Antivir tommosen löys, en tiiä osasko poistaa. Näkyskö tästä mitään korjattavaa: EDIT: Olihan se poistunu mutta liekkö jättäny muuta jälkeensä =) Logfile of HijackThis v1.99.1 Scan saved at 10:21:04, on 3.6.2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ewido\security suite\ewidoctrl.exe C:\WINDOWS\system32\inetsrv\inetinfo.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\DU Meter\DUMeter.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\MessengerPlus! 3\MsgPlus.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Microsoft AntiSpyware\gcasServ.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\Program Files\FreeRam\FreeRAM XP Pro.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe C:\Program Files\Uptime\client.exe C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\No-IP\DUC20.exe C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE C:\Program Files\Microsoft Office\Office10\OUTLOOK.EXE C:\Program Files\Microsoft Office\Office10\WINWORD.EXE C:\Program Files\Winamp\winamp.exe C:\Program Files\Microsoft Office\Office10\EXCEL.EXE C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\AntiVir PersonalEdition Classic\sched.exe C:\HJT\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe" O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\FreeRam\FreeRAM XP Pro.exe" -win O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog O4 - HKCU\..\Run: [Uptime-Project] C:\Program Files\Uptime\client.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" O4 - Startup: Client Default.lnk = C:\Program Files\Samurize\Client.exe O4 - Startup: No-IP DUC.lnk = C:\Program Files\No-IP\DUC20.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - http://localhost:2610/tsweb/msrdp.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{FE4C7616-797D-4873-8879-3CD8EC920706}: NameServer = 62.165.128.12,62.165.128.11 O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
Skannaa koneesi Kaspersky Online Skannerilla (IE) http://www.kaspersky.com/downloads/kws/kavwebscan.html Sinulta kysytään sallitko ActiveX -komponentin asentamisen Kasperskyltä, klikkaa Kyllä. Ohjelma käynnistyy ja aloittaa viimeisimpien tunnistetiedostojen lataamisen. Kun skanneri on asennettu ja tunnistetiedot ladattu, klikkaa Next. Klikkaa nyt asetuksia, Scan Settings Tarkista asetuksista, että seuraavat ovat valittuina: o Scan using the following Anti-Virus database: + Extended (Jos valittavissa, muuten valitse Standard) o Scan Options: + Scan Archives + Scan Mail Bases Klikkaa OK Nyt valitse "select a target to scan" otsikon alta Oma Tietokone, My Computer Skannaus vie aikaa, joten ole kärsivällinen. Kun skannaus on valmis saat ilmoituksen, jos koneesi on saastunut. Klikkaa nyt Save as Text-painiketta. Tallenna tiedosto työpöydällesi. Kopioi ja Liitä tiedoston sisältö seuraavaan vastaukseesi.
------------------------------------------------------------------------------- KASPERSKY ON-LINE SCANNER REPORT Sunday, June 04, 2006 12:47:48 AM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky On-line Scanner version: 5.0.78.0 Kaspersky Anti-Virus database last update: 3/06/2006 Kaspersky Anti-Virus database records: 198301 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ F:\ G:\ H:\ I:\ J:\ K:\ L:\ M:\ V:\ W:\ X:\ Y:\ Z:\ Scan Statistics: Total number of scanned objects: 98743 Number of viruses found: 6 Number of infected objects: 32 Number of suspicious objects: 0 Duration of the scan process: 01:37:57 Infected Object Name / Virus Name / Last Action C:\Program Files\BitTorrent\uninstall.exe/stream/data0002 Infected: not-a-virus:RiskTool.Win32.PsKill.n skipped C:\Program Files\BitTorrent\uninstall.exe/stream Infected: not-a-virus:RiskTool.Win32.PsKill.n skipped C:\Program Files\BitTorrent\uninstall.exe NSIS: infected - 2 skipped C:\Program Files\fulDC\DCPlusPlus.exe Infected: not-a-virus:Monitor.Win32.NetMon.a skipped C:\Program Files\RealVNC\VNC4\winvnc4.rar/winvnc4.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4110 skipped C:\Program Files\RealVNC\VNC4\winvnc4.rar RAR: infected - 1 skipped D:\keyfinder.exe/data.rar/xpkey.exe Infected: not-a-virusSWTool.Win32.RAS.a skipped D:\keyfinder.exe/data.rar/officekey.exe Infected: not-a-virusSWTool.Win32.RAS.a skipped D:\keyfinder.exe/data.rar Infected: not-a-virusSWTool.Win32.RAS.a skipped D:\keyfinder.exe RarSFX: infected - 3 skipped F:\Ohjelmia\Pikkuohjelmia\vnc-3.3.7-x86_win32.exe/data0002 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.c skipped F:\Ohjelmia\Pikkuohjelmia\vnc-3.3.7-x86_win32.exe/data0003 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.c skipped F:\Ohjelmia\Pikkuohjelmia\vnc-3.3.7-x86_win32.exe/data0004 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.c skipped F:\Ohjelmia\Pikkuohjelmia\vnc-3.3.7-x86_win32.exe Inno: infected - 3 skipped F:\Nettilataus\BitTorrent-4.4.1.exe/stream/data0009 Infected: not-a-virus:RiskTool.Win32.PsKill.n skipped F:\Nettilataus\BitTorrent-4.4.1.exe/stream Infected: not-a-virus:RiskTool.Win32.PsKill.n skipped F:\Nettilataus\BitTorrent-4.4.1.exe NSIS: infected - 2 skipped F:\Nettilataus\ccsetup126.exe/stream/data0006 Infected: not-a-virus:RiskTool.Win32.PsKill.n skipped F:\Nettilataus\ccsetup126.exe/stream Infected: not-a-virus:RiskTool.Win32.PsKill.n skipped F:\Nettilataus\ccsetup126.exe NSIS: infected - 2 skipped F:\Nettilataus\fulDC-6.76.msi/_5B663934D3150C1A2CE5A602435F38E5/_13B5FCBE8FBD856DA69486A1B60B8AC6 Infected: not-a-virus:Monitor.Win32.NetMon.a skipped F:\Nettilataus\fulDC-6.76.msi/_5B663934D3150C1A2CE5A602435F38E5 Infected: not-a-virus:Monitor.Win32.NetMon.a skipped F:\Nettilataus\fulDC-6.76.msi Embedded: infected - 2 skipped F:\Nettilataus\kf141.zip/keyfinder.exe/data.rar/xpkey.exe Infected: not-a-virusSWTool.Win32.RAS.a skipped F:\Nettilataus\kf141.zip/keyfinder.exe/data.rar/officekey.exe Infected: not-a-virusSWTool.Win32.RAS.a skipped F:\Nettilataus\kf141.zip/keyfinder.exe/data.rar Infected: not-a-virusSWTool.Win32.RAS.a skipped F:\Nettilataus\kf141.zip/keyfinder.exe Infected: not-a-virusSWTool.Win32.RAS.a skipped F:\Nettilataus\kf141.zip ZIP: infected - 4 skipped F:\Nettilataus\mirc616.exe/data0001.bin Infected: not-a-virus:Client-IRC.Win32.mIRC.616 skipped F:\Nettilataus\mirc616.exe mIRC: infected - 1 skipped F:\Nettilataus\vnc-4_1_1-x86_win32.exe/data0001 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4110 skipped F:\Nettilataus\vnc-4_1_1-x86_win32.exe Inno: infected - 1 skipped Scan process completed. Ei ainakaan tuo löytäny sitä samaa ja samasta kohteesta eli on se ilmeisesti poistunu.
Joo, ei sitä tossa taida olla ja noi muut mitä Kaspersky löysi on mun mielestä ainakin ihan turvallisia
