Joo. Kone on ollut vähän epävakaana ja tasaisin väliajoin spywareguard ilmoittaa kotisivunkaappauksista, enkä ole mitään ohjelmaa käyttämällä saanut sitä loppumaan. Eli jotain örkkei tossa varmasti on:
Logfile of HijackThis v1.99.1
Scan saved at 16:12:23, on 5.12.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\spool32.exe
C:\Program Files\mrtr\otss.exe
D:\Ohjelmat\Acrobat Reader\Reader\reader_sl.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\GetRight\getright.exe
C:\Program Files\GetRight\getright.exe
E:\HP\Digital Imaging\bin\hpohmr08.exe
E:\HP\Digital Imaging\bin\hpotdd01.exe
E:\SPYWARE\SpywareGuard\SpywareGuard\sgmain.exe
E:\SPYWARE\SpywareGuard\SpywareGuard\sgbhp.exe
E:\HP\Digital Imaging\bin\hpoevm08.exe
E:\HP\Digital Imaging\Bin\hpoSTS08.exe
E:\SPYWARE\HijackThis\HijackThis.exe
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - Toimittaja Elisa Internet
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Ohjelmat\Acrobat Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {20060989-A50F-98F2-6571-9F02C0D2D5AC} - (no file)
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: (no name) - {80BACED0-6F07-0CF6-6957-587E77C271A1} - (no file)
O2 - BHO: (no name) - {C913CF2D-6EF6-0F58-954B-5CDEDD146AF0} - (no file)
O2 - BHO: (no name) - {D35443B5-B069-8498-55D2-85B3CB547DA6} - (no file)
O2 - BHO: (no name) - {E67973B5-9D5A-B1AC-78E2-B59EFB645096} - (no file)
O2 - BHO: (no name) - {F2E72C0A-8E83-EF7B-B539-EEE52EBD06A6} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKCU\..\Run: [Ycdvsm] C:\WINDOWS\System32\spool32.exe
O4 - HKCU\..\Run: [Bcae] "C:\Program Files\mrtr\otss.exe" -vt rbnd
O4 - Startup: SpywareGuard.lnk = E:\SPYWARE\SpywareGuard\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Ohjelmat\Acrobat Reader\Reader\reader_sl.exe
O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
O15 - Trusted IP range: 206.161.125.149
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - http://www.stopzilla.com/_download/Auto_Installer/dwnldr.cab
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
Logfile of HijackThis v1.99.1
Scan saved at 16:12:23, on 5.12.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\spool32.exe
C:\Program Files\mrtr\otss.exe
D:\Ohjelmat\Acrobat Reader\Reader\reader_sl.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\GetRight\getright.exe
C:\Program Files\GetRight\getright.exe
E:\HP\Digital Imaging\bin\hpohmr08.exe
E:\HP\Digital Imaging\bin\hpotdd01.exe
E:\SPYWARE\SpywareGuard\SpywareGuard\sgmain.exe
E:\SPYWARE\SpywareGuard\SpywareGuard\sgbhp.exe
E:\HP\Digital Imaging\bin\hpoevm08.exe
E:\HP\Digital Imaging\Bin\hpoSTS08.exe
E:\SPYWARE\HijackThis\HijackThis.exe
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - Toimittaja Elisa Internet
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Ohjelmat\Acrobat Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {20060989-A50F-98F2-6571-9F02C0D2D5AC} - (no file)
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: (no name) - {80BACED0-6F07-0CF6-6957-587E77C271A1} - (no file)
O2 - BHO: (no name) - {C913CF2D-6EF6-0F58-954B-5CDEDD146AF0} - (no file)
O2 - BHO: (no name) - {D35443B5-B069-8498-55D2-85B3CB547DA6} - (no file)
O2 - BHO: (no name) - {E67973B5-9D5A-B1AC-78E2-B59EFB645096} - (no file)
O2 - BHO: (no name) - {F2E72C0A-8E83-EF7B-B539-EEE52EBD06A6} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKCU\..\Run: [Ycdvsm] C:\WINDOWS\System32\spool32.exe
O4 - HKCU\..\Run: [Bcae] "C:\Program Files\mrtr\otss.exe" -vt rbnd
O4 - Startup: SpywareGuard.lnk = E:\SPYWARE\SpywareGuard\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Ohjelmat\Acrobat Reader\Reader\reader_sl.exe
O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
O15 - Trusted IP range: 206.161.125.149
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - http://www.stopzilla.com/_download/Auto_Installer/dwnldr.cab
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
Vastaukset 11
Vanhimmat
Scannaa nuo yksitellen tuolla ja ilmoita tulokset
C:\WINDOWS\System32\spool32.exe
C:\Program Files\mrtr\otss.exe
http://virusscan.jotti.org/
jos löytyy usiampi spool32.exe ,niin scannaa ne kaikki
Tein tuon ja spool32:sta ei löytynyt mitään, mutta tuosta toisesta kylläkin:
Kaspersky Anti-Virus
Found Trojan-Downloader.Win32.PurityScan.ax
NOD32
Found probably a variant of Win32/Adware.MediaTickets application (probable variant)
VBA32
Found Backdoor.Rbot.2 (probable variant)
Eiku perkele, menin kämmäileen jotain; kyllä löytyi:
C:\WINDOWS\System32\spool32.exe:
AntiVir
Found nothing
ArcaVir
Found nothing
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found nothing
ClamAV
Found nothing
Dr.Web
Found Adware.ValueAd
F-Prot Antivirus
Found nothing
Fortinet
Found nothing
Kaspersky Anti-Virus
Found not-a-virus:AdWare.Win32.PurityScan.dd
NOD32
Found a variant of Win32/Adware.MediaTickets application
Norman Virus Control
Found W32/PurityScan.IR
UNA
Found nothing
VBA32
Found Malware.Agent.17 (probable variant)
C:\Program Files\mrtr\otss.exe:
AntiVir
Found nothing
ArcaVir
Found nothing
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found nothing
ClamAV
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found nothing
Fortinet
Found W32/PurityScan.AX-dldr
Kaspersky Anti-Virus
Found Trojan-Downloader.Win32.PurityScan.ax
NOD32
Found probably a variant of Win32/Adware.MediaTickets application (probable variant)
Norman Virus Control
Found nothing
UNA
Found nothing
VBA32
Found Backdoor.Rbot.2 (probable variant)
Merkkaa nuo sulje selain ja paina Fix checked
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: (no name) - {20060989-A50F-98F2-6571-9F02C0D2D5AC} - (no file)
O2 - BHO: (no name) - {80BACED0-6F07-0CF6-6957-587E77C271A1} - (no file)
O2 - BHO: (no name) - {C913CF2D-6EF6-0F58-954B-5CDEDD146AF0} - (no file)
O2 - BHO: (no name) - {D35443B5-B069-8498-55D2-85B3CB547DA6} - (no file)
O2 - BHO: (no name) - {E67973B5-9D5A-B1AC-78E2-B59EFB645096} - (no file)
O2 - BHO: (no name) - {F2E72C0A-8E83-EF7B-B539-EEE52EBD06A6} - (no file)
O4 - HKCU\..\Run: [Bcae] "C:\Program Files\mrtr\otss.exe" -vt rbnd
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - http://www.stopzilla.com/_download/Auto_Installer/dwnldr.cab
jos tuo on ite määritelty,niin anna olla muuten merkkaa se myös
O15 - Trusted IP range: 206.161.125.149
Sitte poista vikasietotilassa piilotiedostot näkyvillä
C:\Program Files\mrtr\otss.exe <
- tai koko tuo mrtr kansio jos siellä ei oo mitään järkevää
Käynnistä normaalisti ja us logi
sitte siellä vikasietotilassa samalla tuo
C:\WINDOWS\System32\spool32.exe
mutta poista se oikee jos niitä on usiampi.
Voi kettu, kun ei tuolta system32:sta löydy mitään spool32.exe:ä, vaikka laitoin piilotetutkin tiedostot näkyviin. Haullakin koitin ja löyty tommonen kuin SPOOL32.EXE-285C9F2E.pf, C:\WINDOWS\Prefetch-kansiosta.
Pistä uus logi jos ne aikasemmat on jo tehty.
Logfile of HijackThis v1.99.1
Scan saved at 19:30:53, on 5.12.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\GetRight\getright.exe
E:\HP\Digital Imaging\bin\hpohmr08.exe
E:\HP\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\GetRight\getright.exe
E:\SPYWARE\SpywareGuard\SpywareGuard\sgmain.exe
E:\HP\Digital Imaging\bin\hpoevm08.exe
E:\SPYWARE\SpywareGuard\SpywareGuard\sgbhp.exe
E:\HP\Digital Imaging\Bin\hpoSTS08.exe
E:\Mozilla Firefox\firefox.exe
E:\SPYWARE\HijackThis\HijackThis.exe
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - Toimittaja Elisa Internet
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Ohjelmat\Acrobat Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - Startup: SpywareGuard.lnk = E:\SPYWARE\SpywareGuard\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Ohjelmat\Acrobat Reader\Reader\reader_sl.exe
O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
O17 - HKLM\System\CCS\Services\Tcpip\..\{446E0A4D-77E6-45E8-96B0-B36DD1A22087}: NameServer = 193.229.0.42 193.229.0.40
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
Jos nuo on ite määritelty niin anna olla,muuten merkkaa ja Fix:saa ne
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
Voit myös varalta scannata tolla kone
http://koti.mbnet.fi/pattaya1/escanmwav.htm
Joo-o, kiitoksia avusta.
voit tyhjentää huoleti.