|
|
|||||||
| Rekisteröidy | Sivustokartta Spy | Käyttäjälista | Lahjoita | Haku | Today's Posts | Mark Forums Read | Foorumin säännöt |
|
 |
|
|
Thread Tools |
|
#1
28 Sep 2007, 17:13
|
|||
|
|||
|
Zlob, Smitfraud-, pop-ups, punainen taustakuva muutoksia
Nimeni on Tatjana ja im epätoivoisesti apua, yrittänyt lähes joka virusskannauksen outthere, mutta ei onnea. Olen yrittänyt ladata Smitfraud korjata, mutta se ei voinut olla safed koska lähde ei löydy "tai" tuntematon virhe ".. sama tarkka ongelma tämä kaveri" ja i pitää saada typerä pop-ups sanomalla minun pc on uhan kautta tehtäväpalkissa / työkalurivillä ja suuri punainen rasti vilkkuu tehtäväpalkissa ja minun taustakuvaksi työpöydälle muutokset punaisella taustalla suuri symboli kuvaa ja Norton voi nähdä tämän, yksi pop-up bubbles alkaen tehtäväpalkissa / työkalurivin sanoo sen trojan32.looksky, ja myös minun kotisivu IE on muuttunut ucleaner.com lopullinen puhtaampia 2007, whicjh on väärä vakoiluohjelmista asia skanneri / poisto "
Ole hyvä ja auta minua! minun log Logfile tehty HijackThis v1.99.1 Scan tallennettu klo 7:26:18 PM, annettu 9.28.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Käynnissä olevista prosesseista: C: \ WINDOWS \ System32 \ smss.exe C: \ WINDOWS \ system32 \ Winlogon.exe C: \ WINDOWS \ system32 \ Services.exe C: \ WINDOWS \ system32 \ Lsass.exe C: \ WINDOWS \ system32 \ Ati2evxx.exe C: \ WINDOWS \ system32 \ Svchost.exe C: \ WINDOWS \ System32 \ Svchost.exe C: \ WINDOWS \ system32 \ brsvc01a.exe C: \ WINDOWS \ system32 \ brss01a.exe C: \ WINDOWS \ system32 \ spoolsv.exe C: \ Program Files \ Intel \ Intel Application Accelerator \ iaanotif.exe C: \ Program Files \ Intel \ Modem Event Monitor \ IntelMEM.exe C: \ Program Files \ Creative \ Sound Blaster Live! 24-bit \ Surround Mixer \ CTSysVol.exe C: \ WINDOWS \ system32 \ rundll32.exe C: \ Program Files \ Dell \ Media Kokemus \ PCMService.exe C: \ Program Files \ Cyberlink \ PowerDVD \ DVDLauncher.exe C: \ WINDOWS \ system32 \ dla \ tfswctrl.exe C: \ PROGRA ~ 1 \ Yahoo! \ Selaimen \ ybrwicon.exe C: \ Program Files \ BroadJump \ Client Foundation \ CFD.exe C: \ Program Files \ Adobe \ Photoshop Elements 4.0 \ apdproxy.exe C: \ Program Files \ Yahoo! \ Yahoo! Music Engine \ ymetray.exe C: \ Program Files \ Yahoo! \ Antivirus \ CAVTray.exe C: \ Program Files \ Yahoo! \ Antivirus \ CAVRID.exe C: \ PROGRA ~ 1 \ Yahoo! \ YOP \ yop.exe C: \ WINDOWS \ System32 \ spool \ DRIVERS \ W32X86 \ 3 \ E_FATIA JA.EXE C: \ Program Files \ QuickTime \ QTTask.exe C: \ Program Files \ iTunes \ iTunesHelper.exe C: \ Program Files \ Webroot \ Spy Sweeper \ SpySweeperUI.exe C: \ WINDOWS \ SYSTEM32 \ WTablet \ TabUserW.exe C: \ PROGRA ~ 1 \ Yahoo! \ Messen ~ 1 \ ymsgr_tray.exe C: \ PROGRA ~ 1 \ Yahoo! \ Selaimen \ ycommon.exe C: \ Program Files \ APC \ APC PowerChute Personal Edition \ apcsystray.exe C: \ Program Files \ Adobe \ Photoshop Elements 3.0 \ PhotoshopElementsFileAgent.exe C: \ Program Files \ Adobe \ Photoshop Elements 4.0 \ PhotoshopElementsFileAgent.exe C: \ PROGRA ~ 1 \ Common ~ 1 \ AOL \ ACS \ acsd.exe C: \ Program Files \ APC \ APC PowerChute Personal Edition \ mainserv.exe C: \ Program Files \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe C: \ Program Files \ Yahoo! \ Antivirus \ ISafe.exe C: \ Program Files \ CIFPFiltering \ CIFPLogAggregator.exe C: \ WINDOWS \ system32 \ CTsvcCDA.EXE C: \ Program Files \ CIFPFiltering \ FilterService.exe C: \ Program Files \ Intel \ Intel Application Accelerator \ iaantmon.exe C: \ Program Files \ Common Files \ LightScribe \ LSSrvc.exe c: \ PROGRA ~ 1 \ mcafee.com \ VSO \ mcvsrte.exe C: \ Program Files \ Eset \ nod32krn.exe C: \ WINDOWS \ system32 \ Svchost.exe C: \ WINDOWS \ system32 \ Tablet.exe C: \ Program Files \ Yahoo! \ Antivirus \ VetMsg.exe C: \ WINDOWS \ wanmpsvc.exe C: \ Program Files \ Webroot \ Spy Sweeper \ SpySweeper.exe C: \ WINDOWS \ system32 \ MsPMSPSv.exe C: \ Program Files \ iPod \ bin \ iPodService.exe C: \ WINDOWS \ system32 \ wscntfy.exe C: \ Program Files \ Mozilla Firefox \ firefox.exe C: \ WINDOWS \ system32 \ wuauclt.exe C: \ Program Files \ Webroot \ Spy Sweeper \ SSU.EXE C: \ WINDOWS \ explorer.exe C: \ PROGRA ~ 1 \ Yahoo! \ Selaimen \ ybrowser.exe C: \ Program Files \ Hijackthis \ HijackThis.exe R1 - HKCU \ Software \ Microsoft \ Internet Explorer \ Main, Default_Page_URL = http://www.dell4me.com/myway R1 - HKCU \ Software \ Microsoft \ Internet Explorer \ Main, Search Bar = http://red.clientapps.yahoo.com/cust...search/ie.html R1 - HKCU \ Software \ Microsoft \ Internet Explorer \ Main, Search Page = http://red.clientapps.yahoo.com/cust.../www.yahoo.com R0 - HKCU \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://yahoo.sbc.com/dsl R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Page_URL = http://yahoo.sbc.com/dsl R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Search_URL = http://red.clientapps.yahoo.com/cust.../www.yahoo.com R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Search Bar = http://red.clientapps.yahoo.com/cust...search/ie.html R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Search Page = http://red.clientapps.yahoo.com/cust.../www.yahoo.com R0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://yahoo.sbc.com/dsl R1 - HKCU \ Software \ Microsoft \ Internet Explorer \ SearchURL, (Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com R1 - HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Int ernet Asetukset, ProxyServer = 127.0.0.1:8080 R1 - HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Int ernet Asetukset, ProxyOverride = paikallinen N3 - Netscape 7: user_pref ( "browser.startup.homepage", "http://home.netscape.com/bookmark/7_2/home.html"); (C: \ Documents and Settings \ Tatjana Blazevic \ Application Data \ Mozilla \ Profiles \ Default \ mhiwv3o3.slt \ prefs.js) N3 - Netscape 7: user_pref ( "browser.search.defaultengine", "moottori: / / C% 3A% 5CPROGRA% 7E1% 5CNETSCAPE% 5CNETSCAPE% 5Csearchpl ugins% 5CSBWeb_01.src"); (C: \ Documents and Settings \ Tatjana BLAZEVIC \ Application Data \ Mozilla \ Profiles \ Default \ mhiwv3o3.slt \ prefs.js) O2 - BHO: AcroIEHlprObj Class - (06849E9F-C8D7-4D59-B87D-784B7D6BE0B3) - C: \ Program Files \ Adobe \ Acrobat 6.0 \ Reader \ ActiveX \ AcroIEHelper.dll O2 - BHO: (no name) - (549B5CA7-4A86-11D7-A4DF-000874180BB3) - (no file) O2 - BHO: UberButton Class - (5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897) - C: \ Program Files \ Yahoo! \ Common \ yiesrvc.dll O2 - BHO: DriveLetterAccess - (5CA3D70E-1895-11CF-8E15-001234567890) - C: \ WINDOWS \ system32 \ dla \ tfswshx.dll O2 - BHO: YahooTaggedBM Class - (65D886A2-7CA7-479b-BB95-14D1EFB7946A) - C: \ Program Files \ Yahoo! \ Common \ YIeTagBm.dll O2 - BHO: SidebarAutoLaunch Class - (F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D) - C: \ Program Files \ Yahoo! \ Selaimen \ YSidebarIEBHO.dll O2 - BHO: (no name) - (FDD3B846-8D59-4ffb-8758-209B6AD74ACC) - (no file) O3 - Toolbar: McAfee VirusScan - (BA52B914-B692-46c4-B683-905236F6F655) - c: \ progra ~ 1 \ mcafee.com \ VSO \ mcvsshl.dll O3 - Toolbar: Yahoo! Toolbar - (EF99BD32-C1FB-11D2-892F-0090271D4F88) - C: \ Program Files \ Yahoo! \ Companion \ Installs \ CPN \ yt.dll O4 - HKLM \ .. \ Run: [IAAnotif] "C: \ Program Files \ Intel \ Intel Application Accelerator \ iaanotif.exe" O4 - HKLM \ .. \ Run: [ATIPTA] "C: \ Program Files \ ATI Technologies \ ATI Control Panel \ atiptaxx.exe" O4 - HKLM \ .. \ Run: [IntelMeM] "C: \ Program Files \ Intel \ Modem Event Monitor \ IntelMEM.exe" O4 - HKLM \ .. \ Run: [CTSysVol] "C: \ Program Files \ Creative \ Sound Blaster Live! 24-bit \ Surround Mixer \ CTSysVol.exe" / r O4 - HKLM \ .. \ Run: [P17Helper] rundll32 P17.dll, P17Helper O4 - HKLM \ .. \ Run: [UpdReg] C: \ WINDOWS \ UpdReg.EXE O4 - HKLM \ .. \ Run: [PCMService] "C: \ Program Files \ Dell \ Media Kokemus \ PCMService.exe" O4 - HKLM \ .. \ Run: [DVDLauncher] "C: \ Program Files \ Cyberlink \ PowerDVD \ DVDLauncher.exe" O4 - HKLM \ .. \ Run: [UpdateManager] "C: \ Program Files \ Common Files \ Sonic \ Update Manager \ sgtray.exe" / r O4 - HKLM \ .. \ Run: [dla] C: \ WINDOWS \ system32 \ dla \ tfswctrl.exe O4 - HKLM \ .. \ Run: [YBrowser] C: \ PROGRA ~ 1 \ Yahoo! \ Selaimen \ ybrwicon.exe O4 - HKLM \ .. \ Run: [BJCFD] "C: \ Program Files \ BroadJump \ Client Foundation \ CFD.exe" O4 - HKLM \ .. \ Run: [VSOCheckTask] "C: \ PROGRA ~ 1 \ mcafee.com \ VSO \ mcmnhdlr.exe" / checktask O4 - HKLM \ .. \ Run: [VirusScan Online] c: \ PROGRA ~ 1 \ mcafee.com \ VSO \ mcvsshld.exe O4 - HKLM \ .. \ Run: [Adobe Photo Downloader] "C: \ Program Files \ Adobe \ Photoshop Elements 4.0 \ apdproxy.exe" O4 - HKLM \ .. \ Run: [ymetray] "C: \ Program Files \ Yahoo! \ Yahoo! Music Engine \ ymetray.exe" O4 - HKLM \ .. \ Run: [CaAvTray] "C: \ Program Files \ Yahoo! \ Antivirus \ CAVTray.exe" O4 - HKLM \ .. \ Run: [CAVRID] "C: \ Program Files \ Yahoo! \ Antivirus \ CAVRID.exe" O4 - HKLM \ .. \ Run: [YOP] "C: \ PROGRA ~ 1 \ Yahoo! \ YOP \ yop.exe" / Autostart O4 - HKLM \ .. \ Run: [EPSON Stylus Photo R340 Series] "C: \ WINDOWS \ System32 \ spool \ DRIVERS \ W32X86 \ 3 \ E_FATI AJA.EXE" / P30 "EPSON Stylus Photo R340 Series" / O6 "USB002 "/ M" Stylus Photo R340 " O4 - HKLM \ .. \ Run: [nod32kui] "C: \ Program Files \ Eset \ nod32kui.exe" / WAITSERVICE O4 - HKLM \ .. \ Run: [QuickTime Task] "C: \ Program Files \ QuickTime \ QTTask.exe"-atboottime O4 - HKLM \ .. \ Run: [iTunesHelper] "C: \ Program Files \ iTunes \ iTunesHelper.exe" O4 - HKLM \ .. \ Run: [SpySweeper] "C: \ Program Files \ Webroot \ Spy Sweeper \ SpySweeperUI.exe" / startintray O4 - HKCU \ .. \ Run: [Yahoo! Hakulaite] "C: \ PROGRA ~ 1 \ Yahoo! \ Messen ~ 1 \ ypager.exe"-quiet O4 - HKCU \ .. \ Run: [SpybotSD TeaTimer] "C: \ Program Files \ Spybot - Search & Destroy \ TeaTimer.exe" O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C: \ Program Files \ Common Files \ Adobe \ Calibration \ Adobe Gamma Loader.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C: \ Program Files \ Common Files \ Adobe \ Calibration \ Adobe Gamma Loader.exe O4 - Global Startup: America Online 9.0 Lokero Icon.lnk = C: \ Program Files \ America Online 9.0 \ aoltray.exe O4 - Global Startup: APC UPS Status.lnk =? O4 - Global Startup: ColorVisionStartup.lnk = C: \ Program Files \ PANTONE COLORVISION \ Startup \ ColorVisionStartup.exe O4 - Global Startup: TabUserW.exe.lnk = C: \ WINDOWS \ SYSTEM32 \ WTablet \ TabUserW.exe O9 - Extra button: SBC Yahoo! Services - (5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897) - C: \ Program Files \ Yahoo! \ Common \ yiesrvc.dll O9 - Extra button: (no name) - (CD67F990-D8E9-11D2-98FE-00C0F0318AFE) - (no file) O9 - Extra button: MusicMatch MX Web Player - (d81ca86b-ef63-42af-bee3-4502d9a03c2d) -- http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing) O9 - Extra button: Messenger - (FB5F1910-F110-11D2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - (FB5F1910-F110-11D2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ msmsgs.exe O16 - DPF: (9A9307A0-7DA4-4DAF-B042-5009F29E09E1) (ActiveScan Installer Class) -- http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: (DBA230D1-8467-4e69-987E-5FAE815A3B45) -- O20 - Winlogon Notify: WgaLogon - C: \ WINDOWS \ SYSTEM32 \ WgaLogon.dll O20 - Winlogon Notify: WRNotifier - C: \ WINDOWS \ SYSTEM32 \ WRLogonNTF.dll O21 - SSODL: mssql - (9516DDA8-E023-4472-A7C0-12A7A4834359) - C: \ WINDOWS \ mssql.dll O21 - SSODL: syscore - (D5B03680-8880-4BC8-80A4-C9BAC2A7A341) - C: \ WINDOWS \ syscore.dll O21 - SSODL: msmhost - (69F3A520-2471-4FF3-8139-ECFD56DED8DB) - C: \ WINDOWS \ msmhost.dll O21 - SSODL: msmdev - (E8E8584D-8FA5-4641-A934-8A93158794E9) - C: \ WINDOWS \ msmdev.dll O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C: \ Program Files \ Adobe \ Photoshop Elements 3.0 \ PhotoshopElementsFileAgent.exe O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C: \ Program Files \ Adobe \ Photoshop Elements 4.0 \ PhotoshopElementsFileAgent.exe O23 - Service: AOL Yhteydet Service (AOL ACS) - America Online, Inc. - C: \ PROGRA ~ 1 \ Common ~ 1 \ AOL \ ACS \ acsd.exe O23 - Service: APC UPS Service - American Power Conversion Corporation - C: \ Program Files \ APC \ APC PowerChute Personal Edition \ mainserv.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C: \ Program Files \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe O23 - Service: Ati Pikanäppäin Poller - Unknown owner - C: \ WINDOWS \ system32 \ Ati2evxx.exe O23 - Service: BrSplService (Brother XP SPL Service) - Brother Industries Ltd - C: \ WINDOWS \ system32 \ brsvc01a.exe O23 - Service: CAISafe - Computer Associates International, Inc. - C: \ Program Files \ Yahoo! \ Antivirus \ ISafe.exe O23 - Service: CIFPLogAggregator - Unknown owner - C: \ Program Files \ CIFPFiltering \ CIFPLogAggregator.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C: \ WINDOWS \ system32 \ CTsvcCDA.EXE O23 - Service: CyclopeInternetFilter - Unknown owner - C: \ Program Files \ CIFPFiltering \ FilterService.exe O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C: \ Program Files \ Intel \ Intel Application Accelerator \ iaantmon.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C: \ Program Files \ Common Files \ InstallShield \ Driver \ 11 \ Intel 32 \ IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C: \ Program Files \ iPod \ bin \ iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C: \ Program Files \ Common Files \ LightScribe \ LSSrvc.exe O23 - Service: McAfee.com McShield (McShield) - Unknown owner - C: \ PROGRA ~ 1 \ mcafee.com \ VSO \ mcshield.exe O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc. - c: \ PROGRA ~ 1 \ mcafee.com \ VSO \ mcvsrte.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C: \ Program Files \ Eset \ nod32krn.exe O23 - Service: TabletService - Wacom Technology, Corp. - C: \ WINDOWS \ system32 \ Tablet.exe O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C: \ Program Files \ Yahoo! \ Antivirus \ VetMsg.exe O23 - Service: WAN Miniport (atwig) Service (WANMiniportService) - America Online, Inc. - C: \ WINDOWS \ wanmpsvc.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C: \ Program Files \ Webroot \ Spy Sweeper \ SpySweeper.exe O23 - Service: YPCService - Yahoo! Inc. - C: \ WINDOWS \ SYSTEM32 \ YPCSER ~ 1.EXE |
|
#2
28 Sep 2007, 17:55
|
|||
|
|||
|
Zlob, Smitfraud-, pop-ups, punainen taustakuva muutoksia
Hi Tatjana, tervetuloa TCF.
* Tärkeää * Nimeä Hijackthis.exe tiedosto Analyze.exe. Tämä on tärkeää, koska joidenkin uusien haittaohjelmien muotoja voi piiloutua HijackThis.exe. Oikeus napsauttamalla HijackThis.exe tiedosto C: \ Program Files \ HijackThis ja valitse Nimeä uudelleen. Kirjoita Analyze.exe ja paina Enter-näppäintä. Oikeus napsauttamalla Analyze.exe tiedostoon ja lähettää työpöydän pikakuvakkeen luomisesta. ============================ Näyttää siltä, että sinulla on useampi kuin yksi Antivirus asennettu. Jos niin käy, että lisää / poista sovellus ja poista kaikki paitsi yksi. Ottaa enemmän sitten jokin antivirus on tarpeetonta ja voi aiheuttaa konflikteja. ============================ Poista Spybot n TeaTimer. Vaikka TeaTimer on erinomainen väline ehkäisyä vakoiluohjelmia, se voi joskus estää työkalut vahvistamisesta tiettyjä asioita. Poista TeaTimer nyt kunnes olet puhdas. TeaTimer voi aktivoitua uudelleen kerran lokitiedostoissa ovat puhtaat. * Avaa Spybot Search & Destroy. * Kun valikosta klikkaa "Edistynyt tila"Jos ei ole jo valittuna. * Valitse "Kyllä"At Varoitus kehote. * Laajenna "Työkalut"-Valikosta. * Klikkaa "Asukas". * Poista "Asukas "TeaTimer" (suoja koko järjestelmän asetuksia) aktiivinen."Laatikko. * Vuonna Tiedosto-valikosta klikkaa "Poistu"Poistuaksesi Spybot Search & Destroy. + Voit uudelleen käyttöön TeaTimer kun olemme tehneet. ============================= Lataa ATF Cleaner on Atribune. Tämä auttaa mitään skannaa ajaa nopeammin. ATF Cleaner.exe Tämä ohjelma ei vaadi asennusta. Suoritustiedoston itse käynnistää ohjelman. HUOM: ATF Cleaner poistaa kaikki tiedostot kohteista on valittu niin, jos sinulla on evästeet haluat tallentaa. Ole hyvä ja siirtää ne eri hakemistoon ensin. * Kaksoisnapsauta ATF-Cleaner.exe ohjelman suorittamiseen. * Alle Main valita: Valitse kaikki * Valitse Tyhjä Valitut painiketta. Jos käytät Firefox selain * Valitse Firefox yläreunassa ja valitse: Valitse kaikki * Valitse Tyhjä Valitut painiketta. HUOM: Jos haluaisit pitää tallennetut salasanasi, klikkaa Ei klo kehoitteeseen. Jos käytät Opera selain * Valitse Opera yläreunassa ja valitse: Valitse kaikki * Valitse Tyhjä Valitut painiketta. HUOM: Jos haluaisit pitää tallennetut salasanasi, klikkaa Ei klo kehoitteeseen. Valitse Poistu päälistalla ATF Cleaner valikosta Lopeta ohjelma. =============================== 1. Lataa tämä tiedosto combofix.exe 2. Kaksoisnapsauta combofix.exe ja seuraa ohjeita. 3. Kun olet valmis, se tuottaa lokin sinulle. Post, että kirjaudut sisään seuraavan vastauksen. Huom: Älä mouseclick combofix ikkunassa vaikka se on käynnissä. Tämä saattaa aiheuttaa sen, pilttuu. ===================================== In the next post lisää: Combofix log Uusi ja nimettiin HijackThis loki 
__________________
 |
|
#3
28 Sep 2007, 18:31
|
|||
|
|||
|
Zlob, Smitfraud-, pop-ups, punainen taustakuva muutoksia
Myös:
Haluan tietää, miten asiat ovat nyt.
__________________
|
|
#4
29th Sep 2007, 22:23
|
|||
|
|||
|
Zlob, Smitfraud-, pop-ups, punainen taustakuva muutoksia
Hi evilfantasy-thx varten nopea vastaus .. minun tietokone on käynnissä hyvin hidas, ja se kesti tunnin lähettämistä tämän .. Tein mitä kerroitte minulle uninstalled antivirus-nod32, spysweeper ja yahoo Online Protection ..
i liitetty combofix loki ja tästä on hijackthis loki. Logfile tehty HijackThis v1.99.1 Scan tallennettu klo 1:11:41 AM, annettu 9.30.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Käynnissä olevista prosesseista: C: \ WINDOWS \ System32 \ smss.exe C: \ WINDOWS \ system32 \ Winlogon.exe C: \ WINDOWS \ system32 \ Services.exe C: \ WINDOWS \ system32 \ Lsass.exe C: \ WINDOWS \ system32 \ Ati2evxx.exe C: \ WINDOWS \ system32 \ Svchost.exe C: \ WINDOWS \ System32 \ Svchost.exe C: \ WINDOWS \ system32 \ brss01a.exe C: \ WINDOWS \ system32 \ spoolsv.exe C: \ WINDOWS \ Explorer.exe C: \ Program Files \ Adobe \ Photoshop Elements 3.0 \ PhotoshopElementsFileAgent.exe C: \ Program Files \ Adobe \ Photoshop Elements 4.0 \ PhotoshopElementsFileAgent.exe C: \ PROGRA ~ 1 \ Common ~ 1 \ AOL \ ACS \ acsd.exe C: \ Program Files \ APC \ APC PowerChute Personal Edition \ mainserv.exe C: \ Program Files \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe C: \ Program Files \ CIFPFiltering \ CIFPLogAggregator.exe C: \ WINDOWS \ system32 \ CTsvcCDA.EXE C: \ Program Files \ CIFPFiltering \ FilterService.exe C: \ Program Files \ Intel \ Intel Application Accelerator \ iaantmon.exe C: \ Program Files \ Common Files \ LightScribe \ LSSrvc.exe C: \ WINDOWS \ system32 \ Svchost.exe C: \ WINDOWS \ system32 \ Tablet.exe C: \ WINDOWS \ wanmpsvc.exe C: \ WINDOWS \ system32 \ MsPMSPSv.exe C: \ WINDOWS \ system32 \ wscntfy.exe C: \ Program Files \ Intel \ Intel Application Accelerator \ iaanotif.exe C: \ Program Files \ Intel \ Modem Event Monitor \ IntelMEM.exe C: \ Program Files \ Creative \ Sound Blaster Live! 24-bit \ Surround Mixer \ CTSysVol.exe C: \ WINDOWS \ system32 \ rundll32.exe C: \ Program Files \ Dell \ Media Kokemus \ PCMService.exe C: \ Program Files \ Cyberlink \ PowerDVD \ DVDLauncher.exe C: \ Program Files \ Common Files \ Sonic \ Update Manager \ sgtray.exe C: \ WINDOWS \ system32 \ dla \ tfswctrl.exe C: \ WINDOWS \ system32 \ wuauclt.exe C: \ PROGRA ~ 1 \ Yahoo! \ Selaimen \ ybrwicon.exe C: \ Program Files \ BroadJump \ Client Foundation \ CFD.exe C: \ Program Files \ Adobe \ Photoshop Elements 4.0 \ apdproxy.exe C: \ Program Files \ Yahoo! \ Yahoo! Music Engine \ ymetray.exe C: \ PROGRA ~ 1 \ Yahoo! \ Selaimen \ ycommon.exe C: \ WINDOWS \ System32 \ spool \ DRIVERS \ W32X86 \ 3 \ E_FATIA JA.EXE C: \ Program Files \ QuickTime \ QTTask.exe C: \ Program Files \ iTunes \ iTunesHelper.exe C: \ Program Files \ Spybot - Search & Destroy \ TeaTimer.exe C: \ WINDOWS \ SYSTEM32 \ WTablet \ TabUserW.exe C: \ Program Files \ APC \ APC PowerChute Personal Edition \ apcsystray.exe C: \ PROGRA ~ 1 \ Yahoo! \ Messen ~ 1 \ ymsgr_tray.exe C: \ Program Files \ iPod \ bin \ iPodService.exe C: \ Program Files \ HijackThis \ Analyze.exe R0 - HKCU \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://softwarereferral.com/jump.php...MjI6Ojg5&lid=2 R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Page_URL = http://yahoo.sbc.com/dsl R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Search_URL = http://red.clientapps.yahoo.com/cust.../www.yahoo.com R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Search Bar = http://red.clientapps.yahoo.com/cust...search/ie.html R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Search Page = http://red.clientapps.yahoo.com/cust.../www.yahoo.com R0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://yahoo.sbc.com/dsl R1 - HKCU \ Software \ Microsoft \ Internet Explorer \ SearchURL, (Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com R1 - HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Int ernet Asetukset, ProxyServer = 127.0.0.1:8080 R1 - HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Int ernet Asetukset, ProxyOverride = paikallinen N3 - Netscape 7: user_pref ( "browser.startup.homepage", "http://home.netscape.com/bookmark/7_2/home.html"); (C: \ Documents and Settings \ Tatjana Blazevic \ Application Data \ Mozilla \ Profiles \ Default \ mhiwv3o3.slt \ prefs.js) N3 - Netscape 7: user_pref ( "browser.search.defaultengine", "moottori: / / C% 3A% 5CPROGRA% 7E1% 5CNETSCAPE% 5CNETSCAPE% 5Csearchpl ugins% 5CSBWeb_01.src"); (C: \ Documents and Settings \ Tatjana BLAZEVIC \ Application Data \ Mozilla \ Profiles \ Default \ mhiwv3o3.slt \ prefs.js) O2 - BHO: AcroIEHlprObj Class - (06849E9F-C8D7-4D59-B87D-784B7D6BE0B3) - C: \ Program Files \ Adobe \ Acrobat 6.0 \ Reader \ ActiveX \ AcroIEHelper.dll O2 - BHO: Spybot-S & D IE Protection - (53707962-6F74-2D53-2644-206D7942484F) - C: \ PROGRA ~ 1 \ Spybot ~ 1 \ SDHelper.dll O2 - BHO: (no name) - (549B5CA7-4A86-11D7-A4DF-000874180BB3) - (no file) O2 - BHO: UberButton Class - (5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897) - C: \ Program Files \ Yahoo! \ Common \ yiesrvc.dll O2 - BHO: DriveLetterAccess - (5CA3D70E-1895-11CF-8E15-001234567890) - C: \ WINDOWS \ system32 \ dla \ tfswshx.dll O2 - BHO: YahooTaggedBM Class - (65D886A2-7CA7-479b-BB95-14D1EFB7946A) - C: \ Program Files \ Yahoo! \ Common \ YIeTagBm.dll O2 - BHO: SidebarAutoLaunch Class - (F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D) - C: \ Program Files \ Yahoo! \ Selaimen \ YSidebarIEBHO.dll O2 - BHO: (no name) - (FDD3B846-8D59-4ffb-8758-209B6AD74ACC) - (no file) O3 - Toolbar: McAfee VirusScan - (BA52B914-B692-46c4-B683-905236F6F655) - c: \ progra ~ 1 \ mcafee.com \ VSO \ mcvsshl.dll O4 - HKLM \ .. \ Run: [IAAnotif] "C: \ Program Files \ Intel \ Intel Application Accelerator \ iaanotif.exe" O4 - HKLM \ .. \ Run: [ATIPTA] "C: \ Program Files \ ATI Technologies \ ATI Control Panel \ atiptaxx.exe" O4 - HKLM \ .. \ Run: [IntelMeM] "C: \ Program Files \ Intel \ Modem Event Monitor \ IntelMEM.exe" O4 - HKLM \ .. \ Run: [CTSysVol] "C: \ Program Files \ Creative \ Sound Blaster Live! 24-bit \ Surround Mixer \ CTSysVol.exe" / r O4 - HKLM \ .. \ Run: [P17Helper] rundll32 P17.dll, P17Helper O4 - HKLM \ .. \ Run: [UpdReg] C: \ WINDOWS \ UpdReg.EXE O4 - HKLM \ .. \ Run: [PCMService] "C: \ Program Files \ Dell \ Media Kokemus \ PCMService.exe" O4 - HKLM \ .. \ Run: [DVDLauncher] "C: \ Program Files \ Cyberlink \ PowerDVD \ DVDLauncher.exe" O4 - HKLM \ .. \ Run: [UpdateManager] "C: \ Program Files \ Common Files \ Sonic \ Update Manager \ sgtray.exe" / r O4 - HKLM \ .. \ Run: [dla] C: \ WINDOWS \ system32 \ dla \ tfswctrl.exe O4 - HKLM \ .. \ Run: [YBrowser] C: \ PROGRA ~ 1 \ Yahoo! \ Selaimen \ ybrwicon.exe O4 - HKLM \ .. \ Run: [BJCFD] "C: \ Program Files \ BroadJump \ Client Foundation \ CFD.exe" O4 - HKLM \ .. \ Run: [VSOCheckTask] "C: \ PROGRA ~ 1 \ mcafee.com \ VSO \ mcmnhdlr.exe" / checktask O4 - HKLM \ .. \ Run: [Adobe Photo Downloader] "C: \ Program Files \ Adobe \ Photoshop Elements 4.0 \ apdproxy.exe" O4 - HKLM \ .. \ Run: [ymetray] "C: \ Program Files \ Yahoo! \ Yahoo! Music Engine \ ymetray.exe" O4 - HKLM \ .. \ Run: [EPSON Stylus Photo R340 Series] "C: \ WINDOWS \ System32 \ spool \ DRIVERS \ W32X86 \ 3 \ E_FATI AJA.EXE" / P30 "EPSON Stylus Photo R340 Series" / O6 "USB002 "/ M" Stylus Photo R340 " O4 - HKLM \ .. \ Run: [QuickTime Task] "C: \ Program Files \ QuickTime \ QTTask.exe"-atboottime O4 - HKLM \ .. \ Run: [iTunesHelper] "C: \ Program Files \ iTunes \ iTunesHelper.exe" O4 - HKCU \ .. \ Run: [Yahoo! Hakulaite] "C: \ PROGRA ~ 1 \ Yahoo! \ Messen ~ 1 \ ypager.exe"-quiet O4 - HKCU \ .. \ Run: [SpybotSD TeaTimer] C: \ Program Files \ Spybot - Search & Destroy \ TeaTimer.exe O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C: \ Program Files \ Common Files \ Adobe \ Calibration \ Adobe Gamma Loader.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C: \ Program Files \ Common Files \ Adobe \ Calibration \ Adobe Gamma Loader.exe O4 - Global Startup: America Online 9.0 Lokero Icon.lnk = C: \ Program Files \ America Online 9.0 \ aoltray.exe O4 - Global Startup: APC UPS Status.lnk =? O4 - Global Startup: ColorVisionStartup.lnk = C: \ Program Files \ PANTONE COLORVISION \ Startup \ ColorVisionStartup.exe O4 - Global Startup: TabUserW.exe.lnk = C: \ WINDOWS \ SYSTEM32 \ WTablet \ TabUserW.exe O9 - Extra button: SBC Yahoo! Services - (5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897) - C: \ Program Files \ Yahoo! \ Common \ yiesrvc.dll O9 - Extra button: (no name) - (CD67F990-D8E9-11D2-98FE-00C0F0318AFE) - (no file) O9 - Extra button: MusicMatch MX Web Player - (d81ca86b-ef63-42af-bee3-4502d9a03c2d) -- http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing) O9 - Extra button: (no name) - (DFB852A3-47F8-48C4-A200-58CAB36FD2A2) - C: \ PROGRA ~ 1 \ Spybot ~ 1 \ SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - (DFB852A3-47F8-48C4-A200-58CAB36FD2A2) - C: \ PROGRA ~ 1 \ Spybot ~ 1 \ SDHelper.dll O9 - Extra button: Messenger - (FB5F1910-F110-11D2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - (FB5F1910-F110-11D2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ msmsgs.exe O16 - DPF: (9A9307A0-7DA4-4DAF-B042-5009F29E09E1) (ActiveScan Installer Class) -- http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: (DBA230D1-8467-4e69-987E-5FAE815A3B45) -- O20 - Winlogon Notify: WgaLogon - C: \ WINDOWS \ SYSTEM32 \ WgaLogon.dll O21 - SSODL: mssql - (9516DDA8-E023-4472-A7C0-12A7A4834359) - C: \ WINDOWS \ mssql.dll O21 - SSODL: syscore - (D5B03680-8880-4BC8-80A4-C9BAC2A7A341) - C: \ WINDOWS \ syscore.dll O21 - SSODL: msmdev - (074897B2-6CAF-45A4-905A-C5A5FC626767) - C: \ WINDOWS \ msmdev.dll (file missing) O21 - SSODL: msmhost - (70D6A632-39E2-4089-9E67-552ADB6B182D) - C: \ WINDOWS \ msmhost.dll (file missing) O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C: \ Program Files \ Adobe \ Photoshop Elements 3.0 \ PhotoshopElementsFileAgent.exe O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C: \ Program Files \ Adobe \ Photoshop Elements 4.0 \ PhotoshopElementsFileAgent.exe O23 - Service: AOL Yhteydet Service (AOL ACS) - America Online, Inc. - C: \ PROGRA ~ 1 \ Common ~ 1 \ AOL \ ACS \ acsd.exe O23 - Service: APC UPS Service - American Power Conversion Corporation - C: \ Program Files \ APC \ APC PowerChute Personal Edition \ mainserv.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C: \ Program Files \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe O23 - Service: Ati Pikanäppäin Poller - Unknown owner - C: \ WINDOWS \ system32 \ Ati2evxx.exe O23 - Service: BrSplService (Brother XP SPL Service) - Brother Industries Ltd - C: \ WINDOWS \ system32 \ brsvc01a.exe O23 - Service: CIFPLogAggregator - Unknown owner - C: \ Program Files \ CIFPFiltering \ CIFPLogAggregator.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C: \ WINDOWS \ system32 \ CTsvcCDA.EXE O23 - Service: CyclopeInternetFilter - Unknown owner - C: \ Program Files \ CIFPFiltering \ FilterService.exe O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C: \ Program Files \ Intel \ Intel Application Accelerator \ iaantmon.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C: \ Program Files \ Common Files \ InstallShield \ Driver \ 11 \ Intel 32 \ IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C: \ Program Files \ iPod \ bin \ iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C: \ Program Files \ Common Files \ LightScribe \ LSSrvc.exe O23 - Service: McAfee.com McShield (McShield) - Unknown owner - C: \ PROGRA ~ 1 \ mcafee.com \ VSO \ mcshield.exe O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc. - c: \ PROGRA ~ 1 \ mcafee.com \ VSO \ mcvsrte.exe O23 - Service: TabletService - Wacom Technology, Corp. - C: \ WINDOWS \ system32 \ Tablet.exe O23 - Service: WAN Miniport (atwig) Service (WANMiniportService) - America Online, Inc. - C: \ WINDOWS \ wanmpsvc.exe |
|
#5
30 Sep 2007, 00:49
|
|||
|
|||
|
Zlob, Smitfraud-, pop-ups, punainen taustakuva muutoksia
Avaa HijackThis ja valitse "Tee järjestelmän tarkistus vain"Ja aseta valintamerkki vieressä nämä merkinnät.
R0 - HKCU \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://softwarereferral.com/jump.php...MjI6Ojg5&lid=2 O2 - BHO: (no name) - (549B5CA7-4A86-11D7-A4DF-000874180BB3) - (no file) O2 - BHO: (no name) - (FDD3B846-8D59-4ffb-8758-209B6AD74ACC) - (no file) O9 - Extra button: (no name) - (CD67F990-D8E9-11D2-98FE-00C0F0318AFE) - (no file) O9 - Extra button: MusicMatch MX Web Player - (d81ca86b-ef63-42af-bee3-4502d9a03c2d) -- http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing) O16 - DPF: (DBA230D1-8467-4e69-987E-5FAE815A3B45) -- Sulje kaikki selainikkunat, mukaan lukien tämä yksi ja valitse sitten "Korjaa tarkastetaan" Käynnistä tietokone uudelleen ja lähetä uusi HijackThis loki. Kerro minulle, miten asiat ovat nyt.
__________________
|
|
#6
30 Sep 2007, 08:16
|
|||
|
|||
|
Zlob, Smitfraud-, pop-ups, punainen taustakuva muutoksia
helllo, ahh minun tietokone lopuksi ei ole ärsyttävää ikkunat pop up varoitukset, ja kolme virusskannauksen kuvakkeet, jotka on asennettu tietokone on myös mennyt, yeeeah ..
 Näyttää siltä, että kaikki on palannut normaaliksi, punainen tausta on myös poissa. Tässä on loki.Logfile tehty HijackThis v1.99.1 Scan tallennettu klo 11:03:37, on 9.30.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Käynnissä olevista prosesseista: C: \ WINDOWS \ System32 \ smss.exe C: \ WINDOWS \ system32 \ Winlogon.exe C: \ WINDOWS \ system32 \ Services.exe C: \ WINDOWS \ system32 \ Lsass.exe C: \ WINDOWS \ system32 \ Ati2evxx.exe C: \ WINDOWS \ system32 \ Svchost.exe C: \ WINDOWS \ System32 \ Svchost.exe C: \ WINDOWS \ system32 \ spoolsv.exe C: \ WINDOWS \ system32 \ brss01a.exe C: \ WINDOWS \ Explorer.exe C: \ Program Files \ Intel \ Intel Application Accelerator \ iaanotif.exe C: \ Program Files \ Intel \ Modem Event Monitor \ IntelMEM.exe C: \ Program Files \ Creative \ Sound Blaster Live! 24-bit \ Surround Mixer \ CTSysVol.exe C: \ WINDOWS \ system32 \ rundll32.exe C: \ Program Files \ Dell \ Media Kokemus \ PCMService.exe C: \ Program Files \ Cyberlink \ PowerDVD \ DVDLauncher.exe C: \ WINDOWS \ system32 \ dla \ tfswctrl.exe C: \ PROGRA ~ 1 \ Yahoo! \ Selaimen \ ybrwicon.exe C: \ Program Files \ BroadJump \ Client Foundation \ CFD.exe C: \ Program Files \ Adobe \ Photoshop Elements 4.0 \ apdproxy.exe C: \ PROGRA ~ 1 \ Yahoo! \ Selaimen \ ycommon.exe C: \ Program Files \ Yahoo! \ Yahoo! Music Engine \ ymetray.exe C: \ Program Files \ Adobe \ Photoshop Elements 3.0 \ PhotoshopElementsFileAgent.exe C: \ Program Files \ Adobe \ Photoshop Elements 4.0 \ PhotoshopElementsFileAgent.exe C: \ PROGRA ~ 1 \ Common ~ 1 \ AOL \ ACS \ acsd.exe C: \ Program Files \ APC \ APC PowerChute Personal Edition \ mainserv.exe C: \ Program Files \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe C: \ Program Files \ CIFPFiltering \ CIFPLogAggregator.exe C: \ WINDOWS \ system32 \ CTsvcCDA.EXE C: \ Program Files \ CIFPFiltering \ FilterService.exe C: \ Program Files \ Intel \ Intel Application Accelerator \ iaantmon.exe C: \ WINDOWS \ System32 \ spool \ DRIVERS \ W32X86 \ 3 \ E_FATIA JA.EXE C: \ Program Files \ Common Files \ LightScribe \ LSSrvc.exe C: \ Program Files \ QuickTime \ QTTask.exe C: \ Program Files \ iTunes \ iTunesHelper.exe C: \ Program Files \ Spybot - Search & Destroy \ TeaTimer.exe C: \ WINDOWS \ SYSTEM32 \ WTablet \ TabUserW.exe C: \ WINDOWS \ system32 \ Svchost.exe C: \ WINDOWS \ system32 \ Tablet.exe C: \ WINDOWS \ wanmpsvc.exe C: \ WINDOWS \ system32 \ MsPMSPSv.exe C: \ Program Files \ APC \ APC PowerChute Personal Edition \ apcsystray.exe C: \ WINDOWS \ system32 \ wscntfy.exe C: \ Program Files \ iPod \ bin \ iPodService.exe C: \ WINDOWS \ system32 \ wuauclt.exe C: \ Program Files \ Mozilla Firefox \ firefox.exe C: \ Program Files \ HijackThis \ Analyze.exe R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Page_URL = http://yahoo.sbc.com/dsl R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Search_URL = http://red.clientapps.yahoo.com/cust.../www.yahoo.com R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Search Bar = http://red.clientapps.yahoo.com/cust...search/ie.html R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Search Page = http://red.clientapps.yahoo.com/cust.../www.yahoo.com R0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://yahoo.sbc.com/dsl R1 - HKCU \ Software \ Microsoft \ Internet Explorer \ SearchURL, (Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com R1 - HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Int ernet Asetukset, ProxyServer = 127.0.0.1:8080 R1 - HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Int ernet Asetukset, ProxyOverride = paikallinen N3 - Netscape 7: user_pref ( "browser.startup.homepage", "http://home.netscape.com/bookmark/7_2/home.html"); (C: \ Documents and Settings \ Tatjana Blazevic \ Application Data \ Mozilla \ Profiles \ Default \ mhiwv3o3.slt \ prefs.js) N3 - Netscape 7: user_pref ( "browser.search.defaultengine", "moottori: / / C% 3A% 5CPROGRA% 7E1% 5CNETSCAPE% 5CNETSCAPE% 5Csearchpl ugins% 5CSBWeb_01.src"); (C: \ Documents and Settings \ Tatjana BLAZEVIC \ Application Data \ Mozilla \ Profiles \ Default \ mhiwv3o3.slt \ prefs.js) O2 - BHO: AcroIEHlprObj Class - (06849E9F-C8D7-4D59-B87D-784B7D6BE0B3) - C: \ Program Files \ Adobe \ Acrobat 6.0 \ Reader \ ActiveX \ AcroIEHelper.dll O2 - BHO: MSVPS System - (0D5227BF-0C5B-4EA8-833C-FE09F1496F39) - C: \ WINDOWS \ div32.dll O2 - BHO: Spybot-S & D IE Protection - (53707962-6F74-2D53-2644-206D7942484F) - C: \ PROGRA ~ 1 \ Spybot ~ 1 \ SDHelper.dll O2 - BHO: (no name) - (549B5CA7-4A86-11D7-A4DF-000874180BB3) - (no file) O2 - BHO: UberButton Class - (5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897) - C: \ Program Files \ Yahoo! \ Common \ yiesrvc.dll O2 - BHO: DriveLetterAccess - (5CA3D70E-1895-11CF-8E15-001234567890) - C: \ WINDOWS \ system32 \ dla \ tfswshx.dll O2 - BHO: YahooTaggedBM Class - (65D886A2-7CA7-479b-BB95-14D1EFB7946A) - C: \ Program Files \ Yahoo! \ Common \ YIeTagBm.dll O2 - BHO: MSVPS System - (88418AA3-16F5-4FC2-A9D8-90B1266DF841) - C: \ WINDOWS \ nsduo.dll O2 - BHO: SidebarAutoLaunch Class - (F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D) - C: \ Program Files \ Yahoo! \ Selaimen \ YSidebarIEBHO.dll O2 - BHO: (no name) - (FDD3B846-8D59-4ffb-8758-209B6AD74ACC) - (no file) O3 - Toolbar: McAfee VirusScan - (BA52B914-B692-46c4-B683-905236F6F655) - c: \ progra ~ 1 \ mcafee.com \ VSO \ mcvsshl.dll O4 - HKLM \ .. \ Run: [IAAnotif] "C: \ Program Files \ Intel \ Intel Application Accelerator \ iaanotif.exe" O4 - HKLM \ .. \ Run: [ATIPTA] "C: \ Program Files \ ATI Technologies \ ATI Control Panel \ atiptaxx.exe" O4 - HKLM \ .. \ Run: [IntelMeM] "C: \ Program Files \ Intel \ Modem Event Monitor \ IntelMEM.exe" O4 - HKLM \ .. \ Run: [CTSysVol] "C: \ Program Files \ Creative \ Sound Blaster Live! 24-bit \ Surround Mixer \ CTSysVol.exe" / r O4 - HKLM \ .. \ Run: [P17Helper] rundll32 P17.dll, P17Helper O4 - HKLM \ .. \ Run: [UpdReg] C: \ WINDOWS \ UpdReg.EXE O4 - HKLM \ .. \ Run: [PCMService] "C: \ Program Files \ Dell \ Media Kokemus \ PCMService.exe" O4 - HKLM \ .. \ Run: [DVDLauncher] "C: \ Program Files \ Cyberlink \ PowerDVD \ DVDLauncher.exe" O4 - HKLM \ .. \ Run: [UpdateManager] "C: \ Program Files \ Common Files \ Sonic \ Update Manager \ sgtray.exe" / r O4 - HKLM \ .. \ Run: [dla] C: \ WINDOWS \ system32 \ dla \ tfswctrl.exe O4 - HKLM \ .. \ Run: [YBrowser] C: \ PROGRA ~ 1 \ Yahoo! \ Selaimen \ ybrwicon.exe O4 - HKLM \ .. \ Run: [BJCFD] "C: \ Program Files \ BroadJump \ Client Foundation \ CFD.exe" O4 - HKLM \ .. \ Run: [VSOCheckTask] "C: \ PROGRA ~ 1 \ mcafee.com \ VSO \ mcmnhdlr.exe" / checktask O4 - HKLM \ .. \ Run: [Adobe Photo Downloader] "C: \ Program Files \ Adobe \ Photoshop Elements 4.0 \ apdproxy.exe" O4 - HKLM \ .. \ Run: [ymetray] "C: \ Program Files \ Yahoo! \ Yahoo! Music Engine \ ymetray.exe" O4 - HKLM \ .. \ Run: [EPSON Stylus Photo R340 Series] "C: \ WINDOWS \ System32 \ spool \ DRIVERS \ W32X86 \ 3 \ E_FATI AJA.EXE" / P30 "EPSON Stylus Photo R340 Series" / O6 "USB002 "/ M" Stylus Photo R340 " O4 - HKLM \ .. \ Run: [QuickTime Task] "C: \ Program Files \ QuickTime \ QTTask.exe"-atboottime O4 - HKLM \ .. \ Run: [iTunesHelper] "C: \ Program Files \ iTunes \ iTunesHelper.exe" O4 - HKCU \ .. \ Run: [Yahoo! Hakulaite] "C: \ PROGRA ~ 1 \ Yahoo! \ Messen ~ 1 \ ypager.exe"-quiet O4 - HKCU \ .. \ Run: [SpybotSD TeaTimer] C: \ Program Files \ Spybot - Search & Destroy \ TeaTimer.exe O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C: \ Program Files \ Common Files \ Adobe \ Calibration \ Adobe Gamma Loader.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C: \ Program Files \ Common Files \ Adobe \ Calibration \ Adobe Gamma Loader.exe O4 - Global Startup: America Online 9.0 Lokero Icon.lnk = C: \ Program Files \ America Online 9.0 \ aoltray.exe O4 - Global Startup: APC UPS Status.lnk =? O4 - Global Startup: ColorVisionStartup.lnk = C: \ Program Files \ PANTONE COLORVISION \ Startup \ ColorVisionStartup.exe O4 - Global Startup: TabUserW.exe.lnk = C: \ WINDOWS \ SYSTEM32 \ WTablet \ TabUserW.exe O9 - Extra button: SBC Yahoo! Services - (5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897) - C: \ Program Files \ Yahoo! \ Common \ yiesrvc.dll O9 - Extra button: (no name) - (DFB852A3-47F8-48C4-A200-58CAB36FD2A2) - C: \ PROGRA ~ 1 \ Spybot ~ 1 \ SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - (DFB852A3-47F8-48C4-A200-58CAB36FD2A2) - C: \ PROGRA ~ 1 \ Spybot ~ 1 \ SDHelper.dll O9 - Extra button: Messenger - (FB5F1910-F110-11D2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - (FB5F1910-F110-11D2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ msmsgs.exe O16 - DPF: (9A9307A0-7DA4-4DAF-B042-5009F29E09E1) (ActiveScan Installer Class) -- http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: (DBA230D1-8467-4e69-987E-5FAE815A3B45) -- O20 - Winlogon Notify: WgaLogon - C: \ WINDOWS \ SYSTEM32 \ WgaLogon.dll O21 - SSODL: msmhost - (70D6A632-39E2-4089-9E67-552ADB6B182D) - C: \ WINDOWS \ msmhost.dll O21 - SSODL: mssql - (A6B63875-F4DA-4705-B945-16F8C1FA3FBF) - C: \ WINDOWS \ mssql.dll O21 - SSODL: syscore - (AF05D607-D0B5-4A61-8B71-A13F8997495B) - C: \ WINDOWS \ syscore.dll O21 - SSODL: msmdev - (074897B2-6CAF-45A4-905A-C5A5FC626767) - C: \ WINDOWS \ msmdev.dll O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C: \ Program Files \ Adobe \ Photoshop Elements 3.0 \ PhotoshopElementsFileAgent.exe O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C: \ Program Files \ Adobe \ Photoshop Elements 4.0 \ PhotoshopElementsFileAgent.exe O23 - Service: AOL Yhteydet Service (AOL ACS) - America Online, Inc. - C: \ PROGRA ~ 1 \ Common ~ 1 \ AOL \ ACS \ acsd.exe O23 - Service: APC UPS Service - American Power Conversion Corporation - C: \ Program Files \ APC \ APC PowerChute Personal Edition \ mainserv.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C: \ Program Files \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe O23 - Service: Ati Pikanäppäin Poller - Unknown owner - C: \ WINDOWS \ system32 \ Ati2evxx.exe O23 - Service: BrSplService (Brother XP SPL Service) - Brother Industries Ltd - C: \ WINDOWS \ system32 \ brsvc01a.exe O23 - Service: CIFPLogAggregator - Unknown owner - C: \ Program Files \ CIFPFiltering \ CIFPLogAggregator.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C: \ WINDOWS \ system32 \ CTsvcCDA.EXE O23 - Service: CyclopeInternetFilter - Unknown owner - C: \ Program Files \ CIFPFiltering \ FilterService.exe O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C: \ Program Files \ Intel \ Intel Application Accelerator \ iaantmon.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C: \ Program Files \ Common Files \ InstallShield \ Driver \ 11 \ Intel 32 \ IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C: \ Program Files \ iPod \ bin \ iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C: \ Program Files \ Common Files \ LightScribe \ LSSrvc.exe O23 - Service: McAfee.com McShield (McShield) - Unknown owner - C: \ PROGRA ~ 1 \ mcafee.com \ VSO \ mcshield.exe O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc. - c: \ PROGRA ~ 1 \ mcafee.com \ VSO \ mcvsrte.exe O23 - Service: TabletService - Wacom Technology, Corp. - C: \ WINDOWS \ system32 \ Tablet.exe O23 - Service: WAN Miniport (atwig) Service (WANMiniportService) - America Online, Inc. - C: \ WINDOWS \ wanmpsvc.exe |
|
#7
30 Sep 2007, 08:35
|
|||
|
|||
|
Zlob, Smitfraud-, pop-ups, punainen taustakuva muutoksia
Glad asiat ovat paremmin. Mutta vielä on joitakin nasties puututtava.
Poista kopio Combofix olet ja lataa uuden version. Combofix päivittää jatkuvasti niin se on aina hyvä saada uusi kopio. 1. Lataa tämä tiedosto combofix.exe 2. Kaksoisnapsauta combofix.exe ja seuraa ohjeita. 3. Kun olet valmis, se tuottaa lokin sinulle. Post, että kirjaudut sisään seuraavan vastauksen. Huom: Älä mouseclick combofix ikkunassa vaikka se on käynnissä. Tämä saattaa aiheuttaa sen, pilttuu. In the next post lisätään liitetiedostoina. Voit lisätä enemmän kuin yhden liitetiedoston, vain toista vaihetta: Combofix log Tuore HJT loki
__________________
|
|
#8
30 Sep 2007, 09:03
|
|||
|
|||
|
Zlob, Smitfraud-, pop-ups, punainen taustakuva muutoksia
Hei, olen yrittänyt klikkaamalla combofix.exe linkkiä, mutta tämä on, mitä tuli
404 Not Found Pyydettyä URL '/ Subs / combofix.exe "ei löytynyt palvelimelta. |
|
#9
30 Sep 2007, 09:12
|
|||
|
|||
|
Zlob, Smitfraud-, pop-ups, punainen taustakuva muutoksia
__________________
|
|
#10
30 Sep 2007, 12:50
|
|||
|
|||
|
Zlob, Smitfraud-, pop-ups, punainen taustakuva muutoksia
Hei, kyllä, että linkki toimii, kiitos ... punainen taustakuva palautuneeseen: (ja myös ei kuvakkeita ja pop-ups .. joka tapauksessa täällä on combofix ja HJT loki.
Logfile tehty HijackThis v1.99.1 Scan tallennettu klo 3:37:03 PM, annettu 9.30.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Käynnissä olevista prosesseista: C: \ WINDOWS \ System32 \ smss.exe C: \ WINDOWS \ system32 \ Winlogon.exe C: \ WINDOWS \ system32 \ Services.exe C: \ WINDOWS \ system32 \ Lsass.exe C: \ WINDOWS \ system32 \ Ati2evxx.exe C: \ WINDOWS \ system32 \ Svchost.exe C: \ WINDOWS \ System32 \ Svchost.exe C: \ WINDOWS \ system32 \ spoolsv.exe C: \ WINDOWS \ system32 \ brss01a.exe C: \ WINDOWS \ Explorer.exe C: \ Program Files \ Adobe \ Photoshop Elements 3.0 \ PhotoshopElementsFileAgent.exe C: \ Program Files \ Adobe \ Photoshop Elements 4.0 \ PhotoshopElementsFileAgent.exe C: \ PROGRA ~ 1 \ Common ~ 1 \ AOL \ ACS \ acsd.exe C: \ Program Files \ APC \ APC PowerChute Personal Edition \ mainserv.exe C: \ Program Files \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe C: \ Program Files \ CIFPFiltering \ CIFPLogAggregator.exe C: \ WINDOWS \ system32 \ CTsvcCDA.EXE C: \ Program Files \ CIFPFiltering \ FilterService.exe C: \ Program Files \ Intel \ Intel Application Accelerator \ iaantmon.exe C: \ Program Files \ Common Files \ LightScribe \ LSSrvc.exe C: \ WINDOWS \ system32 \ Svchost.exe C: \ WINDOWS \ system32 \ Tablet.exe C: \ WINDOWS \ wanmpsvc.exe C: \ WINDOWS \ system32 \ MsPMSPSv.exe C: \ WINDOWS \ system32 \ wscntfy.exe C: \ Program Files \ Intel \ Intel Application Accelerator \ iaanotif.exe C: \ Program Files \ Intel \ Modem Event Monitor \ IntelMEM.exe C: \ Program Files \ Creative \ Sound Blaster Live! 24-bit \ Surround Mixer \ CTSysVol.exe C: \ WINDOWS \ system32 \ rundll32.exe C: \ Program Files \ Dell \ Media Kokemus \ PCMService.exe C: \ Program Files \ Cyberlink \ PowerDVD \ DVDLauncher.exe C: \ Program Files \ Common Files \ Sonic \ Update Manager \ sgtray.exe C: \ WINDOWS \ system32 \ dla \ tfswctrl.exe C: \ PROGRA ~ 1 \ Yahoo! \ Selaimen \ ybrwicon.exe C: \ Program Files \ BroadJump \ Client Foundation \ CFD.exe C: \ Program Files \ Adobe \ Photoshop Elements 4.0 \ apdproxy.exe C: \ Program Files \ Yahoo! \ Yahoo! Music Engine \ ymetray.exe C: \ WINDOWS \ System32 \ spool \ DRIVERS \ W32X86 \ 3 \ E_FATIA JA.EXE C: \ Program Files \ QuickTime \ QTTask.exe C: \ PROGRA ~ 1 \ Yahoo! \ Selaimen \ ycommon.exe C: \ Program Files \ iTunes \ iTunesHelper.exe C: \ Program Files \ Spybot - Search & Destroy \ TeaTimer.exe C: \ WINDOWS \ SYSTEM32 \ WTablet \ TabUserW.exe C: \ Program Files \ APC \ APC PowerChute Personal Edition \ apcsystray.exe C: \ PROGRA ~ 1 \ Yahoo! \ Messen ~ 1 \ ymsgr_tray.exe C: \ WINDOWS \ system32 \ wuauclt.exe C: \ Program Files \ iPod \ bin \ iPodService.exe C: \ Program Files \ HijackThis \ Analyze.exe R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Page_URL = http://yahoo.sbc.com/dsl R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Search_URL = http://red.clientapps.yahoo.com/cust.../www.yahoo.com R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Search Bar = http://red.clientapps.yahoo.com/cust...search/ie.html R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Search Page = http://red.clientapps.yahoo.com/cust.../www.yahoo.com R0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://yahoo.sbc.com/dsl R1 - HKCU \ Software \ Microsoft \ Internet Explorer \ SearchURL, (Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com R1 - HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Int ernet Asetukset, ProxyServer = 127.0.0.1:8080 R1 - HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Int ernet Asetukset, ProxyOverride = paikallinen N3 - Netscape 7: user_pref ( "browser.startup.homepage", "http://home.netscape.com/bookmark/7_2/home.html"); (C: \ Documents and Settings \ Tatjana Blazevic \ Application Data \ Mozilla \ Profiles \ Default \ mhiwv3o3.slt \ prefs.js) N3 - Netscape 7: user_pref ( "browser.search.defaultengine", "moottori: / / C% 3A% 5CPROGRA% 7E1% 5CNETSCAPE% 5CNETSCAPE% 5Csearchpl ugins% 5CSBWeb_01.src"); (C: \ Documents and Settings \ Tatjana BLAZEVIC \ Application Data \ Mozilla \ Profiles \ Default \ mhiwv3o3.slt \ prefs.js) O2 - BHO: AcroIEHlprObj Class - (06849E9F-C8D7-4D59-B87D-784B7D6BE0B3) - C: \ Program Files \ Adobe \ Acrobat 6.0 \ Reader \ ActiveX \ AcroIEHelper.dll O2 - BHO: MSVPS System - (0D5227BF-0C5B-4EA8-833C-FE09F1496F39) - C: \ WINDOWS \ div32.dll O2 - BHO: Spybot-S & D IE Protection - (53707962-6F74-2D53-2644-206D7942484F) - C: \ PROGRA ~ 1 \ Spybot ~ 1 \ SDHelper.dll O2 - BHO: (no name) - (549B5CA7-4A86-11D7-A4DF-000874180BB3) - (no file) O2 - BHO: UberButton Class - (5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897) - C: \ Program Files \ Yahoo! \ Common \ yiesrvc.dll O2 - BHO: DriveLetterAccess - (5CA3D70E-1895-11CF-8E15-001234567890) - C: \ WINDOWS \ system32 \ dla \ tfswshx.dll O2 - BHO: YahooTaggedBM Class - (65D886A2-7CA7-479b-BB95-14D1EFB7946A) - C: \ Program Files \ Yahoo! \ Common \ YIeTagBm.dll O2 - BHO: SidebarAutoLaunch Class - (F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D) - C: \ Program Files \ Yahoo! \ Selaimen \ YSidebarIEBHO.dll O2 - BHO: (no name) - (FDD3B846-8D59-4ffb-8758-209B6AD74ACC) - (no file) O3 - Toolbar: McAfee VirusScan - (BA52B914-B692-46c4-B683-905236F6F655) - c: \ progra ~ 1 \ mcafee.com \ VSO \ mcvsshl.dll O4 - HKLM \ .. \ Run: [IAAnotif] "C: \ Program Files \ Intel \ Intel Application Accelerator \ iaanotif.exe" O4 - HKLM \ .. \ Run: [ATIPTA] "C: \ Program Files \ ATI Technologies \ ATI Control Panel \ atiptaxx.exe" O4 - HKLM \ .. \ Run: [IntelMeM] "C: \ Program Files \ Intel \ Modem Event Monitor \ IntelMEM.exe" O4 - HKLM \ .. \ Run: [CTSysVol] "C: \ Program Files \ Creative \ Sound Blaster Live! 24-bit \ Surround Mixer \ CTSysVol.exe" / r O4 - HKLM \ .. \ Run: [P17Helper] rundll32 P17.dll, P17Helper O4 - HKLM \ .. \ Run: [UpdReg] C: \ WINDOWS \ UpdReg.EXE O4 - HKLM \ .. \ Run: [PCMService] "C: \ Program Files \ Dell \ Media Kokemus \ PCMService.exe" O4 - HKLM \ .. \ Run: [DVDLauncher] "C: \ Program Files \ Cyberlink \ PowerDVD \ DVDLauncher.exe" O4 - HKLM \ .. \ Run: [UpdateManager] "C: \ Program Files \ Common Files \ Sonic \ Update Manager \ sgtray.exe" / r O4 - HKLM \ .. \ Run: [dla] C: \ WINDOWS \ system32 \ dla \ tfswctrl.exe O4 - HKLM \ .. \ Run: [YBrowser] C: \ PROGRA ~ 1 \ Yahoo! \ Selaimen \ ybrwicon.exe O4 - HKLM \ .. \ Run: [BJCFD] "C: \ Program Files \ BroadJump \ Client Foundation \ CFD.exe" O4 - HKLM \ .. \ Run: [VSOCheckTask] "C: \ PROGRA ~ 1 \ mcafee.com \ VSO \ mcmnhdlr.exe" / checktask O4 - HKLM \ .. \ Run: [Adobe Photo Downloader] "C: \ Program Files \ Adobe \ Photoshop Elements 4.0 \ apdproxy.exe" O4 - HKLM \ .. \ Run: [ymetray] "C: \ Program Files \ Yahoo! \ Yahoo! Music Engine \ ymetray.exe" O4 - HKLM \ .. \ Run: [EPSON Stylus Photo R340 Series] "C: \ WINDOWS \ System32 \ spool \ DRIVERS \ W32X86 \ 3 \ E_FATI AJA.EXE" / P30 "EPSON Stylus Photo R340 Series" / O6 "USB002 "/ M" Stylus Photo R340 " O4 - HKLM \ .. \ Run: [QuickTime Task] "C: \ Program Files \ QuickTime \ QTTask.exe"-atboottime O4 - HKLM \ .. \ Run: [iTunesHelper] "C: \ Program Files \ iTunes \ iTunesHelper.exe" O4 - HKCU \ .. \ Run: [Yahoo! Hakulaite] "C: \ PROGRA ~ 1 \ Yahoo! \ Messen ~ 1 \ ypager.exe"-quiet O4 - HKCU \ .. \ Run: [SpybotSD TeaTimer] C: \ Program Files \ Spybot - Search & Destroy \ TeaTimer.exe O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C: \ Program Files \ Common Files \ Adobe \ Calibration \ Adobe Gamma Loader.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C: \ Program Files \ Common Files \ Adobe \ Calibration \ Adobe Gamma Loader.exe O4 - Global Startup: America Online 9.0 Lokero Icon.lnk = C: \ Program Files \ America Online 9.0 \ aoltray.exe O4 - Global Startup: APC UPS Status.lnk =? O4 - Global Startup: ColorVisionStartup.lnk = C: \ Program Files \ PANTONE COLORVISION \ Startup \ ColorVisionStartup.exe O4 - Global Startup: TabUserW.exe.lnk = C: \ WINDOWS \ SYSTEM32 \ WTablet \ TabUserW.exe O9 - Extra button: SBC Yahoo! Services - (5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897) - C: \ Program Files \ Yahoo! \ Common \ yiesrvc.dll O9 - Extra button: (no name) - (DFB852A3-47F8-48C4-A200-58CAB36FD2A2) - C: \ PROGRA ~ 1 \ Spybot ~ 1 \ SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - (DFB852A3-47F8-48C4-A200-58CAB36FD2A2) - C: \ PROGRA ~ 1 \ Spybot ~ 1 \ SDHelper.dll O9 - Extra button: Messenger - (FB5F1910-F110-11D2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - (FB5F1910-F110-11D2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ msmsgs.exe O16 - DPF: (9A9307A0-7DA4-4DAF-B042-5009F29E09E1) (ActiveScan Installer Class) -- http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: (DBA230D1-8467-4e69-987E-5FAE815A3B45) -- O20 - Winlogon Notify: WgaLogon - C: \ WINDOWS \ SYSTEM32 \ WgaLogon.dll O21 - SSODL: mssql - (A6B63875-F4DA-4705-B945-16F8C1FA3FBF) - C: \ WINDOWS \ mssql.dll O21 - SSODL: syscore - (AF05D607-D0B5-4A61-8B71-A13F8997495B) - C: \ WINDOWS \ syscore.dll O21 - SSODL: msmhost - (70D6A632-39E2-4089-9E67-552ADB6B182D) - C: \ WINDOWS \ msmhost.dll (file missing) O21 - SSODL: msmdev - (074897B2-6CAF-45A4-905A-C5A5FC626767) - C: \ WINDOWS \ msmdev.dll (file missing) O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C: \ Program Files \ Adobe \ Photoshop Elements 3.0 \ PhotoshopElementsFileAgent.exe O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C: \ Program Files \ Adobe \ Photoshop Elements 4.0 \ PhotoshopElementsFileAgent.exe O23 - Service: AOL Yhteydet Service (AOL ACS) - America Online, Inc. - C: \ PROGRA ~ 1 \ Common ~ 1 \ AOL \ ACS \ acsd.exe O23 - Service: APC UPS Service - American Power Conversion Corporation - C: \ Program Files \ APC \ APC PowerChute Personal Edition \ mainserv.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C: \ Program Files \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe O23 - Service: Ati Pikanäppäin Poller - Unknown owner - C: \ WINDOWS \ system32 \ Ati2evxx.exe O23 - Service: BrSplService (Brother XP SPL Service) - Brother Industries Ltd - C: \ WINDOWS \ system32 \ brsvc01a.exe O23 - Service: CIFPLogAggregator - Unknown owner - C: \ Program Files \ CIFPFiltering \ CIFPLogAggregator.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C: \ WINDOWS \ system32 \ CTsvcCDA.EXE O23 - Service: CyclopeInternetFilter - Unknown owner - C: \ Program Files \ CIFPFiltering \ FilterService.exe O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C: \ Program Files \ Intel \ Intel Application Accelerator \ iaantmon.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C: \ Program Files \ Common Files \ InstallShield \ Driver \ 11 \ Intel 32 \ IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C: \ Program Files \ iPod \ bin \ iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C: \ Program Files \ Common Files \ LightScribe \ LSSrvc.exe O23 - Service: McAfee.com McShield (McShield) - Unknown owner - C: \ PROGRA ~ 1 \ mcafee.com \ VSO \ mcshield.exe O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc. - c: \ PROGRA ~ 1 \ mcafee.com \ VSO \ mcvsrte.exe O23 - Service: TabletService - Wacom Technology, Corp. - C: \ WINDOWS \ system32 \ Tablet.exe O23 - Service: WAN Miniport (atwig) Service (WANMiniportService) - America Online, Inc. - C: \ WINDOWS \ wanmpsvc.exe PS Olen yrittänyt kiinnittää HJT loki, mutta se ei kiinnitä, anteeksi! |
