hjt-log / mesevirus

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by baabis, Feb 19, 2008.

Page 1 of 2
  1. baabis

    baabis Member

    Joined:
    Feb 19, 2008
    Messages:
    30
    Likes Received:
    0
    Trophy Points:
    16
    Uusi palstalla ja tiedän tehneeni todella tyhmästi. Toivottavasti joku viitsisi auttaa... Kiitos etukäteen.

    ---------------------------------------------

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 20:05:18, on 19.2.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe
    C:\Program Files\Common Files\Nokia\Tools\NclTray.exe
    C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\wksmgrtsgs.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\Nokia\PC Suite for Nokia 6600\connmngmntbox.exe
    C:\Program Files\Nokia\PC Suite for Nokia 6600\ectaskscheduler.exe
    C:\Program Files\WinZip\WZQKPICK.EXE
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\PROGRA~1\Nokia\PCSUIT~1\Elogerr.exe
    C:\Program Files\Intuwave\Shared\mRouterRunTime\mRouterRuntime.exe
    C:\PROGRA~1\Nokia\PCSUIT~1\BROADC~1.EXE
    C:\Program Files\Billionton\Bluetooth-ohjelmisto\bin\btwdins.exe
    C:\PROGRA~1\Nokia\PCSUIT~1\SCRFS.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [Nokia Tray Application] C:\Program Files\Common Files\Nokia\Tools\NclTray.exe
    O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [Windows Control Server] wksmgrtsgs.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: BTTray.lnk = ?
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: PCSuiteForNokia6600 Detect.lnk = ?
    O4 - Global Startup: PCSuiteForNokia6600 TS.lnk = ?
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O8 - Extra context menu item: Lähetä &Bluetooth-laitteeseen - C:\Program Files\Billionton\Bluetooth-ohjelmisto\btsendto_ie_ctx.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Billionton\Bluetooth-ohjelmisto\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Billionton\Bluetooth-ohjelmisto\btsendto_ie.htm
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\Billionton\Bluetooth-ohjelmisto\bin\btwdins.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

    --
    End of file - 6599 bytes
     
    baabis, Feb 19, 2008
    #1
  2. Hujo

    Hujo Guest

    Ohje AVG:n Anti-Spyware 7.5:n käyttöön
    Huom! Tässä ohjeessa sammutetaan tuo reaaliaikasuojaus (Shield). Näin vältetään tilanteet joissa suojaus estäisi esim HijackThis:n työkalun toimintaa.

    Tallenna nämä ohjeet tekstitiedostoon tai tulosta nämä, muuten et pääse niihin käsiksi vikasietotilasta

    Lataa AVG:n Anti-Spyware 7.5:n
    ja tallenna ohjelma työpöydällesi.
    o Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa.
    o Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää.
    o Käynnistä AVG:n Anti-Spyware.
    o Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta.

    o Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa.

    o Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti.
    o Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine".

    o Sitten "Reports" valikon alta:
    o Laita täppi kohtaan "Automatically generate report after every scan"
    o Ota täppi pois kohdasta"Only if threats were found"

    o Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa
    o "Resident shield is", muuta tila active:sta inactive:ksi
    o Sulje ohjelma, ÄLÄ skannaa vielä.

    Käynnistä koneesi vikasietotilaan,
    sammuta ja käynnistä
    käynnistyksen yhteydessä naputtele F8
    valitse nuoli näppäimellä vikasietotila
    paina enter ja enter

    Toisissa koneissa paukutetaan F8:sin sijasta F5:tä

    HUOM! Älä käytä muita ohjelmia AVG:n skannauksen aikana, tämä saattaa häiritä skannausta.
    o Kun vikasietotilassa, käynnistä AVG:n Anti-Spyware.
    o Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan".
    o Ewido aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa.

    Kun skannaus on valmis:
    TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions"
    o Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta.
    o Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions"
    [​IMG]
    o Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta.
    o Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle.
    o Sulje ohjelma, käynnistä kone normaalisti ja lähetä AVG:n raportti viestikejuusi.
     
    Hujo, Feb 19, 2008
    #2
  3. baabis

    baabis Member

    Joined:
    Feb 19, 2008
    Messages:
    30
    Likes Received:
    0
    Trophy Points:
    16
    Onnistuin tämänkin homman tekeen väärin vaikka ohjeistus oli selkeä. Toivottavasti peli ei ole vielä menetetty... :S


    ---------------------------------------------------------
    AVG Anti-Spyware - Scan Report
    ---------------------------------------------------------

    + Created at: 17:43:01 20.2.2008

    + Scan result:



    :mozilla.137:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.138:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.139:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.140:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.141:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.142:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.143:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.144:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.145:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.146:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.147:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.148:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.149:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.150:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.151:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.152:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.153:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.154:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.155:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.156:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.469:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.485:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.522:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.570:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.724:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.725:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    C:\Documents and Settings\ada\Cookies\ada@2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.257:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
    :mozilla.258:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
    :mozilla.106:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
    :mozilla.107:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
    :mozilla.101:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.102:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.103:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.104:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.99:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    C:\Documents and Settings\ada\Cookies\ada@advertising[1].txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.183:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
    C:\Documents and Settings\ada\Cookies\ada@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
    C:\Documents and Settings\ada\Cookies\ada@atdmt[3].txt -> TrackingCookie.Atdmt : Cleaned.
    :mozilla.121:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
    :mozilla.260:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
    :mozilla.399:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Gemius : Cleaned.
    :mozilla.400:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Gemius : Cleaned.
    :mozilla.857:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
    :mozilla.122:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.123:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.124:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.831:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Information : Cleaned.
    :mozilla.429:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Ivwbox : Cleaned.
    :mozilla.26:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Netflame : Cleaned.
    :mozilla.27:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Netflame : Cleaned.
    :mozilla.21:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
    :mozilla.261:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
    :mozilla.262:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
    :mozilla.263:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
    :mozilla.264:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
    :mozilla.265:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
    :mozilla.266:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
    :mozilla.267:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
    :mozilla.612:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
    :mozilla.613:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
    :mozilla.617:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Revenue : Cleaned.
    :mozilla.618:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
    :mozilla.619:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
    :mozilla.620:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
    :mozilla.621:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
    C:\Documents and Settings\ada\Cookies\ada@serving-sys[1].txt -> TrackingCookie.Serving-sys : Cleaned.
    :mozilla.29:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Statistik-gallup : Cleaned.
    :mozilla.655:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
    :mozilla.656:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
    :mozilla.657:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
    :mozilla.658:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
    :mozilla.659:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
    :mozilla.100:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
    :mozilla.105:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
    :mozilla.98:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
    :mozilla.685:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
    :mozilla.686:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
    :mozilla.687:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
    :mozilla.688:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
    C:\Documents and Settings\ada\Cookies\ada@m.webtrends[2].txt -> TrackingCookie.Webtrends : Cleaned.
    :mozilla.754:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Yadro : Cleaned.
    :mozilla.76:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
    :mozilla.77:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
    :mozilla.78:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
    :mozilla.79:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
    :mozilla.80:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
    :mozilla.81:C:\Documents and Settings\ada\Application Data\Mozilla\Firefox\Profiles\mtvyrhyw.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.


    ::Report end
     
    baabis, Feb 20, 2008
    #3
  4. Hujo

    Hujo Guest

    Lataa tuolta http://www.ccleaner.com/download/builds.aspx
    CCleaner v2.03.532- Standard Build, ÄLÄ aseenna Yahoo toolbaria!

    laita asetukset näin:
    Valinnat --> Lisäasetukset --> Ota ruksi pois kohdasta Poista vain yli 48 tuntia vanhat tilapäistiedostot.

    aja Puhdistaja > tutki nappi > aja ccleaner nappi oikea alakulma
    aja Virheet > etsi rekisteri virheitä nappi > Korjaa rekisteri virheet. nappi
     
    Hujo, Feb 20, 2008
    #4
  5. baabis

    baabis Member

    Joined:
    Feb 19, 2008
    Messages:
    30
    Likes Received:
    0
    Trophy Points:
    16
    Tehty, sitte?
     
    baabis, Feb 21, 2008
    #5
  6. Hujo

    Hujo Guest

    1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
    combofix1
    combofix2

    2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen
     
    Hujo, Feb 21, 2008
    #6
  7. baabis

    baabis Member

    Joined:
    Feb 19, 2008
    Messages:
    30
    Likes Received:
    0
    Trophy Points:
    16
    ComboFix 08-02-21 - ada 2008-02-21 19:46:56.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.216 [GMT 2:00]
    Running from: C:\Documents and Settings\ada\Työpöytä\ComboFix.exe
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-01-21 to 2008-02-21 )))))))))))))))))
    .

    2008-02-21 18:29 . 2008-02-21 18:29 <KANSIO> d-------- C:\Program Files\CCleaner
    2008-02-20 19:17 . 2008-02-21 18:22 <KANSIO> d-------- C:\Program Files\Miranda IM
    2008-02-20 18:46 . 2008-02-20 21:49 <KANSIO> d-------- C:\Documents and Settings\ada\Application Data\.purple
    2008-02-20 16:23 . 2008-02-20 16:23 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
    2008-02-20 16:23 . 2008-02-20 16:23 <KANSIO> d-------- C:\Documents and Settings\ada\Application Data\Grisoft
    2008-02-20 16:23 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2008-02-19 20:04 . 2008-02-19 20:04 <KANSIO> d-------- C:\Program Files\Trend Micro
    2008-02-19 17:57 . 2008-02-19 17:57 <KANSIO> d-------- C:\Program Files\Spybot - Search & Destroy
    2008-02-19 17:57 . 2008-02-19 18:28 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-02-19 16:08 . 2008-02-19 16:07 26,632 -r-hs---- C:\WINDOWS\wksmgrtsgs.exe

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-02-20 19:49 --------- d-----w C:\Documents and Settings\ada\Application Data\.purple
    2008-02-20 17:01 --------- d-----w C:\Documents and Settings\ada\Application Data\gtk-2.0
    2008-02-19 20:42 --------- d-----w C:\Program Files\Winamp
    2008-02-09 19:30 --------- d-----w C:\Documents and Settings\ada\Application Data\LimeWire
    2008-01-09 12:52 --------- d-----w C:\Program Files\Alwil Software
    2008-01-04 08:44 --------- d-----w C:\Program Files\Winamp Remote
    2008-01-04 08:44 --------- d-----w C:\Documents and Settings\All Users\Application Data\OrbNetworks
    2007-12-11 15:25 200 ----a-w C:\WINDOWS\Fonts\WS_FTP.LOG
    2007-12-07 01:07 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
    2007-12-04 18:41 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
    2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
    2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
    .

    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 14:00 15360]
    "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "RTHDCPL"="RTHDCPL.EXE" [2006-09-12 03:58 16264192 C:\WINDOWS\RTHDCPL.exe]
    "SkyTel"="SkyTel.EXE" [2006-05-16 05:04 2879488 C:\WINDOWS\SkyTel.exe]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 02:06 40048]
    "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 09:50 155648]
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-09-04 17:22 155648]
    "RemoteControl"="C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe" [2004-11-02 19:24 32768]
    "Nokia Tray Application"="C:\Program Files\Common Files\Nokia\Tools\NclTray.exe" [2003-12-19 10:38 425984]
    "DataLayer"="C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe" [2004-02-19 15:23 1089536]
    "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-09-15 14:00 110592 C:\WINDOWS\system32\bthprops.cpl]
    "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 15:00 79224]
    "Windows Control Server"="wksmgrtsgs.exe" [2008-02-19 16:07 26632 C:\WINDOWS\wksmgrtsgs.exe]
    "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25 6731312]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 14:00 15360]

    C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-10-10 19:16:47 113664]
    BTTray.lnk - C:\Program Files\Billionton\Bluetooth-ohjelmisto\BTTray.exe [2003-12-01 14:28:00 499779]
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 09:15:54 65588]
    PCSuiteForNokia6600 Detect.lnk - C:\Program Files\Nokia\PC Suite for Nokia 6600\connmngmntbox.exe [2007-10-17 18:40:48 196608]
    PCSuiteForNokia6600 TS.lnk - C:\Program Files\Nokia\PC Suite for Nokia 6600\ectaskscheduler.exe [2007-10-17 18:40:49 258112]
    WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2007-08-03 10:10:00 394856]


    .
    **************************************************************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-02-21 19:48:56
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-02-21 19:49:34
    .
    2008-02-13 20:51:13 --- E O F ---
     
    baabis, Feb 21, 2008
    #7
  8. Hujo

    Hujo Guest

    Lataa MsnCleaner.zip

    "Pura tiedosto työpöydälle, älä käytä sitä vielä.
    "Käynnistä kone Vikasietotilaan
    "Tuplaklikkaa MsnCleaner.exe
    "Paina Analyze nappia.
    "Jos löytyy tartuntoja, paina Deleted nappia.
    "Käynnistä kone normaalisti ja lähetä C:\MsnCleaner.txt raportti viestiketjuusi.
     
    Hujo, Feb 21, 2008
    #8
  9. baabis

    baabis Member

    Joined:
    Feb 19, 2008
    Messages:
    30
    Likes Received:
    0
    Trophy Points:
    16
    - Logfile MSNCleaner 1.5.5 by www.forospyware.com
    - Created Logfile: 21.2.2008 on 20:13:01
    - Operative System: Windows XP
    - Boot mode: Safe mode
    _________________________________________

    Detected files: 0
    Deleted file: 0
    Undeleted Files: 0

    <<<<<<< No file found >>>>>>>
     
    baabis, Feb 21, 2008
    #9
  10. Hujo

    Hujo Guest

    eipä näy mesevirusta
     
    Hujo, Feb 21, 2008
    #10
  11. baabis

    baabis Member

    Joined:
    Feb 19, 2008
    Messages:
    30
    Likes Received:
    0
    Trophy Points:
    16
    Kiitos avusta.
     
    baabis, Feb 21, 2008
    #11
  12. baabis

    baabis Member

    Joined:
    Feb 19, 2008
    Messages:
    30
    Likes Received:
    0
    Trophy Points:
    16
    Ongelma on kuitenkin jatkunut. Messengeri lähettää ittellänsä muille online:ssä oleville linkkiä, josta viruksen saa. Mitä avuksi?
    Ohessa uus logi:


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 21:13:54, on 23.2.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Billionton\Bluetooth-ohjelmisto\bin\btwdins.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe
    C:\Program Files\Common Files\Nokia\Tools\NclTray.exe
    C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\wksmgrtsgs.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Billionton\Bluetooth-ohjelmisto\BTTray.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\Nokia\PC Suite for Nokia 6600\ectaskscheduler.exe
    C:\Program Files\WinZip\WZQKPICK.EXE
    C:\PROGRA~1\Nokia\PCSUIT~1\Elogerr.exe
    C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
    C:\PROGRA~1\Nokia\PCSUIT~1\BROADC~1.EXE
    C:\PROGRA~1\Nokia\PCSUIT~1\SCRFS.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [Nokia Tray Application] C:\Program Files\Common Files\Nokia\Tools\NclTray.exe
    O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [Windows Control Server] wksmgrtsgs.exe
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: BTTray.lnk = ?
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: PCSuiteForNokia6600 Detect.lnk = ?
    O4 - Global Startup: PCSuiteForNokia6600 TS.lnk = ?
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O8 - Extra context menu item: Lähetä &Bluetooth-laitteeseen - C:\Program Files\Billionton\Bluetooth-ohjelmisto\btsendto_ie_ctx.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Billionton\Bluetooth-ohjelmisto\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Billionton\Bluetooth-ohjelmisto\btsendto_ie.htm
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\Billionton\Bluetooth-ohjelmisto\bin\btwdins.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

    --
    End of file - 6957 bytes
     
    Last edited: Feb 23, 2008
    baabis, Feb 23, 2008
    #12
  13. Hujo

    Hujo Guest

    Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

    Käynnistä koneesi vikasietotilaan:

    sammuta ja käynnistä
    käynnistyksen yhteydessä hakkaa F8 nappia
    valitse nuolinäppäimellä vikasietotila
    paina enter ja enter
    valitse käyttäjätilisi
    paina kyllä

    Jossakin koneissa hakataan F8:sin sijasta F5:tä

    " Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
    " Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
    " Paina Y käynnistääksesi skriptin.
    " Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
    " Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
    " Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
    " Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
    " Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
    " Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.
     
    Hujo, Feb 23, 2008
    #13
  14. baabis

    baabis Member

    Joined:
    Feb 19, 2008
    Messages:
    30
    Likes Received:
    0
    Trophy Points:
    16

    SDFix: Version 1.146

    Run by ada on su 24.02.2008 at 11:03

    Microsoft Windows XP [versio 5.1.2600]
    Running From: C:\DOCUME~1\ada\TYPYT~1\SDFix

    Checking Services :


    Restoring Windows Registry Values
    Restoring Windows Default Hosts File

    Rebooting


    Checking Files :

    Trojan Files Found:

    C:\WINDOWS\system32\drivers\etc\BackupHosts.bak - Deleted





    Removing Temp Files

    ADS Check :



    Final Check :

    catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-02-24 11:13:10
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden services & system hive ...

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001060a5f15f]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\001060a5f15f]

    scanning hidden registry entries ...

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\\x90\x2022\x20ac|\xff\xff\xff\xff"\x2022\x20ac|\xfe\xbb\xd3w\2]
    "b049C053C7D38EE4AB9A00CB3B5D2472"="C?\Program Files\Common Files\Microsoft Shared\Web Folders\PUBPLACE.HTT"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
    "TracesProcessed"=dword:0000003a

    scanning hidden files ...


    scan completed successfully
    hidden processes: 0
    hidden services: 0
    hidden files: 1


    Remaining Services :



    Authorized Application Key Export:

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

    Remaining Files :


    File Backups: - C:\DOCUME~1\ada\TYPYT~1\SDFix\backups\backups.zip

    Files with Hidden Attributes :

    Tue 19 Feb 2008 26,632 ..SHR --- "C:\WINDOWS\wksmgrtsgs.exe"
    Mon 28 Jan 2008 1,404,240 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
    Mon 28 Jan 2008 5,146,448 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
    Mon 28 Jan 2008 2,097,488 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
    Wed 14 Nov 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
    Wed 14 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\28daf2e1f8ef97b772dfdbad9c3d0bd9\BIT4.tmp"

    Finished!

     
    baabis, Feb 24, 2008
    #14
  15. baabis

    baabis Member

    Joined:
    Feb 19, 2008
    Messages:
    30
    Likes Received:
    0
    Trophy Points:
    16
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:22:47, on 24.2.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Billionton\Bluetooth-ohjelmisto\bin\btwdins.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe
    C:\Program Files\Common Files\Nokia\Tools\NclTray.exe
    C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\wksmgrtsgs.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\Program Files\Billionton\Bluetooth-ohjelmisto\BTTray.exe
    C:\Program Files\Nokia\PC Suite for Nokia 6600\connmngmntbox.exe
    C:\Program Files\Nokia\PC Suite for Nokia 6600\ectaskscheduler.exe
    C:\Program Files\WinZip\WZQKPICK.EXE
    C:\PROGRA~1\Nokia\PCSUIT~1\Elogerr.exe
    C:\Program Files\Intuwave\Shared\mRouterRunTime\mRouterRuntime.exe
    C:\PROGRA~1\Nokia\PCSUIT~1\BROADC~1.EXE
    C:\PROGRA~1\Nokia\PCSUIT~1\SCRFS.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [Nokia Tray Application] C:\Program Files\Common Files\Nokia\Tools\NclTray.exe
    O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [Windows Control Server] wksmgrtsgs.exe
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: BTTray.lnk = ?
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: PCSuiteForNokia6600 Detect.lnk = ?
    O4 - Global Startup: PCSuiteForNokia6600 TS.lnk = ?
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O8 - Extra context menu item: Lähetä &Bluetooth-laitteeseen - C:\Program Files\Billionton\Bluetooth-ohjelmisto\btsendto_ie_ctx.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Billionton\Bluetooth-ohjelmisto\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Billionton\Bluetooth-ohjelmisto\btsendto_ie.htm
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\Billionton\Bluetooth-ohjelmisto\bin\btwdins.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

    --
    End of file - 7201 bytes
     
    baabis, Feb 24, 2008
    #15
  16. Hujo

    Hujo Guest

    Pistäs tämä wksmgrtsgs.exe virustotaaliin

    Lähetetääni tiedosto Virustotaliin
    virustotal

    1 Klikkaa Selaa... nappia
    2 Selaa sitten siihen tämä tiedosto: C:\WINDOWS\wksmgrtsgs.exe
    3 Klikkaa Avaa nappia
    4 Klikkaa Send nappia
    5 Sivusto scannaa tiedostoa hetken, tallenna sitten tulokset jotka saat vaikka muistioon.
     
    Hujo, Feb 24, 2008
    #16
  17. Kepetys

    Kepetys Member

    Joined:
    Jan 27, 2008
    Messages:
    81
    Likes Received:
    0
    Trophy Points:
    16
    Toi C:\WINDOWS\wksmgrtsgs.exe on se virus.
     
    Kepetys, Feb 24, 2008
    #17
  18. baabis

    baabis Member

    Joined:
    Feb 19, 2008
    Messages:
    30
    Likes Received:
    0
    Trophy Points:
    16
    Joo, toimis ny vaa toi virustotal..
     
    baabis, Feb 24, 2008
    #18
  19. Hujo

    Hujo Guest

    Olin tuossa virustotaalissa ja 8 sija oli scannaukseen.
     
    Hujo, Feb 24, 2008
    #19
  20. baabis

    baabis Member

    Joined:
    Feb 19, 2008
    Messages:
    30
    Likes Received:
    0
    Trophy Points:
    16
    Muute hyvä, mutta en vaan millään löydä koneelta tota wksmgrtsgs.exe:ä. Mutta prosesseissa se kyllä näkyy....
     
    baabis, Feb 24, 2008
    #20
Page 1 of 2

Share This Page