Moro!
Joo, elikkäs koneessani on tää ilmeisesti mesen välityksellä leviävä Virkel.A virus (vai oliko se troijalainen)
F-Securen client security 6.0 kyllä löytää sen, mutta ei oikein osaa tehdä sille mitään. Asensin eilen winukan uudestaan, edellisessä asennuksessa se majaili system restoressa, mutta tällä kertaa se on yhdessä D-aseman kansiossa (voiko se olla se SAMA virus, vai tuliko se uudelleen koneelle, kun muijan oli ihan pakko saada se hemmetin messenger taas?)
Joka tapauksessa, tässä olisi HJT-logi... apu tulee kyllä tarpeeseen!
Logfile of HijackThis v1.99.1
Scan saved at 0:00:00, on 19.3.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Jetico\BestCrypt\BCResident.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\F-Secure\BackWeb\7681197\Program\F-Secure Automatic Update.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure\Anti-Virus\fsrw.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\PROGRA~1\F-Secure\ANTI-S~1\fsaw.exe
C:\Program Files\F-Secure\FSGUI\fsguidll.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://haku.soneraplaza.fi/haku/queryie5.jsp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.soneraplaza.fi
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.soneraplaza.fi
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja Sonera Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.dial.inet.fi:800
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;*.*.fi;*.*.*.fi;
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: MRU-Blaster Silent Clean.lnk = C:\Program Files\MRU-Blaster\mrublaster.exe
O4 - Global Startup: BestCrypt Auto Open.lnk = C:\Program Files\Jetico\BestCrypt\BestCrypt.exe
O4 - Global Startup: F-Secure Automatic Update.lnk = C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: &Block this popup - C:\Program Files\F-Secure\Anti-Spyware\blockpopups.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: IE Shield - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: IE Shield... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: hplun.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - F-Secure Automatic Update - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
Joo, elikkäs koneessani on tää ilmeisesti mesen välityksellä leviävä Virkel.A virus (vai oliko se troijalainen)
F-Securen client security 6.0 kyllä löytää sen, mutta ei oikein osaa tehdä sille mitään. Asensin eilen winukan uudestaan, edellisessä asennuksessa se majaili system restoressa, mutta tällä kertaa se on yhdessä D-aseman kansiossa (voiko se olla se SAMA virus, vai tuliko se uudelleen koneelle, kun muijan oli ihan pakko saada se hemmetin messenger taas?)
Joka tapauksessa, tässä olisi HJT-logi... apu tulee kyllä tarpeeseen!
Logfile of HijackThis v1.99.1
Scan saved at 0:00:00, on 19.3.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Jetico\BestCrypt\BCResident.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\F-Secure\BackWeb\7681197\Program\F-Secure Automatic Update.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure\Anti-Virus\fsrw.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\PROGRA~1\F-Secure\ANTI-S~1\fsaw.exe
C:\Program Files\F-Secure\FSGUI\fsguidll.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://haku.soneraplaza.fi/haku/queryie5.jsp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.soneraplaza.fi
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.soneraplaza.fi
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja Sonera Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.dial.inet.fi:800
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;*.*.fi;*.*.*.fi;
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: MRU-Blaster Silent Clean.lnk = C:\Program Files\MRU-Blaster\mrublaster.exe
O4 - Global Startup: BestCrypt Auto Open.lnk = C:\Program Files\Jetico\BestCrypt\BestCrypt.exe
O4 - Global Startup: F-Secure Automatic Update.lnk = C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: &Block this popup - C:\Program Files\F-Secure\Anti-Spyware\blockpopups.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: IE Shield - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: IE Shield... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: hplun.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - F-Secure Automatic Update - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
Vastaukset 19
Vanhimmat
lataa tuosta Escan
http://koti.mbnet.fi/pattaya1/escanmwav.htm
asenna, päivitä tapa2 ja laita täpit merkkauksien mukaan
Kuva
http://koti.mbnet.fi/pattaya1/eScan6.jpg
Scannaa
Tallenna alaikkunasta virukset
Käytä komentoa Ctrl A. Kopioi rivit komennolla Ctrl C.
Avaa WordPad
Liitä rivit komennolla Ctrl V.
Kopioi wordpad:sta tänne jos alaikkunaan jotain tulee.
Jees, scannasin sillä Escanilla koneen, mutta se ei löytänyt mitään.
Eilen, ennenkuin olit vastannut mun viestiin, latasin ewidon ja tein sillä skannauksen... Ewido löysi kaksi troijalaista, ne ei kyllä ollut nimeltään Virkel.A, mutta ne oli samassa kansiossa, missä se virkelkin oli ollut.. Voi olla että Ewido tunnisti ne vaan eri nimisinä (rakkaalla viruksellahan on monta nimeä). Hölmö kun oli, en ottanut ylös niitä nimiä... oiskohan ollut Trojan.aia tai jotain siihen tyyliin.
Mitä mun pitäis seuraavaksi tehdä?
ewidon niin teitkö tämän kun hälyytti
Perform action -> Remove
ja laita ruksi kohtaan: Perform action with all infections
Näin se poistaa kaikki löydöt erikseen kysymättä
Juu, remove kohtaan laitoin rastin... Tosin, se oli siirtänyt ne pöpöt karanteeniin, eikä poistanut niitä automaattisesti.. Poistin ne sit sieltä karanteenista. Siinä oli ne pari troijalaista ja 8 jotain tracking cookieta firefoxiin, mitähän mahtanevat olla.
Aloin just ajamaan uudestaan tarkastusta Ewidolla, ja toistaiseksi se on löytänyt taas jotain tracking cookieita.. Ei troijalaisia ainakaan vielä.. 40% koneesta skannaamatta, eli kerron kohta miten kävi..
ja lähetä tänne
ööh.. hehheh... ehdin jo poistaa kyseiset trackerit:)
Anyway, Ewido ei tällä kertaa löytänyt mitään muuta kuin ne tracker cookiet... Sen sijaan, kesken ewidon skannauksen, f-secure ilmoitti että Trojan.Win32.VB.aia (eli virkel.A) löydetty. Aina kun valitsin "poista", se kyllä poisti sen, mutta välittömästi antoi ilmoituksen uudesta löydöstä... se siis monistaa itseään...
Se on nyt yhdessä D-asemankansiossa, ja nimeää itseään siellä olevien tiedostojen mukaan....
Mene vikasietotilaan ja aja ewido siellä
sammuta ja käynnistä
Käynnistyksen yhteydessä naputtele F8
valitse vikasiettotila paina enter
ja uudelleen enter ja ok
sawe report ja lähetä tänne
Käys ajamassa pandan onlain scannaus käytä siihen ie selainta
http://www.pandasoftware.com/products/activescan.htm
laita tulos siintä tänne
Ja OHHOH.... Vikasietotilassa Ewido löysi vaivaiset 162 troijalaista ja pari niitä tarckin cookieta...
Created on: 13:55:00, 19.3.2006
Report-Checksum: 40A1AD4A
Scan result:
:mozilla.6:C:\Documents and Settings\Juha\Application Data\Mozilla\Firefox\Profiles\alvcbwv7.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup
:mozilla.15:C:\Documents and Settings\Juha\Application Data\Mozilla\Firefox\Profiles\alvcbwv7.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup
D:\Sturmo\Design\colour_charts\USN_COLOR_CHART.JPG.0XE -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\grave digger\1826_Grave_Digger.JPG.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\grave digger\DSCF0034.JPG.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\grave digger\GD20th640.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\iida.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\illu\illu1.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\illu\illu2.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\illu\illu3.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\illu\illufl.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\illu\juutil1.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\illu\Mannerheim_korset.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\illu\Rudel_Blank_Template_Bf-109G-2_v4psd\Bf-109G-2_Template_v4.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Insignia\FIS Liput\liput2.JPG.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Insignia\FIS Liput\liput3.JPG.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Insignia\FIS Liput\liput4.JPG.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\intothebluepubw.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\John-Paul-II.jpg2.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\juha.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\karambit.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\kasi.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\kingcobr.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\kissa.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\KISSA2.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\käsimerkit.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\mac\3f082d60.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\mac\macarms.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\mac\mackinnon-crest.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\mac\tarten.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\micvic1.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\night_at_the_roxbury.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\nimetön.JPG.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Noseart\16566-NaughtyNoseArt\call_girl.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Noseart\CA7RHZPE.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Noseart\CAK9WZAZ.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Noseart\CAKB61CZ.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Noseart\CAO1QR0H.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Noseart\CAQBTGS9.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Noseart\fartingelk2_24.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Noseart\greendragon_small1.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Noseart\images.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Noseart\images1.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Noseart\images2.JPG.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Noseart\images2g.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Noseart\images3.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Noseart\images4.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Noseart\leprechan.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Noseart\lohari.JPG.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Noseart\Noseart\Noseart Vargas Cards.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Noseart\Noseart\VargasNartDiamonds.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Noseart\Noseart\VargasNartHearts.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Noseart\Noseart\VargasNartSpades.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Noseart\Untitled2.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Noseart\Untitled3.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Noseart\Untitled4.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\p-51\51.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\p-51\screenshot51.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pics\12-12uns.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pics\2402268.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pics\airplanesanta.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pics\brew.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pics\clown-arrest.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pics\dangerous_dog.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pics\day1.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pics\drugcats.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pics\drunksanta.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pics\FALCON.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pics\fartingelk2_24.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pics\ffgallensinterklaas.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pics\FunnyPart.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pics\governor8.JPG.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pics\homer_beer.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pics\Killasheep1.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pics\Killasheep2.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pics\kissa.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pics\kissa2.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pics\MarsBig.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pics\pic11323.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pics\pioneeri.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pics\rokka.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pics\rowley_640.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pics\santadead.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pics\sapper.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pics\Sapper2.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pics\spit.JPG.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pics\spit1024.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pics\SS00000.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pics\SS00001.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pics\SS00002.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pics\SS00003.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pics\SS00004 copy.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pics\SS00004.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pics\SS00005.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pics\SS00006.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pics\SS00007.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pics\suityou_640.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pics\tali2.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pics\uploaded\carpenoctu\Sapper.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pics\Wallpapers\16250-Luftwaffereplacementbackgrounds\background pack - Luftwaffe\back (10).jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pics\Wallpapers\16269-replacementbackgrounds-USAAFETO\background pack - USAAF ETO\back (11).jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\pingit.JPG.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\projektit\Preddy2\51003a.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\projektit\Preddy2\CAM 3rd-2.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\projektit\Preddy2\ce32-1.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\projektit\Preddy2\cripes.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\projektit\Preddy2\CripesAMightyLAST.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\projektit\Preddy2\fullhouse_wallpaper.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\projektit\Preddy2\George2000.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\projektit\Preddy2\GEP6down.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\projektit\Preddy2\GEP6downzn.JPG.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\projektit\Preddy2\gmp51003.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\projektit\Preddy2\grab0001.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\projektit\Preddy2\p51dprof2.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\projektit\Preddy2\p51dprof22.JPG.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\projektit\Preddy2\preddy.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\projektit\Preddy2\Preddy34.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\projektit\Preddy2\preddykuva.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\projektit\Preddy2\Preddypreview.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\projektit\Preddy2\preddypreview1.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\projektit\Preddy2\preddypreview2.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\projektit\Preddy2\preddypreview3.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\projektit\Preddy2\preddy_hard_cover.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\projektit\Preddy2\Untitled-1 copy.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\projektit\Preddy2\zoom_51003.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\rowley_640.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\russianp63.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\sakara_muki.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\skinit\10685-FiatG50LeLv261943\fiatg50_lelv26_neuro.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\skinit\12528-HotRod\Bf109k4_JG28HGGord_hotrod.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\skinit\14584-BillGruber362ndFS357thFG\CooterSSLR.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\skinit\16446-LtJames“SunnyJim”HalfordVF-17\Halford_HR.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\skotti.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\SM65_iso.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\snuffly.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\so_close.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\ss48783b.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\ss48784b.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\suityou_640.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\swat4-15.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\swiss_640.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\tallyHO.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\tallyho2.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\tapetti.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Template\15628-BeaufighterMk21Template\Beaufighter Template\Beaufighter Template.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Template\6476-Ki84IaTemplateK1b\Ki84_1.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Template\6476-Ki84IaTemplateK1b\Ki84_2.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Template\6476-Ki84IaTemplateK1b\Ki84_3.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Template\6476-Ki84IaTemplateK1b\Ki84_4.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Template\fiudeprojekti\fa27.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Template\fiudeprojekti\fa33.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Template\fiudeprojekti\g50finnish2.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Template\fiudeprojekti\tuominen.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Template\fiudeprojekti\tuominen1.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Template\fiudeprojekti\tuominen12.JPG.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Template\mustang\Untitled11.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Template\mustang\Untitled2.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Template\templatestuka\cleaver87ga.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Template\templatestuka\cleaver87gb.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Template\templatestuka\cleaver87gc.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Template\templatestuka\cleaver87gd.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Template\templatestuka\cleaver87ge.jpg.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\Template\templatestuka\ju87_profil_winter.JPG.exe -> Trojan.VB.aia : Cleaned with backup
D:\Sturmo\testi.jpg.exe -> Trojan.VB.aia : Cleaned with backup
::Report End
Ja niinku näkyy, Ewido myös ilmoitti poistaneensa ne... Tota d-asemaa mä käytän lähinnä tietojen varastoimiseen, Winukka on C:llä....
Miten se ei windowsin ollessa "normaalisti" päällä, noita löytänyt?
Meen nyt ajamaan sen pandan skannauksen...
Ja tässä olis raportti:
Incident Status Location
Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\Juha\Application Data\Mozilla\Firefox\Profiles\alvcbwv7.default\cookies.txt[.tradedoubler.com/]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Juha\Application Data\Mozilla\Firefox\Profiles\alvcbwv7.default\cookies.txt[.doubleclick.net/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Juha\Application Data\Mozilla\Firefox\Profiles\alvcbwv7.default\cookies.txt[.advertising.com/]
Spyware:Cookie/Tradedoubler
Elikkäs valitsin sieltä eri vaihtoehdoista "my computer"
Asiasta kukkaruukkuun, F-securen palomuuri ilmoittaa aina välillä että "program.exe" yrittää päästä nettiin... Luulisin että se liittyy johonkin spywareen tai muihin örkkeihin... Jos se olis joku oikea ohjelma, niin se tuskin olis nimetty "program.exe"...
Lataa tuosta CCleaner
http://www.ccleaner.com/downloadbuilds.asp
tuolta löydät asennus ohjeen
http://koti.mbnet.fi/pattaya1/muut_ilmaisohjelmat.htm
aja puhdistaja ja virheet
Ok, CCleaner ajettu..
Ajoin puhdistajan ja sen rekisterivirheiden hakujutskan ja puhdistin/korjasin ongelmat..
Mitäs ohjelmaa sit käytetään?:)
mikä pyrkii sinne nettiin niin tarkista se mikä se on
Jos en väärin muista f-securea niin lisätiedoista löytyy. Mikä on pyrkimässä.
Katoin sieltä palomuuriasetusten sovelluksien hallinnasta, ja kyseisellä ohjelmalla ei ollut minkäänlaisia lisätietoja...
Hetkinen, taas tuli palomuuri-ilmoitus, ja nyt kun tarkemmin katoin, kyseisen ohjelman sijainniksi on määritelty pelkästään "C:", mutta IP-osoite mihin se yrittää ottaa yhetyttä on aika mielenkiintonen:
85.10.237.9 (update.ewido.net)
Eli onko toi nyt vaan ewido joka yrittää päivittää itseään? Miksiköhän ne ei ole sitä yhtään fiksummin nimenneet?
Äsken ajoin Ewidon uudestaan kun kone oli vikasietotilassa, eikä mitään muuta löytynyt kuin niitä mozillan tracking cookieita... Voidaanko tästä nyt päätellä että kone on puhdas kyseisestä troijalaisesta?
uusi hjt-loki
Jeps, tässä tulee:
Logfile of HijackThis v1.99.1
Scan saved at 17:57:41, on 19.3.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure\Anti-Virus\fsrw.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\PROGRA~1\F-Secure\ANTI-S~1\fsaw.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\F-Secure\FSGUI\fsguidll.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
C:\Program Files\Jetico\BestCrypt\BCResident.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://haku.soneraplaza.fi/haku/queryie5.jsp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.soneraplaza.fi
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.soneraplaza.fi
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja Sonera Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.dial.inet.fi:800
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;*.*.fi;*.*.*.fi;
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - Startup: MRU-Blaster Silent Clean.lnk = C:\Program Files\MRU-Blaster\mrublaster.exe
O4 - Global Startup: BestCrypt Auto Open.lnk = C:\Program Files\Jetico\BestCrypt\BestCrypt.exe
O4 - Global Startup: F-Secure Automatic Update.lnk = C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: &Block this popup - C:\Program Files\F-Secure\Anti-Spyware\blockpopups.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: IE Shield - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: IE Shield... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: hplun.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - F-Secure Automatic Update - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
Loki on puhas
Jos, F-secure rupee nikotteleen tuosta ewido guard iso E oikeasa-alakulmassa niin poistase käytöstä. Se poistuukin 14vrk:n kuluttua
Ewido yrittää päivittää itseään sen takia se siellä f-secure kyselee lupaa.
Siis se ikävä ökkömönkiäinen on nyt poistunut koneelta?? Tuhannet kiitokset avusta!!
Se on oikeesti hienoa, että joku jaksaa avustaa tälläsissäkin asioissa, koska aikaahan tämmönen vie...
Mo, tässä kun tuota aikaa on ei siviili kiireet vielä paina:)
Siellä Ewido hoiteli vikasiedossa pöpöjä pois escan voisi myös tehdä hyvää siellä ajettuna.