Kun käynnistää netin niin tulee "varoitus" että on pöpö koneella ja psusuositellaan lataamaan ps guard tai vastaava. valillä heittää semmoselle sivustolle kuin http://www.syserrors.com/. Oon käyny Panda virus ohjelmalla läpi ja ei mitään. Jos mitään ideoita, niin kaikki tervetulleita. Logfile of HijackThis v1.99.1 Scan saved at 12:01:26, on 5.11.2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: F:\WINDOWS\System32\smss.exe F:\WINDOWS\system32\csrss.exe F:\WINDOWS\system32\winlogon.exe F:\WINDOWS\system32\services.exe F:\WINDOWS\system32\lsass.exe F:\WINDOWS\system32\Ati2evxx.exe F:\WINDOWS\system32\svchost.exe F:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\TPSrv.exe F:\WINDOWS\system32\svchost.exe F:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\pavsrv51.exe F:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\AVENGINE.EXE F:\WINDOWS\system32\Ati2evxx.exe F:\WINDOWS\Explorer.EXE F:\WINDOWS\System32\svchost.exe F:\WINDOWS\system32\svchost.exe F:\WINDOWS\system32\svchost.exe f:\program files\panda software\panda titanium 2006 antivirus + antispyware\firewall\PNMSRV.EXE F:\WINDOWS\system32\LEXBCES.EXE F:\WINDOWS\system32\spoolsv.exe F:\WINDOWS\system32\LEXPPS.EXE F:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe F:\WINDOWS\system32\CTsvcCDA.EXE F:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PavFnSvr.exe F:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe F:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PsImSvc.exe F:\WINDOWS\system32\svchost.exe F:\WINDOWS\system32\wdfmgr.exe F:\WINDOWS\system32\UAService7.exe F:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\apvxdwin.exe F:\WINDOWS\System32\alg.exe F:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\WebProxy.exe F:\Program Files\D-Tools\daemon.exe F:\WINDOWS\system32\ctfmon.exe F:\Program Files\ABIT\ABIT uGuru\uGuru.exe F:\Program Files\ABIT\ABIT uGuru\OCGuru.exe C:\ATITool\ATITool.exe F:\Program Files\VIRUS POISTO\SpySub.exe F:\Program Files\ABIT\ABIT uGuru\uGuru_Event_Receiver.exe F:\WINDOWS\explorer.exe F:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\AvltMain.exe F:\Program Files\HJT\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.subaruclubfinland.net/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.fi R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: HomepageBHO - {3bf1f86f-b1a8-489b-8d8b-43781d51411f} - F:\WINDOWS\system32\hp5133.tmp O3 - Toolbar: (no name) - {736b5468-bdad-41be-92d0-22ae2ddf7bcb} - (no file) O4 - HKLM\..\Run: [DAEMON Tools-1033] "F:\Program Files\D-Tools\daemon.exe" -lang 1035 O4 - HKLM\..\Run: [TrojanScanner] F:\Program Files\Trojan Remover\Trjscan.exe O4 - HKLM\..\Run: [APVXDWIN] "F:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\APVXDWIN.EXE" /s O4 - HKCU\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [ABIT uGuru] F:\Program Files\ABIT\ABIT uGuru\uGuru.exe O4 - HKCU\..\Run: [ABIT OcGuru] F:\Program Files\ABIT\ABIT uGuru\OCGuru.exe -p O4 - Global Startup: ATITool.lnk = C:\ATITool\ATITool.exe O4 - Global Startup: SpySubtract.lnk = F:\Program Files\VIRUS POISTO\SpySub.exe O8 - Extra context menu item: Vie Microsoft E&xceliin - res://F:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1125745361921 O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} (F-Secure Online Scanner) - http://support.f-secure.com/ols/fscax.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,20/mcgdmgr.cab O20 - Winlogon Notify: avldr - F:\WINDOWS\SYSTEM32\avldr.dll O20 - Winlogon Notify: st3i - F:\WINDOWS\q885387156.dll (file missing) O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing) O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - F:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - F:\WINDOWS\system32\ati2sgag.exe O23 - Service: BlueSoleil Hid Service - Unknown owner - F:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - F:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: iPod-palvelu (iPodService) - Unknown owner - F:\Program Files\iPod\bin\iPodService.exe (file missing) O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - F:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Macromedia Licensing Service - Unknown owner - F:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software - F:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PavFnSvr.exe O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - F:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - F:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\pavsrv51.exe O23 - Service: Panda Network Manager (PNMSRV) - Panda Software - f:\program files\panda software\panda titanium 2006 antivirus + antispyware\firewall\PNMSRV.EXE O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software Internacional - F:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PsImSvc.exe O23 - Service: Panda TPSrv (TPSrv) - Panda Software - F:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\TPSrv.exe O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - F:\WINDOWS\system32\UAService7.exe
Hae eScan täältä -> http://koti.mbnet.fi/pattaya1/escanmwav.htm seuraa ohjeita ja lähetä sen "logi", joka tulee sinne alempaan laatikkoon.
Sori Disa-, kun tulen taas väliin Fixaa HjT:llä (do a system scan only, merkkaa ja paina fix checked): O3 - Toolbar: (no name) - {736b5468-bdad-41be-92d0-22ae2ddf7bcb} - (no file) O20 - Winlogon Notify: st3i - F:\WINDOWS\q885387156.dll (file missing) O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing) Hae smitrem täältä -> http://noahdfear.geekstogo.com/click counter/click.php?id=1 Tallenna työpöydälle ja tuplaklikkaa sitä, jolloin se luo smitRem-kansion työpöydälle .Käynnistä vikasietotilaan, avaa smitRem-kansio ja tuplaklikkaa RunThis.bat. Seuraa ohjeita. Käynnistä kone uudelleen normaalisti, lähetä uusi HjT-loki ja c:\smitfiles.txt-tiedoston sisältö tänne.
No niin, tarvittavat jutut tehty ja tässä olis nämä. Ainakin nyt näyttäis toimivan oikeen. Kiitos nopeista vastauksista ja tuo smitrem näytti poistavan ton popup hässäkän. Logfile of HijackThis v1.99.1 Scan saved at 13:49:06, on 5.11.2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: F:\WINDOWS\System32\smss.exe F:\WINDOWS\system32\csrss.exe F:\WINDOWS\system32\winlogon.exe F:\WINDOWS\system32\services.exe F:\WINDOWS\system32\lsass.exe F:\WINDOWS\system32\Ati2evxx.exe F:\WINDOWS\system32\svchost.exe F:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\TPSrv.exe F:\WINDOWS\system32\svchost.exe F:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\pavsrv51.exe F:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\AVENGINE.EXE F:\WINDOWS\System32\svchost.exe F:\WINDOWS\system32\svchost.exe F:\WINDOWS\system32\svchost.exe f:\program files\panda software\panda titanium 2006 antivirus + antispyware\firewall\PNMSRV.EXE F:\WINDOWS\system32\LEXBCES.EXE F:\WINDOWS\system32\LEXPPS.EXE F:\WINDOWS\system32\spoolsv.exe F:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe F:\WINDOWS\system32\CTsvcCDA.EXE F:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PavFnSvr.exe F:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe F:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PsImSvc.exe F:\WINDOWS\system32\svchost.exe F:\WINDOWS\system32\wdfmgr.exe F:\WINDOWS\system32\UAService7.exe F:\WINDOWS\System32\alg.exe F:\WINDOWS\system32\Ati2evxx.exe F:\WINDOWS\Explorer.EXE F:\Program Files\D-Tools\daemon.exe F:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\APVXDWIN.EXE F:\WINDOWS\system32\ctfmon.exe F:\Program Files\ABIT\ABIT uGuru\uGuru.exe F:\Program Files\ABIT\ABIT uGuru\OCGuru.exe C:\ATITool\ATITool.exe F:\Program Files\VIRUS POISTO\SpySub.exe F:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\WebProxy.exe F:\Program Files\ABIT\ABIT uGuru\uGuru_Event_Receiver.exe F:\Program Files\Internet Explorer\iexplore.exe F:\WINDOWS\explorer.exe F:\Program Files\HJT\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.subaruclubfinland.net/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.fi R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O4 - HKLM\..\Run: [DAEMON Tools-1033] "F:\Program Files\D-Tools\daemon.exe" -lang 1035 O4 - HKLM\..\Run: [TrojanScanner] F:\Program Files\Trojan Remover\Trjscan.exe O4 - HKLM\..\Run: [APVXDWIN] "F:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\APVXDWIN.EXE" /s O4 - HKCU\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [ABIT uGuru] F:\Program Files\ABIT\ABIT uGuru\uGuru.exe O4 - HKCU\..\Run: [ABIT OcGuru] F:\Program Files\ABIT\ABIT uGuru\OCGuru.exe -p O4 - Global Startup: ATITool.lnk = C:\ATITool\ATITool.exe O4 - Global Startup: SpySubtract.lnk = F:\Program Files\VIRUS POISTO\SpySub.exe O8 - Extra context menu item: Vie Microsoft E&xceliin - res://F:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1125745361921 O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} (F-Secure Online Scanner) - http://support.f-secure.com/ols/fscax.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,20/mcgdmgr.cab O20 - Winlogon Notify: avldr - F:\WINDOWS\SYSTEM32\avldr.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - F:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - F:\WINDOWS\system32\ati2sgag.exe O23 - Service: BlueSoleil Hid Service - Unknown owner - F:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - F:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: iPod-palvelu (iPodService) - Unknown owner - F:\Program Files\iPod\bin\iPodService.exe (file missing) O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - F:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Macromedia Licensing Service - Unknown owner - F:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software - F:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PavFnSvr.exe O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - F:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - F:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\pavsrv51.exe O23 - Service: Panda Network Manager (PNMSRV) - Panda Software - f:\program files\panda software\panda titanium 2006 antivirus + antispyware\firewall\PNMSRV.EXE O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software Internacional - F:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PsImSvc.exe O23 - Service: Panda TPSrv (TPSrv) - Panda Software - F:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\TPSrv.exe O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - F:\WINDOWS\system32\UAService7.exe ja toinen smitRem © log file version 2.7 by noahdfear Microsoft Windows XP [versio 5.1.2600] ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ checking for ShudderLTD key ShudderLTD key not present! checking for PSGuard.com key PSGuard.com key not present! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Existing Pre-run Files ~~~ Program Files ~~~ ~~~ Shortcuts ~~~ ~~~ Favorites ~~~ ~~~ system32 folder ~~~ ~~~ Icons in System32 ~~~ ~~~ Windows directory ~~~ ~~~ Drive root ~~~ ~~~ Miscellaneous Files/folders ~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Remaining Post-run Files ~~~ Program Files ~~~ ~~~ Shortcuts ~~~ ~~~ Favorites ~~~ ~~~ system32 folder ~~~ ~~~ Icons in System32 ~~~ ~~~ Windows directory ~~~ ~~~ Drive root ~~~ ~~~ Miscellaneous Files/folders ~~~ ~~~ Wininet.dll ~~~ CLEAN!
Jep, lokit on kunnossa Sulla oli smithfraudin pirulainen koneella, joka aiheutti noi popupit. Nyt se on pois.
No olipas pirulainen... Perhana ku ei edes virustorjunta (Panda titanium) voi sitä poistaa? Mut hyvä näin Ja vielä kerran ISOT kiitokset!!
Joo, ei monet virustorjunnat osaa tota smithfraudia poistaa (ainakaan kokonaan). Ja ei muutenkaan osaa yleensä noita pahimpia pöpöjä poistaa, sitä varten on omat fixit Ole hyvä
