Iššokantis virusas

durial666 · #1 Sausis 31, 2008, 05:25

Gaunu šį langelį pasirodo, kai aš einu per bet kaip My Documents "arba kompiuteris ir tt ... Jis taip pat atrodo, kai aš naudoju IE bet kai aš naudoju Firefox. Aš naudojau keletą programų, tačiau ji vis dar išeina jį. Ar tai gali būti rootkit (tikiuosi ne).

Mano Įrašai: --

ESET Online Scanner
# Version = 4
# OnlineScanner.ocx = 1.0.0.56
# OnlineScannerDLLA.dll = 1, 0, 0, 51
# OnlineScannerDLLW.dll = 1, 0, 0, 51
# OnlineScannerUninstaller.exe = 1, 0, 0, 49
# Vers_standard_module = 2836 (20080130)
# Vers_arch_module = 1,063 (20080117)
# Vers_adv_heur_module = 1,060 (20070601)
# EOSSerial = 86fa0ec02340bf40b27cfd3ccc323dee
# End = Baigta
# Remove_checked = true
# Unwanted_checked = true
# Utc_time = 2008-01-31 02:29:31
# Local_time = 2008-01-31 02:29:31 (+0000, GMT Standard Time)
# Country = "Jungtinė Karalystė"
# OSVer = 6.0.6000 NT
# Nuskaityti = 306.177
# Rasti = 0
# Scan_time = 8.875

SUPERAntiSpyware Scan Prisijungti
http://www.superantispyware.com

At 02:32 01/31/2008 Generated AM

Application Version: 3.9.1008

Core Taisyklės Database Versija: 3.391
Sekti Taisyklės duomenų bazė Versija: 1.383

Scan Type: Complete Scan
Iš viso nuskaitymo laikas: 02:21:07

Atminties elementai nuskaityta: 834
Atminties grėsmių detected: 0
Registro objektų nuskaitomi: 7.637
Registras grėsmių detected: 0
Failo elementai nuskaityta: 66.364
Failo grėsmių detected: 6

Adware.Tracking Cookie
C: \ Users \ Chris \ AppData \ Roaming \ Microsoft \ Windows \ C ookies \ Chris @ tribalfusion [2]. Txt
C: \ Users \ Chris \ AppData \ Roaming \ Microsoft \ Windows \ C ookies \ chris@adopt.euroclick [2]. Txt

Trojan.Media-Codec/V5-Intaller
C: \ Users \ CHRIS \ DESKTOP \ INSTALL_PLAYER_3912994 (2). XE E
C: \ Users \ CHRIS \ DESKTOP \ INSTALL_PLAYER_3912994.EXE
C: \ Windows \ prefetch \ INSTALL_PLAYER_3912994 (2). Exe-03357FA6.pf
C: \ Windows \ prefetch \ INSTALL_PLAYER_3912994.EXE-9E95D8EF.pf

HijackThis

Logfile Trend Micro HijackThis v2.0.2
Skaitymo išsaugotas 12:05:19, on 31/01/2008
Platforma: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16575)
Boot mode: Normal

Veikia procesus:
C: \ Windows \ System32 \ smss.exe
C: \ Windows \ system32 \ csrss.exe
C: \ Windows \ system32 \ wininit.exe
C: \ Windows \ system32 \ csrss.exe
C: \ Windows \ system32 \ services.exe
C: \ Windows \ system32 \ lsass.exe
C: \ Windows \ system32 \ lsm.exe
C: \ Windows \ system32 \ winlogon.exe
C: \ Windows \ System32 \ svchost.exe
C: \ Windows \ Microsoft.Net \ Framework \ v3.0 \ WPF \ PRESEN tationFontCache.exe
C: \ Windows \ System32 \ svchost.exe
C: \ Windows \ System32 \ svchost.exe
C: \ Windows \ System32 \ svchost.exe
C: \ Windows \ System32 \ svchost.exe
C: \ Windows \ System32 \ svchost.exe
C: \ Windows \ system32 \ SLsvc.exe
C: \ Windows \ System32 \ svchost.exe
C: \ Windows \ System32 \ svchost.exe
C: \ Program Files \ Lavasoft \ Ad-Aware 2007 \ aawservice.exe
C: \ Program Files \ Alwil Software \ Avast4 \ aswUpdSv.exe
C: \ Program Files \ Alwil Software \ Avast4 \ ashServ.exe
C: \ Windows \ System32 \ Spoolsv.exe
C: \ Windows \ System32 \ svchost.exe
C: \ Windows \ system32 \ Dwm.exe
C: \ Windows \ explorer.exe
C: \ Program Files \ Windows Defender \ MSASCui.exe
C: \ Windows \ RtHDVCpl.exe
C: \ Program Files \ TOSHIBA \ Power Saver \ TPwrMain.exe
C: \ Program Files \ TOSHIBA \ SmoothView \ SmoothView.exe
C: \ Program Files \ TOSHIBA \ Flashcards \ TCrdMain.exe
C: \ Program Files \-squared Anti-Malware \ a2service.exe
C: \ Windows \ system32 \ agrsmsvc.exe
C: \ Program Files \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe
C: \ Program Files \ Bonjour \ mDNSResponder.exe
C: \ Program Files \ TOSHIBA \ ConfigFree \ CFSvcs.exe
C: \ Windows \ System32 \ svchost.exe
C: \ Windows \ System32 \ svchost.exe
C: \ Windows \ system32 \ TODDSrv.exe
C: \ Program Files \ TOSHIBA \ Power Saver \ TosCoSrv.exe
C: \ Program Files \ Toshiba \ Bluetooth Toshiba Stack \ TosBtSrv.exe
C: \ Program Files \ Common Files \ Ulead Systems \ DVD \ ULCDRSvr.exe
C: \ Windows \ System32 \ svchost.exe
C: \ Windows \ system32 \ SearchIndexer.exe
C: \ Program Files \ Alwil Software \ Avast4 \ ashMaiSv.exe
C: \ Program Files \ Alwil Software \ Avast4 \ ashWebSv.exe
C: \ Windows \ system32 \ taskeng.exe
C: \ Windows \ system32 \ taskeng.exe
C: \ Program Files \ TOSHIBA \ Utilities \ KeNotify.exe
C: \ Program Files \ TOSHIBA \ ConfigFree \ NDSTray.exe
C: \ Program Files \ TOSHIBA \ TOSHIBA Online Product Information \ TOPI.exe
C: \ Program Files \ IDM \ Desktop SMS \ DesktopSMS.exe
C: \ Program Files \ Synaptics \ SynTP \ SynTPEnh.exe
C: \ Program Files \ TOSHIBA \ Registracijos \ ToshibaRegistration.exe
C: \ Program Files \ Alwil Software \ Avast4 \ ashDisp.exe
C: \ Program Files \ Camera asistentas Programinė Toshiba \ traybar.exe
C: \ Program Files \ Nokia \ Nokia PC Suite 6 \ LaunchApplication.exe
C: \ Program Files \ iTunes \ iTunesHelper.exe
C: \ Program Files \-squared Anti-Malware \ a2guard.exe
C: \ Program Files \ Windows Sidebar \ sidebar.exe
C: \ Program Files \ TOSHIBA \ TOSCDSPD \ TOSCDSPD.exe
C: \ Program Files \ MSN Messenger \ msnmsgr.exe
C: \ Windows \ eHoMe \ ehtray.exe
C: \ Windows \ system32 \ wbem \ wmiprvse.exe
C: \ Program Files \ Veoh Networks \ Veoh \ VeohClient.exe
C: \ Program Files \ Spybot - Search & Destroy \ TeaTimer.exe
C: \ Program Files \ SUPERAntiSpyware \ SUPERAntiSpyware.exe
C: \ Program Files \ Fantastic Flame Screensaver \ FantasticFlameAgent.exe
C: \ Windows \ eHoMe \ ehmsas.exe
C: \ Windows \ System32 \ rundll32.exe
C: \ Program Files \ Synaptics \ SynTP \ SynToshiba.exe
C: \ Program Files \ Camera asistentas Programinė Toshiba \ CEC_MAIN.exe
C: \ Program Files \ Windows Sidebar \ sidebar.exe
C: \ Program Files \ PC Connectivity Solution \ ServiceLayer.exe
C: \ Program Files \ TOSHIBA \ ConfigFree \ CFSwMgr.exe
C: \ Program Files \ Windows Mail \ WinMail.exe
C: \ Program Files \ iPod \ bin \ iPodService.exe
C: \ Program Files \ MSN Messenger \ usnsvc.exe
C: \ Program Files \ Microsoft Office \ Office11 \ Winword.exe
C: \ Program Files \ Mozilla Firefox \ firefox.exe
C: \ Windows \ System32 \ Msiexec.exe
C: \ Program Files \ PrevxCSI \ prevxcsi.exe
C: \ Program Files \ Spybot - Search & Destroy \ SpybotSD.exe
C: \ Windows \ System32 \ svchost.exe
C: \ Windows \ system32 \ SearchProtocolHost.exe
C: \ Windows \ system32 \ SearchFilterHost.exe
C: \ Program Files \ Trend Micro \ HijackThis \ Sniper.exe.exe

R1 - HKCU \ Software \ Microsoft \ Internet Explorer \ Main, Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://www.altavista.com/audio/default
R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Search, SearchAssistant =
R0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Search, CustomizeSearch =
R1 - HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Žiniasklaida ernet Nustatymai, ProxyOverride = *. vietos
R0 - HKCU \ Software \ Microsoft \ Internet Explorer \ Toolbar, LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - (EF99BD32-C1FB-11D2-892F-0090271D4F88) - C: \ Program Files \ Yahoo! \ Companion \ Įrenginiai \ NKP \ yt.dll
O1 - Hosts::: 1 localhost
O2 - BHO: Yahoo! Toolbar Helper - (02478D38-C3F9-4EFB-9B51-7695ECA05670) - C: \ Program Files \ Yahoo! \ Companion \ Įrenginiai \ NKP \ yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - (06849E9F-C8D7-4D59-B87D-784B7D6BE0B3) - C: \ Program Files \ Adobe \ Acrobat 7.0 \ ActiveX \ AcroIEHelper.dll
O2 - BHO: Megaupload Toolbar - (4e7bd74f-2b8d-469e-CCB0-B130EEDBE97C) - C: \ PROGRA ~ 1 \ MEGAUP ~ 1 \ MEGAUP ~ 1.DLL
O2 - BHO: Spybot-S & D IE Protection - (53707962-6F74-2D53-2644-206D7942484F) - C: \ PROGRA ~ 1 \ Spybot ~ 1 \ SDHelper.dll
O2 - BHO: SSVHelper Class - (761497BB-D6F0-462C-B6EB-D4DAF1D92D43) - C: \ Program Files \ Java \ jre1.6.0_04 \ bin \ ssv.dll
O2 - BHO: (no name) - (7E853D72-626A-48EC-A868-BA8D5E23E045) - (no file)
O2 - BHO: Žaidėjas - (83FD1F86-B40A-41EE-8512-929F005ED2A8) - C: \ Windows \ orgnavi.dll
O2 - BHO: Windows Live Sign-in Helper - (9030D464-4C02-4ABF-8ECC-5164760863C6) - C: \ Program Files \ Common Files \ Microsoft Shared \ Windows Live \ WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar - (EF99BD32-C1FB-11D2-892F-0090271D4F88) - C: \ Program Files \ Yahoo! \ Companion \ Įrenginiai \ NKP \ yt.dll
O3 - Toolbar: Megaupload Toolbar - (4e7bd74f-2b8d-469e-CCB0-B130EEDBE97C) - C: \ PROGRA ~ 1 \ MEGAUP ~ 1 \ MEGAUP ~ 1.DLL
O4 - HKLM \ .. \ Run: [Windows Defender]% ProgramFiles% \ Windows Defender \ MSASCui.exe-hide
O4 - HKLM \ .. \ Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM \ .. \ Run: [TPwrMain]% ProgramFiles% \ TOSHIBA \ Power Saver \ TPwrMain.EXE
O4 - HKLM \ .. \ Run: [HSON]% ProgramFiles% \ TOSHIBA \ TBS \ HSON.exe
O4 - HKLM \ .. \ Run: [SmoothView]% ProgramFiles% \ Toshiba \ SmoothView \ SmoothView.exe
O4 - HKLM \ .. \ Run: [00TCrdMain]% ProgramFiles% \ TOSHIBA \ Flashcards \ TCrdMain.exe
O4 - HKLM \ .. \ Run: [KeNotify] C: \ Program Files \ TOSHIBA \ Utilities \ KeNotify.exe
O4 - HKLM \ .. \ Run: [HWSetup] C: \ Program Files \ TOSHIBA \ Utilities \ HWSetup.exe hwSetUP
O4 - HKLM \ .. \ Run: [SVPWUTIL] C: \ Program Files \ TOSHIBA \ Utilities \ SVPWUTIL.exe SVPwUTIL
O4 - HKLM \ .. \ Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM \ .. \ Run: [Topi] C: \ Program Files \ TOSHIBA \ TOSHIBA Online Product Information \ topi.exe-startup
O4 - HKLM \ .. \ Run: [Desktop SMS] C: \ Program Files \ IDM \ Desktop SMS \ DesktopSMS.exe / Auto
O4 - HKLM \ .. \ Run: [NvSvc] RUNDLL32.EXE C: \ Windows \ system32 \ nvsvc.dll, nvsvcStart
O4 - HKLM \ .. \ Run: [NvCplDaemon] RUNDLL32.EXE C: \ Windows \ system32 \ NvCpl.dll, NvStartup
O4 - HKLM \ .. \ Run: [NvMediaCenter] RUNDLL32.EXE C: \ Windows \ system32 \ NvMcTray.dll, NvTaskbarInit
O4 - HKLM \ .. \ Run: [SynTPEnh] C: \ Program Files \ Synaptics \ SynTP \ SynTPEnh.exe
O4 - HKLM \ .. \ Run: [Toshiba Registracija] C: \ Program Files \ Toshiba \ Registracijos \ ToshibaRegistration.exe
O4 - HKLM \ .. \ Run: [avast!] C: \ PROGRA ~ 1 \ ALWILS ~ 1 \ Avast4 \ ashDisp.exe
O4 - HKLM \ .. \ Run: [Camera Assistant Software] "C: \ Program Files \ Camera asistentas Programinė Toshiba \ traybar.exe"
O4 - HKLM \ .. \ Run: [PCSuiteTrayApplication] C: \ Program Files \ Nokia \ Nokia PC Suite 6 \ LaunchApplication.exe-startup
O4 - HKLM \ .. \ Run: [QuickTime Task] "C: \ Program Files \ QuickTime \ QTTask.exe"-atboottime
O4 - HKLM \ .. \ Run: [iTunesHelper] "C: \ Program Files \ iTunes \ iTunesHelper.exe"
O4 - HKLM \ .. \ Run: [a-squared] "C: \ Program Files \-squared Anti-Malware \ a2guard.exe" / d = 60
O4 - HKLM \ .. \ Run: [PrevxCSI] "C: \ Program Files \ PrevxCSI \ prevxcsi.exe" įkrovos
O4 - HKLM \ .. \ Run: [SunJavaUpdateSched] "C: \ Program Files \ Java \ jre1.6.0_04 \ bin \ jusched.exe"
O4 - HKCU \ .. \ Run: [Sidebar] C: \ Program Files \ Windows Sidebar \ sidebar.exe / autorun
O4 - HKCU \ .. \ Run: [TOSCDSPD] C: \ Program Files \ TOSHIBA \ TOSCDSPD \ TOSCDSPD.exe
O4 - HKCU \ .. \ Run: [MsnMsgr] "C: \ Program Files \ MSN Messenger \ msnmsgr.exe" / background
O4 - HKCU \ .. \ Run: [ehTray.exe] C: \ Windows \ eHoMe \ ehTray.exe
O4 - HKCU \ .. \ Run: [Veoh] "C: \ Program Files \ Veoh Networks \ Veoh \ VeohClient.exe" / VeohHide
O4 - HKCU \ .. \ Run: [SpybotSD TeaTimer] C: \ Program Files \ Spybot - Search & Destroy \ TeaTimer.exe
O4 - HKCU \ .. \ Run: [SUPERAntiSpyware] C: \ Program Files \ SUPERAntiSpyware \ SUPERAntiSpyware.exe
O4 - HKUS \ S-1-5-19 \ .. \ Run: [Sidebar]% ProgramFiles% \ Windows Sidebar \ Sidebar.exe / detectMem (User 'LOCAL SERVICE')
O4 - HKUS \ S-1-5-19 \ .. \ Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll, ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS \ S-1-5-20 \ .. \ Run: [Sidebar]% ProgramFiles% \ Windows Sidebar \ Sidebar.exe / detectMem (User 'NETWORK SERVICE')
O4 - HKUS \ S-1-5-18 \ .. \ Run: [Nokia.PCSync] C: \ Program Files \ Nokia \ Nokia PC Suite 6 \ PcSync2.exe / NoDialog (User 'SYSTEM')
O4 - HKUS \. DEFAULT \ .. \ Run: [Nokia.PCSync] C: \ Program Files \ Nokia \ Nokia PC Suite 6 \ PcSync2.exe / NoDialog (User 'Default user')
O4 - Global Startup: Fantastic Flame Agent.lnk = C: \ Program Files \ Fantastic Flame Screensaver \ FantasticFlameAgent.exe
O8 - Extra kontekstinio meniu punktą: E & Eksportuoti į "Microsoft Excel - res: / / C: \ PROGRA ~ 1 \ Micros ~ 3 \ Office11 \ EXCEL.EXE/3000
O9 - Extra button: (no name) - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C: \ Program Files \ Java \ jre1.6.0_04 \ bin \ npjpi160_04.dll
O9 - Extra 'Tools' MENUITEM: Sun Java Console - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C: \ Program Files \ Java \ jre1.6.0_04 \ bin \ npjpi160_04.dll
O9 - Extra button: Send to OneNote - (2670000A-7350-4f3c-8081-5663EE0C6C49) - C: \ PROGRA ~ 1 \ Micros ~ 3 \ Office12 \ ONBttnIE.dll
O9 - Extra 'Tools' MENUITEM: S & end to OneNote - (2670000A-7350-4f3c-8081-5663EE0C6C49) - C: \ PROGRA ~ 1 \ Micros ~ 3 \ Office12 \ ONBttnIE.dll
O9 - Extra button: Research - (92780B25-18CC-41C8-B9BE-3C9C571A8263) - C: \ PROGRA ~ 1 \ Micros ~ 3 \ Office11 \ REFIEBAR.DLL
O9 - Extra button: eBay - (C08CAF1D-C0A3-40D5-9970-06D067EAC017) -- http://www.webtip.ch/cgi-bin/toshiba/tracker_url.pl?EN (file missing)
O9 - Extra button: (no name) - (DFB852A3-47F8-48C4-A200-58CAB36FD2A2) - C: \ PROGRA ~ 1 \ Spybot ~ 1 \ SDHelper.dll
O9 - Extra 'Tools' MENUITEM: Spybot - Search & Destroy Configuration - (DFB852A3-47F8-48C4-A200-58CAB36FD2A2) - C: \ PROGRA ~ 1 \ Spybot ~ 1 \ SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: (30528230-99f7-4bb4-88d8-fa1d4f56a2ab) (YInstStarter Class) - C: \ Program Files \ Yahoo! \ Common \ yinsthelper.dll
O16 - DPF: (56762DEC-6B0D-4AB4-A8AD-989993B5D08B) (OnlineScanner Control) -- http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: (5C051655-FCD5-4969-9182-770EA5AA5565) (solitaire Showdown klasė) -- http://messenger.zone.msn.com/binary...n.cab56986.cab
O16 - DPF: (5D6F45B3-9043-443D-A792-115447494D24) (UnoCtrl klasė) -- http://messenger.zone.msn.com/EN-GB/.../GAME_UNO1.cab
O16 - DPF: (C3F79A2B-B9B4-4A66-B012-3EE46475B072) (MessengerStatsClient klasė) -- http://messenger.zone.msn.com/binary...t.cab56907.cab
O16 - DPF: (D4323BF2-006A-4440-a2f5-27E3E7AB25F8) (Virtools WebPlayer klasė) -- http://a532.g.akamai.net/f/532/6712/.../installer.exe
O16 - DPF: (F5A7706B-B9C0-4C89-A715-7A0C6B05DD48) (Minesweeper Flags Class) -- http://messenger.zone.msn.com/binary...r.cab56986.cab
O16 - DPF: (F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8) (GoPetsWeb Control) -- https: / / secure.gopetslive.com / dev / GoPetsWeb.cab
Ø20 - Winlogon Notify:! SASWinLogon - C: \ Program Files \ SUPERAntiSpyware \ SASWINLO.dll
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C: \ Program Files \-squared Anti-Malware \ a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C: \ Program Files \ Lavasoft \ Ad-Aware 2007 \ aawservice.exe
O23 - Service: Agere Modemas skambink pažangos Audio (AgereModemAudio) - Agere Systems - C: \ Windows \ system32 \ agrsmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc - C: \ Program Files \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 kontrolės tarnybos (aswUpdSv) - ALWIL Software - C: \ Program Files \ Alwil Software \ Avast4 \ aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C: \ Program Files \ Alwil Software \ Avast4 \ ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C: \ Program Files \ Alwil Software \ Avast4 \ ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C: \ Program Files \ Alwil Software \ Avast4 \ ashWebSv.exe
O23 - Service: # # Id_String1.6844F930_1628_4223_B5CC_5BB94B879762 # # (Bonjour Service) - Apple Computer, Inc - C: \ Program Files \ Bonjour \ mDNSResponder.exe
O23 - Service: ConfigFree tarnybos (CFSvcs) - "Toshiba Corporation - C: \ Program Files \ TOSHIBA \ ConfigFree \ CFSvcs.exe
O23 - Service: Symantec Lic NETCONNECT paslaugos (CLTNetCnService) - Unknown owner - C: \ Program Files \ Common Files \ Symantec Shared \ ccSvcHst.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd - C: \ Program Files \ Common Files \ Macrovision Shared \ FLEXnet Publisher \ FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc - C: \ Program Files \ iPod \ bin \ iPodService.exe
O23 - Service: ServiceLayer - Nokia. - C: \ Program Files \ PC Connectivity Solution \ ServiceLayer.exe
O23 - Service: TOSHIBA CD-ROM įrenginys tarnybos (TODDSrv) - "Toshiba Corporation - C: \ Windows \ system32 \ TODDSrv.exe
O23 - Service: Toshiba Power Saver (TosCoSrv) - "Toshiba Corporation - C: \ Program Files \ TOSHIBA \ Power Saver \ TosCoSrv.exe
O23 - Service: Toshiba Bluetooth Service - Toshiba Corporation - C: \ Program Files \ Toshiba \ Bluetooth Toshiba Stack \ TosBtSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc - C: \ Program Files \ Common Files \ Ulead Systems \ DVD \ ULCDRSvr.exe

--
End of file - 14.403 baitų

I'm gonna Pridėti rąstų pora iš kitų programų siekiant: --

-Squared

a-squared Anti-Malware - Versija 3.1
Paskutinį kartą atnaujinta: 31/01/2008 01:16:41

Skaitymo parametrai:

Objektai: Atmintis, pėdsakai, Cookies, C: \ E: \
Skaitymo archyvai: On
Heuristics: On
ADS Scan: On

Skaitymo pradžia: 31/01/2008 01:46:59

C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro Files \ xqe1wgaj.default \ Cookies.txt: 43 detected: Trace.TrackingCookie
C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro Files \ xqe1wgaj.default \ Cookies.txt: 72 detected: Trace.TrackingCookie
C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro Files \ xqe1wgaj.default \ Cookies.txt: 80 detected: Trace.TrackingCookie
C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro Files \ xqe1wgaj.default \ Cookies.txt: 161, kiekis: Trace.TrackingCookie
C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro Files \ xqe1wgaj.default \ Cookies.txt: 162, kiekis: Trace.TrackingCookie
C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro Files \ xqe1wgaj.default \ Cookies.txt: 167, kiekis: Trace.TrackingCookie
C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro Files \ xqe1wgaj.default \ Cookies.txt: 181, kiekis: Trace.TrackingCookie
C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro Files \ xqe1wgaj.default \ Cookies.txt: 210, kiekis: Trace.TrackingCookie
C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro Files \ xqe1wgaj.default \ Cookies.txt: 282, kiekis: Trace.TrackingCookie
C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro Files \ xqe1wgaj.default \ Cookies.txt: 283, kiekis: Trace.TrackingCookie
C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro Files \ xqe1wgaj.default \ Cookies.txt: 338, kiekis: Trace.TrackingCookie
C: \ Program Files \ DarkandLight \ Launcher.exe detected: Trojan-Spy.Win32.Banker.gez

Nuskaitomi

Failai: 160.756
Pėdos: 296.173
Slapukai: 381
Procesams: 87

Rado

Failai: 1
Pėdos: 0
Slapukai: 11
Procesams: 0
Registro raktus: 0

Skaitymo pabaiga: 31/01/2008 04:13:41
Nuskaitymo laikas: 2:26:42

C: \ Program Files \ DarkandLight \ Launcher.exe išbraukiamas: Trojan-Spy.Win32.Banker.gez
C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro Files \ xqe1wgaj.default \ Cookies.txt: 43 išbraukiamas: Trace.TrackingCookie
C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro Files \ xqe1wgaj.default \ Cookies.txt: 72 išbraukiamas: Trace.TrackingCookie
C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro Files \ xqe1wgaj.default \ Cookies.txt: 80 išbraukiamas: Trace.TrackingCookie
C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro Files \ xqe1wgaj.default \ Cookies.txt: 161 išbraukiama: Trace.TrackingCookie
C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro Files \ xqe1wgaj.default \ Cookies.txt: 162 išbraukiama: Trace.TrackingCookie
C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro Files \ xqe1wgaj.default \ Cookies.txt: 167 išbraukiama: Trace.TrackingCookie
C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro Files \ xqe1wgaj.default \ Cookies.txt: 181 išbraukiama: Trace.TrackingCookie
C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro Files \ xqe1wgaj.default \ Cookies.txt: 210 išbraukiama: Trace.TrackingCookie
C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro Files \ xqe1wgaj.default \ Cookies.txt: 282 išbraukiama: Trace.TrackingCookie
C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro Files \ xqe1wgaj.default \ Cookies.txt: 283 išbraukiama: Trace.TrackingCookie
C: \ Users \ Chris \ AppData \ Roaming \ Mozilla \ Firefox \ Pro Files \ xqe1wgaj.default \ Cookies.txt: 338 išbraukiama: Trace.TrackingCookie

išbraukiama

Failai: 1
Pėdos: 0
Slapukai: 11

Kada naudoti Spybot-S & D gaunu tą pačią problemą

**evilfantasy** · #2 Sausis 31, 2008, 08:24

Sveiki atvykę į TCF.

Atsisiųsti SmitfraudFix (S! RI) darbalaukyje.

Extract visus failus į jūsų darbalaukio.
Aplanką SmitfraudFix bus sukurta darbalaukyje.

[sąrašas]

Perskaitykite visą šių nurodymų savo prieš ką nors. Užduoti klausimus, kurie jums gali prieš pradedant.

Jūs galite atsispausdinti šias instrukcijas arba nukopijuokite ir įklijuokite jį į Notepad ir įrašykite jį į darbalaukį, kaip jūs negalėsite matyti šį puslapį per Safe Mode

Prašau perkrauti kompiuterį Safe Mode bakstelėję F8 prieš paleidžiant Windows pakrauti ir pasirinkti Safe Mode.

Atidaryti SmitfraudFix aplanko darbalaukyje, tada dukart spustelėkite failą, kad pradėtumėte smitfraudfix.cmd įrankis.

Pasirinkite variantą # 2 - Švarios įvesdami 2 paspauskite Registracija.

Programa bus pradėta valyti savo kompiuterį ir pereiti į valymo procesų seriją. Palaukite, kol priemonė visiškai ir Disko valymas, apdaila.
- Šis procesas gali užtrukti priklausomai nuo jūsų kompiuterio, todėl būkite kantrūs.
Kai jis pilnas, ji bus automatiškai uždaryti ir reikia tęsti kitame žingsnyje.

Jums bus pasiūlyta: "Registro valymas - Ar norite išvalyti registrą? Atsakymas Taip įvesdami Y ir paspauskite Registracija.

Įrankis taip pat patikrinti, ar Wininet.dll užkrėstas. Jei jis yra infekuotas ir švarus versija yra nustatyta, jums bus pasiūlyta pakeisti užkrėsti Wininet.dll su švaraus failas.
Atsakymas Taip į klausimą "Pakeisti užkrėstas failas?"Įvedę Y ir paspauskite Registracija.

Perkrauti gali tekti baigti valymo procesas. Ataskaitą galima rasti tinklalapyje sistemos disko, paprastai C: \ rapport.txt

Siūlomas veiksmas:

Atkurti Patikimas ir riboto svetainės zonoje, pasirinkite 3 ir paspauskite Registracija.

Jums bus pasiūlyta: Vėl Patikimas zona? atsakymas Y (taip) ir paspauskite Registracija ištrinti patikimų zonoje.

Dabar perkrauti į normalų darbo režimą ir paštu naujos rapport.txt į šį pranešimą.

ĮSPĖJIMAS Veikia šio ne užkrėstas kompiuteris galimybe bus pašalinti darbalaukio foną. Tad rodomi tik vieną kartą!

----------

Kitas paleisti naują HijackThis nuskaitymo ir po žurnalą.

----------

Sekantis prašome pridėti
SmitfraudFix Prisijungti
Naujas HijackThis

Panašios Temos
Siūlas	Thread Starter	Forumas	Atsakymai	Last Post
Virus klausimas - Ar kas nors pasakyti, jei man gali turėti virusų	billozz	Virus, Spyware & Security	1	2 balandis 2009 13:58
Mano draugai Mac yra virusas ... umm ... yeah ... Virus ...	cheesepuff	Virus, Spyware & Security	3	29 spalis 2008 12:58
Virus Pagalba	jam90	Virus, Spyware & Security	1	28 liepa 2008 07:26
Virus	lolli_pop	Virus, Spyware & Security	13	Lapkritis 17, 2007 09:42
Virusas?	carpious	Virus, Spyware & Security	12	6 gegužė 2007 09:49