Tässäpä tämä, näkyykö jtkn ihmeellistä? Logfile of HijackThis v1.99.1 Scan saved at 23:28:14, on 30.5.2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\TGVvIFNhbG8\command.exe C:\Program Files\Network Monitor\netmon.exe C:\Norman\Bin\Zanda.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\Norman\bin\ZLH.EXE C:\defender24.exe C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe C:\Program Files\Labtec\Wireless Mouse\MulMouse.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\explorer.exe C:\Program Files\Spyware Doctor\sdhelp.exe C:\Program Files\Spyware Doctor\swdoctor.exe C:\Documents and Settings\Leksa\Työpöytä\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 65.14.123.238:80 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH O4 - HKLM\..\Run: [WinampAgent] C:\Documents and Settings\Leksa\Työpöytä\Omat Jutut\Ohjelmat\Winamp\winampa.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [keyboard] C:\\keyboard24.exe O4 - HKLM\..\Run: [newname] C:\\newname24.exe O4 - HKLM\..\Run: [SysTray] C:\Program Files\puga.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent O4 - HKCU\..\Run: [WhenUSave] "C:\Program Files\Save\Save.exe" O4 - HKCU\..\Run: [shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe" O4 - HKCU\..\Run: [Trust Cleaner] "C:\Program Files\Trust Cleaner\Trust Cleaner.exe" O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q O4 - Global Startup: Labtec Mouse Software 2.0.lnk = C:\Program Files\Labtec\Wireless Mouse\MulMouse.exe O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {D7BF3304-138B-4DD5-86EE-491BB6A2286C} - http://www.azebar.com/1/sux.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - Winlogon Notify: Explorer - C:\WINDOWS\system32\dzprov.dll O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\TGVvIFNhbG8\command.exe O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN\nipsvc.exe O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\Bin\Zanda.exe O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\Norman\Nvc\BIN\NVCSCHED.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
Näkyy. Tulee pitkät ohjeet, joten tulosta nämä tai tallenna tekstitiedostoon. Eikä tässä ole edes kaikki vielä Poista ohjauspaneelista: WhenUSave Trust Cleaner Lataa AlcanShorty_en.exe työpöydälle http://www.geekstogo.com/forum/index.php?act=dscript&CODE=showdetails&f_id=13 Tuplaklikkaa sitä ja seuraa ohjeita. Jos palomuuri kyselee, niin päästä se nettiin. Kun complete script execution-ilmoitus tulee, niin klikkaa ok ja käynnistä kone uudestaan. Lataa http://www.atribune.org/ccount/click.php?id=7 Look2Me-Destroyer.exe työpöydällesi. TÄRKEÄÄ: Ennen fixin jatkamista, sinun täytyy tehdä seuraavat: * Tulosta tämä, tai tallenna tekstitiedostona sopivaan sijaintiin. * Klikkaa käynnistä -> Suorita ja kirjoita: services.msc * Klikkaa OK. * Tarkista että tämä palvelu on käynnissä tai sen käynnistymistapa on automaattinen: * Toissijainen kirjautuminen * Seuraavaksi tietokoneesi on oltava offlinessa, vedä nettipiuha seinästä jos tarpeen. * Virustorjuntasi, ja kaikkien muiden turvaohjelmistojen TÄYTYY olla suljettuja. [*]Sulje kaikki ikkunat ennen jatkamista. [*]Tuplaklikkaa Look2Me-Destroyer.exe ajaaksesi ohjelman. [*]Rastita Run this program as a task. [*]Saat viestin joka sanoo; "Look2Me-Destroyer will close and re-open in approximately 10 seconds". Klikkaa OK [*]Kun Look2Me-Destroyer uudelleen avautuu, klikkaa Scan for L2M-valintaa, työpöytäsi pikakuvakkeet katoavat hetkeksi, tämä on normaalia. [*]Kun skannaus on valmis, klikkaa Remove L2M-valintaa. [*]Saat Done Scanning viestin, klikkaa OK. [*]Kun valmis, saat tämän viestin: Done removing infected files! Look2Me-Destroyer will now shutdown your computer, klikkaa OK. [*]Tietokoneesi sammuttaa itsensä. [*]Käynnistä koneesi uudelleen. [*]Postita C:\Look2Me-Destroyer.txt tiedoston sisältö uuden HijackThis login kera postiisi. Jos palomuurisi varoittaa nettiyhteyksistä tähän ohjelmaan - salli ne. Jos saat runtime error '339', lataa MSWINSCK.OCX seuraavasta linkistä ja sijoita se C:\Windows\System32 kansioosi. http://www.ascentive.com/support/new/images/lib/MSWINSCK.OCX Koeta uudelleen. Lähetä uusi HjT-loki ja C:\Look2Me-Destroyer.txt tiedoston sisältö.
Hijack: Logfile of HijackThis v1.99.1 Scan saved at 14:03:39, on 31.5.2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\svchost.exe C:\Norman\Npf\BIN\NPFSVICE.EXE C:\Norman\Bin\Zanda.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Spyware Doctor\sdhelp.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\system32\wdfmgr.exe C:\Norman\Nvc\BIN\nipsvc.exe C:\Norman\bin\NJEEVES.EXE C:\Norman\Nvc\BIN\NVCSCHED.EXE C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\Norman\bin\ZLH.EXE C:\Documents and Settings\Leksa\Työpöytä\Omat Jutut\Ohjelmat\Winamp\winampa.exe C:\Program Files\Unlocker\UnlockerAssistant.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\Program Files\Spyware Doctor\swdoctor.exe C:\Program Files\Labtec\Wireless Mouse\MulMouse.exe C:\Program Files\RedStrike\UltraWipe\Launcher.exe C:\Norman\Nvc\BIN\NIP.EXE C:\Norman\Npf\BIN\npfmsg2.exe C:\Norman\Nvc\bin\nvcoas.exe C:\Norman\Nvc\bin\cclaw.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\explorer.exe C:\Documents and Settings\Leksa\Työpöytä\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.thepiratebay.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 65.14.123.238:80 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH O4 - HKLM\..\Run: [WinampAgent] C:\Documents and Settings\Leksa\Työpöytä\Omat Jutut\Ohjelmat\Winamp\winampa.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" -H O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q O4 - Global Startup: Labtec Mouse Software 2.0.lnk = C:\Program Files\Labtec\Wireless Mouse\MulMouse.exe O4 - Global Startup: Ultra Wipe Launcher.lnk = C:\Program Files\RedStrike\UltraWipe\Launcher.exe O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN\nipsvc.exe O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE O23 - Service: Norman Type-R - Unknown owner - C:\Norman\Npf\BIN\NPFSVICE.EXE O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\Bin\Zanda.exe O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\Norman\Nvc\BIN\NVCSCHED.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe L2M: Look2Me-Destroyer V1.0.12 Scanning for infected files..... Scan started at 31.5.2006 13:52:13 Infected! C:\WINDOWS\system32\o6660gjse6o60.dll Infected! C:\System Volume Information\_restore{12A9AB26-2A80-4FC0-A331-0EA6668B348C}\RP2\A0000178.dll Infected! C:\System Volume Information\_restore{12A9AB26-2A80-4FC0-A331-0EA6668B348C}\RP3\A0000215.dll Infected! C:\System Volume Information\_restore{12A9AB26-2A80-4FC0-A331-0EA6668B348C}\RP3\A0000219.dll Infected! C:\WINDOWS\system32\g240lchm1f4a.dll Attempting to delete infected files... Attempting to delete: C:\WINDOWS\system32\o6660gjse6o60.dll C:\WINDOWS\system32\o6660gjse6o60.dll could not be deleted! Attempting to delete: C:\System Volume Information\_restore{12A9AB26-2A80-4FC0-A331-0EA6668B348C}\RP2\A0000178.dll C:\System Volume Information\_restore{12A9AB26-2A80-4FC0-A331-0EA6668B348C}\RP2\A0000178.dll could not be deleted! Attempting to delete: C:\System Volume Information\_restore{12A9AB26-2A80-4FC0-A331-0EA6668B348C}\RP3\A0000215.dll C:\System Volume Information\_restore{12A9AB26-2A80-4FC0-A331-0EA6668B348C}\RP3\A0000215.dll could not be deleted! Attempting to delete: C:\System Volume Information\_restore{12A9AB26-2A80-4FC0-A331-0EA6668B348C}\RP3\A0000219.dll C:\System Volume Information\_restore{12A9AB26-2A80-4FC0-A331-0EA6668B348C}\RP3\A0000219.dll could not be deleted! Attempting to delete: C:\WINDOWS\system32\g240lchm1f4a.dll C:\WINDOWS\system32\g240lchm1f4a.dll could not be deleted! Making registry repairs. Removing: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\BITS Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{F0FEE5B1-B61F-4D76-88ED-48D97014680D}" HKCR\Clsid\{F0FEE5B1-B61F-4D76-88ED-48D97014680D} Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{279740B7-1C37-4AD3-A3F5-B0B0BCBF54ED}" HKCR\Clsid\{279740B7-1C37-4AD3-A3F5-B0B0BCBF54ED} Restoring Windows certificates. Replaced hosts file with default windows hosts file Restoring SeDebugPrivilege for Järjestelmänvalvojat - Succeeded
Näyttää jo paremmalta Aja ensin se Look2Me-Destroyer uudestaan Sitten: Fixaa nämä (do a system scan only, merkkaa ja paina fix checked): R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html Myös tämä, jos ei ole itse asettamasi: R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 65.14.123.238:80 Hae,asenna ja päivitä ewido -> http://keskustelu.afterdawn.com/thread_view.cfm/269186 Käynnistä vikasietotilaan (F8 käynnistyksen yhteydessä) Poista, jos löytyy: c:\secure32.html Skannaa ewidolla, anna poistaa mitä löytää ja tallenna raportti. Käynnistä uudelleen ja lähetä ewidon raportti, uusi HjT-loki ja C:\Look2Me-Destroyer.txt-tiedoston sisältö.
HJT: Logfile of HijackThis v1.99.1 Scan saved at 7:19:18, on 3.6.2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\Norman\Npf\BIN\NPFSVICE.EXE C:\Norman\Bin\Zanda.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\system32\wdfmgr.exe C:\Norman\Nvc\bin\nvcoas.exe C:\Norman\Nvc\BIN\nipsvc.exe C:\Norman\bin\NJEEVES.EXE C:\Norman\Nvc\BIN\NVCSCHED.EXE C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\Norman\bin\ZLH.EXE C:\Documents and Settings\Leksa\Työpöytä\Omat Jutut\Ohjelmat\Winamp\winampa.exe C:\Program Files\Unlocker\UnlockerAssistant.exe C:\WINDOWS\system32\ctfmon.exe C:\Norman\Nvc\BIN\NIP.EXE C:\Norman\Nvc\bin\cclaw.exe C:\Norman\Npf\BIN\npfmsg2.exe C:\Program Files\Save\Save.exe C:\Program Files\Labtec\Wireless Mouse\MulMouse.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Documents and Settings\Leksa\Työpöytä\Omat Jutut\Ohjelmat\PeerGuardian2\pg2.exe C:\Program Files\Azureus\Azureus.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Leksa\Työpöytä\Omat Jutut\Ohjelmat\Winamp\winamp.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Documents and Settings\Leksa\Työpöytä\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.thepiratebay.com/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 65.14.123.238:80 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH O4 - HKLM\..\Run: [WinampAgent] C:\Documents and Settings\Leksa\Työpöytä\Omat Jutut\Ohjelmat\Winamp\winampa.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" -H O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent O4 - HKCU\..\Run: [WhenUSave] "C:\Program Files\Save\Save.exe" O4 - Global Startup: Labtec Mouse Software 2.0.lnk = C:\Program Files\Labtec\Wireless Mouse\MulMouse.exe O4 - Global Startup: Ultra Wipe Launcher.lnk = C:\Program Files\RedStrike\UltraWipe\Launcher.exe O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN\nipsvc.exe O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE O23 - Service: Norman Type-R - Unknown owner - C:\Norman\Npf\BIN\NPFSVICE.EXE O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\Bin\Zanda.exe O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\Norman\Nvc\BIN\NVCSCHED.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe L2M: Look2Me-Destroyer V1.0.12 Scanning for infected files..... Scan started at 31.5.2006 21:56:01 Infected! C:\System Volume Information\_restore{12A9AB26-2A80-4FC0-A331-0EA6668B348C}\RP3\A0000230.dll Infected! C:\WINDOWS\system32\k2260cfsef260.dll Infected! C:\WINDOWS\system32\o6660gjse6o60.dll Infected! C:\WINDOWS\system32\ogbctrac.dll Attempting to delete infected files... Attempting to delete: C:\System Volume Information\_restore{12A9AB26-2A80-4FC0-A331-0EA6668B348C}\RP3\A0000230.dll C:\System Volume Information\_restore{12A9AB26-2A80-4FC0-A331-0EA6668B348C}\RP3\A0000230.dll Deleted successfully! Attempting to delete: C:\WINDOWS\system32\k2260cfsef260.dll C:\WINDOWS\system32\k2260cfsef260.dll Deleted successfully! Attempting to delete: C:\WINDOWS\system32\o6660gjse6o60.dll C:\WINDOWS\system32\o6660gjse6o60.dll Deleted successfully! Attempting to delete: C:\WINDOWS\system32\ogbctrac.dll C:\WINDOWS\system32\ogbctrac.dll Deleted successfully! Making registry repairs. Restoring Windows certificates. Replaced hosts file with default windows hosts file Restoring SeDebugPrivilege for Järjestelmänvalvojat - Succeeded Evido: --------------------------------------------------------- ewido anti-malware - Scan report --------------------------------------------------------- + Created on: 22:27:34, 31.5.2006 + Report-Checksum: 2CBD31F2 + Scan result: C:\Program Files\ABC\abc.exe -> Logger.KeyLogger.jm : Ignored HKLM\SOFTWARE\WhenUSave -> Adware.SaveNow : Cleaned with backup HKLM\SOFTWARE\WhenUSave\Partners -> Adware.SaveNow : Cleaned with backup HKLM\SOFTWARE\WhenUSave\Partners\BSPL -> Adware.SaveNow : Cleaned with backup HKU\S-1-5-21-1123561945-343818398-682003330-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A19EF336-01D4-48E6-926A-FE7E1C747AED} -> Adware.MWSearch : Cleaned with backup HKU\S-1-5-21-1123561945-343818398-682003330-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DA7FF3F8-08BE-4CAC-BC00-94D91C6AE7F4} -> Adware.MWSearch : Cleaned with backup HKU\S-1-5-21-1123561945-343818398-682003330-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F65B197F-8260-4D52-909A-F70118E646EB} -> Adware.MWSearch : Cleaned with backup :mozilla.6:C:\Documents and Settings\Leksa\Application Data\Mozilla\Firefox\Profiles\qe9vusnf.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup :mozilla.7:C:\Documents and Settings\Leksa\Application Data\Mozilla\Firefox\Profiles\qe9vusnf.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup :mozilla.10:C:\Documents and Settings\Leksa\Application Data\Mozilla\Firefox\Profiles\qe9vusnf.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup :mozilla.11:C:\Documents and Settings\Leksa\Application Data\Mozilla\Firefox\Profiles\qe9vusnf.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup :mozilla.12:C:\Documents and Settings\Leksa\Application Data\Mozilla\Firefox\Profiles\qe9vusnf.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup :mozilla.13:C:\Documents and Settings\Leksa\Application Data\Mozilla\Firefox\Profiles\qe9vusnf.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup :mozilla.20:C:\Documents and Settings\Leksa\Application Data\Mozilla\Firefox\Profiles\qe9vusnf.default\cookies.txt -> TrackingCookie.Hotlog : Cleaned with backup :mozilla.21:C:\Documents and Settings\Leksa\Application Data\Mozilla\Firefox\Profiles\qe9vusnf.default\cookies.txt -> TrackingCookie.Yadro : Cleaned with backup :mozilla.25:C:\Documents and Settings\Leksa\Application Data\Mozilla\Firefox\Profiles\qe9vusnf.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup :mozilla.26:C:\Documents and Settings\Leksa\Application Data\Mozilla\Firefox\Profiles\qe9vusnf.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup C:\Documents and Settings\Leksa\Käynnistä-valikko\Ohjelmat\WhenU -> Adware.SaveNow : Cleaned with backup C:\Documents and Settings\Leksa\Käynnistä-valikko\Ohjelmat\WhenU\Learn More About WhenU Save.url -> Adware.SaveNow : Cleaned with backup C:\Documents and Settings\Leksa\Käynnistä-valikko\Ohjelmat\WhenU\Learn More About WhenU SaveNow.url -> Adware.SaveNow : Cleaned with backup C:\Documents and Settings\Leksa\Käynnistä-valikko\Ohjelmat\WhenU\Uninstall.lnk -> Adware.SaveNow : Cleaned with backup C:\Documents and Settings\Leksa\Käynnistä-valikko\Ohjelmat\WhenU\WhenU Help Desk.lnk -> Adware.SaveNow : Cleaned with backup C:\Documents and Settings\Leksa\Käynnistä-valikko\Ohjelmat\WhenU\WhenU.com Website.url -> Adware.SaveNow : Cleaned with backup C:\Documents and Settings\Leksa\Työpöytä\BSplayer_WhenUSave_InstallerInstRe.exe -> Adware.SaveNow : Cleaned with backup C:\Documents and Settings\Leksa\Työpöytä\Omat Jutut\Ohjelmat\bs\BSplayer_WhenUSave_InstallerInstRe.exe -> Adware.SaveNow : Cleaned with backup C:\Program Files\Google\GoogleToolbar2.exe -> Adware.Agent : Cleaned with backup C:\Program Files\Save -> Adware.SaveNow : Cleaned with backup C:\Program Files\Save\ACM.dll -> Adware.SaveNow : Cleaned with backup C:\Program Files\Save\ffext.mod -> Adware.SaveNow : Cleaned with backup C:\Program Files\Save\Save.exe -> Adware.SaveNow : Cleaned with backup C:\Program Files\Save\save.htm -> Adware.SaveNow : Cleaned with backup C:\Program Files\Save\SaveUninst.exe -> Adware.SaveNow : Cleaned with backup C:\WINDOWS\icont.exe -> Adware.AdURL : Cleaned with backup C:\WINDOWS\iconu.exe -> Adware.Zestyfind : Cleaned with backup ::Report End
Poista ohjauspaneelista: WhenUSave, Save tai VVSN Tämä fixiin: O4 - HKCU\..\Run: [WhenUSave] "C:\Program Files\Save\Save.exe" Poista: C:\Program Files\Save Käynnistä uudelleen ja lähetä uusi HjT-loki Kun koneella on näköjään BSPlayer, niin kannattaa ottaa tämä versio ja poistaa se vanhempi ensin-> http://www.filehippo.com/download_bsplayer/ Siinä ei ole mukana tuota WhenUSave-p*skaohjelmaa. Tai sitten vlc/media player classic.
