Mitä tästä mahdollisesti kannattaisi poistaa? Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:17:42, on 8.4.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Unable to get Internet Explorer version! Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LVCOMSX.EXE C:\Program Files\Logitech\Video\LogiTray.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\System32\M-AudioTaskBarIcon.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\DNA\btdna.exe C:\Program Files\Logitech\Video\FxSvr2.exe C:\Program Files\LaCie\Backup Software\LaCieBackup.exe C:\Program Files\DMTS\BIN\e3DMTSMediaServer.exe C:\Program Files\DMTS\BIN\e3DMTSServer.exe C:\Program Files\M-Audio Fast Track\GBInst.exe C:\Program Files\M-Audio\JamLab\JamLabInst.exe C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe C:\Program Files\M-Audio\Audiophile USB\MAUSBAPInst.exe C:\Program Files\M-Audio\Black Box\MAUSBBBInst.exe C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe C:\Program Files\M-Audio\Conectiv\MAUSBCVInst.exe C:\Program Files\M-Audio\Fast Track Pro\MAUSBInst.exe C:\Program Files\M-Audio\MobilePre\Install\MPInst.exe C:\Program Files\NetLimiter 2 Pro\nlsvc.exe C:\Program Files\M-Audio\Ozone\Install\ozinst.exe C:\WINDOWS\system32\PnkBstrA.exe C:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\M-Audio\Transit\Install\TUSBInst.exe C:\Program Files\NetLimiter 2 Pro\NLClient.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe C:\Program Files\BitTorrent\bittorrent.exe C:\Program Files\Webteh\BSplayerPro\bsplayer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50168 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe O4 - HKLM\..\Run: [NTFSSAPI] ntfsapi.exe O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [M-Audio Taskbar Icon] C:\WINDOWS\System32\M-AudioTaskBarIcon.exe O4 - HKLM\..\RunServices: [NTFSSAPI] ntfsapi.exe O4 - HKLM\..\RunServices: [Media Load] msn32.exe O4 - HKLM\..\RunServices: [winguard] wingrd32.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe" O4 - HKCU\..\Run: [LaCie Backup] C:\Program Files\LaCie\Backup Software\\LaCieBackup.exe /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [Windows Lmhost Util] lmhost.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [Microsoft IE] IEXPLORE.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [Windows Messenger] msmsgs.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [Sysino] lsess.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [Nvidia CTRL Panel] ncsvc32.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunServices: [MSN Messanger] msnmsng.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [Windows Lmhost Util] lmhost.exe (User 'Default user') O4 - HKUS\.DEFAULT\..\RunServices: [MSN Messanger] msnmsng.exe (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Web Savings - file://C:\Program Files\WebSavingsfromEbates\System\Temp\ebateswebsavings_script0.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{39D78B64-F1D5-4C55-8DB8-2759D59EBBE4}: NameServer = 213.139.190.3 212.50.131.153 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL O23 - Service: e-3 DMTS Media Server (e3DMTSMediaServer) - Unknown owner - C:\Program Files\DMTS\BIN\e3DMTSMediaServer.exe O23 - Service: e-3 DMTS Server (e3DMTSServer) - Unknown owner - C:\Program Files\DMTS\BIN\e3DMTSServer.exe O23 - Service: Fast Track Installer (FastTrackInstallerService) - Nemesis - C:\Program Files\M-Audio Fast Track\GBInst.exe O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: JamLab Installer (JamLabInstallerService) - M-Audio - C:\Program Files\M-Audio\JamLab\JamLabInst.exe O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe O23 - Service: M-Audio Audiophile Installer (MAudioAudiophileService) - Avid Technology, Inc. - C:\Program Files\M-Audio\Audiophile USB\MAUSBAPInst.exe O23 - Service: M-Audio BlackBox Installer (MAudioBlackBoxService) - Avid Technology, Inc. - C:\Program Files\M-Audio\Black Box\MAUSBBBInst.exe O23 - Service: M-Audio Conectiv Installer (MAudioConectivService) - Avid Technology, Inc. - C:\Program Files\M-Audio\Conectiv\MAUSBCVInst.exe O23 - Service: M-Audio USB Installer (MAudioUSBService) - M-Audio - C:\Program Files\M-Audio\Fast Track Pro\MAUSBInst.exe O23 - Service: MobilePre Installer (MobilePreInstallerService) - M-Audio - C:\Program Files\M-Audio\MobilePre\Install\MPInst.exe O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\Program Files\NetLimiter 2 Pro\nlsvc.exe O23 - Service: M-Audio Ozone Installer (OzoneInstallerService) - Nemesis - C:\Program Files\M-Audio\Ozone\Install\ozinst.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PPPoE Service (PPPoEService) - Unknown owner - C:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe O23 - Service: M-Audio Transit Installer (TransitInstallerService) - M-Audio - C:\Program Files\M-Audio\Transit\Install\TUSBInst.exe -- End of file - 8467 bytes
Javan päivitys ja välimuistin tyhjennys: 1. Klikkaa Käynnistä -> Ohjauspaneeli ja tupla-klikkaa Lisää tai poista sovellus Ohjauspaneelissa. 2. Etsi listasta kaikki entiset Java versiosi. (J2SE Runtime Environment.... ) Niissä pitäisi olla seuraava kuva vieressä: 3. Valitse kaikki entiset Java versiosi ja valitse Poista. 4. Asenna uusin Java päivitys seuraavasta linkistä.. 5. Käynnistä kone uudelleen asennuksen jälkeen: http://java.sun.com/javase/downloads/index.jsp Rullaa alas kohteeseen Java Runtime Environment (JRE) 6u5 Paina Download Ruksaa Accept, ota offline installation, tallenna vaikka työpöydälle ja asenna se. 6. Käynnistyksen jälkeen, mene takaisin Ohjauspaneeliin ja avaa Java asetuksesi (Muita Ohjauspaneelin asetuksia -> Java kahvikuppi). 7. General Settings -osion alla, vedä liukusäädintä (Disk Space) pienemmälle, ja klikkaa Delete Files -nappia. (Jotkut javapohjaiset ohjelmat saattavat tarvita enemmän levytilaa. Jos huomaat säädön pienentämisen jälkeen koneessa hitautta, siirrä liukusäädintä isommalle). 8. Varmista että kaikki kaksi valintaa ovat rastitettuja: *Applications and Applets *Trace and Log Files Ja paina OK -nappia 9. Klikkaa OK "Temporary Files Settings" -ikkunassasi. 10. Klikkaa OK jättääksesi Java asetusikkunasi. ============ Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi. Käynnistä koneesi vikasietotilaan: sammuta ja käynnistä käynnistyksen yhteydessä hakkaa F8 nappia valitse nuolinäppäimellä vikasietotila paina enter ja enter valitse käyttäjätilisi paina kyllä Jossakin koneissa hakataan F8:sin sijasta F5:tä " Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix. " Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman. " Paina Y käynnistääksesi skriptin. " Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot". " Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen. " Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta. " Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished". " Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle. " Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.
Tässä SDFixin report muistio: SDFix: Version 1.167 Run by jari on ti 08.04.2008 at 16:16 Microsoft Windows XP [versio 5.1.2600] Running From: C:\SDFix Checking Services : Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting Checking Files : Trojan Files Found: C:\WINDOWS\smdat32a.sys - Deleted Removing Temp Files ADS Check : Final Check : catchme 0.3.1351.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-08 16:23:48 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{259F814B-410F-489B-8E7C-666816BFA02A}] "LeaseObtainedTime"=dword:47fb7aba "T1"=dword:47fb7aba "T2"=dword:47fb7aba "DhcpRetryTime"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{259F814B-410F-489B-8E7C-666816BFA02A}\Parameters\Tcpip] "LeaseObtainedTime"=dword:47fb7aba "T1"=dword:47fb7aba "T2"=dword:47fb7aba scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services : Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:µTorrent" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" "C:\\Program Files\\DNA\\btdna.exe"="C:\\Program Files\\DNA\\btdna.exe:*:EnabledNA" "C:\\Program Files\\BitTorrent\\bittorrent.exe"="C:\\Program Files\\BitTorrent\\bittorrent.exe:*:Enabled:BitTorrent" "C:\\Program Files\\Sunbelt Software\\Personal Firewall 4\\kpf4gui.exe"="C:\\Program Files\\Sunbelt Software\\Personal Firewall 4\\kpf4gui.exe:*:Enabled:Sunbelt Kerio Personal Firewall 4 - GUI" "C:\\Soldat\\Soldat.exe"="C:\\Soldat\\Soldat.exe:*:Enabled:Soldat" "C:\\Program Files\\DC++\\DCPlusPlus.exe"="C:\\Program Files\\DC++\\DCPlusPlus.exe:*:EnabledC++" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] Remaining Files : File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes : Mon 25 Jun 2007 61,440 A..H. --- "C:\Program Files\MSN Messenger\winmm.dll" Mon 27 Dec 2004 56 ..SHR --- "C:\WINDOWS\system32\89931FC656.sys" Sat 5 Apr 2008 13,304 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys" Sat 22 Oct 2005 1,024 ...HR --- "C:\WINDOWS\system32\NTICDMK7.dll" Sat 22 Oct 2005 1,024 ...HR --- "C:\WINDOWS\system32\NTIMPEG2.dll" Tue 23 Dec 2003 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Tue 23 Dec 2003 401 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv11.bak" Fri 5 Mar 2004 401 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv12.bak" Sat 4 Dec 2004 400 ..SH. --- "C:\Documents and Settings\All Users\DRM\v2ks.bla.bak" Sat 4 Dec 2004 48 ..SH. --- "C:\Documents and Settings\All Users\DRM\v2ks.sec.bak" Tue 23 Dec 2003 4,348 A..H. --- "C:\Documents and Settings\jari\Mallit\Omat tiedostot\Omat musiikkitiedostot\K„ytt”oikeuden varmuuskopio\drmv1key.bak" Mon 5 Feb 2007 401 A..H. --- "C:\Documents and Settings\jari\Mallit\Omat tiedostot\Omat musiikkitiedostot\K„ytt”oikeuden varmuuskopio\drmv1lic.bak" Sat 4 Dec 2004 400 A..H. --- "C:\Documents and Settings\jari\Mallit\Omat tiedostot\Omat musiikkitiedostot\K„ytt”oikeuden varmuuskopio\drmv2key.bak" Mon 5 Feb 2007 1,536 A..H. --- "C:\Documents and Settings\jari\Mallit\Omat tiedostot\Omat musiikkitiedostot\K„ytt”oikeuden varmuuskopio\drmv2lic.bak" Finished! Ja uusi HJT-Loki: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:31:47, on 8.4.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Unable to get Internet Explorer version! Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\DMTS\BIN\e3DMTSMediaServer.exe C:\Program Files\DMTS\BIN\e3DMTSServer.exe C:\Program Files\M-Audio Fast Track\GBInst.exe C:\Program Files\M-Audio\JamLab\JamLabInst.exe C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe C:\Program Files\M-Audio\Audiophile USB\MAUSBAPInst.exe C:\Program Files\M-Audio\Black Box\MAUSBBBInst.exe C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe C:\Program Files\M-Audio\Conectiv\MAUSBCVInst.exe C:\Program Files\M-Audio\Fast Track Pro\MAUSBInst.exe C:\Program Files\M-Audio\MobilePre\Install\MPInst.exe C:\Program Files\NetLimiter 2 Pro\nlsvc.exe C:\Program Files\M-Audio\Ozone\Install\ozinst.exe C:\WINDOWS\system32\PnkBstrA.exe C:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\M-Audio\Transit\Install\TUSBInst.exe C:\Program Files\NetLimiter 2 Pro\NLClient.exe C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\LVCOMSX.EXE C:\Program Files\Logitech\Video\LogiTray.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\System32\M-AudioTaskBarIcon.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\DNA\btdna.exe C:\Program Files\LaCie\Backup Software\LaCieBackup.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\Program Files\Logitech\Video\FxSvr2.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50168 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://paivitys.dnainternet.fi/yhteys/proxy.pac R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.suomi.net:8080 R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe O4 - HKLM\..\Run: [NTFSSAPI] ntfsapi.exe O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [M-Audio Taskbar Icon] C:\WINDOWS\System32\M-AudioTaskBarIcon.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\RunServices: [NTFSSAPI] ntfsapi.exe O4 - HKLM\..\RunServices: [Media Load] msn32.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe" O4 - HKCU\..\Run: [LaCie Backup] C:\Program Files\LaCie\Backup Software\\LaCieBackup.exe /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [Windows Lmhost Util] lmhost.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [Microsoft IE] IEXPLORE.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [Windows Messenger] msmsgs.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [Sysino] lsess.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [Nvidia CTRL Panel] ncsvc32.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunServices: [MSN Messanger] msnmsng.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [Windows Lmhost Util] lmhost.exe (User 'Default user') O4 - HKUS\.DEFAULT\..\RunServices: [MSN Messanger] msnmsng.exe (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Web Savings - file://C:\Program Files\WebSavingsfromEbates\System\Temp\ebateswebsavings_script0.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{39D78B64-F1D5-4C55-8DB8-2759D59EBBE4}: NameServer = 213.139.190.3 212.50.131.153 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL O23 - Service: e-3 DMTS Media Server (e3DMTSMediaServer) - Unknown owner - C:\Program Files\DMTS\BIN\e3DMTSMediaServer.exe O23 - Service: e-3 DMTS Server (e3DMTSServer) - Unknown owner - C:\Program Files\DMTS\BIN\e3DMTSServer.exe O23 - Service: Fast Track Installer (FastTrackInstallerService) - Nemesis - C:\Program Files\M-Audio Fast Track\GBInst.exe O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: JamLab Installer (JamLabInstallerService) - M-Audio - C:\Program Files\M-Audio\JamLab\JamLabInst.exe O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe O23 - Service: M-Audio Audiophile Installer (MAudioAudiophileService) - Avid Technology, Inc. - C:\Program Files\M-Audio\Audiophile USB\MAUSBAPInst.exe O23 - Service: M-Audio BlackBox Installer (MAudioBlackBoxService) - Avid Technology, Inc. - C:\Program Files\M-Audio\Black Box\MAUSBBBInst.exe O23 - Service: M-Audio Conectiv Installer (MAudioConectivService) - Avid Technology, Inc. - C:\Program Files\M-Audio\Conectiv\MAUSBCVInst.exe O23 - Service: M-Audio USB Installer (MAudioUSBService) - M-Audio - C:\Program Files\M-Audio\Fast Track Pro\MAUSBInst.exe O23 - Service: MobilePre Installer (MobilePreInstallerService) - M-Audio - C:\Program Files\M-Audio\MobilePre\Install\MPInst.exe O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\Program Files\NetLimiter 2 Pro\nlsvc.exe O23 - Service: M-Audio Ozone Installer (OzoneInstallerService) - Nemesis - C:\Program Files\M-Audio\Ozone\Install\ozinst.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PPPoE Service (PPPoEService) - Unknown owner - C:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe O23 - Service: M-Audio Transit Installer (TransitInstallerService) - M-Audio - C:\Program Files\M-Audio\Transit\Install\TUSBInst.exe -- End of file - 8763 bytes
Lataa Malwarebytes' Anti-Malware työpöydällesi. 1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman. 2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish. 3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version. 4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan. 5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset. 6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected. 7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt 8. Lähetä lokin sisältö seuraavassa viestissäsi.
Tässä tuo Malware loki: Malwarebytes' Anti-Malware 1.11 Tietokantaversio: 599 Tarkistustyyppi: Täysi tarkistus (C:\|E:\|) Tarkistetut kohteet: 141107 Kulunut aika: 47 minute(s), 53 second(s) Saastuneita muistiprosesseja: 0 Saastuneita muistimoduuleja: 0 Saastuneita rekisteriavaimia: 12 Saastuneita rekisteriarvoja: 0 Saastuneita rekisterikohteita: 0 Saastuneita hakemistoja: 0 Saastuneita tiedostoja: 43 Saastuneita muistiprosesseja: (Haitallisia kohteita ei löydetty) Saastuneita muistimoduuleja: (Haitallisia kohteita ei löydetty) Saastuneita rekisteriavaimia: HKEY_CLASSES_ROOT\Interface\{bf06da8e-2beb-4816-9bbd-f7625246e245} (Adware.ISTBar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{db447818-96b4-40df-8a55-720da496f514} (Adware.ISTBar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{a4730ebe-43a6-443e-9776-36915d323ad3} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{2bb15d36-43be-4743-a3a0-3308f4b1a610} (Adware.Delphinmediaviewer) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{41700749-a109-4254-af13-be54011e8783} (Adware.Delphinmediaviewer) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{2a7db8d1-43be-4ad3-a81e-9bb8c9d00073} (Adware.Delphinmediaviewer) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{aa4939c3-deca-4a48-a454-97cd587c0ef5} (Adware.NetOptimizer) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{eee4a2e5-9f56-432f-a6ed-f6f625b551e0} (Adware.NetOptimizer) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\software\salm (Adware.180Solutions) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully. Saastuneita rekisteriarvoja: (Haitallisia kohteita ei löydetty) Saastuneita rekisterikohteita: (Haitallisia kohteita ei löydetty) Saastuneita hakemistoja: (Haitallisia kohteita ei löydetty) Saastuneita tiedostoja: C:\Program Files\mozilla.org\Mozilla\regxpcom.exe (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0760012.exe (Trojan.Zlob) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0760013.dll (Trojan.Zlob) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0760014.exe (Trojan.Zlob) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0762014.dll (Trojan.Zlob) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0762015.exe (Trojan.Zlob) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0762016.exe (Trojan.Zlob) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0762027.exe (Trojan.Zlob) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0762028.dll (Trojan.Zlob) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0762029.exe (Trojan.Zlob) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0763029.exe (Trojan.Zlob) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0763030.dll (Trojan.Zlob) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0763031.exe (Trojan.Zlob) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0766029.exe (Trojan.Zlob) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0766030.dll (Trojan.Zlob) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0767029.exe (Trojan.Zlob) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0773029.dll (Trojan.Zlob) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0773030.exe (Trojan.Zlob) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0774029.exe (Trojan.Zlob) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0774030.dll (Trojan.Zlob) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0774031.exe (Trojan.Zlob) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0777029.dll (Trojan.Zlob) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0777030.exe (Trojan.Zlob) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1319\A0777031.exe (Trojan.Zlob) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1321\A0779041.dll (Trojan.Zlob) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1322\A0779100.dll (Trojan.Zlob) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1322\A0779106.dll (Trojan.Zlob) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1322\A0779153.exe (Trojan.Zlob) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1322\A0779154.exe (Trojan.Zlob) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1322\A0779174.sys (Trojan.Zlob) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1322\A0779175.dll (Trojan.Zlob) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1322\A0779176.dll (Trojan.Zlob) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1322\A0779179.exe (Trojan.Zlob) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1322\A0779180.dll (Trojan.Zlob) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1322\A0779181.exe (Trojan.Zlob) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1322\A0779182.exe (Trojan.Zlob) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1322\A0779183.exe (Trojan.Zlob) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{80B668A7-B9B5-4532-95A4-B1612A4F502F}\RP1322\A0779184.exe (Trojan.Zlob) -> Quarantined and deleted successfully. C:\WINDOWS\system32\ide21201.vxd (Adware.Winad) -> Quarantined and deleted successfully. E:\Program Files\mozilla.org\Mozilla\regxpcom.exe (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully. C:\WINDOWS\inf\ultra.PNF (Malware.Trace) -> Quarantined and deleted successfully. C:\WINDOWS\system32\eglivecam_1028.dll (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Documents and Settings\jari\Suosikit\Online Security Test.url (Rogue.Link) -> Quarantined and deleted successfully. ja HiJackThis: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:30:16, on 8.4.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Unable to get Internet Explorer version! Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\DMTS\BIN\e3DMTSMediaServer.exe C:\Program Files\DMTS\BIN\e3DMTSServer.exe C:\Program Files\M-Audio Fast Track\GBInst.exe C:\Program Files\M-Audio\JamLab\JamLabInst.exe C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe C:\Program Files\M-Audio\Audiophile USB\MAUSBAPInst.exe C:\Program Files\M-Audio\Black Box\MAUSBBBInst.exe C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe C:\Program Files\M-Audio\Conectiv\MAUSBCVInst.exe C:\Program Files\M-Audio\Fast Track Pro\MAUSBInst.exe C:\Program Files\M-Audio\MobilePre\Install\MPInst.exe C:\Program Files\NetLimiter 2 Pro\nlsvc.exe C:\Program Files\M-Audio\Ozone\Install\ozinst.exe C:\WINDOWS\system32\PnkBstrA.exe C:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\M-Audio\Transit\Install\TUSBInst.exe C:\Program Files\NetLimiter 2 Pro\NLClient.exe C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\LVCOMSX.EXE C:\Program Files\Logitech\Video\LogiTray.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\System32\M-AudioTaskBarIcon.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\DNA\btdna.exe C:\Program Files\LaCie\Backup Software\LaCieBackup.exe C:\Program Files\Logitech\Video\FxSvr2.exe C:\Program Files\BitTorrent\bittorrent.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50168 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe O4 - HKLM\..\Run: [NTFSSAPI] ntfsapi.exe O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [M-Audio Taskbar Icon] C:\WINDOWS\System32\M-AudioTaskBarIcon.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\RunServices: [NTFSSAPI] ntfsapi.exe O4 - HKLM\..\RunServices: [Media Load] msn32.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe" O4 - HKCU\..\Run: [LaCie Backup] C:\Program Files\LaCie\Backup Software\\LaCieBackup.exe /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [Windows Lmhost Util] lmhost.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [Microsoft IE] IEXPLORE.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [Windows Messenger] msmsgs.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [Sysino] lsess.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [Nvidia CTRL Panel] ncsvc32.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunServices: [MSN Messanger] msnmsng.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [Windows Lmhost Util] lmhost.exe (User 'Default user') O4 - HKUS\.DEFAULT\..\RunServices: [MSN Messanger] msnmsng.exe (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Web Savings - file://C:\Program Files\WebSavingsfromEbates\System\Temp\ebateswebsavings_script0.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{39D78B64-F1D5-4C55-8DB8-2759D59EBBE4}: NameServer = 213.139.190.3 212.50.131.153 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL O23 - Service: e-3 DMTS Media Server (e3DMTSMediaServer) - Unknown owner - C:\Program Files\DMTS\BIN\e3DMTSMediaServer.exe O23 - Service: e-3 DMTS Server (e3DMTSServer) - Unknown owner - C:\Program Files\DMTS\BIN\e3DMTSServer.exe O23 - Service: Fast Track Installer (FastTrackInstallerService) - Nemesis - C:\Program Files\M-Audio Fast Track\GBInst.exe O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: JamLab Installer (JamLabInstallerService) - M-Audio - C:\Program Files\M-Audio\JamLab\JamLabInst.exe O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe O23 - Service: M-Audio Audiophile Installer (MAudioAudiophileService) - Avid Technology, Inc. - C:\Program Files\M-Audio\Audiophile USB\MAUSBAPInst.exe O23 - Service: M-Audio BlackBox Installer (MAudioBlackBoxService) - Avid Technology, Inc. - C:\Program Files\M-Audio\Black Box\MAUSBBBInst.exe O23 - Service: M-Audio Conectiv Installer (MAudioConectivService) - Avid Technology, Inc. - C:\Program Files\M-Audio\Conectiv\MAUSBCVInst.exe O23 - Service: M-Audio USB Installer (MAudioUSBService) - M-Audio - C:\Program Files\M-Audio\Fast Track Pro\MAUSBInst.exe O23 - Service: MobilePre Installer (MobilePreInstallerService) - M-Audio - C:\Program Files\M-Audio\MobilePre\Install\MPInst.exe O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\Program Files\NetLimiter 2 Pro\nlsvc.exe O23 - Service: M-Audio Ozone Installer (OzoneInstallerService) - Nemesis - C:\Program Files\M-Audio\Ozone\Install\ozinst.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PPPoE Service (PPPoEService) - Unknown owner - C:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe O23 - Service: M-Audio Transit Installer (TransitInstallerService) - M-Audio - C:\Program Files\M-Audio\Transit\Install\TUSBInst.exe -- End of file - 8496 bytes
1.Lataa combofix.exe työpöydällesi yhdestä linkistä: combofix1 combofix2 2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia. 3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi. Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen. Ota tosta kakkos kohdasta =============== Lataa SmitfraudFix (c) S!Ri Pura sisältö (kansio nimeltä SmitfraudFix) työpöydällesi: Avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd Valitse optio #1 - Search kirjoittamalla 1 ja painamalla "Enter"; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa). Postita ponnahtava rapport – muistion sisältö viestiketjuusi. Löytyy myös C:\rapport.txt Huomaa : process.exe filun tunnistaa jotkut Anti-virus ohjelmat (AntiVir, Dr.Web, Kaspersky) "Haittakaluna"; se ei ole virus, vaan ohjelma joka pysäyttää prosesseja. A/V ohjelmat eivät pysty tunnistamaan hyvän ja pahan käytön tälläisten ohjelmian väliltä, silloin ne saattavat varoittaa käyttäjää.
Combofix Logi: ComboFix 08-04-08.1 - jari 2008-04-08 20:49:52.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.441 [GMT 2:00] Running from: E:\Sälät\ComboFix.exe * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . (((((((((((((((((((((((((((((((((((((( Muut poistot )))))))))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\smdat32m.sys . ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-03-08 to 2008-04-08 ))))))))))))))))) . 2008-04-08 17:52 . 2008-04-08 17:57 <KANSIO> d-------- C:\Documents and Settings\jari\.onnet 2008-04-08 17:40 . 2008-04-08 17:40 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-04-08 17:40 . 2008-04-08 17:40 <KANSIO> d-------- C:\Documents and Settings\jari\Application Data\Malwarebytes 2008-04-08 17:40 . 2008-04-08 17:40 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-04-08 16:12 . 2008-04-08 16:29 <KANSIO> d----c--- C:\SDFix 2008-04-06 17:34 . 2008-04-07 15:15 632 --a------ C:\WINDOWS\Sof2.INI 2008-04-05 23:54 . 2008-04-05 23:54 <KANSIO> d-------- C:\Program Files\Alex Buturuga 2008-04-05 10:37 . 2008-04-05 10:37 <KANSIO> d-------- C:\Program Files\Steam 2008-04-05 10:19 . 2008-04-07 23:19 <KANSIO> d-------- C:\Program Files\Counter-Strike 2008-04-05 01:22 . 2008-04-05 01:31 <KANSIO> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-04-05 01:12 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2008-04-05 01:12 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-04-05 01:12 . 2008-03-22 15:49 86,528 --a------ C:\WINDOWS\system32\VACFix.exe 2008-04-05 01:12 . 2008-03-26 08:50 82,432 --a------ C:\WINDOWS\system32\IEDFix.exe 2008-04-05 01:12 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe 2008-04-05 01:12 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2008-04-05 01:12 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2008-04-05 01:06 . 2008-04-05 01:06 <KANSIO> d-------- C:\Program Files\Yahoo! 2008-04-04 22:08 . 2008-04-08 16:36 <KANSIO> d-------- C:\WINDOWS\system32\LogFiles 2008-04-04 22:08 . 2008-04-07 23:14 107,832 --a------ C:\WINDOWS\system32\PnkBstrB.exe 2008-04-04 22:08 . 2008-04-04 22:08 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe 2008-04-04 22:08 . 2008-04-07 23:14 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-04-04 17:25 . 2008-04-04 21:59 <KANSIO> d-------- C:\Program Files\Wolfenstein - Enemy Territory 2008-04-04 12:55 . 2008-04-04 12:55 <KANSIO> d-------- C:\Program Files\PC Wizard 2008 2008-04-04 12:55 . 2007-09-15 15:11 27,136 --a------ C:\WINDOWS\system32\PCWizard.cpl 2008-04-03 22:15 . 2008-04-03 22:15 <KANSIO> d-------- C:\Program Files\LaCie 2008-04-03 22:15 . 2008-04-03 22:15 <KANSIO> d-------- C:\Documents and Settings\jari\Application Data\LaCie 2008-04-03 19:11 . 2008-04-03 19:11 0 -ra--c--- C:\logwmemory.bin 2008-04-03 19:07 . 2008-04-03 19:07 <KANSIO> d----c--- C:\Soldat 2008-04-02 21:45 . 2008-04-02 21:45 <KANSIO> d-------- C:\Program Files\Windows Live Safety Center 2008-03-31 23:14 . 2008-03-31 23:14 <KANSIO> d-------- C:\Program Files\DNA 2008-03-31 23:14 . 2008-03-31 23:14 <KANSIO> d-------- C:\Program Files\BitTorrent 2008-03-31 23:14 . 2008-04-08 20:50 <KANSIO> d-------- C:\Documents and Settings\jari\Application Data\DNA 2008-03-31 23:14 . 2008-04-08 20:47 <KANSIO> d-------- C:\Documents and Settings\jari\Application Data\BitTorrent 2008-03-30 21:56 . 2008-04-03 16:27 <KANSIO> d-------- C:\Program Files\IDoser v4 2008-03-24 19:09 . 2008-03-24 19:15 <KANSIO> d-------- C:\Documents and Settings\jari\Application Data\BSplayer Pro 2008-03-23 23:15 . 2008-03-23 23:15 <KANSIO> d-------- C:\Program Files\MessengerDiscovery 2008-03-23 22:58 . 2008-03-23 22:58 <KANSIO> d-------- C:\Program Files\Trend Micro 2008-03-23 21:30 . 2008-03-23 21:30 <KANSIO> d-------- C:\Program Files\ToniArts 2008-03-15 15:51 . 2008-03-27 18:29 <KANSIO> d-------- C:\Program Files\REAPER 2008-03-15 15:51 . 2008-03-15 18:15 <KANSIO> d-------- C:\Documents and Settings\jari\Application Data\REAPER 2008-03-15 15:21 . 2008-03-15 15:43 <KANSIO> d-------- C:\Program Files\Steinberg 2008-03-15 15:15 . 2003-07-31 21:28 147,425 --a------ C:\WINDOWS\system32\SYNSOACC-Aide.chm 2008-03-15 15:15 . 2003-05-26 16:29 120,468 --a------ C:\WINDOWS\system32\SYNSOACC-Hilfe.chm 2008-03-15 15:15 . 2003-05-26 16:29 114,279 --a------ C:\WINDOWS\system32\SYNSOACC-Help.chm 2008-03-15 15:15 . 2005-05-09 21:08 33,792 --a------ C:\WINDOWS\system32\drivers\cledx.sys 2008-03-15 15:14 . 2008-03-15 15:15 <KANSIO> d-------- C:\Program Files\Syncrosoft 2008-03-15 15:14 . 2005-10-17 10:35 704,512 --a------ C:\WINDOWS\system32\SYNSOACC.dll 2008-03-15 15:14 . 2004-05-10 16:58 147,456 --a------ C:\WINDOWS\system32\SynsoLChk.dll 2008-03-15 15:14 . 2002-11-25 09:36 45,056 --a------ C:\WINDOWS\system32\Synsopos.exe 2008-03-15 15:14 . 2002-11-25 06:46 16,896 --a------ C:\WINDOWS\system32\drivers\synasUSB.sys 2008-03-15 01:54 . 2008-03-25 18:52 <KANSIO> d-------- C:\Documents and Settings\jari\Application Data\skypePM 2008-03-15 01:54 . 2008-03-15 01:54 32 --a------ C:\Documents and Settings\All Users\Application Data\ezsid.dat 2008-03-15 01:49 . 2008-03-15 01:49 <KANSIO> d-------- C:\Program Files\Skype 2008-03-15 01:49 . 2008-03-15 01:49 <KANSIO> d-------- C:\Program Files\Common Files\Skype 2008-03-08 20:10 . 2008-03-23 22:46 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller . (((((((((((((((((((((((((((((((((((( Find3M-raportti )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-04-08 14:09 497 ----a-w C:\WINDOWS\system32\drivers\fwdrv.err 2008-04-08 13:58 --------- d-----w C:\Program Files\Java 2008-04-07 21:20 --------- d-----w C:\Program Files\DC++ 2008-04-04 22:52 13,304 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys 2008-03-26 14:42 --------- d-----w C:\Program Files\WINAMP 2008-03-25 17:06 --------- d-----w C:\Documents and Settings\jari\Application Data\Skype 2008-03-24 17:09 --------- d-----w C:\Program Files\Webteh 2008-03-23 21:15 --------- d-----w C:\Program Files\CCleaner 2008-03-23 20:01 --------- d-----w C:\Program Files\MSN Messenger 2008-03-23 19:30 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-03-16 11:43 --------- d-----w C:\Program Files\RevConnect 2008-03-14 23:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype 2008-03-04 15:23 --------- d-----w C:\Program Files\NetLimiter 2 Pro 2008-03-04 15:23 --------- d-----w C:\Documents and Settings\jari\Application Data\Locktime 2008-03-04 15:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Locktime 2008-03-03 20:15 --------- d-----w C:\Program Files\ASIO4ALL v2 2008-03-03 15:39 --------- d-----w C:\Documents and Settings\jari\Application Data\Ableton 2008-03-03 15:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ableton 2008-03-03 15:36 --------- d-----w C:\Program Files\Ableton 2008-03-03 15:32 --------- d-----w C:\Program Files\M-Audio Fast Track 2008-03-01 18:50 --------- d-----w C:\Program Files\M-Audio Transit 2008-03-01 18:50 --------- d-----w C:\Program Files\M-Audio 2008-03-01 18:48 --------- d-----w C:\Program Files\M-Audio MobilePre 2008-03-01 18:45 --------- d-----w C:\Program Files\M-Audio Firewire Family 2008-03-01 18:43 --------- d-----w C:\Program Files\M-Audio Fast Track USB 2008-03-01 15:28 --------- d-----w C:\Documents and Settings\jari\Application Data\DSound 2008-03-01 15:26 --------- d-----w C:\Program Files\DSound 2008-03-01 05:59 --------- d-----w C:\Program Files\MP4 Player 2008-02-14 12:06 --------- d-----w C:\Documents and Settings\jari\Application Data\gtk-2.0 2006-09-20 19:35 33 ----a-w C:\Documents and Settings\jari\Application Data\tvmuknwrd.dll 2006-09-20 19:34 0 ----a-w C:\Documents and Settings\jari\Application Data\tvmknwrd.dll 2004-10-01 01:49 58 ----a-w C:\Documents and Settings\jari\swe.bat 2004-12-27 15:03 56 --sh--r C:\WINDOWS\system32\89931FC656.sys 2006-07-07 11:02 36,761 --sha-w C:\WINDOWS\system32\stsohcvs.dat . (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet ))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:55 5674352] "BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-03-31 23:14 288576] "LaCie Backup"="C:\Program Files\LaCie\Backup Software\\LaCieBackup.exe" [2006-07-06 10:30 2596864] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-12-14 18:19 221184] "LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2004-12-14 18:57 458752] "LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2004-12-14 18:51 217088] "NTFSSAPI"="ntfsapi.exe" [] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-10-25 07:37 35328] "M-Audio Taskbar Icon"="C:\WINDOWS\System32\M-AudioTaskBarIcon.exe" [2006-02-01 10:24 94208] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] "NTFSSAPI"="ntfsapi.exe" [] "Media Load"="msn32.exe" [] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-15 01:12 15360] "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:55 5674352] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "Windows Lmhost Util"="lmhost.exe" [] "starter"="scvhosting.exe" [] "MicrosoftUpdate"="syshelper.exe" [] "Win32 USB2 Driver"="win32usb.exe" [] "Microsoft IE"="IEXPLORE.EXE" [] "Windows Messenger"="msmsgs.exe" [] "Sysino"="lsess.exe" [] "Nvidia CTRL Panel"="ncsvc32.exe" [] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunServices] "MSN Messanger"="msnmsng.exe" [] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoBandCustomize"= 0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoBandCustomize"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.ffds"= C:\PROGRA~1\ffdshow\ffdshow.ax "VIDC.HFYU"= huffyuv.dll "vidc.DIV3"= DivXc32.dll "vidc.DIV4"= DivXc32f.dll "msacm.divxa32"= DivXa32.acm [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "C:\\Program Files\\DNA\\btdna.exe"= "C:\\Program Files\\BitTorrent\\bittorrent.exe"= "C:\\Program Files\\Sunbelt Software\\Personal Firewall 4\\kpf4gui.exe"= "C:\\Soldat\\Soldat.exe"= "C:\\Program Files\\DC++\\DCPlusPlus.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "11292:TCP"= 11292:TCP:BitComet 11292 TCP "11292:UDP"= 11292:UDP:BitComet 11292 UDP R0 BsStor;InCD Storage Helper Driver;C:\WINDOWS\system32\DRIVERS\bsstor.sys [2002-06-06 01:07] R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2005-12-15 18:13] R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2005-12-15 18:01] R1 nltdi;nltdi;C:\WINDOWS\system32\drivers\nltdi.sys [2007-04-23 13:03] R1 XPROTECTOR;XPROTECTOR;C:\WINDOWS\system32\drivers\Oreans.sys [2005-05-28 19:55] R2 BsUDF;InCD UDF Driver;C:\WINDOWS\system32\drivers\BsUDF.sys [2003-01-15 19:02] R2 e3DMTSMediaServer;e-3 DMTS Media Server;C:\Program Files\DMTS\BIN\e3DMTSMediaServer.exe [2004-06-08 13:05] R2 e3DMTSServer;e-3 DMTS Server;C:\Program Files\DMTS\BIN\e3DMTSServer.exe [2004-03-22 11:59] R2 JamLabInstallerService;JamLab Installer;C:\Program Files\M-Audio\JamLab\JamLabInst.exe [2006-01-09 17:39] R2 MAudioAudiophileService;M-Audio Audiophile Installer;C:\Program Files\M-Audio\Audiophile USB\MAUSBAPInst.exe [2006-03-14 11:52] R2 MAudioBlackBoxService;M-Audio BlackBox Installer;C:\Program Files\M-Audio\Black Box\MAUSBBBInst.exe [2006-03-16 11:02] R2 MAudioConectivService;M-Audio Conectiv Installer;C:\Program Files\M-Audio\Conectiv\MAUSBCVInst.exe [2006-06-16 15:11] R2 MAudioUSBService;M-Audio USB Installer;C:\Program Files\M-Audio\Fast Track Pro\MAUSBInst.exe [2005-12-02 10:20] R2 MobilePreInstallerService;MobilePre Installer;C:\Program Files\M-Audio\MobilePre\Install\MPInst.exe [2005-06-15 15:00] R2 PPPoEService;PPPoE Service;C:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe [2000-07-11 10:48] R2 TransitInstallerService;M-Audio Transit Installer;C:\Program Files\M-Audio\Transit\Install\TUSBInst.exe [2005-06-22 21:51] R3 MA763010;M-Audio Fast Track;C:\WINDOWS\system32\drivers\MA763010.sys [2004-08-31 16:57] R3 NTSPPPOE;Efficient Networks Enternet P.P.P.o.E LAN Miniport Driver;C:\WINDOWS\system32\DRIVERS\ntspppoe.sys [2002-03-06 11:44] S3 RAWESR;RAWESR;C:\PROGRA~1\EFFICI~1\ENTERN~1\app\RAWESR.SYS [2002-03-06 11:39] S3 TAPBIND;TAPBIND;C:\PROGRA~1\EFFICI~1\ENTERN~1\app\TAPBIND1.SYS [2002-03-06 11:42] S4 NetFxUpdate_v1.1.4322;Microsoft .NET Framework v1.1.4322 Update;C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\netfxupdate.exe [2007-01-15 17:11] . ************************************************************************** catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-08 20:56:47 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-04-08 20:58:42 ComboFix-quarantined-files.txt 2008-04-08 18:58:34 Pre-Run: 21,429,768,192 tavua vapaana Post-Run: 21,424,803,840 tavua vapaana . 2008-03-17 02:01:37 --- E O F --- SmitFraudFix raport: SmitFraudFix v2.309 Scan done at 21:02:08,90, ti 08.04.2008 Run from C:\unzipped\SmitfraudFix\SmitfraudFix OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» Process C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\DMTS\BIN\e3DMTSMediaServer.exe C:\Program Files\DMTS\BIN\e3DMTSServer.exe C:\Program Files\M-Audio Fast Track\GBInst.exe C:\Program Files\M-Audio\JamLab\JamLabInst.exe C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe C:\Program Files\M-Audio\Audiophile USB\MAUSBAPInst.exe C:\Program Files\M-Audio\Black Box\MAUSBBBInst.exe C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe C:\Program Files\M-Audio\Conectiv\MAUSBCVInst.exe C:\Program Files\M-Audio\Fast Track Pro\MAUSBInst.exe C:\Program Files\M-Audio\MobilePre\Install\MPInst.exe C:\Program Files\NetLimiter 2 Pro\nlsvc.exe C:\Program Files\M-Audio\Ozone\Install\ozinst.exe C:\WINDOWS\system32\PnkBstrA.exe C:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\M-Audio\Transit\Install\TUSBInst.exe C:\Program Files\NetLimiter 2 Pro\NLClient.exe C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\LVCOMSX.EXE C:\Program Files\Logitech\Video\LogiTray.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\System32\M-AudioTaskBarIcon.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\DNA\btdna.exe C:\Program Files\LaCie\Backup Software\LaCieBackup.exe C:\Program Files\Logitech\Video\FxSvr2.exe C:\Program Files\BitTorrent\bittorrent.exe C:\Program Files\MSN Messenger\usnsvc.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\cmd.exe »»»»»»»»»»»»»»»»»»»»»»»» hosts »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS C:\WINDOWS\d3??.dll FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\jari »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\jari\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\jari\Suosikit »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="Nykyinen kotisivu" »»»»»»»»»»»»»»»»»»»»»»»» IEDFix !!!Attention, following keys are not inevitably infected!!! IEDFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» VACFix !!!Attention, following keys are not inevitably infected!!! VACFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="C:\\PROGRA~1\\Google\\GOOGLE~2\\GOEC62~1.DLL" »»»»»»»»»»»»»»»»»»»»»»»» Winlogon !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "Userinit"="C:\\WINDOWS\\system32\\userinit.exe," "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Rustock »»»»»»»»»»»»»»»»»»»»»»»» DNS Description: WAN (PPP/SLIP) Interface DNS Server Search Order: 213.139.190.3 DNS Server Search Order: 212.50.131.153 HKLM\SYSTEM\CCS\Services\Tcpip\..\{39D78B64-F1D5-4C55-8DB8-2759D59EBBE4}: NameServer=213.139.190.3 212.50.131.153 HKLM\SYSTEM\CS1\Services\Tcpip\..\{39D78B64-F1D5-4C55-8DB8-2759D59EBBE4}: NameServer=213.139.190.3 212.50.131.153 »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End
Printtaa ohjeet ulos Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi. Vikasietotilaan: sammuta ja käynnistä käynnistyksen yhteydessä hakkaa F8 nappia valitse nuolinäppäimellä vikasietotila paina enter ja enter valitse käyttäjätilisi paina kyllä Jossakin koneissa hakataan F8:sin sijasta F5:tä Kun vikasietotilassa, avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd Valitse optio #2 - Clean kirjoittamalla 2 ja painamalla "Enter" poistaaksesi tarttuneet tiedostot. Sinulta kysytään: "Registry cleaning - Do you want to clean the registry ?"; vastaa "Yes" kirjoittamalla Y ja paina "Enter" poistaaksesi työpöydän taustakuvan ja puhdistaaksesi tarttuneet rekisteriavaimet. Työkalu tarkistaa jos wininet.dll on tarttunut. Sinua saatetaan pyytää korvaamaan tarttunut .dll (jos löytyy); vastaa "Yes" kirjoittamalla Y ja painamalla "Enter". Työkalun saattaa tarvita käynnistää kone uudelleen; jos ei tee niin, käynnistä normaaliin Windowsiin. Tekstitiedosto ilmestyy, puhdistusprosessin jäljiltä; kopioi & liitä tämän raportin tulokset vastaukseesi. Raportti löytyy paikalliselta levyltäsi, useimmiten C:\rapport.txt. Varoitus : Ajamalla optio 2:n EI-tarttuneessa tietokoneessa, poistaa sinun työpöytäsi taustakuvan.
Siinäpä tuo rapportti SmitFraudFix v2.309 Scan done at 21:44:18,95, ti 08.04.2008 Run from C:\unzipped\SmitfraudFix\SmitfraudFix OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in safe mode »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» hosts 127.0.0.1 localhost »»»»»»»»»»»»»»»»»»»»»»»» VACFix VACFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix S!Ri's WS2Fix: LSP not Found. »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files C:\WINDOWS\d3??.dll Deleted »»»»»»»»»»»»»»»»»»»»»»»» IEDFix IEDFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» DNS »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» End
Ohje AVG:n Anti-Spyware 7.5:n käyttöön Huom! Tässä ohjeessa sammutetaan tuo reaaliaikasuojaus (Shield). Näin vältetään tilanteet joissa suojaus estäisi esim HijackThis:n työkalun toimintaa. Tallenna nämä ohjeet tekstitiedostoon tai tulosta nämä, muuten et pääse niihin käsiksi vikasietotilasta Lataa AVG:n Anti-Spyware 7.5:n ja tallenna ohjelma työpöydällesi. o Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa. o Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää. o Käynnistä AVG:n Anti-Spyware. o Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta. o Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa. o Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti. o Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine". o Sitten "Reports" valikon alta: o Laita täppi kohtaan "Automatically generate report after every scan" o Ota täppi pois kohdasta"Only if threats were found" o Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa o "Resident shield is", muuta tila active:sta inactive:ksi o Sulje ohjelma, ÄLÄ skannaa vielä. Käynnistä koneesi vikasietotilaan, sammuta ja käynnistä käynnistyksen yhteydessä naputtele F8 valitse nuoli näppäimellä vikasietotila paina enter ja enter Toisissa koneissa paukutetaan F8:sin sijasta F5:tä HUOM! Älä käytä muita ohjelmia AVG:n skannauksen aikana, tämä saattaa häiritä skannausta. o Kun vikasietotilassa, käynnistä AVG:n Anti-Spyware. o Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan". o Ewido aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa. Kun skannaus on valmis: TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions" o Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta. o Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions" o Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta. o Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle. o Sulje ohjelma, käynnistä kone normaalisti ja lähetä AVG:n raportti viestikejuusi.
