missä ZIP luuraa

ne logit tässä kirjoitti:

Vihdoin ja viimein tässä uurastukseni tulos, mutta ZIP taitaa olla lomalla. Tuossa kuitenkin linkki keskusteluun missä aiheesta:
http://keskustelu.suomi24.fi/show.fcgi?category=108&conference=4500000000000628&posting=22000000017325691

Eka HJT:

Logfile of HijackThis v1.99.1
Scan saved at 22:28:56, on 22.6.2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\NORMAN\bin\ZLH.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\NORMAN\Npf\BIN\NPFSVICE.EXE
C:\NORMAN\Bin\Zanda.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\NORMAN\Nvc\BIN\NIP.EXE
C:\NORMAN\Npf\BIN\npfmsg2.exe
C:\NORMAN\bin\NJEEVES.EXE
C:\NORMAN\Nvc\bin\nvcoas.exe
C:\NORMAN\Nvc\BIN\nipsvc.exe
C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\NORMAN\Nvc\bin\cclaw.exe
C:\hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/s b/ymsgr6/*http://www.yahoo.com/ext/search/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/s u/ymsgr6/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Norman ZANDA] C:\NORMAN\bin\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google-haku - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Käännä englanninkielinen sana - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Linkit taaksepäin - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Samankaltaisia sivuja - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Välimuistissa oleva kuvakaappaus sivusta - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O14 - IERESET.INF: START_PAGE_URL=http://www.mtv3.fi/
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - https://scan.safety.live.com/resource/download/scanner/ en-us/wlscbase3401.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls /en/x86/client/wuweb_site.cab?1129529548772
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/s uite/yautocomplete.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{327D6011-1AFD-43CB-B901-6714E647B641}: NameServer = 85.255.116.154,85.255.112.16
O17 - HKLM\System\CCS\Services\Tcpip\..\{602FDC85-3DEF-4A28-88D8-BED428B171D7}: NameServer = 85.255.116.154,85.255.112.16
O17 - HKLM\System\CS1\Services\Tcpip\..\{327D6011-1AFD-43CB-B901-6714E647B641}: NameServer = 85.255.116.154,85.255.112.16
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\NORMAN\Nvc\BIN\nipsvc.exe
O23 - Service: Norman NJeeves - Unknown owner - C:\NORMAN\bin\NJEEVES.EXE
O23 - Service: Norman Type-R - Unknown owner - C:\NORMAN\Npf\BIN\NPFSVICE.EXE
O23 - Service: Norman ZANDA - Unknown owner - C:\NORMAN\Bin\Zanda.exe
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\NORMAN\Nvc\bin\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

------------------------------------------------
Sitten Fixwareoutin raportti:

Fixwareout ver 1.003
Last edited 04/26/2006
Post this report in the forums please

Reg Entries that were deleted
...

Random Runs removed from HKLM
...

PLEASE NOTE, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
Example ipsec6.exe is lagitamate

»»»»» Search by size and names...

»»»»» Misc files

»»»»» Checking for older varients covered by the Rem3 tool

»»»»»
Search five digit cs, dm and jb files
This WILL/CAN also list Legit Files, Submit them at Virustotal
------------------------------------------------
Ja vielä Ewidon logi:

---------------------------------------------------------
ewido anti-spyware - Scan Report
---------------------------------------------------------

Created at: 22:07:05 22.6.2006

Scan result:



C:\RECYCLER\S-1-5-21-1614895754-688789844-1343024091-1003\Dc2.exe -> Adware.Casino : No action taken.
C:\Program Files\Common Files\Real\WeatherBug\MiniBugTransporter.dll -> Adware.Minibug : No action taken.
HKLM\SOFTWARE\Ran Geva -> Adware.URLBlaze : No action taken.
HKLM\SOFTWARE\Ran Geva\MalWhere -> Adware.URLBlaze : No action taken.
:mozilla.15:C:\Documents and Settings\Omistaja\Application Data\Netscape\NSB\Profiles\ug902e9e.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.17:C:\Documents and Settings\Omistaja\Application Data\Netscape\NSB\Profiles\ug902e9e.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\Omistaja\Cookies\omistaja@2o7[2].txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\Omistaja\Cookies\[email protected][2].txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\Omistaja\Cookies\[email protected][2].txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\Omistaja\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\Omistaja\Cookies\omistaja@adtech[2].txt -> TrackingCookie.Adtech : No action taken.
:mozilla.18:C:\Documents and Settings\Omistaja\Application Data\Netscape\NSB\Profiles\ug902e9e.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
:mozilla.19:C:\Documents and Settings\Omistaja\Application Data\Netscape\NSB\Profiles\ug902e9e.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
C:\Documents and Settings\Omistaja\Cookies\omistaja@advertising[1].txt -> TrackingCookie.Advertising : No action taken.
:mozilla.13:C:\Documents and Settings\Omistaja\Application Data\Netscape\NSB\Profiles\ug902e9e.default\cookies.txt -> TrackingCookie.Atdmt : No action taken.
C:\Documents and Settings\Omistaja\Cookies\omistaja@atdmt[2].txt -> TrackingCookie.Atdmt : No action taken.
C:\Documents and Settings\Omistaja\Cookies\[email protected][1].txt -> TrackingCookie.Burstbeacon : No action taken.
C:\Documents and Settings\Omistaja\Cookies\omistaja@burstnet[2].txt -> TrackingCookie.Burstnet : No action taken.
C:\Documents and Settings\Omistaja\Cookies\omistaja@com[2].txt -> TrackingCookie.Com : No action taken.
:mozilla.16:C:\Documents and Settings\Omistaja\Application Data\Netscape\NSB\Profiles\ug902e9e.default\cookies.txt -> TrackingCookie.Doubleclick : No action taken.
C:\Documents and Settings\Omistaja\Cookies\omistaja@doubleclick[1].txt -> TrackingCookie.Doubleclick : No action taken.
C:\Documents and Settings\Omistaja\Cookies\[email protected][1].txt -> TrackingCookie.Enhance : No action taken.
C:\Documents and Settings\Omistaja\Cookies\[email protected][1].txt -> TrackingCookie.Euroclick : No action taken.
C:\Documents and Settings\Omistaja\Cookies\[email protected][2].txt -> TrackingCookie.Goclick : No action taken.
:mozilla.6:C:\Documents and Settings\Omistaja\Application Data\Netscape\NSB\Profiles\ug902e9e.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.8:C:\Documents and Settings\Omistaja\Application Data\Netscape\NSB\Profiles\ug902e9e.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.9:C:\Documents and Settings\Omistaja\Application Data\Netscape\NSB\Profiles\ug902e9e.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
C:\Documents and Settings\Omistaja\Cookies\[email protected][1].txt -> TrackingCookie.Hitbox : No action taken.
C:\Documents and Settings\Omistaja\Cookies\omistaja@hitbox[2].txt -> TrackingCookie.Hitbox : No action taken.
C:\Documents and Settings\Omistaja\Cookies\[email protected][1].txt -> TrackingCookie.Myaffiliateprogram : No action taken.
C:\Documents and Settings\Omistaja\Cookies\[email protected][2].txt -> TrackingCookie.Onestat : No action taken.
C:\Documents and Settings\Omistaja\Cookies\[email protected][1].txt -> TrackingCookie.Overture : No action taken.
C:\Documents and Settings\Omistaja\Cookies\[email protected][1].txt -> TrackingCookie.Overture : No action taken.
C:\Documents and Settings\Omistaja\Cookies\omistaja@paypopup[2].txt -> TrackingCookie.Paypopup : No action taken.
C:\Documents and Settings\Omistaja\Cookies\[email protected][1].txt -> TrackingCookie.Reliablestats : No action taken.
C:\Documents and Settings\Omistaja\Cookies\[email protected][1].txt -> TrackingCookie.Serving-sys : No action taken.
C:\Documents and Settings\Omistaja\Cookies\omistaja@serving-sys[2].txt -> TrackingCookie.Serving-sys : No action taken.
C:\Documents and Settings\Omistaja\Cookies\[email protected][2].txt -> TrackingCookie.Specificclick : No action taken.
C:\Documents and Settings\Omistaja\Cookies\omistaja@tacoda[2].txt -> TrackingCookie.Tacoda : No action taken.
C:\Documents and Settings\Omistaja\Cookies\omistaja@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : No action taken.
:mozilla.116:C:\Documents and Settings\Omistaja\Application Data\Netscape\NSB\Profiles\ug902e9e.default\cookies.txt -> TrackingCookie.Web-stat : No action taken.
C:\Documents and Settings\Omistaja\Cookies\[email protected][1].txt -> TrackingCookie.Web-stat : No action taken.
:mozilla.38:C:\Documents and Settings\Omistaja\Application Data\Netscape\NSB\Profiles\ug902e9e.default\cookies.txt -> TrackingCookie.Yadro : No action taken.
C:\Documents and Settings\Omistaja\Cookies\omistaja@yadro[1].txt -> TrackingCookie.Yadro : No action taken.
C:\Documents and Settings\Omistaja\Cookies\[email protected][1].txt -> TrackingCookie.Yieldmanager : No action taken.
C:\Documents and Settings\Omistaja\Local Settings\Temp\Cookies\[email protected][2].txt -> TrackingCookie.Yieldmanager : No action taken.
C:\RECYCLER\S-1-5-21-1614895754-688789844-1343024091-1003\Dc3.exe -> Trojan.Hoster : No action taken.


::Report end

------------------------------------------------
Siinä kaikki... :) ei muuten mutta läppärini lähdössä luultavasti takuuhuoltoon ja olisi kiva "korjata" tämä alta, mutta huoltoon ihan vain ylikuumemisen ja yli-innostuneen tuulettimen takia.

kirjoitti:

Anonyymi

Kirjoita kommentti

5000

Lähetä