IE availee omia sivuja

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by Keke99, May 3, 2007.

  1. Keke99

    Keke99 Member

    Joined:
    May 3, 2007
    Messages:
    8
    Likes Received:
    0
    Trophy Points:
    11
    Kun avaan mozillan niin IE aukaisee jonkun sivun. Estin IE:n yhteyden nettiin sygate:lla, mutta ei tunnu auttavan. Tässä on HiJackThis Logi

    Logfile of HijackThis v1.99.1
    Scan saved at 18:20:31, on 3.5.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Sygate\smc.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\RunDll32.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\Program Files\Picasa2\PicasaMediaDetector.exe
    C:\windvd 7\Common\Bin\WinCinemaMgr.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\VIA\RAID\raid_tool.exe
    C:\WinZip\WZQKPICK.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Azureus\Azureus.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\Risto\Työpöytä\HijackThis_v1.99.1.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O2 - BHO: (no name) - {395192A6-2224-4F93-890E-D8608A075275} - C:\WINDOWS\system32\mllmk.dll
    O2 - BHO: (no name) - {46A4E9D9-B30E-452A-8157-DBBEC8573B03} - C:\Program Files\VSAdd-in\VSAdd-in.dll (file missing)
    O2 - BHO: (no name) - {4978D272-3E0C-4A94-8F9D-17C68F4CEC41} - C:\WINDOWS\system32\wqurvqkw.dll
    O2 - BHO: (no name) - {57E218E6-5A80-4f0c-AB25-83598F25D7E9} - C:\WINDOWS\system32\lwqxvrkw.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: (no name) - {C47A9554-195A-4769-9B13-04F15B450A39} - C:\WINDOWS\system32\yayvtrq.dll (file missing)
    O2 - BHO: (no name) - {D651AFF4-9590-424d-BD1E-8E33E090DFB3} - C:\WINDOWS\system32\omlpqeij.dll
    O3 - Toolbar: &VSAdd-in - {74DD705D-6834-439C-A735-A6DBE2677452} - C:\Program Files\VSAdd-in\VSAdd-in.dll (file missing)
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
    O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
    O4 - HKLM\..\Run: [SmcService] C:\Sygate\smc.exe -startgui
    O4 - HKLM\..\Run: [InfoData] rundll32.exe "C:\WINDOWS\system32\vevnwphx.dll",realset
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\windvd 7\Common\Bin\WinCinemaMgr.exe
    O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\WinZip\WZQKPICK.EXE
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: mllmk - C:\WINDOWS\system32\mllmk.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
    O20 - Winlogon Notify: yayvtrq - yayvtrq.dll (file missing)
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Sygate\smc.exe
     
    Keke99, May 3, 2007
    #1
  2. Auttaja

    Auttaja Guest

    Lataa VundoFix.exe työpöydällesi.
    *Tupla-klikkaa VundoFix.exe ajaaksesi sen.
    *Klikkaa Scan for Vundo valintaa.
    *Kun skannaus on valmis, klikkaa Remove Vundo valintaa.
    *Sinulta kysytään haluatko poistaa filut - klikkaa YES.
    *Kun olet klikannut yes, työpöytäsi tyhjenee kun se alkaa poistamaan Vundoa.
    *Kun se on valmis, fiksi ilmoittaa käynnistäväsi koneesi uudelleen, klikkaa OK.
    *Postita C:\vundofix.txt lokin sekä tuoreen HijackThis lokin sisältö.


    Huomaa: Se on mahdollista että VundoFix löysi tiedoston jota se ei pystynyt poistamaan.
    Tässä tilanteessa, VundoFix ajaa itsensä rebootissa, seuraa vain yläpuolelle olevia ohjeita alkaen kohdasta "Klikkaa Scan for Vundo valintaa." kun VundoFix ilmaantuu uudelleenkäynnistyksen yhteydessä.

    ********

    1) Lataa http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe
    2) Tallenna VirtumundoBeGone.exe työpöydällesi.
    3) Aja VirtumundoBeGone.exe ja seuraa ohjeita. Älä huoli jos näet sinisen ruudun "Fatal Error" viestin, tämä on normaalia.
    4) Kun työkalu on valmis, käynnistä kone uudelleen.

    Se luo työpöydällesi lokin nimeltä VBG.TXT, kopioi ja liitä sen sisältö vastaukseesi.

    ******

    Laita uusi hijackthis logi :)
     
    Auttaja, May 3, 2007
    #2
  3. Keke99

    Keke99 Member

    Joined:
    May 3, 2007
    Messages:
    8
    Likes Received:
    0
    Trophy Points:
    11
    Tässä on logit:

    Logfile of HijackThis v1.99.1
    Scan saved at 19:24:45, on 3.5.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Sygate\smc.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\RunDll32.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\Program Files\Picasa2\PicasaMediaDetector.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\windvd 7\Common\Bin\WinCinemaMgr.exe
    C:\Program Files\VIA\RAID\raid_tool.exe
    C:\WinZip\WZQKPICK.EXE
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\Risto\Työpöytä\HijackThis_v1.99.1.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O2 - BHO: (no name) - {395192A6-2224-4F93-890E-D8608A075275} - C:\WINDOWS\system32\mllmk.dll (file missing)
    O2 - BHO: (no name) - {4978D272-3E0C-4A94-8F9D-17C68F4CEC41} - C:\WINDOWS\system32\wqurvqkw.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O3 - Toolbar: (no name) - {74DD705D-6834-439C-A735-A6DBE2677452} - (no file)
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
    O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
    O4 - HKLM\..\Run: [SmcService] C:\Sygate\smc.exe -startgui
    O4 - HKLM\..\Run: [InfoData] rundll32.exe "C:\WINDOWS\system32\vevnwphx.dll",realset
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\windvd 7\Common\Bin\WinCinemaMgr.exe
    O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\WinZip\WZQKPICK.EXE
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
    O20 - Winlogon Notify: yayvtrq - yayvtrq.dll (file missing)
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Sygate\smc.exe


    VundoFix V6.3.21

    Checking Java version...

    Java version is 1.5.0.11

    Scan started at 19:10:35 3.5.2007

    Listing files found while scanning....

    C:\Program Files\VSAdd-in\VSAdd-in.dll
    C:\WINDOWS\system32\aktusxit.dll
    C:\WINDOWS\system32\apbdyhgy.exe
    C:\WINDOWS\system32\awhrlqfp.dll
    C:\WINDOWS\system32\awtqp.dll
    C:\WINDOWS\system32\blfplfxg.dll
    C:\WINDOWS\system32\bxfdsgjk.dll
    C:\WINDOWS\system32\cyhggemw.dll
    C:\WINDOWS\system32\flhvgfol.dll
    C:\WINDOWS\system32\fukhihvo.dll
    C:\WINDOWS\system32\fuoccgro.dll
    C:\WINDOWS\system32\fvcdtsqr.dll
    C:\WINDOWS\system32\ghqirrdh.dll
    C:\WINDOWS\system32\gjvjfavb.dll
    C:\WINDOWS\system32\guxgruct.dll
    C:\WINDOWS\system32\hfraflun.dll
    C:\WINDOWS\system32\hkpjgvdr.dll
    C:\WINDOWS\system32\igtsriyr.ini
    C:\WINDOWS\system32\ijiqonni.dll
    C:\WINDOWS\system32\jgvxeave.dll
    C:\WINDOWS\system32\kmllm.bak1
    C:\WINDOWS\system32\kmllm.bak2
    C:\WINDOWS\system32\kmllm.ini
    C:\WINDOWS\system32\kmllm.ini2
    C:\WINDOWS\system32\kmllm.tmp
    C:\WINDOWS\system32\ljjhhhg.dll
    C:\WINDOWS\system32\llvofbfe.dll
    C:\WINDOWS\system32\lmffcvpo.dll
    C:\WINDOWS\system32\lwqxvrkw.dll
    C:\WINDOWS\system32\mavyymcf.dll
    C:\WINDOWS\system32\mljkjgh.dll
    C:\WINDOWS\system32\mllmk.dll
    C:\WINDOWS\system32\nmafllbd.dll
    C:\WINDOWS\system32\nqdcofrf.dll
    C:\WINDOWS\system32\oliyfrrt.dll
    C:\WINDOWS\system32\omlpqeij.dll
    C:\WINDOWS\system32\pptlneaf.dll
    C:\WINDOWS\system32\pqtwa.ini
    C:\WINDOWS\system32\pukgvufa.dll
    C:\WINDOWS\system32\qhnthncg.dll
    C:\WINDOWS\system32\qhrspsmq.dll
    C:\WINDOWS\system32\qrdkgqjn.dll
    C:\WINDOWS\system32\qrqrklwt.dll
    C:\WINDOWS\system32\rfcahorx.dll
    C:\WINDOWS\system32\rnqywvuw.dll
    C:\WINDOWS\system32\rptmxyvs.dll
    C:\WINDOWS\system32\rqbfpgsq.dll
    C:\WINDOWS\system32\rsfyoqoa.dll
    C:\WINDOWS\system32\ryirstgi.dll
    C:\WINDOWS\system32\sevcsvkv.dll
    C:\WINDOWS\system32\tcpqduvc.dll
    C:\WINDOWS\system32\teegxhpo.dll
    C:\WINDOWS\system32\uxqnjliv.dll
    C:\WINDOWS\system32\vbuodqxb.dll
    C:\WINDOWS\system32\vevnwphx.dll
    C:\WINDOWS\system32\vfyaquin.dll
    C:\WINDOWS\system32\xghfkqgq.dll
    C:\WINDOWS\system32\xhpwnvev.ini
    C:\WINDOWS\system32\xixabhpw.dll
    C:\WINDOWS\system32\xtffkvva.dll
    C:\WINDOWS\system32\yayvtrq.dll
    C:\WINDOWS\system32\yhifgxuv.dll
    C:\WINDOWS\system32\ynctgbax.dll

    Beginning removal...

    Attempting to delete C:\WINDOWS\system32\aktusxit.dll
    C:\WINDOWS\system32\aktusxit.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\apbdyhgy.exe
    C:\WINDOWS\system32\apbdyhgy.exe Has been deleted!

    Attempting to delete C:\WINDOWS\system32\awhrlqfp.dll
    C:\WINDOWS\system32\awhrlqfp.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\awtqp.dll
    C:\WINDOWS\system32\awtqp.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\blfplfxg.dll
    C:\WINDOWS\system32\blfplfxg.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\bxfdsgjk.dll
    C:\WINDOWS\system32\bxfdsgjk.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\cyhggemw.dll
    C:\WINDOWS\system32\cyhggemw.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\flhvgfol.dll
    C:\WINDOWS\system32\flhvgfol.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\fukhihvo.dll
    C:\WINDOWS\system32\fukhihvo.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\fuoccgro.dll
    C:\WINDOWS\system32\fuoccgro.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\fvcdtsqr.dll
    C:\WINDOWS\system32\fvcdtsqr.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\ghqirrdh.dll
    C:\WINDOWS\system32\ghqirrdh.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\gjvjfavb.dll
    C:\WINDOWS\system32\gjvjfavb.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\guxgruct.dll
    C:\WINDOWS\system32\guxgruct.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\hfraflun.dll
    C:\WINDOWS\system32\hfraflun.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\hkpjgvdr.dll
    C:\WINDOWS\system32\hkpjgvdr.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\igtsriyr.ini
    C:\WINDOWS\system32\igtsriyr.ini Has been deleted!

    Attempting to delete C:\WINDOWS\system32\ijiqonni.dll
    C:\WINDOWS\system32\ijiqonni.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\jgvxeave.dll
    C:\WINDOWS\system32\jgvxeave.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\kmllm.bak1
    C:\WINDOWS\system32\kmllm.bak1 Has been deleted!

    Attempting to delete C:\WINDOWS\system32\kmllm.bak2
    C:\WINDOWS\system32\kmllm.bak2 Has been deleted!

    Attempting to delete C:\WINDOWS\system32\kmllm.ini
    C:\WINDOWS\system32\kmllm.ini Has been deleted!

    Attempting to delete C:\WINDOWS\system32\kmllm.ini2
    C:\WINDOWS\system32\kmllm.ini2 Has been deleted!

    Attempting to delete C:\WINDOWS\system32\kmllm.tmp
    C:\WINDOWS\system32\kmllm.tmp Has been deleted!

    Attempting to delete C:\WINDOWS\system32\ljjhhhg.dll
    C:\WINDOWS\system32\ljjhhhg.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\llvofbfe.dll
    C:\WINDOWS\system32\llvofbfe.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\lmffcvpo.dll
    C:\WINDOWS\system32\lmffcvpo.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\lwqxvrkw.dll
    C:\WINDOWS\system32\lwqxvrkw.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\mavyymcf.dll
    C:\WINDOWS\system32\mavyymcf.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\mljkjgh.dll
    C:\WINDOWS\system32\mljkjgh.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\mllmk.dll
    C:\WINDOWS\system32\mllmk.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\nmafllbd.dll
    C:\WINDOWS\system32\nmafllbd.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\nqdcofrf.dll
    C:\WINDOWS\system32\nqdcofrf.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\oliyfrrt.dll
    C:\WINDOWS\system32\oliyfrrt.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\omlpqeij.dll
    C:\WINDOWS\system32\omlpqeij.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\pptlneaf.dll
    C:\WINDOWS\system32\pptlneaf.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\pqtwa.ini
    C:\WINDOWS\system32\pqtwa.ini Has been deleted!

    Attempting to delete C:\WINDOWS\system32\pukgvufa.dll
    C:\WINDOWS\system32\pukgvufa.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\qhnthncg.dll
    C:\WINDOWS\system32\qhnthncg.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\qhrspsmq.dll
    C:\WINDOWS\system32\qhrspsmq.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\qrdkgqjn.dll
    C:\WINDOWS\system32\qrdkgqjn.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\qrqrklwt.dll
    C:\WINDOWS\system32\qrqrklwt.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\rfcahorx.dll
    C:\WINDOWS\system32\rfcahorx.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\rnqywvuw.dll
    C:\WINDOWS\system32\rnqywvuw.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\rptmxyvs.dll
    C:\WINDOWS\system32\rptmxyvs.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\rqbfpgsq.dll
    C:\WINDOWS\system32\rqbfpgsq.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\rsfyoqoa.dll
    C:\WINDOWS\system32\rsfyoqoa.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\ryirstgi.dll
    C:\WINDOWS\system32\ryirstgi.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\sevcsvkv.dll
    C:\WINDOWS\system32\sevcsvkv.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\tcpqduvc.dll
    C:\WINDOWS\system32\tcpqduvc.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\teegxhpo.dll
    C:\WINDOWS\system32\teegxhpo.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\uxqnjliv.dll
    C:\WINDOWS\system32\uxqnjliv.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\vbuodqxb.dll
    C:\WINDOWS\system32\vbuodqxb.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\vevnwphx.dll
    C:\WINDOWS\system32\vevnwphx.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\vfyaquin.dll
    C:\WINDOWS\system32\vfyaquin.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\xghfkqgq.dll
    C:\WINDOWS\system32\xghfkqgq.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\xhpwnvev.ini
    C:\WINDOWS\system32\xhpwnvev.ini Has been deleted!

    Attempting to delete C:\WINDOWS\system32\xixabhpw.dll
    C:\WINDOWS\system32\xixabhpw.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\xtffkvva.dll
    C:\WINDOWS\system32\xtffkvva.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\yhifgxuv.dll
    C:\WINDOWS\system32\yhifgxuv.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\ynctgbax.dll
    C:\WINDOWS\system32\ynctgbax.dll Has been deleted!

    Performing Repairs to the registry.
    Done!


    [05/03/2007, 19:21:10] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Risto\Työpöytä\VirtumundoBeGone.exe" )
    [05/03/2007, 19:21:21] - Detected System Information:
    [05/03/2007, 19:21:21] - Windows Version: 5.1.2600, Service Pack 2
    [05/03/2007, 19:21:21] - Current Username: Risto (Admin)
    [05/03/2007, 19:21:21] - Windows is in NORMAL mode.
    [05/03/2007, 19:21:21] - Searching for Browser Helper Objects:
    [05/03/2007, 19:21:21] - BHO 1: {395192A6-2224-4F93-890E-D8608A075275} ()
    [05/03/2007, 19:21:21] - WARNING: BHO has no default name. Checking for Winlogon reference.
    [05/03/2007, 19:21:21] - Checking for HKLM\...\Winlogon\Notify\mllmk
    [05/03/2007, 19:21:21] - Key not found: HKLM\...\Winlogon\Notify\mllmk, continuing.
    [05/03/2007, 19:21:21] - BHO 2: {4978D272-3E0C-4A94-8F9D-17C68F4CEC41} ()
    [05/03/2007, 19:21:21] - WARNING: BHO has no default name. Checking for Winlogon reference.
    [05/03/2007, 19:21:21] - Checking for HKLM\...\Winlogon\Notify\wqurvqkw
    [05/03/2007, 19:21:21] - Key not found: HKLM\...\Winlogon\Notify\wqurvqkw, continuing.
    [05/03/2007, 19:21:21] - BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
    [05/03/2007, 19:21:21] - BHO 4: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
    [05/03/2007, 19:21:21] - WARNING: BHO has no default name. Checking for Winlogon reference.
    [05/03/2007, 19:21:21] - No filename found. Continuing.
    [05/03/2007, 19:21:21] - Finished Searching Browser Helper Objects
    [05/03/2007, 19:21:21] - Finishing up...
    [05/03/2007, 19:21:21] - Nothing found! Exiting...

    Kun käynnistän tietokoneen uudestaan niin ilmestyy virheraportti, virhe ladattaessa C:\windows\system32\vevnwphx.dll
    Määritettyä osaa ei löydy
     
    Keke99, May 3, 2007
    #3
  4. Auttaja

    Auttaja Guest

    jaahans

    [*]Tupla-klikkaa VundoFix.exe ajaaksesi sen.
    [*]Kun Vundofix uudelleenaukeaa, klikkaa Scan for Vundo valintaa.
    [*]Kun skannaus on valmis, oikea-klikkaa kyseisen listaboksin sisällä (valkoinen laatikko jossa on löydetyt tiedostot listattu) ja valitse Add more files
    [*]Kopioi ja liitä seuraavat 2 riviä kahteen ylimmäiseen boksiin
    [*]C:\WINDOWS\system32\wqurvqkw.dll
    [*]C:\WINDOWS\system32\wkqvruqw.*
    [*]Klikkaa Add Files ja sitten klikkaa Close Window.

    [*]Klikkaa Remove Vundo valintaa.
    [*]Saat viestin jossa kysytään haluatko poistaa valitut tiedostot, klikkaa YES.
    [*]Kun klikkaat yes, työpöytäsi tyhjenee kun työkalu alkaa poistamaan Vundoa.
    [*]Kun valmis, saat viestin jossa pyydetään sammuttamaan tietokone, klikkaa OK.
    [*]Käynnistä koneesi uudelleen.
    [*]Postita C:\vundofix.txt lokin sisältö tuoreen HijackThis lokin kera.
     
    Last edited by a moderator: May 3, 2007
    Auttaja, May 3, 2007
    #4
  5. Keke99

    Keke99 Member

    Joined:
    May 3, 2007
    Messages:
    8
    Likes Received:
    0
    Trophy Points:
    11
    Ei tässä vundofix.exe:ssä ole run vundofix as a task boksia!!??
     
    Keke99, May 3, 2007
    #5
  6. Auttaja

    Auttaja Guest

    muokkasin nyt oikeeksi :)
     
    Auttaja, May 3, 2007
    #6
  7. Keke99

    Keke99 Member

    Joined:
    May 3, 2007
    Messages:
    8
    Likes Received:
    0
    Trophy Points:
    11

    VundoFix V6.3.21

    Checking Java version...

    Java version is 1.5.0.11

    Scan started at 20:01:54 3.5.2007

    Listing files found while scanning....

    No infected files were found.


    Beginning removal...



    Logfile of HijackThis v1.99.1
    Scan saved at 20:08:38, on 3.5.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Sygate\smc.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\RunDll32.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\Program Files\Picasa2\PicasaMediaDetector.exe
    C:\windvd 7\Common\Bin\WinCinemaMgr.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\VIA\RAID\raid_tool.exe
    C:\WinZip\WZQKPICK.EXE
    C:\WINDOWS\system32\wuauclt.exe
    C:\Documents and Settings\Risto\Työpöytä\HijackThis_v1.99.1.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O2 - BHO: (no name) - {395192A6-2224-4F93-890E-D8608A075275} - C:\WINDOWS\system32\mllmk.dll (file missing)
    O2 - BHO: (no name) - {4978D272-3E0C-4A94-8F9D-17C68F4CEC41} - C:\WINDOWS\system32\wqurvqkw.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O3 - Toolbar: (no name) - {74DD705D-6834-439C-A735-A6DBE2677452} - (no file)
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
    O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
    O4 - HKLM\..\Run: [SmcService] C:\Sygate\smc.exe -startgui
    O4 - HKLM\..\Run: [InfoData] rundll32.exe "C:\WINDOWS\system32\vevnwphx.dll",realset
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\windvd 7\Common\Bin\WinCinemaMgr.exe
    O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\WinZip\WZQKPICK.EXE
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
    O20 - Winlogon Notify: yayvtrq - yayvtrq.dll (file missing)
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Sygate\smc.exe
     
    Keke99, May 3, 2007
    #7
  8. Auttaja

    Auttaja Guest

    O2 - BHO: (no name) - {395192A6-2224-4F93-890E-D8608A075275} - C:\WINDOWS\system32\mllmk.dll (file missing)
    O2 - BHO: (no name) - {4978D272-3E0C-4A94-8F9D-17C68F4CEC41} - C:\WINDOWS\system32\wqurvqkw.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O3 - Toolbar: (no name) - {74DD705D-6834-439C-A735-A6DBE2677452} - (no file)
    Unknown
    O4 - HKLM\..\Run: [InfoData] rundll32.exe "C:\WINDOWS\system32\vevnwphx.dll",realset
    O20 - Winlogon Notify: yayvtrq - yayvtrq.dll (file missing)

    merkkaa ja fixaa

    *******

    1. Lataa combofix.exe työpöydällesi jommastakummasta linkistä:
    http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe
    http://download.bleepingcomputer.com/sUBs/ComboFix.exe

    2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. (C:\ComboFix.txt) Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

    ******

    uusi hijackthislogi myös.

     
    Auttaja, May 3, 2007
    #8
  9. Keke99

    Keke99 Member

    Joined:
    May 3, 2007
    Messages:
    8
    Likes Received:
    0
    Trophy Points:
    11
    "Risto" - 07-05-03 21:18:57 Service Pack 2
    ComboFix 07-04-25.4V - Running from: "C:\Documents and Settings\Risto\Ty”p”yt„\"


    (((((((((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))


    C:\WINDOWS\system32\egucnqfx.dll
    C:\WINDOWS\system32\nlmrmlyq.dll
    C:\WINDOWS\system32\wqurvqkw.dll
    C:\WINDOWS\system32\xbvixorn.dll
    C:\WINDOWS\system32\ipgshavq.dll
    C:\WINDOWS\system32\cryoccdn.dll
    C:\WINDOWS\system32\oyrmggqk.dll
    C:\WINDOWS\system32\plrvpgkx.dll
    C:\WINDOWS\system32\vkxinjjj.dll


    * * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *


    ((((((((((((((((((((((((((((((( Files Created from 2007-04-03 to 2007-05-03 ))))))))))))))))))))))))))))))))))


    2007-05-03 19:10 <KANSIO> d-------- C:\VundoFix Backups
    2007-04-25 18:01 83,096 --a------ C:\WINDOWS\system32\SSSensor.dll
    2007-04-25 18:01 60,496 --a------ C:\WINDOWS\system32\drivers\Teefer.sys
    2007-04-25 18:01 21,075 --a------ C:\WINDOWS\system32\drivers\wpsdrvnt.sys
    2007-04-25 18:01 14,568 --a------ C:\WINDOWS\system32\drivers\wg6n.sys
    2007-04-25 18:01 14,568 --a------ C:\WINDOWS\system32\drivers\wg5n.sys
    2007-04-25 18:01 14,568 --a------ C:\WINDOWS\system32\drivers\wg4n.sys
    2007-04-25 18:01 14,568 --a------ C:\WINDOWS\system32\drivers\wg3n.sys
    2007-04-25 18:00 <KANSIO> d-------- C:\Sygate
    2007-04-25 17:58 <KANSIO> d-------- C:\Program Files\Common Files\Wise Installation Wizard
    2007-04-20 15:09 <KANSIO> d-------- C:\DOCUME~1\Risto\APPLIC~1\Talkback
    2007-04-15 19:44 73,216 --a------ C:\WINDOWS\ST6UNST.EXE
    2007-04-15 19:44 249,856 --------- C:\WINDOWS\Setup1.exe
    2007-04-14 15:40 <KANSIO> d-------- C:\Program Files\Western Digital Technologies


    (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


    2007-04-25 23:18 -------- d-------- C:\DOCUME~1\Risto\APPLIC~1\temporary
    2007-04-24 15:05 219136 --a------ C:\WINDOWS\system32\uxtheme.dll
    2007-04-23 23:53 48448 --a------ C:\WINDOWS\system32\perfc00b.dat
    2007-04-23 23:53 283024 --a------ C:\WINDOWS\system32\perfh00b.dat
    2007-04-01 00:53 -------- d-------- C:\DOCUME~1\Risto\APPLIC~1\vlc
    2007-04-01 00:14 -------- d-------- C:\Program Files\vlc
    2007-03-28 11:14 -------- d-------- C:\Program Files\picasa2
    2007-03-24 21:12 -------- d-------- C:\Program Files\subtitle workshop
    2007-03-24 14:43 -------- d--h----- C:\Program Files\installshield installation information
    2007-03-22 15:25 11076 --ah----- C:\WINDOWS\system32\mlfcache.dat
    2007-03-20 19:16 -------- d-------- C:\DOCUME~1\Risto\APPLIC~1\transrender
    2007-03-20 19:16 -------- d-------- C:\DOCUME~1\Risto\APPLIC~1\samsung
    2007-03-20 19:16 -------- d-------- C:\DOCUME~1\Risto\APPLIC~1\converttemp
    2007-03-17 16:44 292864 --a------ C:\WINDOWS\system32\winsrv.dll
    2007-03-08 18:38 578048 --a------ C:\WINDOWS\system32\user32.dll
    2007-03-08 18:37 40960 --a------ C:\WINDOWS\system32\mf3216.dll
    2007-03-08 18:37 281600 --a------ C:\WINDOWS\system32\gdi32.dll
    2007-03-08 18:34 1843840 --a------ C:\WINDOWS\system32\win32k.sys
    2007-03-06 12:46 -------- d-------- C:\DOCUME~1\Risto\APPLIC~1\bsplayer pro
    2007-03-03 13:15 12528 --a------ C:\WINDOWS\system32\drivers\secdrv.sys
    2007-02-19 15:25 62 --ahs---- C:\DOCUME~1\Risto\APPLIC~1\desktop.ini
    2007-02-19 14:46 1407 --a------ C:\WINDOWS\mozver.dat
    2007-02-19 14:03 0 --a------ C:\WINDOWS\nsreg.dat
    2007-02-19 13:49 0 -rahs---- C:\MSDOS.SYS
    2007-02-19 13:49 0 -rahs---- C:\IO.SYS
    2007-02-19 13:49 0 --a------ C:\CONFIG.SYS
    2007-02-19 13:49 0 --a------ C:\AUTOEXEC.BAT
    2007-02-19 13:45 21672 --a------ C:\WINDOWS\system32\emptyregdb.dat
    2007-02-05 23:19 185344 --a------ C:\WINDOWS\system32\upnphost.dll


    (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))


    *Note* empty entries & legit default entries are not shown

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
    {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
    "Cmaudio"="RunDll32 cmicnfg.cpl,CMICtrlWnd"
    "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
    "nwiz"="nwiz.exe /install"
    "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
    "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\""
    "DAEMON Tools"="\"C:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033"
    "Picasa Media Detector"="C:\\Program Files\\Picasa2\\PicasaMediaDetector.exe"
    "SmcService"="C:\\Sygate\\smc.exe -startgui"
    "InfoData"="rundll32.exe \"C:\\WINDOWS\\system32\\vevnwphx.dll\",realset"

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
    "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"
    "{C47A9554-195A-4769-9B13-04F15B450A39}"=""

    HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
    Authentication Packages REG_MULTI_SZ msv1_0\0\0
    Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
    Notification Packages REG_MULTI_SZ scecli\0\0


    [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
    HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
    LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
    NetworkService REG_MULTI_SZ DnsCache\0\0
    DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
    rpcss REG_MULTI_SZ RpcSs\0\0
    imgsvc REG_MULTI_SZ StiSvc\0\0
    termsvcs REG_MULTI_SZ TermService\0\0


    ********************************************************************

    catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-05-03 21:20:51
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden services ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden processes: 0
    hidden services: 0
    hidden files: 0


    ********************************************************************

    Completion time: 07-05-03 21:20:53
    C:\ComboFix-quarantined-files.txt ... 07-05-03 21:20



    Logfile of HijackThis v1.99.1
    Scan saved at 21:28:52, on 3.5.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Sygate\smc.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\RunDll32.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\Program Files\Picasa2\PicasaMediaDetector.exe
    C:\windvd 7\Common\Bin\WinCinemaMgr.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\VIA\RAID\raid_tool.exe
    C:\WinZip\WZQKPICK.EXE
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Documents and Settings\Risto\Työpöytä\HijackThis_v1.99.1.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
    O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
    O4 - HKLM\..\Run: [SmcService] C:\Sygate\smc.exe -startgui
    O4 - HKLM\..\Run: [InfoData] rundll32.exe "C:\WINDOWS\system32\vevnwphx.dll",realset
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\windvd 7\Common\Bin\WinCinemaMgr.exe
    O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\WinZip\WZQKPICK.EXE
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Sygate\smc.exe

     
    Keke99, May 3, 2007
    #9
  10. Auttaja

    Auttaja Guest

    missä virustorjuntasi on? aviran antivir on esim. kätsä ilmanen siihen hommaan

    fixaa tää rivi logista

    O4 - HKLM\..\Run: [InfoData] rundll32.exe "C:\WINDOWS\system32\vevnwphx.dll",realset

    ****

    2. [*]Käynnistä AVG eAnti-Spyware.
    [*]Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta.
    [*]Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa.
    [*]Paina hetken kuluttua uudestaan "Start Update" , jos päivitykset eivät heti onnistu
    [*]Jos automaattipäivitys ei jostain syystä toimi, niin tunnisteet voi ladata manuaalisesti http://www.ewido.net/en/download/updates/ -linkin takaa.
    [*]Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti.
    [*]Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine".
    [*]Sitten "Reports" valikon alta:
    [*]Laita täppi kohtaan "Automatically generate report after every scan"
    [*]Ota täppi pois kohdasta"Only if threats were found"
    [*]Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa
    [*]"Resident shield is", muuta tila active:sta inactive:ksi
    [*]Sulje ohjelma, ÄLÄ skannaa vielä.

    Käynnistä tietokone vikasietotilaan:
    1. Käynnistä tietokone uudelleen.
    2. Kun tietokone käynnistyy, paina F8-näppäintä.
    3. Näyttöön tulee erilaisia käynnistysvaihtoehtoja.
    4. Valitse näppäimistön nuolinäppäinten avulla Vikasietotila.
    5. Paina ENTER-näppäintä.

    HUOM! Älä käytä muita ohjelmia AVG skannauksen aikana, tämä saattaa häiritä skannausta.
    [*]Kun vikasietotilassa, käynnistä AVG Anti-Spyware.
    [*]Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan".
    [*]AVG aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa.
    Kun skannaus on valmis:
    TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions"
    [*]Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta.
    [*]Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions"
    [​IMG]
    [*]Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta.
    [*]Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle.
    [*]Sulje ohjelma, käynnistä kone normaalisti ja lähetä AVG:n raportti viestiketjuusi.

     
    Auttaja, May 3, 2007
    #10
  11. Keke99

    Keke99 Member

    Joined:
    May 3, 2007
    Messages:
    8
    Likes Received:
    0
    Trophy Points:
    11
    Eikö avg sit riitä??

    Tässä AVG:n logi

    ---------------------------------------------------------
    AVG Anti-Spyware - Scan Report
    ---------------------------------------------------------

    + Created at: 22:49:25 3.5.2007

    + Scan result:



    C:\System Volume Information\_restore{C6B13B5A-3670-44EA-B5DF-6BE8C561AEF6}\RP80\A0005492.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{C6B13B5A-3670-44EA-B5DF-6BE8C561AEF6}\RP80\A0005497.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
    C:\VundoFix Backups\ljjhhhg.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).
    C:\VundoFix Backups\mljkjgh.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined).


    ::Report end
     
    Keke99, May 3, 2007
    #11
  12. Auttaja

    Auttaja Guest

    avg a-s ei oo viruksentorjuntaohjelmisto :)

    C:\VundoFix Backups\ <-poista

    Laita viel uusin hijackthis logi :)
     
    Auttaja, May 3, 2007
    #12
  13. Keke99

    Keke99 Member

    Joined:
    May 3, 2007
    Messages:
    8
    Likes Received:
    0
    Trophy Points:
    11
    Kiitti tiedosta :)

    Logfile of HijackThis v1.99.1
    Scan saved at 23:07:33, on 3.5.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Sygate\smc.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\RunDll32.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\Program Files\Picasa2\PicasaMediaDetector.exe
    C:\WINDOWS\system32\svchost.exe
    C:\windvd 7\Common\Bin\WinCinemaMgr.exe
    C:\Program Files\VIA\RAID\raid_tool.exe
    C:\WinZip\WZQKPICK.EXE
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\Risto\Työpöytä\HijackThis_v1.99.1.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
    O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
    O4 - HKLM\..\Run: [SmcService] C:\Sygate\smc.exe -startgui
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\windvd 7\Common\Bin\WinCinemaMgr.exe
    O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\WinZip\WZQKPICK.EXE
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Sygate\smc.exe

     
    Keke99, May 3, 2007
    #13
  14. Auttaja

    Auttaja Guest

    ok :)

    Pysy puhtaana

    -> Tyhjennä järjestelmänpalautus Ohjeet
    Tyhjennä järjestelmänpalautuskansio ja luo uusi palautuspiste. Tämä puhdistaa palautuskansion mahdollisista haittaohjelmajäännöksistä.

    -> Käytä CCleaneria -> CCleaner
    Lataa ja asenna CCleaner. Puhdista väliaikaistiedostot ja -kansiot ohjelmalla säännöllisesti.

    -> Asenna SpywareBlaster -> SpywareBlaster
    SpywareBlaster estää haittaohjelmia asentumasta koneellesi. Ei kuluta muistia!
    Opas saatavilla suomeksi! Nimimerkki Ad-Awaren opas

    -> Asenna MVPS Hosts tiedosto -> MVPS Hosts
    Estää koneesi yhteyden haitallisiin sivustoihin.
    Opas saatavilla suomeksi! Nimimerkki Axelin opas

    -> Vaihda selaimesi Firefoxiin -> Firefox
    Firefox on nopeampi, turvallisempi ja parempi selain kuin Internet Explorer.

    -> Pidä järjestelmäsi ajantasalla. -> Windows Update
    Vieraile Windows Updatessa säännöllisesti.

    -> Pidä palomuuri ja virustorjunta ajantasalla
    Päivitä ja skannaa koneesi säännöllisesti virustorjuntaohjelmallasi.
    ja hyvä myös escan http://koti.mbnet.fi/pattaya1/escanmwav.htm

    ->Pidä ohjelmistosi ajantasalla. -> Secunia Software Inspector
    Secunia Software Inspector tutkii sinun järjestälmäsi ja ohjelmistosi puuttuvien turvallisuuspäivityksien osalta. Tavallinen tutkinta kestää normaalisti 5-40 sekuntia, kun läpikotainen (thorough system inspection) voi kestää useita minuutteja.

    ->Seuraa säännöllisesti viestintäviraston tietoja uusista haavoittuvuuksista -> CERT-FI
     
    Auttaja, May 3, 2007
    #14
  15. Keke99

    Keke99 Member

    Joined:
    May 3, 2007
    Messages:
    8
    Likes Received:
    0
    Trophy Points:
    11
    Kiitoksia erittäin paljon :)
     
    Keke99, May 3, 2007
    #15

Share This Page