Rekisteröidy

Ilmoitukset

Ladataan…

    Näytä kaikki

    nyt on ongelmia

    Logfile of HijackThis v1.99.1
    Scan saved at 12:47:25, on 22.3.2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\ewido anti-malware\ewidoctrl.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
    c:\progra~1\intern~1\iexplore.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\SMC\SMC2635W Wireless Cardbus Adapter Utility\drivers\WINXP\SMCRMonitor.exe
    C:\Program Files\Morpheus\Morpheus.exe
    C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
    C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
    C:\WINDOWS\system32\rundll32.exe
    C:\hjt\HijackThis.exe

    F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
    O4 - HKCU\..\Run: [Mags sign] C:\DOCUME~1\KRISTO~1\APPLIC~1\JUGSSI~1\logload.exe
    O4 - Startup: Morpheus.lnk = C:\Program Files\Morpheus\Morpheus.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: SMC2635W Wireless Cardbus Adapter Utility.lnk = C:\Program Files\SMC\SMC2635W Wireless Cardbus Adapter Utility\drivers\WINXP\SMCRMonitor.exe
    O8 - Extra context menu item: Lähetä &Bluetooth-laitteeseen - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\btsendto_ie_ctx.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
    O9 - Extra button: ShopperReports - Compare travel rates - {946B3E9E-E21A-49c8-9F63-900533FAFE14} - C:\Program Files\ShopperReports\Bin\1.1.0.0\ShprRprt.dll (file missing)
    O9 - Extra button: ShopperReports - Compare product prices - {946B3E9E-E21A-49c8-9F63-900533FAFE15} - C:\Program Files\ShopperReports\Bin\1.1.0.0\ShprRprt.dll (file missing)
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\btsendto_ie.htm (file missing)
    O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\btsendto_ie.htm (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
    O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
    O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O20 - Winlogon Notify: App Management - C:\WINDOWS\system32\ir66l5js1.dll
    O23 - Service: Bluetooth Service (btwdins) - Unknown owner - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\bin\btwdins.exe (file missing)
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    7481
    Äänestä

    Muut lukivat myös

    Vastaukset 7

    Vanhimmat

    Missä ovat virustorjunta ja palomuuri?

    Hanki sellaiset ensi tilassa

    Poista ohjauspaneelista (lisää/poista sovellus), jos on:

    ShopperReports

    Fixaa HjT:llä (do a system scan only, merkkaa ja paina fix checked):

    O4 - HKCU\..\Run: [Mags sign] C:\DOCUME~1\KRISTO~1\APPLIC~1\JUGSSI~1\logload.exe
    O9 - Extra button: ShopperReports - Compare travel rates - {946B3E9E-E21A-49c8-9F63-900533FAFE14} - C:\Program Files\ShopperReports\Bin\1.1.0.0\ShprRprt.dll (file missing)
    O9 - Extra button: ShopperReports - Compare product prices - {946B3E9E-E21A-49c8-9F63-900533FAFE15} - C:\Program Files\ShopperReports\Bin\1.1.0.0\ShprRprt.dll (file missing)
    O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)

    Sitten käynnistä -> suorita -> services.msc

    Etsi listalta Network Monitor, tuplaklikkaa, paina seis ja valitse käynnistymistavaksi ei käytössä

    Avaa hjt -> open misc tools -> delete nt service
    Syötä Network Monitor ja klikkaa ok

    Hae findlop ->

    http://metallica.geekstogo.com/findlop.zip

    Pura ja tuplaklikkaa findlop.bat
    Logi löytyy tuolta C:\findlop.txt

    Poista, jos löytyy:

    C:\DOCUME~1\KRISTO~1\APPLIC~1\JUGSSI~1
    C:\Program Files\ShopperReports
    C:\Program Files\Network Monitor\

    Lataa Look2Me-Destroyer http://www.atribune.org/ccount/click.php?id=7 työpöydällesi.[list]
    [*]Sulje kaikki ikkunat ennen jatkamista.
    [*]Tuplaklikkaa Look2Me-Destroyer.exeajaaksesi ohjelman.
    [*]Rastita Run this program as a task.
    [*]Saat viestin joka sanoo; "Look2Me-Destroyer will close and re-open in approximately 10 seconds". Klikkaa OK
    [*]Kun Look2Me-Destroyer uudelleen avautuu, klikkaa Scan for L2M-valintaa, työpöytäsi pikakuvakkeet katoavat hetkeksi, tämä on normaalia.
    [*]Kun skannaus on valmis, klikkaa Remove L2M-valintaa.
    [*]Saat Done Scanning viestin, klikkaa OK].
    [*]Kun valmis, saat tämän viestin: Done removing infected files! Look2Me-Destroyer will now shutdown your computer, klikkaa OK.
    [*]Tietokoneesi sammuttaa itsensä.
    [*]Käynnistä koneesi uudelleen.
    [*]Postita C:\Look2Me-Destroyer.txt-tiedoston sisältö uuden HijackThis login kera postiisi.
    Jos palomuurisi varoittaa nettiyhteyksistä tähän ohjelmaan - salli ne.

    Jos saat runtime error '339', lataa MSWINSCK.OCX seuraavasta linkistä ja sijoita se C:\Windows\System32 kansioosi.

    http://www.ascentive.com/support/new/images/lib/MSWINSCK.OCX

    Koeta uudelleen.

    Lähetä uusi HjT-loki, c:\findlop.txt-tiedoston sisältö ja C:\Look2Me-Destroyer.txt-tiedoston sisältö

    Äänestä

    • ogfile of HijackThis v1.99.1
      Scan saved at 13:35:34, on 22.3.2006
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\ewido anti-malware\ewidoctrl.exe
      C:\WINDOWS\System32\nvsvc32.exe
      C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Skype\Phone\Skype.exe
      C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
      C:\WINDOWS\system32\rundll32.exe
      C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      C:\Program Files\SMC\SMC2635W Wireless Cardbus Adapter Utility\drivers\WINXP\SMCRMonitor.exe
      C:\Program Files\Morpheus\Morpheus.exe
      C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
      C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
      C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
      C:\WINDOWS\system32\wuauclt.exe
      C:\hjt\HijackThis.exe

      F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
      O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
      O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
      O4 - Startup: Morpheus.lnk = C:\Program Files\Morpheus\Morpheus.exe
      O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
      O4 - Global Startup: SMC2635W Wireless Cardbus Adapter Utility.lnk = C:\Program Files\SMC\SMC2635W Wireless Cardbus Adapter Utility\drivers\WINXP\SMCRMonitor.exe
      O8 - Extra context menu item: Lähetä &Bluetooth-laitteeseen - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\btsendto_ie_ctx.htm
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
      O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
      O9 - Extra button: ShopperReports - Compare travel rates - {946B3E9E-E21A-49c8-9F63-900533FAFE14} - C:\Program Files\ShopperReports\Bin\1.1.0.0\ShprRprt.dll (file missing)
      O9 - Extra button: ShopperReports - Compare product prices - {946B3E9E-E21A-49c8-9F63-900533FAFE15} - C:\Program Files\ShopperReports\Bin\1.1.0.0\ShprRprt.dll (file missing)
      O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\btsendto_ie.htm (file missing)
      O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\btsendto_ie.htm (file missing)
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
      O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
      O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
      O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
      O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
      O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
      O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
      O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
      O23 - Service: Bluetooth Service (btwdins) - Unknown owner - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\bin\btwdins.exe (file missing)
      O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
      O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
      O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exeLook2Me-Destroyer V1.0.11

      Scanning for infected files.....
      Scan started at 22.3.2006 13:28:15

      Infected! C:\WINDOWS\system32\j66m0gj1e6o.dll
      Infected! C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0106649.dll
      Infected! C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107696.dll
      Infected! C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107698.dll
      Infected! C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107702.dll
      Infected! C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107740.dll
      Infected! C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107944.dll
      Infected! C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107949.dll
      Infected! C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107957.dll
      Infected! C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107970.dll
      Infected! C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107971.dll
      Infected! C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107981.dll
      Infected! C:\WINDOWS\system32\fp0003dme.dll
      Infected! C:\WINDOWS\system32\ipdkcs32.dll
      Infected! C:\WINDOWS\system32\j66m0gj1e6o.dll
      Infected! C:\WINDOWS\system32\k680lglm16qa.dll
      Infected! C:\WINDOWS\system32\mdxclu.dll
      Infected! C:\WINDOWS\system32\guard.tmp

      Attempting to delete infected files...

      Attempting to delete: C:\WINDOWS\system32\j66m0gj1e6o.dll
      C:\WINDOWS\system32\j66m0gj1e6o.dll Deleted successfully!

      Attempting to delete: C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0106649.dll
      C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0106649.dll Deleted successfully!

      Attempting to delete: C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107696.dll
      C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107696.dll Deleted successfully!

      Attempting to delete: C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107698.dll
      C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107698.dll Deleted successfully!

      Attempting to delete: C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107702.dll
      C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107702.dll Deleted successfully!

      Attempting to delete: C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107740.dll
      C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107740.dll Deleted successfully!

      Attempting to delete: C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107944.dll
      C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107944.dll Deleted successfully!

      Attempting to delete: C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107949.dll
      C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107949.dll Deleted successfully!

      Attempting to delete: C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107957.dll
      C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107957.dll Deleted successfully!

      Attempting to delete: C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107970.dll
      C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107970.dll Deleted successfully!

      Attempting to delete: C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107971.dll
      C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107971.dll Deleted successfully!

      Attempting to delete: C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107981.dll
      C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107981.dll Deleted successfully!

      Attempting to delete: C:\WINDOWS\system32\fp0003dme.dll
      C:\WINDOWS\system32\fp0003dme.dll Deleted successfully!

      Attempting to delete: C:\WINDOWS\system32\ipdkcs32.dll
      C:\WINDOWS\system32\ipdkcs32.dll Deleted successfully!

      Attempting to delete: C:\WINDOWS\system32\j66m0gj1e6o.dll
      C:\WINDOWS\system32\j66m0gj1e6o.dll Deleted successfully!

      Attempting to delete: C:\WINDOWS\system32\k680lglm16qa.dll
      C:\WINDOWS\system32\k680lglm16qa.dll Deleted successfully!

      Attempting to delete: C:\WINDOWS\system32\mdxclu.dll
      C:\WINDOWS\system32\mdxclu.dll Deleted successfully!

      Attempting to delete: C:\WINDOWS\system32\guard.tmp
      C:\WINDOWS\system32\guard.tmp Deleted successfully!

      Making registry repairs.

      Removing: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Unimodem

      Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{15C35CFC-BEF9-442E-9797-C0588F00C68E}"
      HKCR\Clsid\{15C35CFC-BEF9-442E-9797-C0588F00C68E}

      Restoring Windows certificates.

      Replaced hosts file with default windows hosts file


      Restoring SeDebugPrivilege for Järjestelmänvalvojat - Succeeded

      Äänestä

    • samurai80 kirjoitti:

      ogfile of HijackThis v1.99.1
      Scan saved at 13:35:34, on 22.3.2006
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\ewido anti-malware\ewidoctrl.exe
      C:\WINDOWS\System32\nvsvc32.exe
      C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Skype\Phone\Skype.exe
      C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
      C:\WINDOWS\system32\rundll32.exe
      C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      C:\Program Files\SMC\SMC2635W Wireless Cardbus Adapter Utility\drivers\WINXP\SMCRMonitor.exe
      C:\Program Files\Morpheus\Morpheus.exe
      C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
      C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
      C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
      C:\WINDOWS\system32\wuauclt.exe
      C:\hjt\HijackThis.exe

      F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
      O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
      O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
      O4 - Startup: Morpheus.lnk = C:\Program Files\Morpheus\Morpheus.exe
      O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
      O4 - Global Startup: SMC2635W Wireless Cardbus Adapter Utility.lnk = C:\Program Files\SMC\SMC2635W Wireless Cardbus Adapter Utility\drivers\WINXP\SMCRMonitor.exe
      O8 - Extra context menu item: Lähetä &Bluetooth-laitteeseen - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\btsendto_ie_ctx.htm
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
      O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
      O9 - Extra button: ShopperReports - Compare travel rates - {946B3E9E-E21A-49c8-9F63-900533FAFE14} - C:\Program Files\ShopperReports\Bin\1.1.0.0\ShprRprt.dll (file missing)
      O9 - Extra button: ShopperReports - Compare product prices - {946B3E9E-E21A-49c8-9F63-900533FAFE15} - C:\Program Files\ShopperReports\Bin\1.1.0.0\ShprRprt.dll (file missing)
      O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\btsendto_ie.htm (file missing)
      O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\btsendto_ie.htm (file missing)
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
      O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
      O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
      O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
      O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
      O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
      O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
      O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
      O23 - Service: Bluetooth Service (btwdins) - Unknown owner - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\bin\btwdins.exe (file missing)
      O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
      O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
      O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exeLook2Me-Destroyer V1.0.11

      Scanning for infected files.....
      Scan started at 22.3.2006 13:28:15

      Infected! C:\WINDOWS\system32\j66m0gj1e6o.dll
      Infected! C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0106649.dll
      Infected! C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107696.dll
      Infected! C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107698.dll
      Infected! C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107702.dll
      Infected! C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107740.dll
      Infected! C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107944.dll
      Infected! C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107949.dll
      Infected! C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107957.dll
      Infected! C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107970.dll
      Infected! C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107971.dll
      Infected! C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107981.dll
      Infected! C:\WINDOWS\system32\fp0003dme.dll
      Infected! C:\WINDOWS\system32\ipdkcs32.dll
      Infected! C:\WINDOWS\system32\j66m0gj1e6o.dll
      Infected! C:\WINDOWS\system32\k680lglm16qa.dll
      Infected! C:\WINDOWS\system32\mdxclu.dll
      Infected! C:\WINDOWS\system32\guard.tmp

      Attempting to delete infected files...

      Attempting to delete: C:\WINDOWS\system32\j66m0gj1e6o.dll
      C:\WINDOWS\system32\j66m0gj1e6o.dll Deleted successfully!

      Attempting to delete: C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0106649.dll
      C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0106649.dll Deleted successfully!

      Attempting to delete: C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107696.dll
      C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107696.dll Deleted successfully!

      Attempting to delete: C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107698.dll
      C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107698.dll Deleted successfully!

      Attempting to delete: C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107702.dll
      C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107702.dll Deleted successfully!

      Attempting to delete: C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107740.dll
      C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107740.dll Deleted successfully!

      Attempting to delete: C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107944.dll
      C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107944.dll Deleted successfully!

      Attempting to delete: C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107949.dll
      C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107949.dll Deleted successfully!

      Attempting to delete: C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107957.dll
      C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107957.dll Deleted successfully!

      Attempting to delete: C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107970.dll
      C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107970.dll Deleted successfully!

      Attempting to delete: C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107971.dll
      C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107971.dll Deleted successfully!

      Attempting to delete: C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107981.dll
      C:\System Volume Information\_restore{F8E8F132-53A0-4818-A3C7-29B1BA71A747}\RP308\A0107981.dll Deleted successfully!

      Attempting to delete: C:\WINDOWS\system32\fp0003dme.dll
      C:\WINDOWS\system32\fp0003dme.dll Deleted successfully!

      Attempting to delete: C:\WINDOWS\system32\ipdkcs32.dll
      C:\WINDOWS\system32\ipdkcs32.dll Deleted successfully!

      Attempting to delete: C:\WINDOWS\system32\j66m0gj1e6o.dll
      C:\WINDOWS\system32\j66m0gj1e6o.dll Deleted successfully!

      Attempting to delete: C:\WINDOWS\system32\k680lglm16qa.dll
      C:\WINDOWS\system32\k680lglm16qa.dll Deleted successfully!

      Attempting to delete: C:\WINDOWS\system32\mdxclu.dll
      C:\WINDOWS\system32\mdxclu.dll Deleted successfully!

      Attempting to delete: C:\WINDOWS\system32\guard.tmp
      C:\WINDOWS\system32\guard.tmp Deleted successfully!

      Making registry repairs.

      Removing: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Unimodem

      Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{15C35CFC-BEF9-442E-9797-C0588F00C68E}"
      HKCR\Clsid\{15C35CFC-BEF9-442E-9797-C0588F00C68E}

      Restoring Windows certificates.

      Replaced hosts file with default windows hosts file


      Restoring SeDebugPrivilege for Järjestelmänvalvojat - Succeeded

      Ota ensin rekisteristä näin varmuuskopio:

      Suorita -> regedit -> ok. Sitten Tiedosto -> Vie. Kirjoita sille joku nimi ja sitten Tallenna(ja laita muistiin, mihin tallensit sen).

      Sitten mene regeditissä tänne -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions

      Etsi sieltä avain (eli näyttää siis hakemistolta), jossa lukee
      {946B3E9E-E21A-49c8-9F63-900533FAFE15}

      Klikkaa sitä hiiren oikealla ja valitse Poista. Vastaa kyllä, jos regedit kysyy, haluatko poistaa sen.

      Tee sama tälle ->

      {946B3E9E-E21A-49c8-9F63-900533FAFE14}

      Käynnistä kone uudelleen ja lähetä uusi HjT-loki ja c:\findlop.txt-sisältö.

      Äänestä

    • Fixaaja kirjoitti:

      Ota ensin rekisteristä näin varmuuskopio:

      Suorita -> regedit -> ok. Sitten Tiedosto -> Vie. Kirjoita sille joku nimi ja sitten Tallenna(ja laita muistiin, mihin tallensit sen).

      Sitten mene regeditissä tänne -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions

      Etsi sieltä avain (eli näyttää siis hakemistolta), jossa lukee
      {946B3E9E-E21A-49c8-9F63-900533FAFE15}

      Klikkaa sitä hiiren oikealla ja valitse Poista. Vastaa kyllä, jos regedit kysyy, haluatko poistaa sen.

      Tee sama tälle ->

      {946B3E9E-E21A-49c8-9F63-900533FAFE14}

      Käynnistä kone uudelleen ja lähetä uusi HjT-loki ja c:\findlop.txt-sisältö.

      ei toimi regedit..herjaa että ei ole kelvollinen win32 sovellus

      Äänestä

    • samurai80 kirjoitti:

      ei toimi regedit..herjaa että ei ole kelvollinen win32 sovellus

      Löytyykö kuitenkin regedit.exe koneelta?

      Äänestä

    • Fixaaja kirjoitti:

      Löytyykö kuitenkin regedit.exe koneelta?

      Logfile of HijackThis v1.99.1
      Scan saved at 13:57:56, on 22.3.2006
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\ewido anti-malware\ewidoctrl.exe
      C:\WINDOWS\System32\nvsvc32.exe
      C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Skype\Phone\Skype.exe
      C:\WINDOWS\system32\rundll32.exe
      C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
      C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      C:\Program Files\SMC\SMC2635W Wireless Cardbus Adapter Utility\drivers\WINXP\SMCRMonitor.exe
      C:\Program Files\Morpheus\Morpheus.exe
      C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
      C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
      C:\WINDOWS\system32\wuauclt.exe
      C:\WINDOWS\system32\notepad.exe
      C:\hjt\HijackThis.exe

      F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
      O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
      O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
      O4 - Startup: Morpheus.lnk = C:\Program Files\Morpheus\Morpheus.exe
      O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
      O4 - Global Startup: SMC2635W Wireless Cardbus Adapter Utility.lnk = C:\Program Files\SMC\SMC2635W Wireless Cardbus Adapter Utility\drivers\WINXP\SMCRMonitor.exe
      O8 - Extra context menu item: Lähetä &Bluetooth-laitteeseen - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\btsendto_ie_ctx.htm
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
      O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
      O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\btsendto_ie.htm (file missing)
      O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\btsendto_ie.htm (file missing)
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
      O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
      O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
      O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
      O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
      O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
      O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
      O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
      O23 - Service: Bluetooth Service (btwdins) - Unknown owner - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\bin\btwdins.exe (file missing)
      O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
      O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
      O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

      [TRACE] Enumerating jobs and queues
      [TRACE] Activating job 'B8ABFE3893A4685C.job'
      [TRACE] Printing all job properties

      ApplicationName: 'c:\docume~1\kristo~1\applic~1\jugssi~1\sixthplatformcool.exe'
      Parameters: ''
      WorkingDirectory: ''
      Comment: ''
      Creator: 'Kristoffer Nylund'
      Priority: NORMAL
      MaxRunTime: 259200000 (3d 0:00:00)
      IdleWait: 10
      IdleDeadline: 60
      MostRecentRun: 03/22/2006 10:00:00
      NextRun: 03/22/2006 14:00:00
      StartError: 0x80070002
      ExitCode: 0
      Status: SCHED_S_TASK_READY
      ScheduledWorkItem Flags:
      DeleteWhenDone = 0
      Suspend = 0
      StartOnlyIfIdle = 0
      KillOnIdleEnd = 0
      RestartOnIdleResume = 0
      DontStartIfOnBatteries = 0
      KillIfGoingOnBatteries = 0
      RunOnlyIfLoggedOn = 1
      SystemRequired = 0
      Hidden = 1
      TaskFlags: 0

      1 Trigger

      Trigger 0:
      Type: Daily
      DaysInterval: 1
      StartDate: 02/23/2001
      EndDate: 00/00/0000
      StartTime: 00:00
      MinutesDuration: 1440
      MinutesInterval: 60
      Flags:
      HasEndDate = 0
      KillAtDuration = 0
      Disabled = 0

      Äänestä

    • samurai80 kirjoitti:

      Logfile of HijackThis v1.99.1
      Scan saved at 13:57:56, on 22.3.2006
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\ewido anti-malware\ewidoctrl.exe
      C:\WINDOWS\System32\nvsvc32.exe
      C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Skype\Phone\Skype.exe
      C:\WINDOWS\system32\rundll32.exe
      C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
      C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      C:\Program Files\SMC\SMC2635W Wireless Cardbus Adapter Utility\drivers\WINXP\SMCRMonitor.exe
      C:\Program Files\Morpheus\Morpheus.exe
      C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
      C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
      C:\WINDOWS\system32\wuauclt.exe
      C:\WINDOWS\system32\notepad.exe
      C:\hjt\HijackThis.exe

      F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
      O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
      O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
      O4 - Startup: Morpheus.lnk = C:\Program Files\Morpheus\Morpheus.exe
      O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
      O4 - Global Startup: SMC2635W Wireless Cardbus Adapter Utility.lnk = C:\Program Files\SMC\SMC2635W Wireless Cardbus Adapter Utility\drivers\WINXP\SMCRMonitor.exe
      O8 - Extra context menu item: Lähetä &Bluetooth-laitteeseen - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\btsendto_ie_ctx.htm
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
      O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
      O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\btsendto_ie.htm (file missing)
      O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\btsendto_ie.htm (file missing)
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
      O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
      O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
      O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
      O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
      O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
      O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
      O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
      O23 - Service: Bluetooth Service (btwdins) - Unknown owner - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\bin\btwdins.exe (file missing)
      O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
      O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
      O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

      [TRACE] Enumerating jobs and queues
      [TRACE] Activating job 'B8ABFE3893A4685C.job'
      [TRACE] Printing all job properties

      ApplicationName: 'c:\docume~1\kristo~1\applic~1\jugssi~1\sixthplatformcool.exe'
      Parameters: ''
      WorkingDirectory: ''
      Comment: ''
      Creator: 'Kristoffer Nylund'
      Priority: NORMAL
      MaxRunTime: 259200000 (3d 0:00:00)
      IdleWait: 10
      IdleDeadline: 60
      MostRecentRun: 03/22/2006 10:00:00
      NextRun: 03/22/2006 14:00:00
      StartError: 0x80070002
      ExitCode: 0
      Status: SCHED_S_TASK_READY
      ScheduledWorkItem Flags:
      DeleteWhenDone = 0
      Suspend = 0
      StartOnlyIfIdle = 0
      KillOnIdleEnd = 0
      RestartOnIdleResume = 0
      DontStartIfOnBatteries = 0
      KillIfGoingOnBatteries = 0
      RunOnlyIfLoggedOn = 1
      SystemRequired = 0
      Hidden = 1
      TaskFlags: 0

      1 Trigger

      Trigger 0:
      Type: Daily
      DaysInterval: 1
      StartDate: 02/23/2001
      EndDate: 00/00/0000
      StartTime: 00:00
      MinutesDuration: 1440
      MinutesInterval: 60
      Flags:
      HasEndDate = 0
      KillAtDuration = 0
      Disabled = 0

      Hae KillBox

      http://www.bleepingcomputer.com/files/spyware/KillBox.zip

      Pura,avaa ja täppi kohtaan Delete on Reboot
      Sitte kopioi rivi tosta alapuolelta

      C:\WINDOWS\Tasks\B8ABFE3893A4685C.job

      Sitten KillBoxissa ylhäältä File > Paste from Clipboard
      Valitse "All Files".Sen jälkeen paina Delete (punainen, jossa on valkonen X)
      Vastaa myöntävästi kysymyksiin ja jos kone ei itestään käynnisty uudestaan,niin käynnistä se.

      Lataa ja tallenna Blacklight ->
      http://www.f-secure.com/blacklight/try.shtml työpöydällesi;

      Tupla-klikkaa blbeta.exe, hyväksy sopimus, klikkaa > Scan, sitten > Next

      Näet listan kaikesta mitä löytyi. Työpöydällesi myös ilmestyy loki jonka nimi on fsbl.xxxxxxx.log (xxxxxxx;n tilalla on luultavimmin numeroita).

      Kopioi ja liitä tämä loki seuraavaan vastaukseesi. Älä valitse "Rename" optiota vielä! Haluamme nähdä login ensin, koska hyviä tiedostoja saattaa olla mukana, kuten "wbemtest.exe".

      Lähetä sen jälkeen uus Hijack-logi ja blacklightin loki.

      Äänestä

    Odottaa vastausta

    Näihin keskusteluihin ei ole vielä vastattu. Ole ensimmäinen.

    Luetuimmat keskustelut

    Kommentoi aloitusta

    virus79 kirjoitti:

    Logfile of HijackThis v1.99.1
    Scan saved at 12:47:25, on 22.3.2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\ewido anti-malware\ewidoctrl.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
    c:\progra~1\intern~1\iexplore.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\SMC\SMC2635W Wireless Cardbus Adapter Utility\drivers\WINXP\SMCRMonitor.exe
    C:\Program Files\Morpheus\Morpheus.exe
    C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
    C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
    C:\WINDOWS\system32\rundll32.exe
    C:\hjt\HijackThis.exe

    F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
    O4 - HKCU\..\Run: [Mags sign] C:\DOCUME~1\KRISTO~1\APPLIC~1\JUGSSI~1\logload.exe
    O4 - Startup: Morpheus.lnk = C:\Program Files\Morpheus\Morpheus.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: SMC2635W Wireless Cardbus Adapter Utility.lnk = C:\Program Files\SMC\SMC2635W Wireless Cardbus Adapter Utility\drivers\WINXP\SMCRMonitor.exe
    O8 - Extra context menu item: Lähetä &Bluetooth-laitteeseen - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\btsendto_ie_ctx.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
    O9 - Extra button: ShopperReports - Compare travel rates - {946B3E9E-E21A-49c8-9F63-900533FAFE14} - C:\Program Files\ShopperReports\Bin\1.1.0.0\ShprRprt.dll (file missing)
    O9 - Extra button: ShopperReports - Compare product prices - {946B3E9E-E21A-49c8-9F63-900533FAFE15} - C:\Program Files\ShopperReports\Bin\1.1.0.0\ShprRprt.dll (file missing)
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\btsendto_ie.htm (file missing)
    O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\btsendto_ie.htm (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
    O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
    O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O20 - Winlogon Notify: App Management - C:\WINDOWS\system32\ir66l5js1.dll
    O23 - Service: Bluetooth Service (btwdins) - Unknown owner - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\bin\btwdins.exe (file missing)
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

    Anonyymi
    5000

    Ilmoita asiaton sisältö

    • Sisältää materiaalia, joka on loukkaavaa, herjaavaa, rasistista, uhkailevaa tai ahdistelevaa.

    • Materiaali sisältää nimiä, yhteystietoja tai muita henkilökohtaisia tietoja. Julkisuuden henkilöistä, julkisissa viroissa toimivista ihmisistä sekä yritysten vastuuhenkilöistä saa keskustella työhön liittyen. Myös yksityiselämään liittyvistä asioista voi keskustella siltä osin, kuin niistä on julkisesti kerrottu.

    • Sisältää lapsille haitallista tai heiltä kiellettyä materiaalia. Seksuaalinen sisältö on sallittua aiheeseen tarkoitetuilla palstoilla, joiden ikäraja on 18 vuotta.

    • Lainvastaista sisältöä voi olla mm. yksityiselämää loukkaavan tiedon levitys, kiihottaminen kansanryhmää vastaan, laiton uhkaaminen, alaikäisiin liittyvä seksuaalinen sisältö/grooming, petokset, identiteettivarkaudet, kunnianloukkaukset ja tekijänoikeusrikkomukset.

    • Sisältö ei liity palstan tai keskusteluketjun aiheeseen.

    • Viesti ei ole suomea tai ruotsia (pl. International Forums), se sisältää mainontaa, se sisältää tekijänoikeuksin suojattua materiaalia, se on massapostitus tai jokin muu syy.

    Jaa keskustelu