Logfile of HijackThis v1.99.1 Scan saved at 14:44:01, on 14.1.2007 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\WINDOWS\System32\igfxtray.exe C:\WINDOWS\System32\hkcmd.exe C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe D:\Drivers\Winamp\winampa.exe D:\drivers\d-tools\daemon.exe C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe D:\Drivers\VIRUST~2\ashDisp.exe D:\Drivers\AVG Anti-Spyware 7.5\avgas.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\Program Files\Messenger\MSMSGS.EXE D:\Drivers\virustorjunta1\aswUpdSv.exe D:\Drivers\virustorjunta1\ashServ.exe D:\Drivers\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\system32\slserv.exe C:\Program Files\Common Files\Teleca Shared\Generic.exe C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe D:\Drivers\virustorjunta1\ashWebSv.exe D:\Drivers\virustorjunta1\ashMaiSv.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Mozilla Firefox\firefox.exe D:\Drivers\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fi/0SEFIFI/SAOS01?FORM=TOOLBR R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.fi/0SEFIFI/SAOS01?FORM=TOOLBR R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fi/0SEFIFI/SAOS01?FORM=TOOLBR R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions O4 - HKLM\..\Run: [WinampAgent] D:\Drivers\Winamp\winampa.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\drivers\d-tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe" O4 - HKLM\..\Run: [DllRunning] rundll32.exe "C:\WINDOWS\System32\koumyxhm.dll",setvm O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\system32\qttask.exe" -atboottime O4 - HKLM\..\Run: [avast!] D:\Drivers\VIRUST~2\ashDisp.exe O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Drivers\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - D:\Drivers\virustorjunta1\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - D:\Drivers\virustorjunta1\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - D:\Drivers\virustorjunta1\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - D:\Drivers\virustorjunta1\ashWebSv.exe" /service (file missing) O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - D:\Drivers\AVG Anti-Spyware 7.5\guard.exe O23 - Service: COM+ Messages - Unknown owner - C:\WINDOWS\System32\svchosts.exe" -e mc-110-12-0000272 (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINDOWS\System32\msasvc.exe (file missing) O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - D:\Drivers\virustorjunta\Nvc\BIN\nipsvc.exe (file missing) O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
Poista lisää poista sovelutuksesta javat scannaa hjt:llä merkkaa paina Fix checkesd R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINDOWS\System32\msasvc.exe (file missing) O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - D:\Drivers\virustorjunta\Nvc\BIN\nipsvc.exe (file missing) Käynnistä > suorita kirjoita rivit ja jokaisen rivin jälkeen paina enter sc stop MsaSvc sc delete MsaSvc sc stop NipSvc sc delete NipSvc Poista vikasiedossa D:\Drivers\virustorjunta\Nvc scannaa escanilla Ohjeet tuolla sivulla. http://koti.mbnet.fi/pattaya1/escanmwav.htm lataa tuosta http://www.spywareinfo.dk/download/mwav.exe päivitä tuosta http://koti.mbnet.fi/pattaya1/lataus/Mwav.bat laita täpit merkkauksien mukaan http://koti.mbnet.fi/pattaya1/eScan6.jpg scannaa jos ala luukkuun tulee jotain niin kopioi se näin: Käytä komentoa Ctrl+A. Kopioi rivit komennolla Ctrl+C. Liitä rivit komennolla Ctrl+V. Laita virus log tänne.
Tässä on se virus log: File C:\WINDOWS\TEMP\win8.tmp.exe infected by "Packed.Win32.Klone.g" Virus. Action Taken: File Renamed. File C:\WINDOWS\System32\bkpsykra.dll infected by "Trojan-Spy.Win32.VBStat.j" Virus. Action Taken: File Deleted. File C:\WINDOWS\System32\koumyxhm.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.ft. No Action Taken. File C:\WINDOWS\System32\mhprbyni.exe tagged as not-a-virus:AdWare.Win32.Agent.at. No Action Taken. File C:\WINDOWS\System32\sjktqjxk.dll infected by "Trojan.Win32.BHO.g" Virus. Action Taken: File Deleted. File C:\WINDOWS\System32\tdxbfomq.dll infected by "Trojan-Spy.Win32.VBStat.j" Virus. Action Taken: File Deleted. File C:\WINDOWS\System32\winjjq32.dll infected by "Trojan-Proxy.Win32.Agent.lu" Virus. Action Taken: File to be deleted on reboot. File C:\baiod.exe infected by "Trojan-Clicker.Win32.Costrat.ae" Virus. Action Taken: File Deleted. File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\IMW0YZO1\WinAntiVirusPro2006FreeInstall[1].cab tagged as not-a-virusownloader.Win32.WinFixer.o. No Action Taken. File C:\System Volume Information\_restore{B7961D5E-A740-4BC6-9868-1646396B9822}\RP80\A0005490.dll infected by "Trojan.Win32.BHO.g" Virus. Action Taken: File Deleted. File C:\System Volume Information\_restore{B7961D5E-A740-4BC6-9868-1646396B9822}\RP80\A0006484.exe tagged as not-a-virus:AdTool.Win32.WhenU.i. No Action Taken. File C:\System Volume Information\_restore{B7961D5E-A740-4BC6-9868-1646396B9822}\RP80\A0006489.exe infected by "Trojan-Downloader.Win32.Small.bpz" Virus. Action Taken: File Deleted. File C:\System Volume Information\_restore{B7961D5E-A740-4BC6-9868-1646396B9822}\RP80\A0006490.dll infected by "Trojan-Spy.Win32.BZub.hg" Virus. Action Taken: File Deleted. File C:\System Volume Information\_restore{B7961D5E-A740-4BC6-9868-1646396B9822}\RP80\A0006491.dll infected by "Trojan-Spy.Win32.BZub.hg" Virus. Action Taken: File Deleted. File C:\System Volume Information\_restore{B7961D5E-A740-4BC6-9868-1646396B9822}\RP80\A0006492.exe infected by "Trojan-Downloader.Win32.Agent.bca" Virus. Action Taken: File Deleted. File C:\System Volume Information\_restore{B7961D5E-A740-4BC6-9868-1646396B9822}\RP80\A0006493.exe infected by "Trojan-Spy.Win32.BZub.gr" Virus. Action Taken: File Deleted. File C:\System Volume Information\_restore{B7961D5E-A740-4BC6-9868-1646396B9822}\RP80\A0006495.dll tagged as not-a-virus:AdTool.Win32.WhenU.i. No Action Taken. File C:\System Volume Information\_restore{B7961D5E-A740-4BC6-9868-1646396B9822}\RP80\A0006499.exe tagged as not-a-virus:AdWare.Win32.DelphinMediaViewer.f. No Action Taken. File C:\System Volume Information\_restore{B7961D5E-A740-4BC6-9868-1646396B9822}\RP80\A0006501.exe tagged as not-a-virus:AdWare.Win32.Softomate.ac. No Action Taken. File C:\System Volume Information\_restore{B7961D5E-A740-4BC6-9868-1646396B9822}\RP80\A0006502.dll tagged as not-a-virus:AdWare.Win32.Softomate.ac. No Action Taken. File C:\System Volume Information\_restore{B7961D5E-A740-4BC6-9868-1646396B9822}\RP80\A0006503.exe tagged as not-a-virus:AdWare.Win32.Softomate.ac. No Action Taken. File C:\System Volume Information\_restore{B7961D5E-A740-4BC6-9868-1646396B9822}\RP80\A0006504.dll tagged as not-a-virus:AdWare.Win32.Softomate.ac. No Action Taken. File C:\System Volume Information\_restore{B7961D5E-A740-4BC6-9868-1646396B9822}\RP80\A0008519.exe infected by "Trojan-Downloader.Win32.Small.edb" Virus. Action Taken: File Deleted. File C:\System Volume Information\_restore{B7961D5E-A740-4BC6-9868-1646396B9822}\RP80\A0010525.dll infected by "Trojan-Spy.Win32.VBStat.j" Virus. Action Taken: File Deleted. File C:\System Volume Information\_restore{B7961D5E-A740-4BC6-9868-1646396B9822}\RP80\A0010526.dll infected by "Trojan-Spy.Win32.VBStat.j" Virus. Action Taken: File Deleted. File C:\System Volume Information\_restore{B7961D5E-A740-4BC6-9868-1646396B9822}\RP80\A0010527.exe infected by "Trojan-Clicker.Win32.Costrat.ae" Virus. Action Taken: File Deleted. File C:\WINDOWS\Downloaded Program Files\UWA6P_0001_N91M1807NetInstaller.exe tagged as not-a-virusownloader.Win32.WinFixer.o. No Action Taken. File C:\WINDOWS\system32\koumyxhm.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.ft. No Action Taken. File C:\WINDOWS\system32\mhprbyni.exe tagged as not-a-virus:AdWare.Win32.Agent.at. No Action Taken. File C:\WINDOWS\Temp\idd1.tmp.exe tagged as not-a-virusorn-Dialer.Win32.IDialer.m. No Action Taken. File C:\WINDOWS\Temp\idd3.tmp.exe tagged as not-a-virusorn-Dialer.Win32.IDialer.m. No Action Taken. File C:\WINDOWS\Temp\idd31.tmp.exe tagged as not-a-virusorn-Dialer.Win32.IDialer.m. No Action Taken. File C:\WINDOWS\Temp\idd33.tmp.exe tagged as not-a-virusorn-Dialer.Win32.IDialer.m. No Action Taken. File C:\WINDOWS\Temp\idd3C5.tmp.exe tagged as not-a-virusorn-Dialer.Win32.IDialer.m. No Action Taken. File C:\WINDOWS\Temp\idd4.tmp.exe tagged as not-a-virusorn-Dialer.Win32.IDialer.m. No Action Taken. File C:\WINDOWS\Temp\idd4C6.tmp.exe tagged as not-a-virusorn-Dialer.Win32.IDialer.m. No Action Taken. File C:\WINDOWS\Temp\idd4FC.tmp.exe tagged as not-a-virusorn-Dialer.Win32.IDialer.m. No Action Taken. File C:\WINDOWS\Temp\idd8E0.tmp.exe tagged as not-a-virusorn-Dialer.Win32.IDialer.m. No Action Taken. File C:\WINDOWS\Temp\idd909.tmp.exe tagged as not-a-virusorn-Dialer.Win32.IDialer.m. No Action Taken. File C:\WINDOWS\Temp\iddBBA.tmp.exe tagged as not-a-virusorn-Dialer.Win32.IDialer.m. No Action Taken. File C:\WINDOWS\Temp\win65.tmp.exe infected by "Packed.Win32.Klone.g" Virus. Action Taken: File Renamed. File C:\WINDOWS\Temp\win74.tmp.exe infected by "Packed.Win32.Klone.g" Virus. Action Taken: File Renamed. File C:\WINDOWS\Temp\win76.tmp.exe infected by "Packed.Win32.Klone.g" Virus. Action Taken: File Renamed. File C:\WINDOWS\Temp\win78.tmp.exe infected by "Packed.Win32.Klone.g" Virus. Action Taken: File Renamed.
ajas tuosta Lataa SmitfraudFix (c) S!Ri http://siri.urz.free.fr/Fix/SmitfraudFix.zip Pura sisältö (kansio nimeltä SmitfraudFix) työpöydällesi: Avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd Valitse optio #1 - Search kirjoittamalla 1 ja painamalla "Enter"; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa). Postita tämän tekstitiedoston sisältö viestiketjuusi. Huomaa : process.exe filun tunnistaa jotkut Anti-virus ohjelmat (AntiVir, Dr.Web, Kaspersky) "Haittakaluna"; se ei ole virus, vaan ohjelma joka pysäyttää prosesseja. A/V ohjelmat eivät pysty tunnistamaan hyvän ja pahan käytön tälläisten ohjelmian väliltä, silloin ne saattavat varoittaa käyttäjää. Lataa VundoFix.exe http://www.atribune.org/ccount/click.php?id=4 työpöydällesi. • Tupla-klikkaa VundoFix.exe ajaaksesi sen. • Klikkaa Scan for Vundo valintaa. • Kun skannaus on valmis, klikkaa Remove Vundo valintaa. • Sinulta kysytään haluatko poistaa filut - klikkaa YES. • Kun olet klikannut yes, työpöytäsi tyhjenee kun se alkaa poistamaan Vundoa. • Kun se on valmis, fiksi ilmoittaa käynnistäväsi koneesi uudelleen, klikkaa OK. • Postita C:\vundofix.txt lokin sekä tuoreen HijackThis lokin sisältö. Huomaa: Se on mahdollista että VundoFix löysi tiedoston jota se ei pystynyt poistamaan. Tässä tilanteessa, VundoFix ajaa itsensä rebootissa, seuraa vain yläpuolelle olevia ohjeita alkaen kohdasta "Klikkaa Scan for Vundo valintaa." kun VundoFix ilmaantuu uudelleenkäynnistyksen yhteydessä.
eli tässä käskemäsi raportti: SmitFraudFix v2.132 Scan done at 17:22:49,17, ti 16.01.2007 Run from C:\Documents and Settings\Omistaja\Ty”p”yt„\smitfraudfix\SmitfraudFix OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Omistaja »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Omistaja\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Omistaja\Suosikit »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="Nykyinen kotisivu" »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32 pe386 detected, use a Rootkit scanner »»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End
eli tässä on uusin hijack ja vundofix: Logfile of HijackThis v1.99.1 Scan saved at 17:46:14, on 16.1.2007 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\WINDOWS\System32\igfxtray.exe C:\WINDOWS\System32\hkcmd.exe C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe D:\Drivers\Winamp\winampa.exe D:\drivers\d-tools\daemon.exe C:\Program Files\Microsoft IntelliPoint\ipoint.exe D:\Drivers\VIRUST~2\ashDisp.exe C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\Program Files\Messenger\MSMSGS.EXE D:\Drivers\virustorjunta1\aswUpdSv.exe D:\Drivers\virustorjunta1\ashServ.exe D:\Drivers\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\system32\slserv.exe C:\Program Files\Common Files\Teleca Shared\Generic.exe C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe D:\Drivers\virustorjunta1\ashWebSv.exe D:\Drivers\virustorjunta1\ashMaiSv.exe C:\WINDOWS\System32\wuauclt.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Mozilla Firefox\firefox.exe D:\Drivers\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fi/0SEFIFI/SAOS01?FORM=TOOLBR R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.fi/0SEFIFI/SAOS01?FORM=TOOLBR R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fi/0SEFIFI/SAOS01?FORM=TOOLBR R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: (no name) - {6BC49D77-85D6-4DAB-9F52-D791C8BDD0A1} - C:\WINDOWS\System32\awtqn.dll (file missing) O2 - BHO: (no name) - {7DA39570-5FD2-4f18-94B4-20730CB3F727} - C:\WINDOWS\System32\sjktqjxk.dll (file missing) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions O4 - HKLM\..\Run: [WinampAgent] D:\Drivers\Winamp\winampa.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\drivers\d-tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe" O4 - HKLM\..\Run: [avast!] D:\Drivers\VIRUST~2\ashDisp.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: winjjq32 - winjjq32.dll (file missing) O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - D:\Drivers\virustorjunta1\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - D:\Drivers\virustorjunta1\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - D:\Drivers\virustorjunta1\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - D:\Drivers\virustorjunta1\ashWebSv.exe" /service (file missing) O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - D:\Drivers\AVG Anti-Spyware 7.5\guard.exe O23 - Service: COM+ Messages - Unknown owner - C:\WINDOWS\System32\svchosts.exe" -e mc-110-12-0000272 (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe ja vundofix: VundoFix V6.3.2 Checking Java version... Java version is 1.4.2.3 Scan started at 17:25:39 16.1.2007 Listing files found while scanning.... C:\Documents and settings\Omistaja\Application Data\SearchToolbarCorp\Toolbar Vision\PageHistory.txt C:\Documents and settings\Omistaja\Application Data\SearchToolbarCorp\Toolbar Vision\WebHistory.txt C:\WINDOWS\System32\awtqn.dll C:\WINDOWS\system32\iifgdby.dll C:\WINDOWS\system32\koumyxhm.dll C:\WINDOWS\system32\mhprbyni.exe C:\WINDOWS\system32\mhxymuok.ini C:\WINDOWS\System32\nqtwa.bak1 C:\WINDOWS\System32\nqtwa.bak2 C:\WINDOWS\System32\nqtwa.ini C:\WINDOWS\System32\nqtwa.ini2 C:\WINDOWS\System32\nqtwa.tmp C:\WINDOWS\System32\sjktqjxk.dll Beginning removal... Attempting to delete C:\Documents and settings\Omistaja\Application Data\SearchToolbarCorp\Toolbar Vision\PageHistory.txt C:\Documents and settings\Omistaja\Application Data\SearchToolbarCorp\Toolbar Vision\PageHistory.txt Has been deleted! Attempting to delete C:\Documents and settings\Omistaja\Application Data\SearchToolbarCorp\Toolbar Vision\WebHistory.txt C:\Documents and settings\Omistaja\Application Data\SearchToolbarCorp\Toolbar Vision\WebHistory.txt Has been deleted! Attempting to delete C:\WINDOWS\System32\awtqn.dll C:\WINDOWS\System32\awtqn.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\iifgdby.dll C:\WINDOWS\system32\iifgdby.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\koumyxhm.dll C:\WINDOWS\system32\koumyxhm.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\mhprbyni.exe C:\WINDOWS\system32\mhprbyni.exe Has been deleted! Attempting to delete C:\WINDOWS\system32\mhxymuok.ini C:\WINDOWS\system32\mhxymuok.ini Has been deleted! Attempting to delete C:\WINDOWS\System32\nqtwa.bak1 C:\WINDOWS\System32\nqtwa.bak1 Has been deleted! Attempting to delete C:\WINDOWS\System32\nqtwa.bak2 C:\WINDOWS\System32\nqtwa.bak2 Has been deleted! Attempting to delete C:\WINDOWS\System32\nqtwa.ini C:\WINDOWS\System32\nqtwa.ini Has been deleted! Attempting to delete C:\WINDOWS\System32\nqtwa.ini2 C:\WINDOWS\System32\nqtwa.ini2 Has been deleted! Attempting to delete C:\WINDOWS\System32\nqtwa.tmp C:\WINDOWS\System32\nqtwa.tmp Has been deleted! Performing Repairs to the registry. Done!
Poista lisää poista sovelutuksesta Java version is 1.4.2.3 scannaa hjt:llä merkkaa paina Fix checked O2 - BHO: (no name) - {6BC49D77-85D6-4DAB-9F52-D791C8BDD0A1} - C:\WINDOWS\System32\awtqn.dll (file missing) O2 - BHO: (no name) - {7DA39570-5FD2-4f18-94B4-20730CB3F727} - C:\WINDOWS\System32\sjktqjxk.dll (file missing) O20 - Winlogon Notify: winjjq32 - winjjq32.dll (file missing) O23 - Service: COM+ Messages - Unknown owner - C:\WINDOWS\System32\svchosts.exe" -e mc-110-12-0000272 (file missing) Poista vikasiedossa C:\WINDOWS\System32\svchosts.exe tarkkana tämän kanssa ettei lähde lailinen svchosts huom! Tuo s perässä Käynnistä > suorita kirjoita alla olevat ja jokaisen rivin jälkeen paina ok sc stop "COM+ Messages" sc delete "COM+ Messages" lainaus merkit myös laitettava Lataa RustBFix by ejvindh http://www.uploads.ejvindh.net/rustbfix.exe ja tallenna se työpöydällesi. Tuplaklikkaa tiedostoa rustbfix.exe. Jos löytyy Rustock.b-infektio, sinua pyydetään pian käynnistämään kone uudelleen. Uudelleenkäynnistyminen saattaa kestää hetken ja joudut ehkä käynnistämään koneen vielä toisenkin kerran. Kaikki tämä tapahtuu automaattisesti. Uudelleenkäynnistyksen jälkeen kaksi lokitiedostoa avautuu (%root%\avenger.txt & %root%\rustbfix\pelog.txt). Kopioi ja liitä nämä kaksi lokitiedostoa seuraavaan vastaukseesi uuden HijackThis lokin kera.
eli tässä ne logit: ************************* Rustock.b-fix -- By ejvindh ************************* ke 17.01.2007 18:48:15,48 ******************* Pre-run Status of system ******************* Rootkit driver PE386 is found. Starting the unload-procedure.... Rustock.b-ADS attached to the System32-folder: :lzx32.sys 70570 Total size: 70570 bytes. Attempting to remove ADS... system32: deleted 70570 bytes in 1 streams. Looking for Rustock.b-files in the System32-folder: No Rustock.b-files found in system32 ******************* Post-run Status of system ******************* Rustock.b-driver on the system: NONE! Rustock.b-ADS attached to the System32-folder: No System32-ADS found. Looking for Rustock.b-files in the System32-folder: No Rustock.b-files found in system32 ******************************* End of Logfile ******************************** Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\uiqhcrhw ******************* Script file located at: \??\C:\WINDOWS\vucdqckp.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Driver PE386 unloaded successfully. Program C:\Rustbfix\2run.bat successfully set up to run once on reboot. Completed script processing. ******************* Finished! Terminate. Logfile of HijackThis v1.99.1 Scan saved at 19:05:47, on 17.1.2007 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\hkcmd.exe C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe D:\Drivers\Winamp\winampa.exe C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe D:\drivers\d-tools\daemon.exe C:\Program Files\Microsoft IntelliPoint\ipoint.exe D:\Drivers\VIRUST~2\ashDisp.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\Program Files\Messenger\MSMSGS.EXE D:\Drivers\virustorjunta1\aswUpdSv.exe D:\Drivers\virustorjunta1\ashServ.exe D:\Drivers\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\system32\slserv.exe C:\Program Files\Common Files\Teleca Shared\Generic.exe C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe D:\Drivers\virustorjunta1\ashWebSv.exe D:\Drivers\virustorjunta1\ashMaiSv.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe D:\Drivers\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fi/0SEFIFI/SAOS01?FORM=TOOLBR R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.fi/0SEFIFI/SAOS01?FORM=TOOLBR R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fi/0SEFIFI/SAOS01?FORM=TOOLBR R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions O4 - HKLM\..\Run: [WinampAgent] D:\Drivers\Winamp\winampa.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\drivers\d-tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe" O4 - HKLM\..\Run: [avast!] D:\Drivers\VIRUST~2\ashDisp.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - D:\Drivers\virustorjunta1\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - D:\Drivers\virustorjunta1\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - D:\Drivers\virustorjunta1\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - D:\Drivers\virustorjunta1\ashWebSv.exe" /service (file missing) O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - D:\Drivers\AVG Anti-Spyware 7.5\guard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe Tässä ne käskemäsi logit, en löytänyt C:\Windows\system32 kansiosta muuta kuin svchost.exe ja jonkun epämääräisen tiedoston "unsvchosts.lzma" en poistanut vielä
SmitFraudFix v2.132 Scan done at 16:33:20,15, to 18.01.2007 Run from C:\Documents and Settings\Omistaja\Ty”p”yt„\smitfraudfix\SmitfraudFix OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Omistaja »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Omistaja\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Omistaja\Suosikit »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="Nykyinen kotisivu" »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32 »»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End tossa se on! joko alkaa kone olemaan tolkuissaan!
