[anonymic]

mul avaneb pdievalt mingine pop-up aken.eriti vastik on siis kui mängin ja välja viskab sellepärast.lehe nimi on ad.oinadserver.com(ja siis mingid tähed veel lõpus)lasin ad-awarega üle.antiviirus ka midagi ei näidanud.kuidas lahti saada?tuli siis kui ezantiviiruse peale panin.kuidas lahti saada sellest.käib tõeliselt närvidele.spybotiga lasin ka üle.ikkagi tuleb see lahti.

[haigo]

No on oinad
http://www.geekstogo.com/forum/index.php?showtopic=83470
Üsna keeruline eemaldamisjuhend.

[anonymic]

mul on see ewido ja hijack thisi logid olemas.aga rohkem ei oska edasi midagi teha, et siis mis ma nüüd teen?

---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on: 22:24:43, 22.04.2006
+ Report-Checksum: A8C5C1EF

+ Scan result:

HKLM\SOFTWARE\Classes\CLSID\{8A406068-D45C-40B9-A096-38AC717FB608} -> Adware.WebDir : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8A406068-D45C-40B9-A096-38AC717FB608} -> Adware.WebDir : Cleaned with backup
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8A406068-D45C-40B9-A096-38AC717FB608} -> Adware.WebDir : Cleaned with backup
HKU\S-1-5-21-854245398-1284227242-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8A406068-D45C-40B9-A096-38AC717FB608} -> Adware.WebDir : Cleaned with backup
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8A406068-D45C-40B9-A096-38AC717FB608} -> Adware.WebDir : Cleaned with backup
[712] C:\WINDOWS\SYSTEM32\wineak32.dll -> Trojan.Agent.qt : Cleaned with backup
[4052] C:\WINDOWS\BHOBJ.dll -> Adware.Webdir : Cleaned with backup
:mozilla.14:C:\Documents and Settings\Villu\Application Data\Mozilla\Firefox\Profiles\fhxehw4h.default\cookies.txt -> TrackingCookie.Adocean : Cleaned with backup
:mozilla.15:C:\Documents and Settings\Villu\Application Data\Mozilla\Firefox\Profiles\fhxehw4h.default\cookies.txt -> TrackingCookie.Adocean : Cleaned with backup
C:\Documents and Settings\Villu\Cookies\villu@revenue[2].txt -> TrackingCookie.Revenue : Cleaned with backup
C:\Documents and Settings\Villu\Desktop\Kaustad\RBR\richards_burns_rally_mod.zip/rbrnet2.0-inst.exe/RBRnet2.0.CAB/KeyHook.dll -> Not-A-Virus.Monitor.Win32.Dafunk : Error during cleaning
C:\Documents and Settings\Villu\Local Settings\Temp\biakcond.exe -> Trojan.Dialer.ay : Cleaned with backup
C:\Documents and Settings\Villu\Local Settings\Temp\cli86.tmp -> Trojan.Agent.qt : Cleaned with backup
C:\Documents and Settings\Villu\Local Settings\Temp\Cookies\villu@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned with backup
C:\Documents and Settings\Villu\Local Settings\Temp\Cookies\villu@yamaha.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\Villu\Local Settings\Temp\win34.tmp.exe -> Trojan.Dialer.oy : Cleaned with backup
C:\Documents and Settings\Villu\Local Settings\Temp\win3B.tmp.exe -> Trojan.Dialer.oy : Cleaned with backup
C:\Documents and Settings\Villu\Local Settings\Temp\win87.tmp.exe -> Trojan.Dialer.oy : Cleaned with backup
C:\Program Files\MessengerDiscovery\killmd.exe -> Adware.VB : Cleaned with backup
C:\WINDOWS\BHOBJ.dll -> Adware.Webdir : Cleaned with backup
C:\WINDOWS\system32\wineak32.dll -> Trojan.Agent.qt : Cleaned with backup
C:\WINDOWS\winres.dll -> Downloader.IstBar.ff : Cleaned with backup


::Report End



Logfile of HijackThis v1.99.1
Scan saved at 22:33:27, on 22.04.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\WINDOWS\SYSTEM32\Ati2evxx.exe
C:\WINDOWS\system32\UAService7.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MessengerDiscovery\msgdiscoveryx.exe
C:\DOCUME~1\Villu\MYDOCU~1\STEM~1\cmd.exe
C:\Documents and Settings\Villu\My Documents\?dobe\?ervices.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Wireless LAN\WlanUtil.exe
C:\Program Files\ZyDAS\ZD1211 802.11g Utility\ZDWlan.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = prosearching.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = prosearching.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neti.ee/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = prosearching.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = prosearching.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = prosearching.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = prosearching.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = prosearching.com
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [adtech2006] C:\windows\adtech2006a.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MessengerDiscovery] C:\Program Files\MessengerDiscovery\msgdiscoveryx.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [CU2] C:\Program Files\Common Files\VCClient\VCMain.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Acaw] "C:\DOCUME~1\Villu\MYDOCU~1\STEM~1\cmd.exe" -vt yazr
O4 - HKCU\..\Run: [Cfbr] C:\Documents and Settings\Villu\My Documents\?dobe\?ervices.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: IEEE 802.11g USB Wireless LAN Utility.lnk = C:\Program Files\Wireless LAN\WlanUtil.exe
O4 - Global Startup: ZDWlan.lnk = ?
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1130940787968
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} - http://yax-download.yazzle.net/YazzleActiveX.cab?refid=1162
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: wineak32 - wineak32.dll (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe

[haigo]

Kõik need "prosearchid" peaksid olema pahad.
Copy-paste oma hijackthis logi fail sellel aadressil olevasse kasti ja vajuta "analyze". Sealt saad juhiseid, mis välja visata.

[anonymic]

nüüd on selline asi et kõik punased on koristatud va. C:\DOCUME~1\Villu\MYDOCU~1\STEM~1\cmd.exe Hijack this:This entry is not running from the System32 folder, so it is probably nasty.
Possibly nasty! According to our database this process runs normally in c:\windows\system32\! Check if you know this process and arrange a viruscheck where required.

mida ma teen sellega?ma ei leia seda kusagilt kaustast.panin selle ka peale show hidden files and folders ja ikkagi mitte midagi.see pop-up avaneb ikka veel

[haigo]

My Documents kaustas pole Stem... nimelist?
Pane Safe Modes masin käima korra ja siis peaks vist kah HijackThis töötama, proovi korraks siis eemaldada.
Lingil, mis esimeses postis, olid ka mingid tegevused kirjeldatud.

[anonymic]

my documentsis ma leidsin selle üles küll aga seda faili ei olnud näha seal.kui selle safe mdoes üles leian panen delete?

[haigo]

Ma ei tea, viska äkki terve kaust välja
Arvan, et tee safe modes hijackiga scan ja pane remove/delete sealt.

[anonymic]

hijack ei näita seda seal.ainult notepad'i logis näitab.pmst võib selle cmd.exe ära kustutada või on see midagi tähtsat?

[haigo]

Mis selle kausta nimi on, kus ta sees on?

[anonymic]

hijack this ütleb et fail on C:\DOCUME~1\Villu\MYDOCU~1\STEM~1\cmd.exe aga ma ei leidnud seda sealt.kohe lähen safe mode ja vaatan kas seal on midagi

EDIT:selle STEM kausta kustutasin ära ja nüüd läksin windowsi kausta ja seal on kahtlased kaustad.need võib kustutada?

[haigo]

Need peaksid olema SP2 või winupdate uninstallifailid, kahtlased ei tohiks olla. Kui ei taha SP2-e välja visata, siis vist võiks kustutada.

[anonymic]

pole sellest ikka lahti saanud.kõik failif on näha aga sellist faili mis ma otsima pean sealt system32 kaustast.seda seal ei ole.siis soovitati seal teha desktopile fail FindFile.bat mingi sisuga aga see fail mis avaneb ja peaks näitama faili asukohta vms on täiesti tühi.ei oska rohkem midagi teha

[Vello.]

Mul oli ka selline probleem. Kasutasin Kaspersky 6.0 30. triali ja sain sellest lahti.
Selle saad tõmmata siit https://foorum.hinnavaatlus.ee/viewtopic.php?t=258741 .
Juhul kui sa juba oled seda kasutanud siis ma ei saa selle postiga sind aidata.

[anonymic]

eks ma proovin selle ära siis.loodan et saan ka lahti

[Lord Ami]

[anonymic]

nii.sain teada mis failid sellega seotud on.

kas need võib ära kustutada?