Win Xp Home, Spyware,Trojan, Missing Components????

:: statistika :: kasutajate nimekiri :: kasutajate grupid :: registreeri
profiil :: lemmikud :: logi sisse, et näha oma privaatsõnumeid :: logi sisse

Tarkvara » Turvalisus » Win Xp Home, Spyware,Trojan, Missing Components????

märgi kõik teemad loetuks
märgi mitteloetuks
vaata eelmist teemat :: vaata järgmist teemat

Hinnavaatlus :: Foorum :: Uudised :: Ärifoorumid :: HV F1 ennustusvõistlus :: Pangalink :: Telekavad :: HV toote otsing

	Samsung Galaxy M15 5G - 139.99
	Mida iganes sa teed - K-rautas on alati valikut! Vii oma suvised projektid ellu - kõik vajamineva leiad ikka K-rautast
	Kõikidele Canyon akupankadele soodustus kuni 30%! Vaata Euronics.ee
	Ole suveks valmis - mängi kõikjal ja vali Lorgar

autor

sõnum :: teata moderaatorile	otsing:

nah
HV veteran

liitunud: 17.02.2006

18.05.2008 20:28:54 Win Xp Home, Spyware,Trojan, Missing Components????

Arvutis siis win XP Home(system restore off!!), Nod32 trial, Super ad-blocker ning pärast super Ad-blockeri scanni leiti spywaret ja osasid trojan downloader, samuti oli Registry key-d seal, said kõik ära visatud, ning programm nõudis restarti, tegin restardi ja siis kui arvuti käima läks lõi kohe paar errorit ette, et some files failed to initalize because Operating system is shutting down - põhimõtteliselt OS tegi ise Bootimisel restarti... Siis vahepeal lasi näiteks 5 minutit sees olla ja viskas BSOD(Seda siis Nodi scanni ajal). Ja kõige tipuks on Taskbarile tulnud veel mingi punane märk millel valge rist peal ja ütleb et Windows is infected with Spyware ... (Praegu asun linnas, aga see arvuti maal, nii et andke soovitusi mida teha, nädalavahetusel lähen maale.) Ja Formattida ei taha, kuna on tegemist töö-arvutiga, millel on vajalik programm peal... Tänan abi eest!

Kommentaarid: 150 loe/lisa

Kasutajad arvavad:

0 ::

141

tagasi üles

tsihh
HV veteran

liitunud: 05.03.2003

18.05.2008 23:18:55

Hijackthis ja process explorer ilmselt abiks uurimaks, mis täpselt masinal kallal. Igasuguseid op.süsteemi veateateid võid leida event viewerist ja seejärel juba guugel

Kommentaarid: 59 loe/lisa

Kasutajad arvavad:

0 ::

tagasi üles

note1
Lõuapoolik

liitunud: 02.09.2007

21.05.2008 10:54:33

1. Live Onecare 2. Sbybot

Kommentaarid: 3 loe/lisa

Kasutajad arvavad:

2 ::

0 ::

tagasi üles

nah
HV veteran

liitunud: 17.02.2006

22.05.2008 23:35:54

Seda ka veel et Safe modes töötab normilt, homme asun parandama toda arvutit..
Edit: ei lase avada hijack thissi ja spybotti samuti mitte, ja nod32 on punaseks muutunud ,ütleb et antivirus protection disabled
Nod32 peksab seda pidevalt ette:

Sain osadest asjadest lahti SDfix-iga, nüüd laseb spyboti lahti teha ja ka hijackthis-i

tsitaat:

SDFix: Version 1.184
Run by Owner on N 22.05.2008 at 21:58

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix\SDFix

Checking Services :

Restoring Windows Registry Values
Restoring Windows Default Hosts File
Resetting AppInit_DLLs value

Rebooting

Infected beep.sys Found!

beep.sys File Locations:

"C:\WINDOWS\system32\drivers\beep.sys" 36352 18.05.2008 17:08

Infected File Listed Below:

C:\WINDOWS\system32\drivers\beep.sys

File copied to Backups Folder
Attempting to replace beep.sys with original version

Original beep.sys Restored

"C:\WINDOWS\system32\dllcache\beep.sys" 4224 20.05.2008 13:30
"C:\WINDOWS\system32\drivers\beep.sys" 4224 20.05.2008 13:30

Checking Files :

Trojan Files Found:

C:\SVCIPA.EXE - Deleted
C:\WINDOWS\braviax.exe - Deleted
C:\WINDOWS\cru629.dat - Deleted
C:\WINDOWS\didduid.ini - Deleted

Could Not Remove C:\WINDOWS\system32\cru629.dat

Removing Temp Files

ADS Check :

Final Check :

catchme 0.3.1359.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-22 22:22:15
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"
"h0"=dword:00000001
"ujdew"=hex:24,9d,7c,57,cf,f5,7e,7a,b9,21,55,6a,a0,6a,02,2d,de,46,4a,70,50,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:c7,12,5a,d8,f4,57,f5,8e,7b,99,81,66,ad,55,35,1b,33,54,eb,d8,40,..
"p0"="C:\Program Files\DAEMON Tools\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"khjeh"=hex:57,4a,2f,6b,54,73,bb,8d,7f,7d,97,06,57,3f,f0,d9,42,bf,b5,32,49,..
"a0"=hex:20,01,00,00,59,38,34,fc,76,6b,0c,b7,b9,59,3a,4e,a7,46,c3,71,6f,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:a7,cc,98,27,e9,1c,71,11,f6,a3,93,f5,ae,53,b6,92,39,58,11,79,7f,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:c3,c4,1c,4a,79,7a,68,f2,45,1f,6a,a6,00,7f,a6,fe,be,af,6f,15,c3,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42]
"khjeh"=hex:b1,63,5d,16,26,71,db,c2,ff,1f,19,31,34,8d,5a,d2,d2,f1,0e,4f,ee,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43]
"khjeh"=hex:b1,63,5d,16,26,71,db,c2,ff,1f,19,31,34,8d,5a,d2,d2,f1,0e,4f,ee,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"
"h0"=dword:00000001
"ujdew"=hex:3e,f7,54,32,de,ac,20,7e,aa,a8,6b,26,15,f0,a8,55,3b,57,65,4b,ca,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:c7,12,5a,d8,f4,57,f5,8e,7b,99,81,66,ad,55,35,1b,33,54,eb,d8,40,..
"p0"="C:\Program Files\DAEMON Tools\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"khjeh"=hex:57,4a,2f,6b,54,73,bb,8d,7f,7d,97,06,57,3f,f0,d9,42,bf,b5,32,49,..
"a0"=hex:20,01,00,00,59,38,34,fc,76,6b,0c,b7,b9,59,3a,4e,a7,46,c3,71,6f,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:e4,d6,83,22,b7,a9,2e,cd,07,1b,23,c4,e9,47,a4,c7,62,15,76,2e,32,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:c3,c4,1c,4a,79,7a,68,f2,45,1f,6a,a6,00,7f,a6,fe,be,af,6f,15,c3,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42]
"khjeh"=hex:b1,63,5d,16,26,71,db,c2,ff,1f,19,31,34,8d,5a,d2,d2,f1,0e,4f,ee,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43]
"khjeh"=hex:b1,63,5d,16,26,71,db,c2,ff,1f,19,31,34,8d,5a,d2,d2,f1,0e,4f,ee,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:75c40b3b
"s2"=dword:a55031b5
"h0"=dword:00000002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"
"h0"=dword:00000001
"ujdew"=hex:3e,f7,54,32,de,ac,20,7e,aa,a8,6b,26,15,f0,a8,55,3b,57,65,4b,ca,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:c7,12,5a,d8,f4,57,f5,8e,7b,99,81,66,ad,55,35,1b,33,54,eb,d8,40,..
"p0"="C:\Program Files\DAEMON Tools\"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"khjeh"=hex:57,4a,2f,6b,54,73,bb,8d,7f,7d,97,06,57,3f,f0,d9,42,bf,b5,32,49,..
"a0"=hex:20,01,00,00,59,38,34,fc,76,6b,0c,b7,b9,59,3a,4e,a7,46,c3,71,6f,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:e4,d6,83,22,b7,a9,2e,cd,07,1b,23,c4,e9,47,a4,c7,62,15,76,2e,32,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:c3,c4,1c,4a,79,7a,68,f2,45,1f,6a,a6,00,7f,a6,fe,be,af,6f,15,c3,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42]
"khjeh"=hex:b1,63,5d,16,26,71,db,c2,ff,1f,19,31,34,8d,5a,d2,d2,f1,0e,4f,ee,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43]
"khjeh"=hex:b1,63,5d,16,26,71,db,c2,ff,1f,19,31,34,8d,5a,d2,d2,f1,0e,4f,ee,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Vax347s\Config\jdgg40]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"
"h0"=dword:00000001
"ujdew"=hex:3e,f7,54,32,de,ac,20,7e,aa,a8,6b,26,15,f0,a8,55,3b,57,65,4b,ca,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:c7,12,5a,d8,f4,57,f5,8e,7b,99,81,66,ad,55,35,1b,33,54,eb,d8,40,..
"p0"="C:\Program Files\DAEMON Tools\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"khjeh"=hex:57,4a,2f,6b,54,73,bb,8d,7f,7d,97,06,57,3f,f0,d9,42,bf,b5,32,49,..
"a0"=hex:20,01,00,00,59,38,34,fc,76,6b,0c,b7,b9,59,3a,4e,a7,46,c3,71,6f,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:e4,d6,83,22,b7,a9,2e,cd,07,1b,23,c4,e9,47,a4,c7,62,15,76,2e,32,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:c3,c4,1c,4a,79,7a,68,f2,45,1f,6a,a6,00,7f,a6,fe,be,af,6f,15,c3,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42]
"khjeh"=hex:b1,63,5d,16,26,71,db,c2,ff,1f,19,31,34,8d,5a,d2,d2,f1,0e,4f,ee,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43]
"khjeh"=hex:b1,63,5d,16,26,71,db,c2,ff,1f,19,31,34,8d,5a,d2,d2,f1,0e,4f,ee,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Remaining Services :

Authorized Application Key Export:

Remaining Files :

C:\WINDOWS\system32\cru629.dat Found

File Backups: - C:\SDFix\SDFix\backups\backups.zip

Files with Hidden Attributes :

Mon 28 Jan 2008 1,404,240 A.SHR --- "C:\Programs\Spybot - Search & Destroy\SDUpdate.exe"
Mon 28 Jan 2008 5,146,448 A.SHR --- "C:\Programs\Spybot - Search & Destroy\SpybotSD.exe"
Mon 28 Jan 2008 2,097,488 A.SHR --- "C:\Programs\Spybot - Search & Destroy\TeaTimer.exe"
Thu 29 Aug 2002 16 ...H. --- "C:\WINDOWS\system32\j9iss0z.dll"
Thu 29 Aug 2002 16 ...H. --- "C:\WINDOWS\system32\tep917u.dll"
Sun 20 Jan 2008 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sat 16 Jun 2007 3,903 A..HR --- "C:\Documents and Settings\Owner\Application Data\SecuROM\UserData\securom_v7_01.bak"

Finished!

See C:\windows\system32\cru629.dat on ikka seal alles ja kirjutab ennast tagasi (system restore on off)
ja hijackthislog:

tsitaat:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:38:48, on 22.05.2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programs\SuperAdBlocker.com\Super Ad Blocker\SABSVC.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
C:\WINDOWS\System32\cisvc.exe
C:\Programs\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\PnkBstrA.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\UAService7.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\cidaemon.exe
C:\WINDOWS\System32\cidaemon.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\NVTray\NVTray.exe
C:\Programs\SuperAdBlocker.com\Super Ad Blocker\SAdBlock.exe
C:\Programs\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe
C:\Programs\Mozilla Firefox 3 Beta 5\firefox.exe
C:\Programs\ESET\ESET NOD32 Antivirus\egui.exe
C:\Documents and Settings\Owner\Desktop\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neti.ee/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.ordi.ee
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 140.247.60.126:3128
O2 - BHO: SuperAdBlockerBHO Class - {00000000-6C30-11D8-9363-000AE6309654} - C:\Programs\SuperAdBlocker.com\Super Ad Blocker\SABBHO.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: Super Ad Blocker Toolbar - {B4B3001E-0F56-4E51-8250-BDE11547EC55} - C:\Programs\SuperAdBlocker.com\Super Ad Blocker\sabtb.dll
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [NVTray] C:\Program Files\NVTray\NVTray.exe
O4 - HKCU\..\Run: [SuperAdBlocker] C:\Programs\SuperAdBlocker.com\Super Ad Blocker\SAdBlock.exe
O4 - HKCU\..\Run: [Spybot-S&D Security Center launcher] C:\Programs\Spybot - Search & Destroy\SDMain.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - .DEFAULT User Startup: Outlook Express.lnk = C:\Program Files\Outlook Express\MSIMN.EXE (User 'Default user')
O4 - Global Startup: APC UPS Status.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger Addon - {FB5F1911-F110-11d2-BB9E-00C04F795683} - http://messenger.ipfox.com (file missing)
O9 - Extra 'Tools' menuitem: &Messenger Addon - {FB5F1911-F110-11d2-BB9E-00C04F795683} - http://messenger.ipfox.com (file missing)
O14 - IERESET.INF: START_PAGE_URL=http://www.ordi.ee
O16 - DPF: {096DCF31-53FA-4BA6-A729-D85D29FC0D70} (Detect Class) - https://installer.id.ee/IDInstaller.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} - https://www.gamespyid.com/alaunch.cab
O16 - DPF: {7C360B4D-3C03-44CA-9C05-EFEFEFEFEF01} (Detect Class) - https://www.id.ee/installer/IDInstaller.cab
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
O16 - DPF: {CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1) -
O16 - DPF: {E8EB147D-ABEF-4228-A603-AAA845D1B2C1} (esteidTool Class) - http://www.sk.ee/id-kontroll/20070223.cab
O16 - DPF: {F4E3DF3A-6F57-4B8C-AF68-BD41C4BDF8ED} - https://www.valimised.ee/evotein.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\cru629.dat
O20 - Winlogon Notify: !SABWinLogon - C:\Programs\SuperAdBlocker.com\Super Ad Blocker\SABWINLO.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Programs\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Programs\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Programs\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe
O23 - Service: Super Ad Blocker Service (SABSVC) - SuperAdBlocker.com - C:\Programs\SuperAdBlocker.com\Super Ad Blocker\SABSVC.EXE
O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\System32\UAService7.exe

--
End of file - 7204 bytes

Edit: Combofix-iga sain lahti cru629.dat-ist 8)

Kommentaarid: 150 loe/lisa

Kasutajad arvavad:

0 ::

141

tagasi üles

Lord Ami
HV veteran

liitunud: 13.01.2006

22.05.2008 23:46:49

HJTs O20 - AppInit_DLLs: C:\WINDOWS\system32\cru629.dat O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} - https://www.gamespyid.com/alaunch.cab Gamespyd kasutatakse selles arvutis?Kui ei, fixi ka viimane.

Kommentaarid: 57 loe/lisa

Kasutajad arvavad:

0 ::

tagasi üles

nah
HV veteran

liitunud: 17.02.2006

23.05.2008 00:07:21

Mis selle gamespy-ga on?

Kommentaarid: 150 loe/lisa

Kasutajad arvavad:

0 ::

141

tagasi üles

Lord Ami
HV veteran

liitunud: 13.01.2006

23.05.2008 06:46:37

nah kirjutas:

Mis selle gamespy-ga on?

See on ka selline kahtlane.Üldse Gamespy on minu jaoks mõttetus...ma ei tea...

Kommentaarid: 57 loe/lisa

Kasutajad arvavad:

0 ::

tagasi üles

nah
HV veteran

liitunud: 17.02.2006

30.05.2008 16:45:36

Siis uus probleem, seekord venna arvutiga:
Trojan.purityScan
Trojan-Dowwnloader.Agent.AFL
Trojan.Agent
Trojan.Virtumonde
Rootkit.Agent.EV
Sellised asjad leidis spyware doctor üles siis... trial versioon ei luba ära visata

HJT:

tsitaat:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:39:38, on 30.05.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Sunbelt Software\CounterSpy\SBCSTray.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
C:\Program Files\ParetoLogic\Anti-Spyware\Pareto_AS.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
C:\Program Files\Hamachi\hamachi.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Spyware Doctor\pctsGui.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neti.ee/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.2.253:3128
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = neptun.ksk;venus.ksk;pluto;<local>
O4 - HKLM\..\Run: [GBB36X Configure] "C:\WINDOWS\system32\JMRaidTool.exe" boot
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [SBCSTray] "C:\Program Files\Sunbelt Software\CounterSpy\SBCSTray.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NodLogin] "C:\Program Files\ESET\ESET NOD32 Antivirus\nodlogin.exe" /o
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [7062e239] rundll32.exe "C:\WINDOWS\system32\ukhisidy.dll",b
O4 - HKLM\..\Run: [BM7351d1a5] Rundll32.exe "C:\WINDOWS\system32\noonsfpk.dll",s
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [igndlm.exe] "C:\Program Files\IGN\Download Manager\DLM.exe" /windowsstart /startifwork
O4 - HKCU\..\Run: [Uniblue SpeedUpMyPC] "C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe" -s
O4 - HKCU\..\Run: [ParetoLogic Anti-Spyware] "C:\Program Files\ParetoLogic\Anti-Spyware\Pareto_AS.exe" -NM -hidesplash
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9c.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9c.exe (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NaturalColorLoad.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.2.100.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1200247487046
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - Unknown owner - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe (file missing)
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - Unknown owner - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe (file missing)
O23 - Service: Eset HTTP Server (EhttpSrv) - Unknown owner - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Sunbelt CounterSpy Antispyware (SBCSSvc) - Sunbelt Software - C:\Program Files\Sunbelt Software\CounterSpy\SBCSSvc.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 8897 bytes

SDFixist ja Combofix-ist pole kasu olnud..

Kommentaarid: 150 loe/lisa

Kasutajad arvavad:

0 ::

141

tagasi üles

Lord Ami
HV veteran

liitunud: 13.01.2006

30.05.2008 21:19:29

nah kirjutas:

HJT:

tsitaat:

SDFixist ja Combofix-ist pole kasu olnud..

Fixi need:
O4 - HKLM\..\Run: [7062e239] rundll32.exe "C:\WINDOWS\system32\ukhisidy.dll",b
O4 - HKLM\..\Run: [BM7351d1a5] Rundll32.exe "C:\WINDOWS\system32\noonsfpk.dll",s
vaata ennem ps-i

Siis skänni masin üle
http://www.atribune.org/ccount/click.php?id=4
http://www.superantispyware.com/downloadfile.html?productid=SUPERANTISPYWAREFREE
SAS-i puhul vaata kindlasti, et enne uuenduse lased ära teha

//
Need 2 faili olid siis vastavalt:
noonsfpk.dll - not-a-virus:AdWare.Win32.Virtumonde.vqh
ukhisidy.dll - not-a-virus:AdWare.Win32.Virtumonde.vqd

Kommentaarid: 57 loe/lisa

Kasutajad arvavad:

0 ::

tagasi üles

nah
HV veteran

liitunud: 17.02.2006

31.05.2008 13:49:38

Kas keegi teab, kuidas saab windows xp proffesional sp2 registry fixida, kuna ma ei saa system restory kasutada ja L0L windowsi sees ei tööta ka copy/paste ja üldse läheb windowsisse sisse cirka 5 minutit, sisuliselt kõik on vist kahjustada saanud winamp ei tööta internet explorer ei l2he k2ima jne, msn pees. Ja eesmärk oleks vähemalt copy/paste tööle saada, et ühelt kettalt teisele asju ülekanda.

Kommentaarid: 150 loe/lisa

Kasutajad arvavad:

0 ::

141

tagasi üles

Lord Ami
HV veteran

liitunud: 13.01.2006

31.05.2008 14:10:41

http://www.softpedia.com/get/Security/Security-Related/RRT-Remove-Ristrictions-Tool.shtml Proovi seda

Kommentaarid: 57 loe/lisa

Kasutajad arvavad:

0 ::

tagasi üles

nah
HV veteran

liitunud: 17.02.2006

31.05.2008 17:35:08

Oleks vaja failid kätte saada tollelt kettalt ja siis format teha, aga copy/cut/paste jne ei saa teha millegi pärast ...

Kommentaarid: 150 loe/lisa

Kasutajad arvavad:

0 ::

141

tagasi üles

Lord Ami
HV veteran

liitunud: 13.01.2006

31.05.2008 19:57:15

http://nu2.nu/pebuilder/ Ehk saad teha windows live cd sellega.Siis peaksid saama asju kopeerida ma loodan.

Kommentaarid: 57 loe/lisa

Kasutajad arvavad:

0 ::

tagasi üles

Märt.
HV Guru

liitunud: 17.01.2004

02.06.2008 16:12:38

Või tõmmata kuskilt netiavarusest MiniPE ja sellega toimetada. _________________ Albert Einstein: "Vaid kaks asja on lõpmatud, universum ja inimlik rumalus, ja selles esimeses pole ma nii kindel."

Kommentaarid: 29 loe/lisa

Kasutajad arvavad:

0 ::

tagasi üles

nah
HV veteran

liitunud: 17.02.2006

02.06.2008 17:17:05

Asi lahenes sellega et teisele kettale installiti uus xp, vanale kettale tehti "repair install" ja siis andmed üle ja vanale kettale format ...

Kommentaarid: 150 loe/lisa

Kasutajad arvavad:

0 ::

141

tagasi üles

näita postitusi alates eelmisest:

Tarkvara » Turvalisus » Win Xp Home, Spyware,Trojan, Missing Components????

[vaata eelmist teemat] [vaata järgmist teemat]

lisa lemmikuks

näita foorumit:

sa ei või postitada uusi teemasid siia foorumisse
sa ei või vastata selle foorumi teemadele
sa ei või muuta oma postitusi selles foorumis
sa ei või kustutada oma postitusi selles foorumis
sa ei või vastata küsitlustele selles foorumis
sa ei saa lisada manuseid selles foorumis
sa võid manuseid alla laadida selles foorumis

Hinnavaatlus ei vastuta foorumis tehtud postituste eest.