HJT-logi tarkistettavaksi

Moro.

Ostin kaverilta tämän läppärin, jossa ei ole ollu ajantasalla olevaa virustorjuntaa vuoteen. Spybotilla ja AD-awarella kone kertaalleen tarkistettu ja avastin virustorjuntaohjelmalla kovo scannattu. Tavaraa siis jo poistettu, mutta tässä vielä hjt-logi, koska ie avautuu itsekseen.

Logfile of HijackThis v1.99.1
Scan saved at 7:38:31, on 31.3.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\bin\btwdins.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\BTTray.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SoundService] rundll32.exe "C:\WINDOWS\system32\xuusnwcc.dll",setvm
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: Lähetä &Bluetooth-laitteeseen - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\btsendto_ie_ctx.htm
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\bin\btwdins.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe


Just rävähti auki uus sivu "system doctor 2006"...?

 

Ohje AVG:n Anti-Spyware 7.5:n käyttöön
Huom! Tässä ohjeessa sammutetaan tuo reaaliaikasuojaus (Shield). Näin vältetään tilanteet joissa suojaus estäisi esim HijackThis työkalun toimintaa.

Tallenna nämä ohjeet tekstitiedostoon tai tulosta nämä, muuten et pääse niihin käsiksi vikasietotilasta

Lataa AVG:n Anti-Spyware 7.5 http://www.ewido.net/en/download/
ja tallenna ohjelma työpöydällesi.
• Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa.
• Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää.
• Käynnistä AVG:n Anti-Spyware.
• Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta.

o Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa.

• Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti.
• Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine".
• Sitten "Reports" valikon alta:

o Laita täppi kohtaan "Automatically generate report after every scan"
o Ota täppi pois kohdasta"Only if threats were found"

• Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa
• "Resident shield is", muuta tila active:sta inactive:ksi
• Sulje ohjelma, ÄLÄ skannaa vielä.
Käynnistä koneesi vikasietotilaan,

sammuta ja käynnistä
käynnistyksen yhteydessä naputtele F8
valitse nuoli näppäimellä vikasietotila
paina enter ja enter

HUOM! Älä käytä muita ohjelmia AVG:n skannauksen aikana, tämä saattaa häiritä skannausta.
• Kun vikasietotilassa, käynnistä AVG:n Anti-Spyware.
• Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan".
• Ewido aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa.

Kun skannaus on valmis:
TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions"
• Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta.
• Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions"

• Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta.
• Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle.
• Sulje ohjelma, käynnistä kone normaalisti ja lähetä AVG:n raportti viestikejuusi.

=====================

Escan
Ohjeet tuolla sivulla.
http://koti.mbnet.fi/pattaya1/escanmwav.htm
lataa tuosta
http://www.spywareinfo.dk/download/mwav.exe
päivitä tuosta
http://koti.mbnet.fi/pattaya1/lataus/Mwav.bat
laita täpit merkkauksien mukaan
http://koti.mbnet.fi/pattaya1/eScan6.jpg

scannaa

jos ala luukkuun tulee jotain niin kopioi se näin:
Käytä komentoa Ctrl+A.
Kopioi rivit komennolla Ctrl+C.
Liitä rivit komennolla Ctrl+V.

Laita virus log tänne.

 

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 10:24:40 31.3.2007

+ Scan result:
Tossa olis toi AVG:n raportti. Lisää tulee kohta.


C:\WINDOWS\system32\efcaawv.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\Documents and Settings\Toni Lindström\Local Settings\Temporary Internet Files\Content.IE5\G45UX709\WinAntiVirusPro2007FreeInstall[1].cab/UWA7P_0001_N91M0809NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Cleaned with backup (quarantined).
:mozilla.59:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.60:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.61:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.62:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.63:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.64:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.65:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.66:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.67:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.68:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.69:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.70:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.71:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.72:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Toni Lindström\Cookies\toni_lindström@2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Toni Lindström\Cookies\toni lindström@www.abcsearch[1].txt -> TrackingCookie.Abcsearch : Cleaned.
:mozilla.206:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.Adobe : Cleaned.
:mozilla.80:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
:mozilla.81:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
:mozilla.20:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.21:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\Toni Lindström\Cookies\toni_lindström@advertising[1].txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.207:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\Toni Lindström\Cookies\toni lindström@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\Toni Lindström\Cookies\toni lindström@www.burstnet[1].txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.94:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\Toni Lindström\Cookies\toni lindström@com[1].txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\Toni Lindström\Cookies\toni lindström@connextra[1].txt -> TrackingCookie.Connextra : Cleaned.
C:\Documents and Settings\Toni Lindström\Cookies\toni_lindström@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned.
:mozilla.23:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\Toni Lindström\Cookies\toni_lindström@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.86:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.87:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.88:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
C:\Documents and Settings\Toni Lindström\Cookies\toni lindström@ads.gamershell[2].txt -> TrackingCookie.Gamershell : Cleaned.
C:\Documents and Settings\Toni Lindström\Cookies\toni lindström@gamershell[2].txt -> TrackingCookie.Gamershell : Cleaned.
:mozilla.25:C:\Documents and Settings\Järjestelmänvalvoja.TONI-95EC922D1A\Application Data\Mozilla\Firefox\Profiles\yviwhi4g.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.117:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.Hotlog : Cleaned.
:mozilla.118:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned.
:mozilla.124:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.Ivwbox : Cleaned.
:mozilla.38:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
C:\Documents and Settings\Järjestelmänvalvoja.TONI-95EC922D1A\Cookies\järjestelmänvalvoja@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.
C:\Documents and Settings\Toni Lindström\Cookies\toni lindström@ie.search.msn[2].txt -> TrackingCookie.Msn : Cleaned.
:mozilla.146:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
:mozilla.74:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.75:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.76:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.77:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.147:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.148:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.159:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.Real : Cleaned.
:mozilla.202:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.Real : Cleaned.
:mozilla.203:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.Real : Cleaned.
:mozilla.14:C:\Documents and Settings\Järjestelmänvalvoja.TONI-95EC922D1A\Application Data\Mozilla\Firefox\Profiles\yviwhi4g.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.15:C:\Documents and Settings\Järjestelmänvalvoja.TONI-95EC922D1A\Application Data\Mozilla\Firefox\Profiles\yviwhi4g.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.16:C:\Documents and Settings\Järjestelmänvalvoja.TONI-95EC922D1A\Application Data\Mozilla\Firefox\Profiles\yviwhi4g.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.17:C:\Documents and Settings\Järjestelmänvalvoja.TONI-95EC922D1A\Application Data\Mozilla\Firefox\Profiles\yviwhi4g.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.18:C:\Documents and Settings\Järjestelmänvalvoja.TONI-95EC922D1A\Application Data\Mozilla\Firefox\Profiles\yviwhi4g.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.33:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.34:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.35:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.36:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.37:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
C:\Documents and Settings\Järjestelmänvalvoja.TONI-95EC922D1A\Cookies\järjestelmänvalvoja@stats1.reliablestats[2].txt -> TrackingCookie.Reliablestats : Cleaned.
C:\Documents and Settings\Toni Lindström\Cookies\toni_lindström@stats1.reliablestats[1].txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.160:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.161:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.162:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.163:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.194:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned.
:mozilla.195:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned.
C:\Documents and Settings\Toni Lindström\Cookies\toni lindström@h.starware[2].txt -> TrackingCookie.Starware : Cleaned.
C:\Documents and Settings\Toni Lindström\Cookies\toni lindström@try.starware[1].txt -> TrackingCookie.Starware : Cleaned.
:mozilla.9:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.Statistik-gallup : Cleaned.
C:\Documents and Settings\Toni Lindström\Cookies\toni lindström@statistik-gallup[1].txt -> TrackingCookie.Statistik-gallup : Cleaned.
:mozilla.173:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.Toplist : Cleaned.
:mozilla.40:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.198:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.Webtrends : Cleaned.
C:\Documents and Settings\Toni Lindström\Cookies\toni lindström@m.webtrends[1].txt -> TrackingCookie.Webtrends : Cleaned.
:mozilla.180:C:\Documents and Settings\Toni Lindström\Application Data\Mozilla\Firefox\Profiles\5twbxxw5.default\cookies.txt -> TrackingCookie.Yadro : Cleaned.
[140] C:\WINDOWS\system32\ssttt.dll -> Trojan.Vundo.ah : Cleaned with backup (quarantined).
[600] C:\WINDOWS\system32\ssttt.dll -> Trojan.Vundo.ah : Cleaned with backup (quarantined).


::Report end

 

ahaan...

Lataa VundoFix.exe työpöydällesi.

Tupla-klikkaa VundoFix.exe ajaaksesi sen.
Klikkaa Scan for Vundo valintaa.
Kun skannaus on valmis, klikkaa Remove Vundo valintaa.
Sinulta kysytään haluatko poistaa filut - klikkaa YES.
Kun olet klikannut yes, työpöytäsi tyhjenee kun se alkaa poistamaan Vundoa.
Kun se on valmis, fiksi ilmoittaa käynnistäväsi koneesi uudelleen, klikkaa OK.
Postita C:\vundofix.txt lokin sekä tuoreen HijackThis lokin sisältö.

Huomaa: Se on mahdollista että VundoFix löysi tiedoston jota se ei pystynyt poistamaan.
Tässä tilanteessa, VundoFix ajaa itsensä rebootissa, seuraa vain yläpuolelle olevia ohjeita alkaen kohdasta "Klikkaa Scan for Vundo valintaa." kun VundoFix ilmaantuu uudelleenkäynnistyksen yhteydessä.

-------------------------------------------------------------------------------------

1) Lataa VirtumundoBegone
2) Tallenna VirtumundoBeGone.exe työpöydällesi.
3) Aja VirtumundoBeGone.exe ja seuraa ohjeita. Älä huoli jos näet sinisen ruudun "Fatal Error" viestin, tämä on normaalia.
4) Kun työkalu on valmis, käynnistä kone uudelleen

Nimeä uudelleen
C:\HJT\HijackThis.exe <--- skanneriksi

 

Mitä tarkotat? Miten?

 

sen millä scannat hjt lokin klikkaa sitä hiiren oikeanpuoleisella napilla. valitse nimeä uudelleen laita Skanneri

 

eScan

File C:\WINDOWS\system32\rqrsspq.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.id. No Action Taken.
File C:\WINDOWS\system32\jkiqosid.dll infected by "Trojan.Win32.BHO.g" Virus. Action Taken: File to be deleted on reboot.
File C:\WINDOWS\system32\jguywuol.dll infected by "Trojan.Win32.BHO.g" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\rqrsspq.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.id. No Action Taken.
File C:\Documents and Settings\Toni Lindström\Local Settings\Temporary Internet Files\Content.IE5\7ZDYT00K\cons_upd[2] tagged as not-a-virus:AdWare.Win32.Virtumonde.id. No Action Taken.
File C:\System Volume Information\_restore{DEF2CEF7-CC1D-447D-9EF8-5500B9479D01}\RP32\A0095958.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.hb. No Action Taken.
File C:\System Volume Information\_restore{DEF2CEF7-CC1D-447D-9EF8-5500B9479D01}\RP33\A0098560.exe infected by "Trojan-Downloader.Win32.INService.bl" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{DEF2CEF7-CC1D-447D-9EF8-5500B9479D01}\RP33\A0098561.exe infected by "Trojan-Downloader.Win32.INService.bl" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{DEF2CEF7-CC1D-447D-9EF8-5500B9479D01}\RP33\A0098562.exe infected by "Trojan-Downloader.Win32.INService.bl" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{DEF2CEF7-CC1D-447D-9EF8-5500B9479D01}\RP33\A0098727.dll tagged as not-a-virus:AdTool.Win32.MyWebSearch.i. No Action Taken.
File C:\System Volume Information\_restore{DEF2CEF7-CC1D-447D-9EF8-5500B9479D01}\RP33\A0098731.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.as. No Action Taken.
File C:\System Volume Information\_restore{DEF2CEF7-CC1D-447D-9EF8-5500B9479D01}\RP33\A0098733.DLL tagged as not-a-virus:AdTool.Win32.MyWebSearch.i. No Action Taken.
File C:\System Volume Information\_restore{DEF2CEF7-CC1D-447D-9EF8-5500B9479D01}\RP39\A0109522.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.hb. No Action Taken.
File C:\System Volume Information\_restore{DEF2CEF7-CC1D-447D-9EF8-5500B9479D01}\RP40\A0109686.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.hb. No Action Taken.
File C:\System Volume Information\_restore{DEF2CEF7-CC1D-447D-9EF8-5500B9479D01}\RP43\A0110106.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.ar. No Action Taken.
File C:\System Volume Information\_restore{DEF2CEF7-CC1D-447D-9EF8-5500B9479D01}\RP43\A0110129.dll infected by "Trojan-Spy.Win32.VBStat.h" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{DEF2CEF7-CC1D-447D-9EF8-5500B9479D01}\RP43\A0110130.dll infected by "Trojan.Win32.BHO.g" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{DEF2CEF7-CC1D-447D-9EF8-5500B9479D01}\RP43\A0110131.dll infected by "Trojan-Spy.Win32.VBStat.h" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{DEF2CEF7-CC1D-447D-9EF8-5500B9479D01}\RP43\A0110132.exe tagged as not-a-virus:AdWare.Win32.Agent.at. No Action Taken.
File C:\System Volume Information\_restore{DEF2CEF7-CC1D-447D-9EF8-5500B9479D01}\RP43\A0110163.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.hc. No Action Taken.
File C:\System Volume Information\_restore{DEF2CEF7-CC1D-447D-9EF8-5500B9479D01}\RP43\A0110165.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.fl. No Action Taken.
File C:\WINDOWS\system32\rqrsspq.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.id. No Action Taken.

 

aja toi vundofix ja VirtumundoBegone tosta ylhäältä

sitten teet tuon uudeleen nimeämisen


ja scannaat sitten vasta uuden hjt:n lokin

 

VundoFix

VundoFix V6.3.18

Checking Java version...

Sun Java not detected
Scan started at 12:00:19 31.3.2007

Listing files found while scanning....

C:\WINDOWS\system32\jkiqosid.dll
C:\WINDOWS\system32\qtstv.bak1
C:\WINDOWS\system32\qtstv.ini
C:\WINDOWS\system32\rqrsspq.dll
C:\WINDOWS\system32\ssttt.dll
C:\WINDOWS\system32\tttss.bak1
C:\WINDOWS\system32\tttss.bak2
C:\WINDOWS\system32\tttss.ini
C:\WINDOWS\system32\tttss.ini2
C:\WINDOWS\system32\tttss.tmp
C:\WINDOWS\system32\vtstq.dll

Beginning removal...

Attempting to delete C:\WINDOWS\system32\jkiqosid.dll
C:\WINDOWS\system32\jkiqosid.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\qtstv.bak1
C:\WINDOWS\system32\qtstv.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\qtstv.ini
C:\WINDOWS\system32\qtstv.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\rqrsspq.dll
C:\WINDOWS\system32\rqrsspq.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\tttss.bak1
C:\WINDOWS\system32\tttss.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\tttss.bak2
C:\WINDOWS\system32\tttss.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\tttss.ini
C:\WINDOWS\system32\tttss.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\tttss.ini2
C:\WINDOWS\system32\tttss.ini2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\tttss.tmp
C:\WINDOWS\system32\tttss.tmp Has been deleted!

Attempting to delete C:\WINDOWS\system32\vtstq.dll
C:\WINDOWS\system32\vtstq.dll Has been deleted!

Performing Repairs to the registry.
Done!

 

sitten tämä VirtumundoBegone

 

Tässä... ja kohta tulee HJT.

[03/31/2007, 12:11:23] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Toni Lindström\Työpöytä\VirtumundoBeGone.exe" )
[03/31/2007, 12:11:31] - Detected System Information:
[03/31/2007, 12:11:31] - Windows Version: 5.1.2600, Service Pack 2
[03/31/2007, 12:11:31] - Current Username: Toni Lindström (Admin)
[03/31/2007, 12:11:31] - Windows is in NORMAL mode.
[03/31/2007, 12:11:31] - Searching for Browser Helper Objects:
[03/31/2007, 12:11:31] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[03/31/2007, 12:11:31] - BHO 2: {1FA608B7-8F80-4BE9-A79F-3452417253E4} ()
[03/31/2007, 12:11:31] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/31/2007, 12:11:31] - Checking for HKLM\...\Winlogon\Notify\vtstq
[03/31/2007, 12:11:31] - Key not found: HKLM\...\Winlogon\Notify\vtstq, continuing.
[03/31/2007, 12:11:31] - BHO 3: {53707962-6F74-2D53-2644-206D7942484F} ()
[03/31/2007, 12:11:31] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/31/2007, 12:11:31] - Checking for HKLM\...\Winlogon\Notify\SDHelper
[03/31/2007, 12:11:31] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[03/31/2007, 12:11:31] - BHO 4: {57E218E6-5A80-4f0c-AB25-83598F25D7E9} ()
[03/31/2007, 12:11:31] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/31/2007, 12:11:31] - Checking for HKLM\...\Winlogon\Notify\jguywuol
[03/31/2007, 12:11:31] - Key not found: HKLM\...\Winlogon\Notify\jguywuol, continuing.
[03/31/2007, 12:11:31] - BHO 5: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[03/31/2007, 12:11:31] - Finished Searching Browser Helper Objects
[03/31/2007, 12:11:31] - Finishing up...
[03/31/2007, 12:11:31] - Nothing found! Exiting...

 

Logfile of HijackThis v1.99.1
Scan saved at 12:17:43, on 31.3.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\BTTray.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\bin\btwdins.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\HJT\skanneri.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1FA608B7-8F80-4BE9-A79F-3452417253E4} - C:\WINDOWS\system32\vtstq.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {57E218E6-5A80-4f0c-AB25-83598F25D7E9} - C:\WINDOWS\system32\jguywuol.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SoundService] rundll32.exe "C:\WINDOWS\system32\xuusnwcc.dll",setvm
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: Lähetä &Bluetooth-laitteeseen - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\btsendto_ie_ctx.htm
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O20 - Winlogon Notify: ssttt - C:\WINDOWS\system32\ssttt.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\bin\btwdins.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

 

scannaa hjt:llä merkkaa

O2 - BHO: (no name) - {1FA608B7-8F80-4BE9-A79F-3452417253E4} - C:\WINDOWS\system32\vtstq.dll (file missing)
O2 - BHO: (no name) - {57E218E6-5A80-4f0c-AB25-83598F25D7E9} - C:\WINDOWS\system32\jguywuol.dll (file missing)
O20 - Winlogon Notify: ssttt - C:\WINDOWS\system32\ssttt.dll (file missing)

Noiten rivien eteen laitat ruksin ja painat Fix checked nappia

====================

1. Klikkaa käynnistä > Oma tietokone oikean puoleisella hiiren napilla
2. Valitse ominaisuudet
3. Valitse järjestelmän palauttaminen välilehti
4. Ruksi eteen ¤ poista järjestelmän palauttaminen kaikissa asemissa
5. Paina Käytä
6. Paina ok
7. Sammuta ja käynnistä
8. Ota ruksi pois ¤ poista järjestelmän palauttaminen kaikissa asemissa
9. Käytä ja OK

======================

Lataa Dr.Web CureIt työpöydälle:

Tuplaklikkaa drweb-cureit.exe ja anna sen tehdä express scan
Se skannaa käynnissä olevat ohjelmat ja jos jotain löytyy, klikkaa yes kun se kysyy haluatko poistaa sen. Tämä on vain lyhyt scan.
Kun scan on valmis, merkkaa asemat, jotka haluat scannata.
Valitse kaikki asemat. Punainen piste osoittaa, mitkä asemat on valittu.
Klikaa vihreää nuolta oikealla ja scan alkaa.
Klikkaa 'Yes to all', jos kysytään haluatko poistaa/siirtää tiedoston.
Kun scan on valmis, katso voitko klikata next-kuvaketta löytyneiden tiedostojen vieressä:
Jos asia on niin, klikkaa sitä ja sitten klikkaa next-kuvaketta oikealla alhaalla ja valitse Move incurable kuten alla olevalla kuvassa:

Tämä siirtää sen %userprofile%\DoctorWeb\quarantine-hakemistoon.
Tämän jälkeen klikkaa Dr.Web CureIt-valikossa file ja valitse save report list
Tallenna raportti työpöydälle. Raportin nimi on DrWeb.csv
Sulje Dr.Web Cureit.
Käynnistä kone uudelleen !! Tämä siksi, että käytössä olevat tiedostot poistetaan/siirretään käynnistyksen yhteydessä.
Käynnistyksen jälkeen liitä Dr.Web-lokin, jonka tallensit aiemmin, sisältö seuraavaan vastaukseesi.


======================

lataa tuolta http://www.ccleaner.com/download/builds.aspx
CCleaner v1.34.407 - Basic, joka EI sisällä Yahoo toolbaria !

laita asetukset näin:
Valinnat --> Lisäasetukset --> Ota ruksi pois kohdasta Poista vain yli 48 tuntia vanhat tilapäistiedostot.

aja puhistaja > tutki > putsaa oikea alakulma
aja virheet > etsi rekisteri virheitä > Korjaa rekisteri virheet.

=====================

lähetä uusi hjt loki

 

Ai, minäkun luulin jo nimenneeni sen skanneriksi...

 

oli se jo nimetty. Olit nopeempi

tuosta ylhäältä jatkoa

 

Next- kuvaketta klikkaamalla ei tapahdu mitään.

Löysi viisi "trojan.virtumod" objectia, jotka poisti.
Löysi yhden "tool.prockill" objectin, jolle ei tehnyt mitään, vihreä pallo sen edessä.


EDIT: JOO, MENI JUST NOIN KUN KIRJOTIT. ITE HÄRÖILIN. ELI JATKETAAN BOOTILLA.

 

lo1[1];C:\Documents and Settings\Järjestelmänvalvoja.TONI-95EC922D1A\Local Settings\Temporary Internet Files\Content.IE5\W1ARWPYN;Trojan.Virtumod;Deleted.;
nss6.tmp;C:\Documents and Settings\Toni Lindström\Local Settings\Temp;Tool.Prockill;Incurable.Moved.;
cons_upd[2];C:\Documents and Settings\Toni Lindström\Local Settings\Temporary Internet Files\Content.IE5\7ZDYT00K;Trojan.Virtumod;Deleted.;
jkiqosid.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.;
rqrsspq.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.;
vtstq.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.;

 

sitten tuolla ccleanerilla vielä.

eikös ne onkelmat loppuneet?

 

Logfile of HijackThis v1.99.1
Scan saved at 13:58:36, on 31.3.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\BTTray.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\bin\btwdins.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\HJT\skanneri.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: Lähetä &Bluetooth-laitteeseen - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\btsendto_ie_ctx.htm
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\bin\btwdins.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

 

Hjt loki on nätti