Jotain kummaa koneella tapahtuu, kun joku vielä osais kertoa mitä =) Eli siis, kaveri asensi tähän koneelle jonkun ohjelman (en tiedä minkä..) ja sen jälkeen työpöydältä katosi taustakuva ja näyttö alkoi välkkyä.. Boottasin koneen, ennen sammumista ruudulle tuli liskon kuva! Sama kuva tuli myös käynnistettäessä. Ad-aware löysi koneelta jonkun CMDSERVICESin, mutta ei pystynyt poistamaan sen kaikkia osia.. Yritin poistaa niitä myös Spybotilla, ei onnistunut. Logfile of HijackThis v1.99.1 Scan saved at 21:41:13, on 24.3.2006 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe C:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe C:\WINDOWS\System32\VTTimer.exe C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe C:\Program Files\VIA\RAID\raid_tool.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Alex\Työpöytä\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.fi/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [VTTimer] VTTimer.exe O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe" O4 - HKLM\..\Run: [PCCClient.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe" O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe" O4 - HKLM\..\Run: [RaidTool] C:\Program Files\VIA\RAID\raid_tool.exe O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{66EF7D4B-9801-4C2F-8A43-84BCDD36BBDC}: NameServer = 85.255.115.2,85.255.112.7 O17 - HKLM\System\CCS\Services\Tcpip\..\{B602088A-670F-47F8-8AEE-5BC00FEDF485}: NameServer = 85.255.115.2,85.255.112.7 O17 - HKLM\System\CCS\Services\Tcpip\..\{F9C05E90-78BC-463F-BB2F-E79D9FD5CB29}: NameServer = 85.255.115.2 85.255.112.7 O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O23 - Service: PC-cillin PersonalFirewall (PCCPFW) - Trend Micro Inc. - C:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe O23 - Service: Trend NT Realtime Service (Tmntsrv) - Trend Micro Inc. - C:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe
Joo sulla on wareout. Lataa Ewido http://keskustelu.afterdawn.com/thread_view.cfm/269186 Asenna ja päivitä, ei tartte skannata vielä. Lataa fixwareout.exe täältä > http://downloads.subratam.org/Fixwareout.exe tai täältä > http://swandog46.geekstogo.com/Fixwareout.exe ja tallenna se työpöydälle. Tuplaklikkaa sitä ja seuraa ohjeita. Sinun pitää käynnistää kone uudelleen, kun niin käsketään. Myöhemmin kun HijackThis aukeaa merkkaa nämä rivit: O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O17 - HKLM\System\CCS\Services\Tcpip\..\{66EF7D4B-9801-4C2F-8A43-84BCDD36BBDC}: NameServer = 85.255.115.2,85.255.112.7 O17 - HKLM\System\CCS\Services\Tcpip\..\{B602088A-670F-47F8-8AEE-5BC00FEDF485}: NameServer = 85.255.115.2,85.255.112.7 O17 - HKLM\System\CCS\Services\Tcpip\..\{F9C05E90-78BC-463F-BB2F-E79D9FD5CB29}: NameServer = 85.255.115.2 85.255.112.7 Ja paina fix cheked. Sitten kun toi homma on valmis poista tämä tiedosto C:\WINDOWS\web\->related.htm Seuraavaksi käynnistä koneesi vikasietotilaan näpyttämällä F8:a käynnistyksen yhteydessä http://www.pchell.com/support/safemode.shtml Siellä aja ewidolla full system scan ohjeiden mukaan ja tallenna sen raportti. Käynnistä koneesi normaalisti uudelleen jotta pääsisit takaisin normaalitilaan. Normaalitilassa lähetä uusi HijackThis loki, c:\fixwareout\report.txt sisältö ja ewidon raportti
Toivottavasti tein kaikki oikein.. [bold]Logfile of HijackThis v1.99.1[/bold] Scan saved at 23:30:01, on 24.3.2006 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\VTTimer.exe C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe C:\Program Files\VIA\RAID\raid_tool.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\Program Files\ewido anti-malware\ewidoguard.exe C:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe C:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Alex\Työpöytä\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [VTTimer] VTTimer.exe O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe" O4 - HKLM\..\Run: [PCCClient.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe" O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe" O4 - HKLM\..\Run: [RaidTool] C:\Program Files\VIA\RAID\raid_tool.exe O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{F9C05E90-78BC-463F-BB2F-E79D9FD5CB29}: NameServer = 85.255.115.2 85.255.112.7 O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe O23 - Service: PC-cillin PersonalFirewall (PCCPFW) - Trend Micro Inc. - C:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe O23 - Service: Trend NT Realtime Service (Tmntsrv) - Trend Micro Inc. - C:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe [bold]Fixwareout ver 1.003[/bold] Last edited march/15/2006 Post this report in the forums please Reg Entries that were deleted HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\repiwoh HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\ypszr HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\daolnwodi HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\putesprpgd HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\lavinraCputeS ... Random Runs removed from HKLM ... PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE. »»»»» Search by size and names... »»»»» Misc files »»»»» Checking for older varients covered by the Rem3 tool [bold]--------------------------------------------------------- ewido anti-malware - Scan report ---------------------------------------------------------[/bold] + Created on: 23:25:34, 24.3.2006 + Report-Checksum: 821849CE + Scan result: C:\WINDOWS\system32\rzspy.exe -> Adware.Raze : Cleaned with backup C:\WINDOWS\system32\idownload.exe -> Downloader.Small.buy : Cleaned with backup C:\Documents and Settings\Alex\Local Settings\Temp\temp.fr70ED -> Adware.CommAd : Cleaned with backup :mozilla.29:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup :mozilla.30:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup :mozilla.34:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup :mozilla.35:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned with backup :mozilla.36:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned with backup :mozilla.37:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup :mozilla.38:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup :mozilla.47:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned with backup :mozilla.51:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Hotlog : Cleaned with backup :mozilla.54:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Yadro : Cleaned with backup :mozilla.56:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Spylog : Cleaned with backup :mozilla.65:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup :mozilla.66:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup :mozilla.67:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup :mozilla.68:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup :mozilla.69:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup :mozilla.70:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup :mozilla.74:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup :mozilla.77:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup :mozilla.78:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup :mozilla.79:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup :mozilla.80:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup :mozilla.84:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup :mozilla.85:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup :mozilla.86:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup :mozilla.87:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup :mozilla.88:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup :mozilla.90:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup :mozilla.91:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup :mozilla.96:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup :mozilla.97:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup :mozilla.98:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup :mozilla.99:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup :mozilla.100:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup :mozilla.101:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup :mozilla.102:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Clickbank : Cleaned with backup :mozilla.103:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Clickzs : Cleaned with backup :mozilla.104:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Clickzs : Cleaned with backup :mozilla.105:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Clickzs : Cleaned with backup :mozilla.106:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Clickzs : Cleaned with backup :mozilla.137:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup :mozilla.144:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup :mozilla.158:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup :mozilla.159:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup :mozilla.160:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup :mozilla.164:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup :mozilla.165:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup :mozilla.226:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned with backup :mozilla.227:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\x3p86yqp.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned with backup C:\System Volume Information\_restore{31868BF7-2DDD-4111-889D-23C2A74867E5}\RP9\A0002285.exe -> Adware.CommAd : Cleaned with backup C:\System Volume Information\_restore{31868BF7-2DDD-4111-889D-23C2A74867E5}\RP9\A0002288.dll -> Adware.CommAd : Cleaned with backup C:\Recycled\Dc2.exe -> Adware.Casino : Cleaned with backup :mozilla.17:F:\Ohjelmat\Netscape\Netscape\23022004_varm_kopioidut_js_ja_Mozilla\Windosws_application_data__Mozilla__Profiles\Default User\kwpvrk15.slt\cookies.txt -> TrackingCookie.Doubleclick : Cleaned with backup :mozilla.28:F:\Ohjelmat\Netscape\Netscape\23022004_varm_kopioidut_js_ja_Mozilla\Windosws_application_data__Mozilla__Profiles\Default User\kwpvrk15.slt\cookies.txt -> TrackingCookie.Atdmt : Cleaned with backup :mozilla.35:F:\Ohjelmat\Netscape\Netscape\23022004_varm_kopioidut_js_ja_Mozilla\Windosws_application_data__Mozilla__Profiles\Default User\kwpvrk15.slt\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup :mozilla.36:F:\Ohjelmat\Netscape\Netscape\23022004_varm_kopioidut_js_ja_Mozilla\Windosws_application_data__Mozilla__Profiles\Default User\kwpvrk15.slt\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup :mozilla.37:F:\Ohjelmat\Netscape\Netscape\23022004_varm_kopioidut_js_ja_Mozilla\Windosws_application_data__Mozilla__Profiles\Default User\kwpvrk15.slt\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup :mozilla.38:F:\Ohjelmat\Netscape\Netscape\23022004_varm_kopioidut_js_ja_Mozilla\Windosws_application_data__Mozilla__Profiles\Default User\kwpvrk15.slt\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup :mozilla.39:F:\Ohjelmat\Netscape\Netscape\23022004_varm_kopioidut_js_ja_Mozilla\Windosws_application_data__Mozilla__Profiles\Default User\kwpvrk15.slt\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup :mozilla.40:F:\Ohjelmat\Netscape\Netscape\23022004_varm_kopioidut_js_ja_Mozilla\Windosws_application_data__Mozilla__Profiles\Default User\kwpvrk15.slt\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup :mozilla.41:F:\Ohjelmat\Netscape\Netscape\23022004_varm_kopioidut_js_ja_Mozilla\Windosws_application_data__Mozilla__Profiles\Default User\kwpvrk15.slt\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup :mozilla.42:F:\Ohjelmat\Netscape\Netscape\23022004_varm_kopioidut_js_ja_Mozilla\Windosws_application_data__Mozilla__Profiles\Default User\kwpvrk15.slt\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup :mozilla.43:F:\Ohjelmat\Netscape\Netscape\23022004_varm_kopioidut_js_ja_Mozilla\Windosws_application_data__Mozilla__Profiles\Default User\kwpvrk15.slt\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup :mozilla.45:F:\Ohjelmat\Netscape\Netscape\23022004_varm_kopioidut_js_ja_Mozilla\Windosws_application_data__Mozilla__Profiles\Default User\kwpvrk15.slt\cookies.txt -> TrackingCookie.Counted : Cleaned with backup :mozilla.47:F:\Ohjelmat\Netscape\Netscape\23022004_varm_kopioidut_js_ja_Mozilla\Windosws_application_data__Mozilla__Profiles\Default User\kwpvrk15.slt\cookies.txt -> TrackingCookie.Qksrv : Cleaned with backup :mozilla.48:F:\Ohjelmat\Netscape\Netscape\23022004_varm_kopioidut_js_ja_Mozilla\Windosws_application_data__Mozilla__Profiles\Default User\kwpvrk15.slt\cookies.txt -> TrackingCookie.Bfast : Cleaned with backup :mozilla.10:F:\Ohjelmat\Netscape\Netscape\23022004_varm_kopioidut_js_ja_Mozilla\Windosws_application_data__Mozilla__Profiles\Katja\88pqymo3.slt\cookies.txt -> TrackingCookie.Doubleclick : Cleaned with backup F:\Ohjelmat\Spybot - Search & Destroy 1.1\Recovery\AvenueAInc.zip/ergopro@atdmt[1].txt -> TrackingCookie.Atdmt : Error during cleaning F:\Ohjelmat\Spybot - Search & Destroy 1.1\Recovery\DoubleClick.zip/ergopro@doubleclick[1].txt -> TrackingCookie.Doubleclick : Error during cleaning F:\Ohjelmat\Spybot - Search & Destroy 1.1\Recovery\HitBox.zip/ergopro@ehg-idg.hitbox[1].txt -> TrackingCookie.Hitbox : Error during cleaning F:\Ohjelmat\Spybot - Search & Destroy 1.1\Recovery\HitBox1.zip/ergopro@hitbox[2].txt -> TrackingCookie.Hitbox : Error during cleaning F:\Ohjelmat\Spybot - Search & Destroy 1.1\Recovery\Advertisingcom.zip/ergopro@servedby.advertising[2].txt -> TrackingCookie.Advertising : Error during cleaning F:\Ohjelmat\Spybot - Search & Destroy 1.1\Recovery\Advertisingcom1.zip/ergopro@advertising[2].txt -> TrackingCookie.Advertising : Error during cleaning F:\Ohjelmat\Spybot - Search & Destroy 1.1\Recovery\AvenueAInc1.zip/ergopro@atdmt[2].txt -> TrackingCookie.Atdmt : Error during cleaning F:\Ohjelmat\Spybot - Search & Destroy 1.1\Recovery\BFast.zip/ergopro@bfast[2].txt -> TrackingCookie.Bfast : Error during cleaning F:\Ohjelmat\Spybot - Search & Destroy 1.1\Recovery\CommissionJunction.zip/ergopro@www.commission-junction[2].txt -> TrackingCookie.Commission-junction : Error during cleaning F:\Ohjelmat\Spybot - Search & Destroy 1.1\Recovery\CommissionJunction1.zip/ergopro@www.qksrv[1].txt -> TrackingCookie.Qksrv : Error during cleaning F:\Ohjelmat\Spybot - Search & Destroy 1.1\Recovery\DoubleClick1.zip/anyuser@doubleclick[1].txt -> TrackingCookie.Doubleclick : Error during cleaning F:\Ohjelmat\Spybot - Search & Destroy 1.1\Recovery\DoubleClick2.zip/ergopro@doubleclick[1].txt -> TrackingCookie.Doubleclick : Error during cleaning F:\Ohjelmat\Spybot - Search & Destroy 1.1\Recovery\FastClick.zip/ergopro@fastclick[1].txt -> TrackingCookie.Fastclick : Error during cleaning F:\Ohjelmat\Spybot - Search & Destroy 1.1\Recovery\HitBox2.zip/ergopro@hitbox[1].txt -> TrackingCookie.Hitbox : Error during cleaning F:\Ohjelmat\Spybot - Search & Destroy 1.1\Recovery\HitBox3.zip/ergopro@hg1.hitbox[2].txt -> TrackingCookie.Hitbox : Error during cleaning F:\Ohjelmat\Spybot - Search & Destroy 1.1\Recovery\HitsLink.zip/ergopro@counter.hitslink[1].txt -> TrackingCookie.Hitslink : Error during cleaning F:\Ohjelmat\Spybot - Search & Destroy 1.1\Recovery\MediaPlex.zip/ergopro@mediaplex[1].txt -> TrackingCookie.Mediaplex : Error during cleaning F:\Ohjelmat\Spybot - Search & Destroy 1.1\Recovery\ValueClick.zip/anyuser@valueclick[1].txt -> TrackingCookie.Valueclick : Error during cleaning F:\Ohjelmien pakkaukset\ultimate_fx.zip/SETUP.EXE -> Adware.Aureate : Error during cleaning ::Report End
Fiksaa tämä vielä O17 - HKLM\System\CCS\Services\Tcpip\..\{F9C05E90-78BC-463F-BB2F-E79D9FD5CB29}: NameServer = 85.255.115.2 85.255.112.7 Ja käynnistä kone uudelleen ja lähetä uusi loki. Ewido löysi täältä mainosohjelman F:\Ohjelmien pakkaukset\ultimate_fx.zip/SETUP.EXE Eli kannattaa melkeen poistaa toi zippi jos et ole ihan varma että se on puhdas.
Logfile of HijackThis v1.99.1 Scan saved at 12:19:10, on 25.3.2006 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\VTTimer.exe C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe C:\Program Files\VIA\RAID\raid_tool.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\Program Files\ewido anti-malware\ewidoguard.exe C:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe C:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe C:\Documents and Settings\Alex\Työpöytä\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [VTTimer] VTTimer.exe O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe" O4 - HKLM\..\Run: [PCCClient.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe" O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe" O4 - HKLM\..\Run: [RaidTool] C:\Program Files\VIA\RAID\raid_tool.exe O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe O23 - Service: PC-cillin PersonalFirewall (PCCPFW) - Trend Micro Inc. - C:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe O23 - Service: Trend NT Realtime Service (Tmntsrv) - Trend Micro Inc. - C:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe
Muuten on kaikki ok, mutta taustakuvaa en työpöydälle vieläkään saa, se vaan vilkkuu edelleen.. edit: Sain sen taustakuvan toimimaan tän ohjeen avulla --> http://keskustelu.afterdawn.com/thread_view.cfm/315348 Super-suuri kiitos avusta =)
