Moi,
Oli tuossa F-securen kanssa pieniä ongelmia ja skannasin eScanilla koneen ja tässä tulos.
Mitähän noi meinaa, kun olivat backweb kansiossa?
File C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\2096\1060ac85\base009.avc infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\2096\1060ac85\base010.avc infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\2096\1060ac85\base011.avc infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\2096\1060ac85\base012.avc infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\2096\1060ac85\base013.avc infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\2096\1060ac85\base014.avc infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\2096\1060ac85\base015.avc infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\2096\1060ac85\base016.avc infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\2096\1060ac85\base017.avc infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\2096\1060ac85\base018.avc infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\2096\1060ac85\base019.avc infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\2096\1060ac85\base020.avc infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\2096\1060ac85\base021.avc infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\2096\1060ac85\base022.avc infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\2096\1060ac85\base023.avc infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\2096\1060ac85\base024.avc infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\2096\1060ac85\base025.avc infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\2096\1060ac85\base026.avc infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\2096\1060ac85\base027.avc infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\2096\1060ac85\base028.avc infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
Oli tuossa F-securen kanssa pieniä ongelmia ja skannasin eScanilla koneen ja tässä tulos.
Mitähän noi meinaa, kun olivat backweb kansiossa?
File C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\2096\1060ac85\base009.avc infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\2096\1060ac85\base010.avc infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\2096\1060ac85\base011.avc infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\2096\1060ac85\base012.avc infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\2096\1060ac85\base013.avc infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\2096\1060ac85\base014.avc infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\2096\1060ac85\base015.avc infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\2096\1060ac85\base016.avc infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\2096\1060ac85\base017.avc infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\2096\1060ac85\base018.avc infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\2096\1060ac85\base019.avc infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\2096\1060ac85\base020.avc infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\2096\1060ac85\base021.avc infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\2096\1060ac85\base022.avc infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\2096\1060ac85\base023.avc infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\2096\1060ac85\base024.avc infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\2096\1060ac85\base025.avc infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\2096\1060ac85\base026.avc infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\2096\1060ac85\base027.avc infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\2096\1060ac85\base028.avc infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
Vastaukset 10
Vanhimmat
olisi vielä HTJ-logi
Logfile of HijackThis v1.99.1
Scan saved at 19:01:05, on 3.11.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsrw.exe
C:\Program Files\F-Secure Internet Security\FSPC\fspc.exe
C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe
C:\PROGRA~1\F-SECU~1\ANTI-S~1\fsaw.exe
C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
C:\Kaspersky\mwavscan.com
C:\Kaspersky\kavss.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\HJT\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\F-Secure Internet Security\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: F-Secure 2006.lnk = C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\F-Secure Internet Security\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: Web-suodatin - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: Web-suodatin - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'winsflt.dll' missing
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1162313495984
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: F-Secure 2006 (BackWeb Plug-in - 4476822) - F-Secure Internet Security 2005 - C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure HTTP Server (fshttps) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSPC\fshttps\fshttps.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
O23 - Service: GhostStartService - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
Taitaa olla F-securen päivitystiedostoja, kun ovat tollasessa kansiossa. Tuo backweb-prosessi saattaa tulla tulkituksi eScanissa haitalliseksi.
Outoa on kuitenkin, että jokainen tiedosto on saanut saman kohtalon.
"False Positive Detection of a Virus inside a BackWeb
InfopakBackWeb InfoPaks wrongly diagnosed as infected with a Trojan
Our support organization has discovered that under certain
conditions, some antivirus software products, such as McAfee VirusScan(R) Enterprise version 7 or 8 with DAT 4398 or later, mistakenly alert users that a temporary zip file used by the BackWeb Plug-in during an InfoPak download contains an "Exploit-ZIP Trojan" and move the file into a quarantine folder. It is important to emphasize that this is a false diagnosis by the antivirus software - see the detailed technical explanation "
http://www.backweb.com/aboutus/spyware.cfm
Lähde on kyllä tuon Backwebin tekijöiden omalta sivulta.
Sinänsä hassua, että eScan käyttää myös Kaspersky Labsin virustunnisteita.
Logi näyttää minusta puhtaalta, expertit tarkistakoot.
escan / kapensky tiedoilta
onkos sulla ccleaner koneella putsaa sillä
aja
puhdistaja ja virheet
Putsasin ccleanerilla, muutamia rekisterivirheitä löytyi.
Testasin, niin ainakin F-securen päivitykset pelaavat vaikka noita on uudelleennimennytkin. Ihmettelen kun ei aikaisemmin ole tuollaista tullut vastaan.
Mutta taitaa sitten olla puhdas vai?
Ja kiitosta molemmille vastaajille
että löyttää tuota paikasta mitään.
Olekos tämän laittanut koneelle tarkoituksella
O23 - Service: GhostStartService - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
Tarkoituksella on koneella toi
Justiina täti, ;) Ei hjt-lokista muuta erikoista löydy. Escan on ne nimennyt uudestaan löydöksensä.
Täällähän oli parikin vanhaa tuttua!
Hieno juttu, että kunnossa.
Kiitosta ja mukavaa viikonloppua, edelleen molemmille :o)
Sitä samaa, pakkasia pitelee...
Mutta varovasti sen korkin kanssa. ;)