[blackwerew]

Firefoxiga netis surfates viskab mulle koguaeg ette mingeid Internet Exploreri lehti kus saab kord mingi mehega poksida, kõhulihaseid teha, lennukeid pommitada, autoga sõita ja mida iganes veel ja mingisugused Online Casino lehed.

Kas on miskisugune uss sisse pugenud äkki kuskilt?

Nod mul midagi ei leidnud... :S

[Lord Ami]

http://www.arvutikaitse.ee/?p=665
Skänni sellega üle ja anna teada mis sai.

[blackwerew]

Pean vahepeal siis NOD32 kinni panema ?

[Lord Ami]

Ei pea, need programmid ei sega üksteist.

[Janis]

sul ikka popup blocker vms on peal?

[qwint]

Kuidas IE7 ga reeklaame keelata saab. No need lollakad pildid, mis sul keset ekraani hüppavad. Tavaliselt on nendel see close nupp ka kuskil kõrval aga ma tahaks, et need nagu üldse ei tuleks. Suht häiriv.

[blackwerew]

Ma ei tea kas on POP-UP blocker peal. Kasutan Mozzillat ja ikka tulevad need IE pop-upid.
Task Manageris kui IE kinni panna tuleb ikka tagasi.

[Dogbert]

Skännisid siis SAS-iga või? Firefoxi kasutamiseks IE asemel on tibake hilja, kui sul viirus või nuhk juba masina üle kontrolli omab ja oma tahtmise järgi IE-ga toimetab.

[blackwerew]

Scannitud siis.
Threate siis 218.
Threat Description

1) AdWare.MyWay - Detected Items = 5
2) Unclassified.Unknown origin - Detected Items = 15
3) AdWare.Tracking Cookie - Detected Items = 192
4) AdWare.PointsManager-Uninstaller - Detected Items = 1
5) AdWare.Need2find. -Detected Items = 3
6) Adware.RX Toolbar -Detected Items = 2

Mis kuradi asi see Adware olla võib 8-)
Maha ta igatahes läks nüüd. Eks päeva aeg ole näha kas hakkab veel neid POP-UP´e tulema või ei.

Võin selle programmi uninstallida nüüd ?

[Ezh]

Kas nod32 oli peal ja ei kaitsnud selle adware eest?

[HacaX]

[Märt.]

[blackwerew]

Sellepärast mul see jama koguaeg ette tuligi :S
Kord poksi mingi päkapikuga, siis lenda lennukiga, tee lõuatõmbeid jne.

E: Naine ütles, et hommikul oli ikka mingi lõuatõmbamine ees olnud :/
E2: Scannin taas.

1) AdWare.Tracking Cookie - Detected Items = 3
2) AdWare.PointsManager-Uninstaller - Detected Items = 1
3) AdWare.Need2find. -Detected Items = 3

[laurx]

kust sa oma nööd32he said? " poest ostetud" variant selliseid asju l2bi lasta ei tohiks, igikestvaks pätsitud nööd ainult simuleerib töötamist ja hoiab exeptions ite all hunnikut troojasid ja muud sarnast. alusta sellest, et tee nt ccleaner iga temp kaustad tühjaks, otsi omale korralik tõrje, keera system restore korraks kinni, tee skänn, tee SAS iga uus skänn ja siis võid system restore uuesti käima keerata. meile uurimiseks võid anda hijackthis nimelise programmi logifailist pärit teksti.

[blackwerew]

Kust ma selle hijackthis nimelise programmi saaksin ?
NOD32 oli igatahes koos karbiga minu mäletamist mööda, tuttav installeeris veel kõik korralikult ära.

[laurx]

http://www.hijackthis.de/ by google

[blackwerew]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:14:57, on 23.05.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\WINDOWS\system32\agrsmsvc.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclBCBTSrv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.iesearch.com/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Mode bold body live] C:\Documents and Settings\All Users\Application Data\Does Date Mode Bold\Second locks.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKCU\..\Run: [blue safe] C:\DOCUME~1\Maili\APPLIC~1\BEEPTI~1\Manager site info.exe
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: &Search - http://kn.bar.need2find.com/KN/menusearch.html?p=KN
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {096DCF31-53FA-4BA6-A729-D85D29FC0D70} (Detect Class) - https://installer.id.ee/IDInstaller.cab
O16 - DPF: {48369DA6-2508-4F08-8716-336190B071A7} (MapViewer Class) - http://maps.lv.parnu.ee/Client/MapViewer/MapViewerCtl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1207057839949
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1207061125937
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/download/AutoDL?BundleId=19588
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\WINDOWS\system32\agrsmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Unknown owner - C:\Program Files\Eset\nod32krn.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 7525 bytes

___________________________________

E: Ccleaneriga tegin juba öösel ja tegin ka praegu, milline on siis korralikum tõrke, kuidas System Restore maha keerata. Sorry, ma veidi võhik :$

[laurx]

O4 - HKLM\..\Run: [Mode bold body live] C:\Documents and Settings\All Users\Application Data\Does Date Mode Bold\Second locks.exe
Nasty (2.97 / 5.00)
O4 - HKCU\..\Run: [blue safe] C:\DOCUME~1\Maili\APPLIC~1\BEEPTI~1\Manager site info.exe
Nasty (1.97 / 5.00)
O8 - Extra context menu item: &Search - http://kn.bar.need2find.com/KN/menusearch.html?p=KN
The entry &Search has been identified as nasty.
O16 - DPF: {48369DA6-2508-4F08-8716-336190B071A7} (MapViewer Class) - http://maps.lv.parnu.ee/Client/MapViewer/MapViewerCtl.cab
Check if you know this site and fix it if you do not. Unknown ActiveX-Objects, or ActiveX-Objects from unknown sites should always be fixed. If the name of the ActiveX-Object or the URL contains the words 'dialer', 'casino', 'free plugin' etc, it should be fixed!

need liigitas analyser ise katkisteks ja peaksid olema masinast kaotatud. mina korjaks veel igastsugu k2ivitusv6tmed mesennide ja muu saasta alt ka 2ra nii,et masina k2ivitamisel l2heks k2ima ainult viirusetõrje.

[blackwerew]

Nende nelja ette pean panema siis linnukese ja FIX CHECKED ?

[Lord Ami]

[blackwerew]

Nüüd scannin veel ühe korra HiJackThis´ga ja annan jälle logi ?

[Lord Ami]

Jah.Kas sa Combofixi logi saaksid ka esitada?
http://www.bleepingcomputer.com/combofix/how-to-use-combofix