fails for C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\Crypto\RSA\MACHIN~1\EA5D83~1
ERROR!!! ScanFile fails for C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\Crypto\RSA\MACHIN~1\F3BC02~1
ERROR!!! ScanFile fails for C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\Crypto\RSA\MACHIN~1\F3BC02~1
ERROR!!! ScanFile fails for C:\DOCUME~1\JRJEST~1\Cookies\index.dat
ERROR!!! ScanFile fails for C:\DOCUME~1\JRJEST~1\LOCALS~1\TEMPOR~1\Content.IE5\index.dat
ERROR!!! ScanFile fails for C:\DOCUME~1\JRJEST~1\NTUSER.DAT
ERROR!!! ScanFile fails for C:\DOCUME~1\JRJEST~1\NTUSER~1.LOG
ERROR!!! ScanFile fails for C:\DOCUME~1\NETWOR~1\LOCALS~1\APPLIC~1\MICROS~1\Windows\UsrClass.dat
ERROR!!! ScanFile fails for C:\DOCUME~1\NETWOR~1\LOCALS~1\APPLIC~1\MICROS~1\Windows\USRCLA~1.LOG
ERROR!!! ScanFile fails for C:\DOCUME~1\NETWOR~1\NTUSER.DAT
ERROR!!! ScanFile fails for C:\DOCUME~1\NETWOR~1\NTUSER~1.LOG
ERROR!!! FindFirstFile For C:\System Volume Information\*.* Failed!!! Reason is Käyttö estetty. (0x5)
ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\AppEvent.Evt
ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\default.LOG
ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\SAM
ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\SAM.LOG
ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\SecEvent.Evt
ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\SECURITY
ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\SECURITY.LOG
ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\software.LOG
ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\SysEvent.Evt
ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\SysEvent.Evt
ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\system.LOG
ERROR!!! ScanFile fails for C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR
ERROR!!! ScanFile fails for C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP
ERROR!!! ScanFile fails for C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER
ERROR!!! ScanFile fails for C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP
ERROR!!! ScanFile fails for C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP
ERROR!!! ScanFile fails for C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP
ERROR!!! ScanFile fails for D:\PROGRA~1\NETANT~1\Param\scArena.loc
Mitä merkitse “having Size Restriction”? Niitäkin oli aika paljon.
*** File C:\pagefile.sys having Size Restriction ***
*** File C:\Program Files\Windows Media Connect\Redist\wmfdist95.exe having Size Restriction
Total Number of Files Scanned: 27187
Total Number of Virus(es) Found: 0
Total Number of Disinfected Files: 0
Total Number of Files Renamed: 0
Total Number of Deleted Files: 0
Sun Apr 24 23:38:16 2005 => Total Number of Errors: 9
Lähettin eilen Hijack login ja korjasin virheet, kiitos.
Voisiko joku vilkaista vielä muitakin ongelmia tai olen väärällä palstalla.
1)Käynnistyksen jälkeen tulee virheilmoitus:
mswmc.exe – CLR-virheenkorjauspalvelut
Sovellus on aiheuttanut poikkeuksen, jota ei voitu käsitellä.
Prosessitunnus=0xbc4 (3012), säietunnus=0xbF8 (3064).
Seuraavaksi:
Rekisteröity JIT-virheenkorjaus ei ole käytettävissä. JIT-virheenkorjauksen käynnistäminen seuraavalla komennolla aiheutti virhekoodin 0x2(2). Tarkista tietoneen asetukset.
cord6g.exe !a 0xbc4
2)
Tarkistusohjelmat:
· F-Secure AVP: 6.0.167.6190, 2005-04-25
· F-Secure Libra: 2.01.10, 2005-04-22
· F-Secure Orion: 1.02.33, 2005-04-20
Miksei saa niitä tarkastaa?
· Tiedoston C:\pagefile.sys avaaminen ei onnistu.
· Tiedoston C:\WINDOWS\system32\config\default avaaminen ei onnistu.
· Tiedoston C:\WINDOWS\SoftwareDistribution\EventCache\{5DB18022-586B-48B9-83F4-8DC2ED516366}.bin avaaminen ei onnistu.
· Tiedoston C:\WINDOWS\SoftwareDistribution\EventCache\{BD0A367E-4DC2-4142-B5A0-4BEDC228C11F}.bin avaaminen ei onnistu.
3) eScan AntiVirus Toolkit Utility: ovatko nämä virheet vaarallisia?
ERROR!!! Invalid Entry Microsoft Windows W32 Services = mssw32.exe. Removing it.
ERROR!!! Invalid Entry Mcafee Antivirus Monitoring System32mn = VSStatmn32.exe
ERROR!!! Invalid Entry C:\WINDOWS\system32\vheipwrmt.exe in SYSTEM\CurrentControlSet\Services\*wuauclt.exe...
ERROR!!! Invalid Entry system32\DRIVERS\pcipim.sys in SYSTEM\CurrentControlSet\Services\pcipim...
C:\WINDOWS\system32\WSMCT.0XE.mwt File already Scanned once... not able to clean.
C:\WINDOWS\system32\WTMSC.0XE.mwt File already Scanned once... not able to clean.
ERROR!!! FindFirstFile For C:\3ef21ae0ba5e72f9acac28b6dcc3e3\i386\*.* Failed!!! Reason is Käyttö estetty. (0x5)
ERROR!!! ScanFile fails for C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\Crypto\RSA\MACHIN~1\54BF7A~1
ERROR!!! ScanFile fails for C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\Crypto\RSA\MACHIN~1\67EF4F~1
ERROR!!! ScanFile fails for C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\Crypto\RSA\MACHIN~1\A5479A~1
ERROR!!! ScanFile fails for C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\Crypto\RSA\MACHIN~1\EA5D83~1
ERROR!!! ScanFile fails for C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\Crypto\RSA\MACHIN~1\F3BC02~1
ERROR!!! ScanFile fails for C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\Crypto\RSA\MACHIN~1\F3BC02~1
ERROR!!! ScanFile fails for C:\DOCUME~1\JRJEST~1\Cookies\index.dat
ERROR!!! ScanFile fails for C:\DOCUME~1\JRJEST~1\LOCALS~1\TEMPOR~1\Content.IE5\index.dat
ERROR!!! ScanFile fails for C:\DOCUME~1\JRJEST~1\NTUSER.DAT
ERROR!!! ScanFile fails for C:\DOCUME~1\JRJEST~1\NTUSER~1.LOG
ERROR!!! ScanFile fails for C:\DOCUME~1\NETWOR~1\LOCALS~1\APPLIC~1\MICROS~1\Windows\UsrClass.dat
ERROR!!! ScanFile fails for C:\DOCUME~1\NETWOR~1\LOCALS~1\APPLIC~1\MICROS~1\Windows\USRCLA~1.LOG
ERROR!!! ScanFile fails for C:\DOCUME~1\NETWOR~1\NTUSER.DAT
ERROR!!! ScanFile fails for C:\DOCUME~1\NETWOR~1\NTUSER~1.LOG
ERROR!!! FindFirstFile For C:\System Volume Information\*.* Failed!!! Reason is Käyttö estetty. (0x5)
ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\AppEvent.Evt
ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\default.LOG
ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\SAM
ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\SAM.LOG
ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\SecEvent.Evt
ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\SECURITY
ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\SECURITY.LOG
ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\software.LOG
ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\SysEvent.Evt
ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\SysEvent.Evt
ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\system.LOG
ERROR!!! ScanFile fails for C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR
ERROR!!! ScanFile fails for C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP
ERROR!!! ScanFile fails for C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER
ERROR!!! ScanFile fails for C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP
ERROR!!! ScanFile fails for C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP
ERROR!!! ScanFile fails for C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP
ERROR!!! ScanFile fails for D:\PROGRA~1\NETANT~1\Param\scArena.loc
Mitä merkitse “having Size Restriction”? Niitäkin oli aika paljon.
*** File C:\pagefile.sys having Size Restriction ***
*** File C:\Program Files\Windows Media Connect\Redist\wmfdist95.exe having Size Restriction
Total Number of Files Scanned: 27187
Total Number of Virus(es) Found: 0
Total Number of Disinfected Files: 0
Total Number of Files Renamed: 0
Total Number of Deleted Files: 0
Sun Apr 24 23:38:16 2005 => Total Number of Errors: 9
Vastaukset 10
Vanhimmat
No noista virheilmoituksista ja erroreista en sen tarkemmin tiedä,mutta poista nuo varalta
C:\WINDOWS\system32\WSMCT.0XE.mwt File already Scanned once... not able to clean.
C:\WINDOWS\system32\WTMSC.0XE.mwt File already Scanned once... not able to clean.
Löytyykö nämä koneelta
mssw32.exe
VSStatmn32.exe
Etsinnän tulos:
Kaksi ensimmäistä: "Windows\system32\" ei ole kelvollinen kansio, kaksi viimeistä - näytettäviä kohteita ei ole.
Lähettäisinko vielä Hijack lokin?
Koita etsiä niitä vaikka noilla nimillä
WSMCT
WTMSC
WSMCT.0XE
WTMSC.0XE
> Lähettäisinko vielä Hijack lokin? <
Pistä vaan
Ei löydy.
Logfile of HijackThis v1.99.1
Scan saved at 20:41:43, on 25.4.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
D:\Program Files\Elisa Tietoturvapalvelu\Common\FSM32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
D:\Program Files\SpySub.exe
D:\PROGRA~1\ELISAT~1\backweb\4119343\Program\SERVIC~1.EXE
D:\Program Files\WinZip\WZQKPICK.EXE
D:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsgk32st.exe
D:\Program Files\Elisa Tietoturvapalvelu\backweb\4119343\Program\fspex.exe
D:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\FSGK32.EXE
D:\Program Files\Elisa Tietoturvapalvelu\backweb\4119343\program\fsbwsys.exe
D:\Program Files\program\soffice.exe
D:\Program Files\Elisa Tietoturvapalvelu\Common\FSMA32.EXE
C:\WINDOWS\system32\nvsvc32.exe
D:\Program Files\Elisa Tietoturvapalvelu\Common\FSMB32.EXE
D:\Program Files\NetAnttila\Bin\scServer.exe
D:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fssm32.exe
D:\Program Files\Elisa Tietoturvapalvelu\Common\FCH32.EXE
C:\Program Files\Windows Media Connect\mswmcls.exe
D:\Program Files\Elisa Tietoturvapalvelu\Common\FAMEH32.EXE
D:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsav32.exe
D:\Program Files\Elisa Tietoturvapalvelu\FWES\Program\fsdfwd.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Media Connect\mswmc.exe
D:\Program Files\Elisa Tietoturvapalvelu\FSGUI\fsguiexe.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\Program Files\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://elisa.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja Elisa Internet
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [F-Secure Manager] "D:\Program Files\Elisa Tietoturvapalvelu\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "D:\Program Files\Elisa Tietoturvapalvelu\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "D:\Program Files\Elisa Tietoturvapalvelu\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [Windows Task System] tasksys.exe
O4 - HKLM\..\Run: [Microsoft Windows W32 Services] mssw32.exe
O4 - HKLM\..\RunServices: [*wuauclt.exe] vheipwrmt.exe
O4 - HKLM\..\RunServices: [Windows Task System] tasksys.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Microsoft Windows W32 Services] mssw32.exe
O4 - HKCU\..\Run: [Mcafee Antivirus Monitoring System32mn] VSStatmn32.exe
O4 - HKCU\..\Run: [*wuauclt.exe] wmsct.exe
O4 - Startup: OpenOffice.org 1.1.4.lnk = D:\Program Files\program\quickstart.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: SpySubtract.lnk = D:\Program Files\SpySub.exe
O4 - Global Startup: WinZip Quick Pick.lnk = D:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O16 - DPF: {02E09B2E-2A03-4572-9291-69900C068564} (LCSim Control) - http://www.learnitcorp.com/cabs/lcsim.cab
O16 - DPF: {15589FA1-C456-11CE-BF01-000000000000} - http://www.errornuker.com/products/errn2004/installers/default/ErrorNukerInstaller.exe
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - http://pirmail1.piramk.fi/iNotes6.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} (F-Secure Online Scanner) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326
O23 - Service: Elisa Tietoturvapalvelu (BackWeb Plug-in - 4119343) - Unknown owner - D:\PROGRA~1\ELISAT~1\backweb\4119343\Program\SERVIC~1.EXE
O23 - Service: CWShredder Service - InterMute, Inc. - C:\Program Files\InterMute\SpySubtract\CWShredder.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - D:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - D:\Program Files\Elisa Tietoturvapalvelu\backweb\4119343\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - D:\Program Files\Elisa Tietoturvapalvelu\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - D:\Program Files\Elisa Tietoturvapalvelu\Common\FSMA32.EXE
O23 - Service: iPod-palvelu (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: scNetAnttila - Unknown owner - D:\Program Files\NetAnttila\Bin\scServer.exe
lataa tämä ohjelma ja poista ( SPYBOT WORM! )
ftp://ftp.europe.f-secure.com/anti-virus/tools/beta/f-bot.exe
Tuossa ohjeet
ftp://ftp.europe.f-secure.com/anti-virus/tools/beta/f-bot.txt
ja Tässä Tieto
http://startup.iamnotageek.com/srch-mssw32.exe.html
"" O4 - HKCU\..\Run: [Microsoft Windows W32 Services] mssw32.exe ""
mssw32.exe >> Added by a variant of the SPYBOT WORM!
Merkkaa ja Fix:saa
O4 - HKLM\..\Run: [Windows Task System] tasksys.exe
O4 - HKLM\..\Run: [Microsoft Windows W32 Services] mssw32.exe
O4 - HKLM\..\RunServices: [*wuauclt.exe] vheipwrmt.exe
O4 - HKLM\..\RunServices: [Windows Task System] tasksys.exe
O4 - HKCU\..\Run: [Microsoft Windows W32 Services] mssw32.exe
O4 - HKCU\..\Run: [Mcafee Antivirus Monitoring System32mn] VSStatmn32.exe
O4 - HKCU\..\Run: [*wuauclt.exe] wmsct.exe
Sitte päivitä se e-scanni ja käynnistä kone vikasietotilassa ja scannaa sillä kone.
Käynnistä sitte normaalisti ja pistä uus Hijack logi ja sen scannerin logi (ala ikkuna jos jotain tulee sinne)
Mitä tästä:
pelossa
Kirjoittanut: mkk 25.4.2005 klo 21.20
lataa tämä ohjelma ja poista ( SPYBOT WORM! )
ftp://ftp.europe.f-secure.com/anti-virus/tools/beta/f-b ot.exe
Tuossa ohjeet
ftp://ftp.europe.f-secure.com/anti-virus/tools/beta/f-b ot.txt
ja Tässä Tieto
http://startup.iamnotageek.com/srch-mssw32.exe.html
"" O4 - HKCU\..\Run: [Microsoft Windows W32 Services] mssw32.exe ""
mssw32.exe >> Added by a variant of the SPYBOT WORM!
Klikkasin linkki, tuli Elisa titoturvapalvelun varoitus, painoin "pura" mutta ei tapahtunut mitään.
No kokeilen nyt kuitenkin sitä vikasitotila asia. Varmasti menee aikaa - asia on uutta minulle.
Tavataan täällä jos jotain hirvettä ei tapahdu.
Logfile of HijackThis v1.99.1
Scan saved at 23:30:43, on 25.4.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
D:\PROGRA~1\ELISAT~1\backweb\4119343\Program\SERVIC~1.EXE
D:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsgk32st.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
D:\Program Files\Elisa Tietoturvapalvelu\backweb\4119343\Program\fspex.exe
D:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\FSGK32.EXE
D:\Program Files\Elisa Tietoturvapalvelu\Common\FSM32.EXE
D:\Program Files\Elisa Tietoturvapalvelu\backweb\4119343\program\fsbwsys.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
D:\Program Files\Elisa Tietoturvapalvelu\Common\FSMA32.EXE
D:\Program Files\SpySub.exe
C:\WINDOWS\system32\nvsvc32.exe
D:\Program Files\Elisa Tietoturvapalvelu\Common\FSMB32.EXE
D:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fssm32.exe
D:\Program Files\WinZip\WZQKPICK.EXE
D:\Program Files\NetAnttila\Bin\scServer.exe
D:\Program Files\Elisa Tietoturvapalvelu\Common\FCH32.EXE
C:\Program Files\Windows Media Connect\mswmcls.exe
D:\Program Files\program\soffice.exe
D:\Program Files\Elisa Tietoturvapalvelu\Common\FAMEH32.EXE
D:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsav32.exe
C:\WINDOWS\system32\wuauclt.exe
D:\Program Files\Elisa Tietoturvapalvelu\FWES\Program\fsdfwd.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Media Connect\mswmc.exe
D:\Program Files\Elisa Tietoturvapalvelu\FSGUI\fsguiexe.exe
D:\Program Files\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://elisa.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja Elisa Internet
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [F-Secure Manager] "D:\Program Files\Elisa Tietoturvapalvelu\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "D:\Program Files\Elisa Tietoturvapalvelu\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "D:\Program Files\Elisa Tietoturvapalvelu\FSGUI\FSSW.EXE" /reboot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: OpenOffice.org 1.1.4.lnk = D:\Program Files\program\quickstart.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: SpySubtract.lnk = D:\Program Files\SpySub.exe
O4 - Global Startup: WinZip Quick Pick.lnk = D:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O16 - DPF: {02E09B2E-2A03-4572-9291-69900C068564} (LCSim Control) - http://www.learnitcorp.com/cabs/lcsim.cab
O16 - DPF: {15589FA1-C456-11CE-BF01-000000000000} - http://www.errornuker.com/products/errn2004/installers/default/ErrorNukerInstaller.exe
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - http://pirmail1.piramk.fi/iNotes6.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} (F-Secure Online Scanner) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326
O23 - Service: Elisa Tietoturvapalvelu (BackWeb Plug-in - 4119343) - Unknown owner - D:\PROGRA~1\ELISAT~1\backweb\4119343\Program\SERVIC~1.EXE
O23 - Service: CWShredder Service - InterMute, Inc. - C:\Program Files\InterMute\SpySubtract\CWShredder.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - D:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - D:\Program Files\Elisa Tietoturvapalvelu\backweb\4119343\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - D:\Program Files\Elisa Tietoturvapalvelu\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - D:\Program Files\Elisa Tietoturvapalvelu\Common\FSMA32.EXE
O23 - Service: iPod-palvelu (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: scNetAnttila - Unknown owner - D:\Program Files\NetAnttila\Bin\scServer.exe
********************************************
Mon Apr 25 22:52:15 2005 => Total Number of Files Scanned: 27374
Mon Apr 25 22:52:15 2005 =>
Total Number of Virus(es) Found: 0
Total Number of Disinfected Files: 0
Total Number of Files Renamed: 0
Total Number of Deleted Files: 0
Total Number of Errors: 5
Time Elapsed: 00:33:03
Virus Database Date: 2005/04/05
Virus Database Count: 124715
Hyvältä näyttää,asenna palomuuri jos sitä ei oo.
Minulla on Elisan Tietoturva, missä on myös palomuuri.
Kiitos avusta, tämä sivu on fantastinen! Hyvä että löytyy ihmisiä kuka auttavat semmoisessa tilanneessa.
Hyvää yötä!