edelliseen vastausta

:D:D

hjk loki
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\WINDOWS\system32\paytime.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Steam\Steam.exe
C:\WINDOWS\system32\paytime.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Topi\Työpöytä\HijackThis.exe
C:\Program Files\Cheating-Death\cdeath.exe

O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WB - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll
O21 - SSODL: SysTray.Exiv - {2963ECFC-4E5C-2f3b-B334-D67434FC72E0} - C:\WINDOWS\system32\nkmhlcjp.dll (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

ewido

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

Created on:         10:31:02, 5.12.2005
Report-Checksum:      7AD2DB24

Scan result:

   [232] C:\WINDOWS\system32\nkmhlcjp.dll -> Proxy.Wopla.m : Error during cleaning
   :mozilla.8:C:\Documents and Settings\Harri\Application Data\Mozilla\Firefox\Profiles\ud93e626.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
   :mozilla.11:C:\Documents and Settings\Harri\Application Data\Mozilla\Firefox\Profiles\ud93e626.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
   C:\Documents and Settings\Harri\Cookies\harri@adtech[2].txt -> Spyware.Cookie.Adtech : Cleaned with backup
   C:\Documents and Settings\Harri\Cookies\harri@atdmt[1].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
   C:\Documents and Settings\Harri\Cookies\harri@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
   C:\Documents and Settings\Harri\Cookies\harri@ehg-teliasonera.hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
   C:\Documents and Settings\Harri\Cookies\harri@hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
   C:\Documents and Settings\Harri\Cookies\harri@microsoftwga.112.2o7[1].txt -> Spyware.Cookie.2o7 : Cleaned with backup
   :mozilla.8:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup
   :mozilla.11:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
   :mozilla.14:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
   :mozilla.15:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
   :mozilla.21:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
   :mozilla.22:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
   :mozilla.77:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Fuck-access : Cleaned with backup
   :mozilla.84:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
   :mozilla.85:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
   :mozilla.92:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
   :mozilla.93:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
   :mozilla.94:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
   :mozilla.95:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
   :mozilla.96:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
   :mozilla.97:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
   :mozilla.98:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
   :mozilla.99:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
   :mozilla.100:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
   :mozilla.101:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
   :mozilla.102:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
   :mozilla.103:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
   :mozilla.104:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
   :mozilla.111:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Findwhat : Cleaned with backup
   :mozilla.125:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.247realmedia : Cleaned with backup
   :mozilla.129:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
   :mozilla.130:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
   :mozilla.152:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
   :mozilla.153:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
   :mozilla.156:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Paycounter : Cleaned with backup
   :mozilla.171:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
   :mozilla.172:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
   :mozilla.173:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
   :mozilla.174:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
   :mozilla.175:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
   :mozilla.176:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
   :mozilla.177:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
   :mozilla.187:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
   :mozilla.199:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Masterstats : Cleaned with backup
   :mozilla.219:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Qksrv : Cleaned with backup
   :mozilla.220:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Qksrv : Cleaned with backup
   :mozilla.221:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
   :mozilla.224:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
   :mozilla.225:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
   :mozilla.228:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Spylog : Cleaned with backup
   :mozilla.236:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
   :mozilla.237:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
   :mozilla.238:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
   :mozilla.239:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
   :mozilla.240:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
   :mozilla.241:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
   :mozilla.242:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
   :mozilla.243:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
   :mozilla.244:C:\Documents and Settings\Topi\Application Data\Mozilla\Firefox\Profiles\lofwkazx.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
   C:\Documents and Settings\Topi\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\Dummy.class-451cae74-4d6625d3.class -> Trojan.ClassLoader.Dummy.d : Cleaned with backup
   C:\Documents and Settings\Topi\Cookies\topi@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
   C:\Documents and Settings\Topi\Local Settings\Temporary Internet Files\Content.IE5\69KFMXY1\kl[1].txt -> Downloader.Small.byf : Cleaned with backup
   C:\Documents and Settings\Topi\Local Settings\Temporary Internet Files\Content.IE5\G5W7CN8J\tool3[1].txt -> Downloader.Small.bwr : Cleaned with backup
   C:\Documents and Settings\Topi\Local Settings\Temporary Internet Files\Content.IE5\RYO7VDW5\hosts[1].txt -> Trojan.Qhost.el : Cleaned with backup
   C:\Documents and Settings\Topi\Local Settings\Temporary Internet Files\Content.IE5\RYO7VDW5\toolbar[1].txt -> Downloader.VB.qr : Cleaned with backup
   C:\Documents and Settings\Topi\Local Settings\Temporary Internet Files\Content.IE5\W9GDY3KH\ms1[1].txt -> Downloader.Small.buh : Cleaned with backup
   C:\Documents and Settings\Topi\Local Settings\Temporary Internet Files\Content.IE5\W9GDY3KH\tool1[1].txt -> Dropper.Agent.abu : Cleaned with backup
   C:\Program Files\WinRAR\Uninstall.exe -> Backdoor.PoeBot.e : Cleaned with backup
   C:\WINDOWS\hosts -> Trojan.Qhost.el : Cleaned with backup
   C:\WINDOWS\system32\__delete_on_reboot__nkmhlcjp.dll -> Proxy.Wopla.m : Cleaned with backup

2

93

    Vastaukset

    Anonyymi (Kirjaudu / Rekisteröidy)
    5000
    • Fixaaja

      Siihen samaan aiheeseen olis voinu vastata ;)

      Teitkö ewidolla "complete system scan"in?

      Jos et, niin tee se nyt.

      Fixaa tämä:

      O21 - SSODL: SysTray.Exiv - {2963ECFC-4E5C-2f3b-B334-D67434FC72E0} - C:\WINDOWS\system32\nkmhlcjp.dll (file missing)

      Hae hoster ->
      http://www.funkytoad.com/download/hoster.zip

      Pura zippi ja tuplaklikkaa hoster.exe

      Paina "Restore original hosts" ja ok.

      Laita piilotiedostot näkyviin , ohje ->
      http://keskustelu.afterdawn.com/thread_view.cfm/248944

      Katso löydätkö tämän ->
      C:\WINDOWS\system32\paytime.exe

      Jos, niin poista se vikasietotilassa (F8 käynnistyksen yhteydessä).

      Käynnistä uudelllen ja lähetä uusi HjT-loki (ja ewidon raportti, jos et ajanut "complete system scan"ia).

      • :D:D

        sopii


    Ketjusta on poistettu 0 sääntöjenvastaista viestiä.

    Luetuimmat keskustelut

    1. Stefu LOISTAVAA!

      Ilmeisesti joku vedonlyönti tms, selvinpäin-elämästä👍👍👍 ilmankos ei ole Sofiaa näkynyt. Miten tän parin nyt käy, kun viimi ei maksettuna enää virta
      Kotimaiset julkkisjuorut
      133
      1935
    2. Msisa on eronnut

      Mies ei kestänyt jatkuvia syrjähyppyjä eikä totuutta Turun yöstä.
      Kotimaiset julkkisjuorut
      28
      850
    3. Missä sinuun mies voisi

      näin pääsiäisenä vahingossa törmätä? Ei ilmeisesti missään?
      Ikävä
      69
      845
    4. Venäläisiä keksintöjä?

      Kun tässä nyt yritän miettiä venäläisiä keksintöjä, niin ei äkkiseltään tule oikein yhtään mieleen. Onko niitä edes?
      Maailman menoa
      259
      728
    5. Tiedän että on aika luovuttaa

      En vaan osaa. Liian kauan toivonut jotain, mikä ei koskaan tule toteutumaan. Olo ei ole mitenkään hyvä, mutta itken vähemmän kuin silloin kun sinuun r
      Ikävä
      64
      710
    6. Raviskalla tappo?

      Huhuja liikkuu et raviskalla ois joku laitettu kylymäksi?
      Oulainen
      10
      677
    7. Katumuksesta

      Pitkäperjantaina eräässä seurueessa puhuttiin katumisesta ja mitä itse kukin katuu. Yleisintä tuntui olevan pahasti sanominen jollekin läheiselle ja t
      Sinkut
      132
      671
    8. Et arvaa nainen, miten ikävä mulla on sinua.

      Sinua ei voi unohtaa. Pusu sulle musulle!
      Ikävä
      26
      644
    9. Sun mies on mun

      Sinun mies on yksin minun ja sinä et voi sille mitään.
      Ikävä
      77
      642
    10. Sisällissota kiihtyy Ruotsissa

      KaupunkiTaistelut koraanin puolesta kiihtyneet Linköpingissä ja Malmössä. Ruotsin poliisi joutunut vetäytymään suojiin. Päätän raporttini Ruotsista.
      Maailman menoa
      200
      635
    Aihe