Moi. F-Secure löysi seuraavat ongelmat: F-Secure Anti-Spyware Build 1.05 Logfile Created on:14. lokakuuta 2005 19:34:24 Using definitions file:SE1R70 12.10.2005 »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» References detected during the scan: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» CommonName(TAC index:7):2 total references. CoolWebSearch(TAC index:10):7 total references. MRU List(TAC index:0):9 total references. Tracking Cookie(TAC index:3):1 total references. Win32.Trojan.Puper.d(TAC index:6):2 total references. »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» F-Secure Anti-Spyware Settings =========================== Set : Search for negligible risk entries Set : Safe mode (always request confirmation) Set : Scan active processes Set : Scan registry Set : Deep-scan registry Set : Scan my IE Favorites for banned URLs Set : Scan my Hosts file Extended F-Secure Anti-Spyware Settings =========================== Set : Unload recognized processes & modules during scan Set : Ignore spanned files when scanning cab archives Set : Scan registry for all users instead of current user only Set : Always try to unload modules before deletion Set : Prior to deletion, allow unloading Explorer and IE if necessary Set : Let Windows remove files in use at next reboot Set : Delete quarantined objects after restoring Set : Block Pop-ups aggresively Set : Automatically select problematic objects in result lists Set : Include basic settings in log file Set : Include additional settings in log file Set : Include reference summary in log file Set : Include Alternate Datastream details in log file Set : Show splash screen Set : Backup current definition file before updating Set : Play sound at scan completion if scan locates critical objects 14.10.2005 19:34:24 - Scan started. (Smart mode) Listing running processes »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» #:1 [smss.exe] FilePath : \SystemRoot\System32\ ProcessID : 540 ThreadCreationTime : 14.10.2005 14:52:52 BasePriority : Normal #:2 [csrss.exe] FilePath : \??\C:\WINDOWS\system32\ ProcessID : 608 ThreadCreationTime : 14.10.2005 14:52:53 BasePriority : Normal #:3 [winlogon.exe] FilePath : \??\C:\WINDOWS\system32\ ProcessID : 632 ThreadCreationTime : 14.10.2005 14:52:53 BasePriority : High #:4 [services.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 676 ThreadCreationTime : 14.10.2005 14:52:53 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® -käyttöjärjestelmä CompanyName : Microsoft Corporation FileDescription : Palvelu- ja ohjainohjelma InternalName : services.exe LegalCopyright : © Microsoft Corporation. Kaikki oikeudet pidätetään. OriginalFilename : services.exe #:5 [lsass.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 688 ThreadCreationTime : 14.10.2005 14:52:53 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : LSA Shell (Export Version) InternalName : lsass.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : lsass.exe #:6 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 840 ThreadCreationTime : 14.10.2005 14:52:54 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:7 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 916 ThreadCreationTime : 14.10.2005 14:52:54 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:8 [svchost.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 1016 ThreadCreationTime : 14.10.2005 14:52:54 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:9 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1072 ThreadCreationTime : 14.10.2005 14:52:54 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:10 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1224 ThreadCreationTime : 14.10.2005 14:52:54 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:11 [explorer.exe] FilePath : C:\WINDOWS\ ProcessID : 1400 ThreadCreationTime : 14.10.2005 14:52:55 BasePriority : Normal FileVersion : 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 6.00.2900.2180 ProductName : Microsoft® Windows® -käyttöjärjestelmä CompanyName : Microsoft Corporation FileDescription : Resurssienhallinta InternalName : explorer LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : EXPLORER.EXE #:12 [spoolsv.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1540 ThreadCreationTime : 14.10.2005 14:52:55 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Spooler SubSystem App InternalName : spoolsv.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : spoolsv.exe #:13 [msole32.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1644 ThreadCreationTime : 14.10.2005 14:52:57 BasePriority : Normal #:14 [shnlog.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1652 ThreadCreationTime : 14.10.2005 14:52:57 BasePriority : Normal #:15 [jmap5289.exe] FilePath : C:\Program Files\ULI5289\ ProcessID : 1672 ThreadCreationTime : 14.10.2005 14:52:57 BasePriority : Normal #:16 [fsm32.exe] FilePath : C:\Program Files\F-Secure Internet Security\Common\ ProcessID : 1680 ThreadCreationTime : 14.10.2005 14:52:57 BasePriority : Normal FileVersion : 5.61.7670 ProductVersion : 5.61 Build 7670 ProductName : F-Secure Management Agent CompanyName : F-Secure Corporation FileDescription : F-Secure Settings and Statistics InternalName : FSM LegalCopyright : Copyright © 1998-2004 F-Secure Corporation. All rights reserved. LegalTrademarks : Windows (TM) is a trademark of Microsoft Corporation OriginalFilename : FSM32.EXE #:17 [ituneshelper.exe] FilePath : C:\Program Files\iTunes\ ProcessID : 1708 ThreadCreationTime : 14.10.2005 14:52:57 BasePriority : Normal FileVersion : 5.0.1.4 ProductVersion : 5.0.1.4 ProductName : iTunes CompanyName : Apple Computer, Inc. FileDescription : iTunesHelper Module InternalName : iTunesHelper LegalCopyright : © 2003-2005 Apple Computer, Inc. All Rights Reserved. OriginalFilename : iTunesHelper.exe #:18 [qttask.exe] FilePath : C:\Program Files\QuickTime\ ProcessID : 1716 ThreadCreationTime : 14.10.2005 14:52:57 BasePriority : Normal FileVersion : 7.0.2 ProductVersion : QuickTime 7.0.2 ProductName : QuickTime CompanyName : Apple Computer, Inc. FileDescription : QuickTime Task InternalName : QuickTime Task LegalCopyright : Copyright Apple Computer, Inc. 1989-2005 OriginalFilename : QTTask.exe #:19 [soundman.exe] FilePath : C:\WINDOWS\ ProcessID : 1748 ThreadCreationTime : 14.10.2005 14:52:57 BasePriority : Normal FileVersion : 5.1.0.29 ProductVersion : 5.1.0.29 ProductName : Realtek Sound Manager CompanyName : Realtek Semiconductor Corp. FileDescription : Realtek Sound Manager InternalName : ALSMTray LegalCopyright : Copyright (c) 2001-2004 Realtek Semiconductor Corp. OriginalFilename : ALSMTray.exe Comments : Realtek AC97 Audio Sound Manager #:20 [ctfmon.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1756 ThreadCreationTime : 14.10.2005 14:52:57 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : CTF Loader InternalName : CTFMON LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : CTFMON.EXE #:21 [msmsgs.exe] FilePath : C:\Program Files\Messenger\ ProcessID : 1764 ThreadCreationTime : 14.10.2005 14:52:57 BasePriority : Normal FileVersion : 4.7.3001 ProductVersion : Version 4.7.3001 ProductName : Messenger CompanyName : Microsoft Corporation FileDescription : Windows Messenger InternalName : msmsgs LegalCopyright : Copyright (c) Microsoft Corporation 2004 LegalTrademarks : Microsoft(R) is a registered trademark of Microsoft Corporation in the U.S. and/or other countries. OriginalFilename : msmsgs.exe #:22 [rundll32.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1840 ThreadCreationTime : 14.10.2005 14:52:57 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® -käyttöjärjestelmä CompanyName : Microsoft Corporation FileDescription : Suorita DLL sovelluksena InternalName : rundll LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : RUNDLL.EXE #:23 [intmon.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1904 ThreadCreationTime : 14.10.2005 14:52:58 BasePriority : Normal #:24 [servic~1.exe] FilePath : C:\PROGRA~1\F-SECU~1\backweb\1245240\Program\ ProcessID : 340 ThreadCreationTime : 14.10.2005 14:53:15 BasePriority : Normal #:25 [fsgk32st.exe] FilePath : C:\Program Files\F-Secure Internet Security\Anti-Virus\ ProcessID : 408 ThreadCreationTime : 14.10.2005 14:53:15 BasePriority : Normal FileVersion : 1, 0, 7360, 0 ProductVersion : 1, 0, 7360, 56 ProductName : F-Secure Corp. Startup service CompanyName : F-Secure Corp. FileDescription : fsgk32st InternalName : fsgk32 LegalCopyright : Copyright © 2001 OriginalFilename : fsgk32st.exe Comments : Startup service for Gatekeeper Handler #:26 [fsbwsys.exe] FilePath : C:\Program Files\F-Secure Internet Security\backweb\1245240\program\ ProcessID : 424 ThreadCreationTime : 14.10.2005 14:53:15 BasePriority : Normal FileVersion : 6.70.734 ProductVersion : 6.70 ProductName : F-Secure BackWeb CompanyName : F-Secure Corp. FileDescription : fsbwsys InternalName : fsbwsys LegalCopyright : Copyright © 2004 F-Secure Corporation OriginalFilename : fsbwsys.exe #:27 [fsgk32.exe] FilePath : C:\Program Files\F-Secure Internet Security\Anti-Virus\ ProcessID : 436 ThreadCreationTime : 14.10.2005 14:53:15 BasePriority : Normal FileVersion : 5.53.10121 ProductVersion : 5.53.10121 ProductName : F-Secure Corp. fsgk32 CompanyName : F-Secure Corp. FileDescription : Gatekeeper Handler II InternalName : fsgk32 LegalCopyright : Copyright © 2003 OriginalFilename : fsgk32.exe Comments : release #:28 [fsma32.exe] FilePath : C:\Program Files\F-Secure Internet Security\Common\ ProcessID : 448 ThreadCreationTime : 14.10.2005 14:53:15 BasePriority : Normal FileVersion : 5.61.7670 ProductVersion : 5.61 Build 7670 ProductName : F-Secure Management Agent CompanyName : F-Secure Corporation FileDescription : F-Secure Management Agent InternalName : VCH LegalCopyright : Copyright © 1998-2004 F-Secure Corporation. All rights reserved. LegalTrademarks : Windows (TM) is a trademark of Microsoft Corporation OriginalFilename : FSMA32.EXE #:29 [fssm32.exe] FilePath : C:\Program Files\F-Secure Internet Security\Anti-Virus\ ProcessID : 476 ThreadCreationTime : 14.10.2005 14:53:15 BasePriority : Normal FileVersion : 5.53.10210 ProductVersion : 5.53.10210 ProductName : F-Secure Corp. fssm32 CompanyName : F-Secure Corp. FileDescription : fssm32 InternalName : fssm32 LegalCopyright : Copyright © 2003 OriginalFilename : fssm32.exe Comments : release #:30 [fsmb32.exe] FilePath : C:\Program Files\F-Secure Internet Security\Common\ ProcessID : 352 ThreadCreationTime : 14.10.2005 14:53:15 BasePriority : Normal FileVersion : 5.61.7670 ProductVersion : 5.61 Build 7670 ProductName : F-Secure Management Agent CompanyName : F-Secure Corporation FileDescription : F-Secure Message Broker InternalName : FSMB LegalCopyright : Copyright © 1998-2004 F-Secure Corporation. All rights reserved. LegalTrademarks : Windows (TM) is a trademark of Microsoft Corporation OriginalFilename : FSMB32.EXE #:31 [fspex.exe] FilePath : C:\Program Files\F-Secure Internet Security\backweb\1245240\Program\ ProcessID : 612 ThreadCreationTime : 14.10.2005 14:53:15 BasePriority : Normal #:32 [fch32.exe] FilePath : C:\Program Files\F-Secure Internet Security\Common\ ProcessID : 1804 ThreadCreationTime : 14.10.2005 14:53:18 BasePriority : Normal FileVersion : 5.61.7670 ProductVersion : 5.61 Build 7670 ProductName : F-Secure Management Agent CompanyName : F-Secure Corporation FileDescription : F-Secure Configuration Handler InternalName : FCH LegalCopyright : Copyright © 1998-2004 F-Secure Corporation. All rights reserved. LegalTrademarks : Windows (TM) is a trademark of Microsoft Corporation OriginalFilename : FCH32.EXE #:33 [fameh32.exe] FilePath : C:\Program Files\F-Secure Internet Security\Common\ ProcessID : 2096 ThreadCreationTime : 14.10.2005 14:53:19 BasePriority : Normal FileVersion : 5.61.7670 ProductVersion : 5.61 Build 7670 ProductName : F-Secure Management Agent CompanyName : F-Secure Corporation FileDescription : F-Secure Alert and Management Extension Handler InternalName : FAMEH LegalCopyright : Copyright © 1998-2004 F-Secure Corporation. All rights reserved. LegalTrademarks : Windows (TM) is a trademark of Microsoft Corporation OriginalFilename : FAMEH32.EXE #:34 [fspc.exe] FilePath : C:\Program Files\F-Secure Internet Security\FSPC\ ProcessID : 2160 ThreadCreationTime : 14.10.2005 14:53:20 BasePriority : Normal FileVersion : 3.01.1100 ProductVersion : 3.01 Build 1100 ProductName : F-Secure Parental Control CompanyName : F-Secure Corporation FileDescription : F-Secure Parental Control InternalName : FSPC LegalCopyright : Copyright © 1998-2004 F-Secure Corporation. All rights reserved. LegalTrademarks : Windows (TM) is a trademark of Microsoft Corporation OriginalFilename : FSPC.EXE #:35 [ipodservice.exe] FilePath : C:\Program Files\iPod\bin\ ProcessID : 2240 ThreadCreationTime : 14.10.2005 14:53:20 BasePriority : Normal FileVersion : 5.0.1.4 ProductVersion : 5.0.1.4 ProductName : iTunes CompanyName : Apple Computer, Inc. FileDescription : iPodService Module InternalName : iPodService LegalCopyright : © 2003-2005 Apple Computer, Inc. All Rights Reserved. OriginalFilename : iPodService.exe #:36 [fshttps.exe] FilePath : C:\Program Files\F-Secure Internet Security\FSPC\fshttps\ ProcessID : 2304 ThreadCreationTime : 14.10.2005 14:53:21 BasePriority : Normal FileVersion : 3.01.1100 ProductVersion : 3.01 Build 1100 ProductName : F-Secure Parental Control CompanyName : F-Secure Corporation FileDescription : F-Secure Http Server InternalName : FSHTTPS LegalCopyright : Copyright © 1998-2004 F-Secure Corporation. All rights reserved. LegalTrademarks : Windows (TM) is a trademark of Microsoft Corporation OriginalFilename : FSHTTPS.EXE #:37 [fsdfwd.exe] FilePath : C:\Program Files\F-Secure Internet Security\FWES\Program\ ProcessID : 2348 ThreadCreationTime : 14.10.2005 14:53:21 BasePriority : Normal FileVersion : 5.80.370 ProductVersion : 5.80 Build 370 ProductName : F-Secure Anti-Virus Internet Shield CompanyName : F-Secure Corporation FileDescription : F-Secure Anti-Virus Internet Shield daemon InternalName : fsdfwd LegalCopyright : Copyright (c) F-Secure Corporation 1997-2004 OriginalFilename : fsdfwd.exe #:38 [fsav32.exe] FilePath : C:\Program Files\F-Secure Internet Security\Anti-Virus\ ProcessID : 2592 ThreadCreationTime : 14.10.2005 14:53:22 BasePriority : Normal FileVersion : 5.53.10480 ProductVersion : 5.53.10480 ProductName : F-Secure Anti-Virus CompanyName : F-Secure Corporation FileDescription : FSAV Handler InternalName : FSAV32 LegalCopyright : Copyright © 1998-2004, F-Secure Corporation OriginalFilename : FSAV32.exe #:39 [alg.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 2724 ThreadCreationTime : 14.10.2005 14:53:22 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Application Layer Gateway Service InternalName : ALG.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : ALG.exe #:40 [fsguiexe.exe] FilePath : C:\Program Files\F-Secure Internet Security\FSGUI\ ProcessID : 3536 ThreadCreationTime : 14.10.2005 14:53:25 BasePriority : Normal FileVersion : 5, 70, 1221, 0 ProductVersion : 5, 0, 560, 0 ProductName : ISP 2005 FileDescription : gui standby component InternalName : fsguiexe LegalCopyright : Copyright (C) 2004 OriginalFilename : fsguiexe.exe #:41 [anti-spyware.exe] FilePath : C:\Program Files\F-Secure Internet Security\Anti-Spyware\ ProcessID : 668 ThreadCreationTime : 14.10.2005 16:34:12 BasePriority : Normal FileVersion : 6.2.0.182 ProductVersion : VI.Second Edition ProductName : F-Secure Anti-Spyware CompanyName : Lavasoft Sweden FileDescription : F-Secure Anti-Spyware Core application InternalName : Anti-Spyware.exe LegalCopyright : Copyright © F-Secure OriginalFilename : Ad-Aware.exe Comments : Licensed from Lavasoft Memory scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New Critical Objects: 0 Objects found so far: 0 Started registry scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» CommonName Object Recognized! Type : RegKey Data : Category : Data Miner Comment : Rootkey : HKEY_CLASSES_ROOT Object : typelib\{1e1b286c-88ff-11d2-8d96-d7acac95951f} CommonName Object Recognized! Type : RegKey Data : Category : Data Miner Comment : Rootkey : HKEY_CLASSES_ROOT Object : interface\{1e1b2878-88ff-11d2-8d96-d7acac95951f} CoolWebSearch Object Recognized! Type : RegKey Data : Category : Malware Comment : Rootkey : HKEY_CLASSES_ROOT Object : clsid\{ffffffff-ffff-ffff-ffff-fffffffffffa} CoolWebSearch Object Recognized! Type : RegKey Data : Category : Malware Comment : Rootkey : HKEY_CLASSES_ROOT Object : clsid\vmhomepage CoolWebSearch Object Recognized! Type : RegValue Data : Category : Malware Comment : Rootkey : HKEY_CLASSES_ROOT Object : clsid\vmhomepage Value : CurVer CoolWebSearch Object Recognized! Type : RegKey Data : Category : Malware Comment : Rootkey : HKEY_CLASSES_ROOT Object : clsid\vmhomepage.1 CoolWebSearch Object Recognized! Type : RegKey Data : Category : Malware Comment : Rootkey : HKEY_LOCAL_MACHINE Object : software\microsoft\windows\currentversion\explorer\browser helper objects\{ffffffff-ffff-ffff-ffff-fffffffffffa} Win32.Trojan.Puper.d Object Recognized! Type : RegKey Data : Category : Malware Comment : Rootkey : HKEY_LOCAL_MACHINE Object : software\microsoft\windows\currentversion\explorer\browser helper objecta\{ffffffff-ffff-ffff-ffff-fffffffffffa} Win32.Trojan.Puper.d Object Recognized! Type : RegValue Data : Category : Malware Comment : "paint.exe" Rootkey : HKEY_LOCAL_MACHINE Object : software\microsoft\windows\currentversion\policies\explorer\run Value : paint.exe Registry scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New Critical Objects: 9 Objects found so far: 9 Started deep registry scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Deep registry scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New Critical Objects: 0 Objects found so far: 9 Started tracking cookie scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Tracking Cookie Object Recognized! Type : IECache Entry Data : pete@tribalfusion[1].txt Category : Data Miner Comment : Hits:1 Value : Cookieete@tribalfusion.com/ Expires : 1.1.2038 3:00:00 LastSync : Hits:1 UseCount : 0 Hits : 1 Tracking cookie scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New Critical Objects: 1 Objects found so far: 10 Deep scanning and examining files... »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Disk scan result for C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New Critical Objects: 0 Objects found so far: 10 Disk scan result for C:\WINDOWS\system32 »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New Critical Objects: 0 Objects found so far: 10 Disk scan result for C:\DOCUME~1\Pete\LOCALS~1\Temp\ »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New Critical Objects: 0 Objects found so far: 10 Scanning Hosts file... Hosts file location:"C:\WINDOWS\system32\drivers\etc\hosts". »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Hosts file scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» 1 entries scanned. New Critical Objects:0 Objects found so far: 10 MRU List Object Recognized! Location: : C:\Documents and Settings\Pete\recent Description : list of recently opened documents MRU List Object Recognized! Location: : software\microsoft\directdraw\mostrecentapplication Description : most recent application to use microsoft directdraw MRU List Object Recognized! Location: : S-1-5-21-1343024091-879983540-839522115-1004\software\microsoft\internet explorer Description : last download directory used in microsoft internet explorer MRU List Object Recognized! Location: : S-1-5-21-1343024091-879983540-839522115-1004\software\microsoft\internet explorer\typedurls Description : list of recently entered addresses in microsoft internet explorer MRU List Object Recognized! Location: : S-1-5-21-1343024091-879983540-839522115-1004\software\microsoft\windows\currentversion\explorer\comdlg32\lastvisitedmru Description : list of recent programs opened MRU List Object Recognized! Location: : S-1-5-21-1343024091-879983540-839522115-1004\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru Description : list of recently saved files, stored according to file extension MRU List Object Recognized! Location: : S-1-5-21-1343024091-879983540-839522115-1004\software\microsoft\windows\currentversion\explorer\recentdocs Description : list of recent documents opened MRU List Object Recognized! Location: : S-1-5-21-1343024091-879983540-839522115-1004\software\nvidia corporation\global\nview\windowmanagement Description : nvidia nview cached application window positions MRU List Object Recognized! Location: : S-1-5-21-1343024091-879983540-839522115-1004\software\microsoft\windows media\wmsdk\general Description : windows media sdk Performing conditional scans.. »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» CoolWebSearch Object Recognized! Type : RegValue Data : Category : Malware Comment : Rootkey : HKEY_CURRENT_USER Object : software\microsoft\internet explorer\main Value : Enable Browser Extensions CoolWebSearch Object Recognized! Type : File Data : wbemess.log Category : Malware Comment : Object : C:\WINDOWS\system32\wbem\logs\ Conditional scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New Critical Objects: 2 Objects found so far: 21 19:35:02 Scan Complete Summary of this scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Total scanning time:00:00:37.203 Objects scanned:61348 Objects identified:12 Objects ignored:0 New Critical Objects:12 Eli koska kaikki pitää opetella kantapään kautta niin ilmeisesti koneen suojaus ei ollut ajantasalla. F-Secure on asennettu, ja sieltä myös haittaohjelmien poistotyökalu. XP:n oma palomuuri oli se ainoa palomuuri, ja se kai oli aivan riittämätön. Olen kokeillut usita (en vielä kaikkia)noita ensimmäisen viestiketjun ohjelmia (sain poistettua suurimman osan haittaohjelmista, nuo 12 jäi) Mitenkäs nyt? Minulla on Nortonin ohjelma (tullut koneen mukana samalla cd:lla kuin koneen ajurit. Vaihdanko F-Securen Nortoniin? Vai onko ainoa vaihtoehto formatointi? Kiitos jo etukäteen.
Laita HjT-loki, ohjelman saat täältä -> http://koti.mbnet.fi/pattaya1/HijackThis.exe . Tallenna hakemistoon c:\hjt, käynnistä, klikkaa do a system scan and save a logfile ja lähetä loki tänne.
Tarkoitiko tätä? Logfile of HijackThis v1.99.1 Scan saved at 20:02:11, on 14.10.2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\msole32.exe C:\WINDOWS\system32\shnlog.exe C:\Program Files\ULI5289\JMAP5289.exe C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\intmon.exe C:\PROGRA~1\F-SECU~1\backweb\1245240\Program\SERVIC~1.EXE C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe C:\Program Files\F-Secure Internet Security\backweb\1245240\program\fsbwsys.exe C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE C:\Program Files\F-Secure Internet Security\backweb\1245240\Program\fspex.exe C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE C:\Program Files\F-Secure Internet Security\FSPC\fspc.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe C:\Program Files\F-Secure Internet Security\FSGUI\fsguiexe.exe C:\hjt\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: (no name) - {FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA} - C:\WINDOWS\system32\hp4536.tmp O4 - HKLM\..\Run: [ALi5289] C:\Program Files\ULI5289\ALi5289.exe O4 - HKLM\..\Run: [JMAP5289] C:\Program Files\ULI5289\JMAP5289.exe O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\F-Secure Internet Security\FSGUI\FSSW.EXE" /reboot O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [RegSvr32] C:\WINDOWS\system32\msmsgs.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [P.S.Guard] C:\Program Files\P.S.Guard\PSGuard.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook O9 - Extra button: Web-suodatin - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll O9 - Extra 'Tools' menuitem: Näytä &Web-sivuluettelo... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll O9 - Extra 'Tools' menuitem: &Keskeytä Web-sivujen suodatus - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll O9 - Extra 'Tools' menuitem: &Kiellä tämä Web-sivusto - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll O9 - Extra 'Tools' menuitem: &Salli tämä Web-sivusto - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Broken Internet access because of LSP provider 'winsflt.dll' missing O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} (F-Secure Online Scanner) - file://E:\ols\cd-db\fscax.cab O23 - Service: F-Secure Internet Security 2005 OEM (BackWeb Plug-in - 1245240) - Unknown owner - C:\PROGRA~1\F-SECU~1\backweb\1245240\Program\SERVIC~1.EXE O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure Internet Security\backweb\1245240\program\fsbwsys.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe O23 - Service: F-Secure HTTP Server (fshttps) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSPC\fshttps\fshttps.exe O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
Just sitä. Sulla on Smithfraudin pirulainen koneessa (ja ehkä muutakin) Hae täältä -> http://noahdfear.geekstogo.com/click counter/click.php?id=1 smitrem.exe, tallenna työpöydälle ja tuplaklikkaa sitä. Käynnistä vikasietotilaan, ohje -> http://www.xtra.co.nz/help/0,,4155-1916458,00.html Sitten avaa smitRem-kansio työpöydältä ja tuplaklikkaa runthis.bat. Kone käynnistyy uudestaan kun fixi on valmis. Lähetä sitten uusi HjT-loki ja c:\smitfiles.txt-tiedoston sisältö tänne. Tarkista sitten nämä tiedostot: C:\Program Files\ULI5289\ALi5289.exe C:\Program Files\ULI5289\JMAP5289.exe täällä -> http://virusscan.jotti.org ja postita niiden tulokset samalla kertaa tänne.
Fixaa seuraavat: O4 - HKLM\..\Run: [ALi5289] C:\Program Files\ULI5289\ALi5289.exe O4 - HKLM\..\Run: [JMAP5289] C:\Program Files\ULI5289\JMAP5289.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime Hae LSPFix tuolta. http://cexx.org/lspfix.htm Tallenna minne huvittaa Avaa LSPFix Laita rasti ruutuun, "I know what I’m doing". Klikkaa vasemmassa ruudussa olevaa winsflt.dll , siirrä se oikealla olevaan ruutuun nuolinäppäimellä, klikkaa "Remove" ja sulje LSPFix. Sit vikasietotilaan(käynnistyksen yhteydessä F8) Poista seuraava: C:\Program Files\ULI5289\ <- kansio
@Disa-: Nämä liittyvät smithfraudiin ja eivät kyllä lähde mihinkään pois ilman tuota smitrem.exeä. O2 - BHO: (no name) - {FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA} - C:\WINDOWS\system32\hp4536.tmp O4 - HKLM\..\Run: [P.S.Guard] C:\Program Files\P.S.Guard\PSGuard.exe Joten editoi se osa pois, kiitos Ja suosittelen ensin tarkistamaan nämä jotilla, ennen kuin niitä poistaa, voivat olla myös ok.: C:\Program Files\ULI5289\ALi5289.exe C:\Program Files\ULI5289\JMAP5289.exe
Huomenta. En ole kylä aivan varma menikö oikein, mutta tässäpä jotain. smitRem log file version 2.7 by noahdfear ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ checking for ShudderLTD key ShudderLTD key not present! checking for PSGuard.com key PSGuard.com key present! Running LTDFix/PSGuard.com fix! PSGuard.com key was successfully removed! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Existing Pre-run Files ~~~ Program Files ~~~ ~~~ Shortcuts ~~~ PSGuard.com ~~~ Favorites ~~~ ~~~ system32 folder ~~~ oleext.dll ole32vbs.exe msole32.exe hp***.tmp shnlog.exe intmon.exe hhk.dll logfiles ~~~ Icons in System32 ~~~ ~~~ Windows directory ~~~ sites.ini ~~~ Drive root ~~~ ~~~ Miscellaneous Files/folders ~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Remaining Post-run Files ~~~ Program Files ~~~ ~~~ Shortcuts ~~~ ~~~ Favorites ~~~ ~~~ system32 folder ~~~ msole32.exe hp***.tmp shnlog.exe intmon.exe ~~~ Icons in System32 ~~~ ~~~ Windows directory ~~~ ~~~ Drive root ~~~ ~~~ Miscellaneous Files/folders ~~~ ~~~ Wininet.dll ~~~ CLEAN! Logfile of HijackThis v1.99.1 Scan saved at 8:47:59, on 15.10.2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\msole32.exe C:\WINDOWS\system32\shnlog.exe C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\intmon.exe C:\PROGRA~1\F-SECU~1\backweb\1245240\Program\SERVIC~1.EXE C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe C:\Program Files\F-Secure Internet Security\backweb\1245240\program\fsbwsys.exe C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe C:\Program Files\F-Secure Internet Security\backweb\1245240\Program\fspex.exe C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE C:\Program Files\F-Secure Internet Security\FSPC\fspc.exe C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe C:\Program Files\F-Secure Internet Security\FSGUI\fsguiexe.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\explorer.exe C:\hjt\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O4 - HKLM\..\Run: [ALi5289] C:\Program Files\ULI5289\ALi5289.exe O4 - HKLM\..\Run: [JMAP5289] C:\Program Files\ULI5289\JMAP5289.exe O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\F-Secure Internet Security\FSGUI\FSSW.EXE" /reboot O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook O9 - Extra button: Web-suodatin - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll O9 - Extra 'Tools' menuitem: Näytä &Web-sivuluettelo... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll O9 - Extra 'Tools' menuitem: &Keskeytä Web-sivujen suodatus - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll O9 - Extra 'Tools' menuitem: &Kiellä tämä Web-sivusto - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll O9 - Extra 'Tools' menuitem: &Salli tämä Web-sivusto - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} (F-Secure Online Scanner) - file://E:\ols\cd-db\fscax.cab O23 - Service: F-Secure Internet Security 2005 OEM (BackWeb Plug-in - 1245240) - Unknown owner - C:\PROGRA~1\F-SECU~1\backweb\1245240\Program\SERVIC~1.EXE O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure Internet Security\backweb\1245240\program\fsbwsys.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe O23 - Service: F-Secure HTTP Server (fshttps) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSPC\fshttps\fshttps.exe O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
...ja en tiedä kuuluuko mitenkään asiaan, F-Secure ei löytänyt viruksia ja anti-spyware löysi ja poisti kolme "tiedostoa" jonka jälkeen scannaus ei löytänyt mitään.
Tarkistä seuraavat tiedostot: C:\Program Files\ULI5289\ALi5289.exe C:\Program Files\ULI5289\JMAP5289.exe täällä -> http://virusscan.jotti.org
Ei lähtenyt smithfraud kokonaan Aja uudestaan vikasiedossa(teithän sen edellisen vikasiedossa, annoin väärän linkin, sori(toi oli piilotiedostojen esillelaitto-ohje). Sinne vikasietotilaan pääsee painamalla F8 koneen käynnistyksen yhteydessä ja valitsemalla valikosta vikasietotila) se fixi(eli avaa smitRem-kansio ja klikkaa runthis.bat ja lähetä sitten smitfiles.txt:n sisältö tänne).
Sen ULI5289 kansion Program filesta kerkesin jo poistaa. Tein nuo pyytämäsi toimet nimenomaan vikasietotilassa. ja tässä tämä viimeisin tarkastus. smitRem log file version 2.7 by noahdfear ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ checking for ShudderLTD key ShudderLTD key not present! checking for PSGuard.com key PSGuard.com key not present! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Existing Pre-run Files ~~~ Program Files ~~~ ~~~ Shortcuts ~~~ ~~~ Favorites ~~~ ~~~ system32 folder ~~~ ~~~ Icons in System32 ~~~ ~~~ Windows directory ~~~ ~~~ Drive root ~~~ ~~~ Miscellaneous Files/folders ~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Remaining Post-run Files ~~~ Program Files ~~~ ~~~ Shortcuts ~~~ ~~~ Favorites ~~~ ~~~ system32 folder ~~~ ~~~ Icons in System32 ~~~ ~~~ Windows directory ~~~ ~~~ Drive root ~~~ ~~~ Miscellaneous Files/folders ~~~ ~~~ Wininet.dll ~~~ CLEAN!
Nyt näyttää jo hyvältä toi loki Sitten lähetä vielä uusi HjT-loki, niin katotaan onko senkin puolesta kaikki kunnossa.
ja tässä tulee. Logfile of HijackThis v1.99.1 Scan saved at 17:24:53, on 15.10.2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\F-SECU~1\backweb\1245240\Program\SERVIC~1.EXE C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe C:\Program Files\F-Secure Internet Security\backweb\1245240\Program\fspex.exe C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE C:\Program Files\F-Secure Internet Security\backweb\1245240\program\fsbwsys.exe C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE C:\Program Files\F-Secure Internet Security\FSPC\fspc.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe C:\Program Files\F-Secure Internet Security\FSGUI\fsguiexe.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\hjt\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O4 - HKLM\..\Run: [ALi5289] C:\Program Files\ULI5289\ALi5289.exe O4 - HKLM\..\Run: [JMAP5289] C:\Program Files\ULI5289\JMAP5289.exe O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\F-Secure Internet Security\FSGUI\FSSW.EXE" /reboot O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook O9 - Extra button: Web-suodatin - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll O9 - Extra 'Tools' menuitem: Näytä &Web-sivuluettelo... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll O9 - Extra 'Tools' menuitem: &Keskeytä Web-sivujen suodatus - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll O9 - Extra 'Tools' menuitem: &Kiellä tämä Web-sivusto - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll O9 - Extra 'Tools' menuitem: &Salli tämä Web-sivusto - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} (F-Secure Online Scanner) - file://E:\ols\cd-db\fscax.cab O23 - Service: F-Secure Internet Security 2005 OEM (BackWeb Plug-in - 1245240) - Unknown owner - C:\PROGRA~1\F-SECU~1\backweb\1245240\Program\SERVIC~1.EXE O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure Internet Security\backweb\1245240\program\fsbwsys.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe O23 - Service: F-Secure HTTP Server (fshttps) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSPC\fshttps\fshttps.exe O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
Jep, smithfraud (tai niin kuin F-secure sen tuntee, Puper,) on poissa Fixaa vielä nämä: O4 - HKLM\..\Run: [ALi5289] C:\Program Files\ULI5289\ALi5289.exe O4 - HKLM\..\Run: [JMAP5289] C:\Program Files\ULI5289\JMAP5289.exe Nyt ei pitäisi enää F-Securen Anti-Spywaren valittaa Puperista ja CoolWebSearchista
