ei kommenttia

karijari kirjoitti:

File Version :      4.10.0.2222
File Description :   Win32-ydin (kernel32.dll)
File Path :      C:\WINDOWS\SYSTEM\kernel32.dll
Process ID :      0xFFCFE875 (Heximal) 4291815541 (Decimal)

Connection origin :   remote initiated
Protocol :      UDP
Local Address :    
Local Port :      68 (BOOTPC - Dynamic Host Configuration Protocol [DHCP] Client)
Remote Name :         
Remote Address :   
Remote Port :       67

Ethernet packet details:
Ethernet II (Packet Length: 364)
   Destination:    ff-ff-ff-ff-ff-ff
   Source:    00-50-3e-a2-e4-00
Type: IP (0x0800)
Internet Protocol
   Version: 4
   Header Length: 20 bytes
   Flags:
      .0.. = Don't fragment: Not set
      ..0. = More fragments: Not set
   Fragment offset:0
   Time to live: 255
   Protocol: 0x11 (UDP - User Datagram Protocol)
   Header checksum: 0x2eb6 (Correct)
   Source:
   Destination:
User Datagram Protocol
   Source port: 67
   Destination port: 68
   Length: 8
   Checksum: 0xdd59 (Correct)
Bootstrap Protocol
   Boot Reply
   Option 53: DHCP Message Type = DHCP Offer
   Option 54: Server Identifier =
   Option 51: IP Address Lease Time = 8 hours
   Option 1: Subnet Mask =
   Option 3: Router =
   Option 6: Domain Name Server
      IP Address:
      IP Address:
      IP Address:
   Option 12: Host Name =
   Option 15: Domain Name:

Binary dump of the packet:
0000: FF FF FF FF FF FF 00 50 : 3E A2 E4 00 08 00 45 00 | .......P>.....E.
0010: 01 5E BD 71 00 00 FF 11 : B6 2E 82 EA C4 04 FF FF | .^.q............
0020: FF FF 00 43 00 44 01 4A : 59 DD 02 01 06 01 77 F7 | ...C.D.JY.....w.
0030: AE 8D 00 04 80 00 00 00 : 00 00 82 EA C6 CB 82 EA | ................
0040: 02 52 82 EA C4 04 00 0C : 76 F7 AE 8D 00 00 00 00 | .R......v.......
0050: 00 00 00 00 00 00 00 00 : 00 00 00 00 00 00 00 00 | ................
0060: 00 00 00 00 00 00 00 00 : 00 00 00 00 00 00 00 00 | ................
0070: 00 00 00 00 00 00 00 00 : 00 00 00 00 00 00 00 00 | ................
0080: 00 00 00 00 00 00 00 00 : 00 00 00 00 00 00 00 00 | ................
0090: 00 00 00 00 00 00 6B 65 : 73 73 6C 65 72 2E 69 6D | ......kessler.im
00A0: 67 00 00 00 00 00 00 00 : 00 00 00 00 00 00 00 00 | g...............
00B0: 00 00 00 00 00 00 00 00 : 00 00 00 00 00 00 00 00 | ................
00C0: 00 00 00 00 00 00 00 00 : 00 00 00 00 00 00 00 00 | ................
00D0: 00 00 00 00 00 00 00 00 : 00 00 00 00 00 00 00 00 | ................
00E0: 00 00 00 00 00 00 00 00 : 00 00 00 00 00 00 00 00 | ................
00F0: 00 00 00 00 00 00 00 00 : 00 00 00 00 00 00 00 00 | ................
0100: 00 00 00 00 00 00 00 00 : 00 00 00 00 00 00 00 00 | ................
0110: 00 00 00 00 00 00 63 82 : 53 63 35 01 02 36 04 82 | ......c.Sc5..6..
0120: EA 04 28 33 04 00 00 7D : 00 01 04 FF FF FC 00 03 | ..(3...}........
0130: 04 82 EA C4 01 06 0C 82 : EA 02 51 82 EA A1 1F 82 | ..........Q.....
0140: EA 04 1E 0C 16 6B 65 73 : 73 6C 65 72 2E 70 68 79 |
0150: 73 2E 61 64 2E 6A 79 75 : 2E 66 69 0F 0E 70 68 79 |
0160: 73 2E 61 64 2E 6A 79 75 : 2E 66 69 FF |



Ad-Aware SE Build 1.06r1
Logfile Created on:2. toukokuuta 2006 0:16:51
Created with Ad-Aware SE Personal, free for private use.
Using definitions file:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

References detected during the scan:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
MRU List(TAC index:0):5 total references
Tracking Cookie(TAC index:3):4 total references
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Ad-Aware SE Settings
===========================
Set : Search for negligible risk entries
Set : Search for low-risk threats
Set : Safe mode (always request confirmation)
Set : Scan active processes
Set : Scan registry
Set : Deep-scan registry
Set : Scan my IE Favorites for banned URLs
Set : Scan within archives
Set : Scan my Hosts file

Extended Ad-Aware SE Settings
===========================
Set : Unload recognized processes & modules during scan
Set : Scan registry for all users instead of current user only
Set : Always try to unload modules before deletion
Set : Let Windows remove files in use at next reboot
Set : Delete quarantined objects after restoring
Set : Include basic Ad-Aware settings in log file
Set : Include additional Ad-Aware settings in log file
Set : Include reference summary in log file
Set : Include alternate data stream details in log file
Set : Play sound at scan completion if scan locates critical objects


2.5.2006 0:16:52 - Scan started. (Full System Scan)

MRU List Object Recognized!
Location: : .DEFAULT\software\adobe\acrobat reader\5.0\avgeneral\crecentfiles
Description : list of recently used files in adobe reader


MRU List Object Recognized!
Location: : software\microsoft\directdraw\mostrecentapplication
Description : most recent application to use microsoft directdraw


MRU List Object Recognized!
Location: : .DEFAULT\software\microsoft\internet explorer\typedurls
Description : list of recently entered addresses in microsoft internet explorer


MRU List Object Recognized!
Location: : .DEFAULT\software\microsoft\windows\currentversion\applets\wordpad\recent file list
Description : list of recent files opened using wordpad


MRU List Object Recognized!
Location: : .DEFAULT\software\microsoft\windows media\wmsdk\general
Description : windows media sdk


Listing running processes
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

#:1 [KERNEL32.DLL]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4291815541
Threads : 6
Priority : High
FileVersion : 4.10.2222
ProductVersion : 4.10.2222
ProductName : Microsoft(R) Windows(R) -käyttöjärjestelmä
CompanyName : Microsoft Corporation
FileDescription : Win32-ydin
InternalName : KERNEL32
LegalCopyright : Copyright (C) Microsoft Corp. 1991 - 1999
OriginalFilename : KERNEL32.DLL

#:2 [MSGSRV32.EXE]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4290788589
Threads : 1
Priority : Normal
FileVersion : 4.10.2222
ProductVersion : 4.10.2222
ProductName : Microsoft(R) Windows(R) -käyttöjärjestelmä
CompanyName : Microsoft Corporation
FileDescription : Windows 32-bittinen VxD-sanomapalvelin
InternalName : MSGSRV32
LegalCopyright : Copyright (C) Microsoft Corp. 1992 - 1998
OriginalFilename : MSGSRV32.EXE

#:3 [MPREXE.EXE]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4290784029
Threads : 1
Priority : Normal
FileVersion : 4.10.1998
ProductVersion : 4.10.1998
ProductName : Microsoft(R) Windows(R) Operating System
CompanyName : Microsoft Corporation
FileDescription : WIN32 Network Interface Service Process
InternalName : MPREXE
LegalCopyright : Copyright (C) Microsoft Corp. 1993-1998
OriginalFilename : MPREXE.EXE

#:4 [MSTASK.EXE]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4290821261
Threads : 2
Priority : Normal
FileVersion : 4.71.1972.1
ProductVersion : 4.71.1972.1
ProductName : Microsoft® Windows® Tehtävien ajoitus
CompanyName : Microsoft Corporation
FileDescription : Tehtävien ajoitus -moduuli
InternalName : TaskScheduler
LegalCopyright : Copyright (C) Microsoft Corp. 2000
OriginalFilename : mstask.exe

#:5 [SMC.EXE]
FilePath : C:\OHJELMATIEDOSTOT\SYGATE\SPF\
ProcessID : 4290816465
Threads : 21
Priority : Normal
FileVersion : 5.6.00.2808
ProductVersion : 5.6.00.2808
ProductName : Sygate® Security Agent and Personal Firewall
CompanyName : Sygate Technologies, Inc.
FileDescription : Sygate Agent Firewall
InternalName : Smc
LegalCopyright : Copyright © 1999 - 2004 Sygate Technologies, Inc. All rights reserved.
OriginalFilename : Smc.EXE

#:6 [mmtask.tsk]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4290841405
Threads : 1
Priority : Normal
FileVersion : 4.03.1998
ProductVersion : 4.03.1998
ProductName : Microsoft Windows
CompanyName : Microsoft Corporation
FileDescription : Multimedia background task support module
InternalName : mmtask.tsk
LegalCopyright : Copyright © Microsoft Corp. 1991-1998
OriginalFilename : mmtask.tsk

#:7 [KB891711.EXE]
FilePath : C:\WINDOWS\SYSTEM\KB891711\
ProcessID : 4290838661
Threads : 1
Priority : Normal
FileVersion : 4.10.2223
ProductVersion : 4.10.2222
ProductName : Microsoft(R) Windows(R) Operating System
CompanyName : Microsoft Corporation
FileDescription : Windows KB891711 component
InternalName : KB891711
LegalCopyright : Copyright (C) Microsoft Corp. 1991-2005
OriginalFilename : KB891711.EXE

#:8 [EXPLORER.EXE]
FilePath : C:\WINDOWS\
ProcessID : 4290868417
Threads : 4
Priority : Normal
FileVersion : 4.72.3110.1
ProductVersion : 4.72.3110.1
ProductName : Microsoft(R) Windows NT(R) -käyttöjärjestelmä
CompanyName : Microsoft Corporation
FileDescription : Resurssienhallinta
InternalName : explorer
LegalCopyright : Copyright (C) Microsoft Corp. 1981-1997
OriginalFilename : EXPLORER.EXE

#:9 [TASKMON.EXE]
FilePath : C:\WINDOWS\
ProcessID : 4290893389
Threads : 1
Priority : Normal
FileVersion : 4.10.1998
ProductVersion : 4.10.1998
ProductName : Microsoft(R) Windows(R) Operating System
CompanyName : Microsoft Corporation
FileDescription : Task Monitor
InternalName : TaskMon
LegalCopyright : Copyright (C) Microsoft Corp. 1998
OriginalFilename : TASKMON.EXE

#:10 [SYSTRAY.EXE]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4290887921
Threads : 2
Priority : Normal
FileVersion : 4.10.2222
ProductVersion : 4.10.2222
ProductName : Microsoft(R) Windows(R) -käyttöjärjestelmä
CompanyName : Microsoft Corporation
FileDescription : Tehtäväpalkki
InternalName : SYSTRAY
LegalCopyright : Copyright (C) Microsoft Corp. 1993 - 1998
OriginalFilename : SYSTRAY.EXE

#:11 [CTDETECT.EXE]
FilePath : C:\CREATIVE\MEDIASOURCE\DETECTOR\
ProcessID : 4290929697
Threads : 1
Priority : Normal
FileVersion : 3.0.2.0
ProductVersion : 3.0.0.0
ProductName : Creative MediaSource Detector
CompanyName : Creative Technology Ltd
FileDescription : Creative MediaSource Detector
InternalName : CTDetect
LegalCopyright : Copyright (c) Creative Technology Ltd., 2003-2004. All rights reserved.
OriginalFilename : CTDetect.EXE

#:12 [DMHKEY.EXE]
FilePath : C:\OHJELMATIEDOSTOT\DIAMOND\INCONTROL TOOLS 99\
ProcessID : 4290947913
Threads : 3
Priority : Normal


#:13 [WMIEXE.EXE]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4290974113
Threads : 3
Priority : Normal
FileVersion : 5.00.1755.1
ProductVersion : 5.00.1755.1
ProductName : Microsoft(R) Windows NT(R) Operating System
CompanyName : Microsoft Corporation
FileDescription : WMI service exe housing
InternalName : wmiexe
LegalCopyright : Copyright (C) Microsoft Corp. 1981-1998
OriginalFilename : wmiexe.exe

#:14 [PSTORES.EXE]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4291161457
Threads : 3
Priority : Normal
FileVersion : 5.00.1877.3
ProductVersion : 5.00.1877.3
ProductName : Microsoft(R) Windows NT(R) Operating System
CompanyName : Microsoft Corporation
FileDescription : Protected storage server
InternalName : Protected storage server
LegalCopyright : Copyright (C) Microsoft Corp. 1981-1998
OriginalFilename : Protected storage server

#:15 [DDHELP.EXE]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4291183997
Threads : 2
Priority : Realtime
FileVersion : 4.09.00.0900
ProductVersion : 4.09.00.0900
ProductName : Microsoft® DirectX for Windows®
CompanyName : Microsoft Corporation
FileDescription : Microsoft DirectX Helper
InternalName : DDHelp.exe
LegalCopyright : Copyright © Microsoft Corp. 1994-2002
OriginalFilename : DDHelp.exe

#:16 [AD-AWARE.EXE]
FilePath : C:\OHJELMATIEDOSTOT\LAVASOFT\AD-AWARE SE PERSONAL\
ProcessID : 4291032373
Threads : 3
Priority : Normal
FileVersion : 6.2.0.236
ProductVersion : SE 106
ProductName : Lavasoft Ad-Aware SE
CompanyName : Lavasoft Sweden
FileDescription : Ad-Aware SE Core application
InternalName : Ad-Aware.exe
LegalCopyright : Copyright © Lavasoft AB Sweden
OriginalFilename : Ad-Aware.exe
Comments : All Rights Reserved

#:17 [WORDPAD.EXE]
FilePath : C:\OHJELMATIEDOSTOT\APUOHJELMAT\
ProcessID : 4291037493
Threads : 2
Priority : Normal
FileVersion : 5.00.1691.1
ProductVersion : 5.00.1691.1
ProductName : Microsoft(R) Windows NT(R) -käyttöjärjestelmä
CompanyName : Microsoft Corporation
FileDescription : WordPad MFC -sovellus
InternalName : wordpad
LegalCopyright : Copyright (C) Microsoft Corp. 1981 - 1997
OriginalFilename : wordpad

Memory scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 5


Started registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Registry Scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 5


Started deep registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Deep registry scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 5


Started Tracking Cookie scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»


Tracking Cookie Object Recognized!
Type : IECache Entry
Data :
TAC Rating : 3
Category : Data Miner
Comment : Hits:3
Value :
Expires : 1.5.2009 0:03:26
LastSync : Hits:3
UseCount : 0
Hits : 3

Tracking Cookie Object Recognized!
Type : IECache Entry
Data :
TAC Rating : 3
Category : Data Miner
Comment : Hits:2
Value :
Expires : 1.5.2011 0:03:26
LastSync : Hits:2
UseCount : 0
Hits : 2

Tracking cookie scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 2
Objects found so far: 7



Deep scanning and examining files (c:)
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Tracking Cookie Object Recognized!
Type : IECache Entry
Data :
TAC Rating : 3
Category : Data Miner
Comment :
Value : c:\WINDOWS\Cookies\jamescomputer@doubleclick[1].txt

Tracking Cookie Object Recognized!
Type : IECache Entry
Data :
TAC Rating : 3
Category : Data Miner
Comment :
Value : c:\WINDOWS\Cookies\
Disk Scan Result for c:\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 9


Deep scanning and examining files (d:)
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Disk Scan Result for d:\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 9


Performing conditional scans...
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Conditional scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 9

0:22:08 Scan Complete

Summary Of This Scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Total scanning time:00:05:16.700
Objects scanned:48749
Objects identified:4
Objects ignored:0
New critical objects:4


Logfile of HijackThis v1.99.1
Scan saved at 0:40:06, on 2.5.2006
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\OHJELMATIEDOSTOT\SYGATE\SPF\SMC.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\CREATIVE\MEDIASOURCE\DETECTOR\CTDETECT.EXE
C:\OHJELMATIEDOSTOT\DIAMOND\INCONTROL TOOLS 99\DMHKEY.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\OHJELMATIEDOSTOT\APUOHJELMAT\WORDPAD.EXE
C:\OHJELMATIEDOSTOT\MOZILLA FIREFOX\FIREFOX.EXE
C:\HJT\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fi.msn.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\OHJELMATIEDOSTOT\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [SmcService] C:\OHJELM~1\SYGATE\SPF\SMC.EXE -startgui
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [SmcService] C:\OHJELMATIEDOSTOT\SYGATE\SPF\SMC.EXE
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKCU\..\Run: [Creative Detector] C:\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - Startup: InControl Desktop Manager.lnk = C:\Ohjelmatiedostot\Diamond\InControl Tools 99\DMHKEY.EXE
O12 - Plugin for .spop: C:\OHJELM~1\INTERN~1\Plugins\NPDocBox.dll

kirjoitti:

Anonyymi

Kirjoita kommentti

5000

Lähetä