Kone saastunut, hijachthis.log

Discussion in 'Virukset ja haittaohjelmat' started by goljat, Jul 8, 2006.

  1. goljat

    goljat Member

    Joined:
    Feb 2, 2005
    Messages:
    77
    Likes Received:
    0
    Trophy Points:
    16
    En tiedä miten onnistun saastuttamaan aina uudestaan asennetun/kootun koneen alku vaiheilla vaikka kuinka koittas pistää palomuureja enne nettiin päästämistä :/ Jälleen tarvis apuja, kiitos etukäteen

    Logfile of HijackThis v1.99.1
    Scan saved at 15:12:16, on 7.7.2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\dcomcfg.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
    C:\Program Files\Microsoft IntelliPoint\point32.exe
    C:\Ohjelmat\AntiVir PersonalEdition Classic\avgnt.exe
    C:\Ohjelmat\ewido anti-spyware 4.0\ewido.exe
    C:\Program Files\Common Files\{98ABF672-06C1-1033-1003-020705020166}\Update.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Ohjelmat\AntiVir PersonalEdition Classic\sched.exe
    C:\Ohjelmat\AntiVir PersonalEdition Classic\avguard.exe
    C:\Ohjelmat\ewido anti-spyware 4.0\guard.exe
    C:\WINDOWS\system32\inetsrv\inetinfo.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Ohjelmat\Outpost Firewall\outpost.exe
    C:\WINDOWS\System32\snmp.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Ohjelmat\Opera\Opera.exe
    C:\WINDOWS\system32\taskmgr.exe
    C:\hjt\HijackThis.exe

    O2 - BHO: (no name) - {5f4c3d09-b3b9-4f88-aa82-31332fee1c08} - C:\WINDOWS\system32\hp100.tmp
    O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\pmnkige.dll
    O2 - BHO: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Program Files\ToolBar888\MyToolBar.dll (file

    missing)
    O3 - Toolbar: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Program Files\ToolBar888\MyToolBar.dll (file

    missing)
    O4 - HKLM\..\Run: [Outpost Firewall] "C:\Ohjelmat\Outpost Firewall\outpost.exe" /waitservice
    O4 - HKLM\..\Run: [OutpostFeedBack] C:\Ohjelmat\Outpost Firewall\feedback.exe /dump:eek:s_startup
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
    O4 - HKLM\..\Run: [avgnt] "C:\Ohjelmat\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKLM\..\Run: [!ewido] "C:\Ohjelmat\ewido anti-spyware 4.0\ewido.exe" /minimized
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O9 - Extra button: Outpost Firewall Pro Quick Tune - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\Ohjelmat\Outpost

    Firewall\Plugins\BrowserBar\ie_bar.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

    Files\Messenger\msmsgs.exe
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O20 - Winlogon Notify: pmnkige - C:\WINDOWS\SYSTEM32\pmnkige.dll
    O20 - Winlogon Notify: winkcj32 - C:\WINDOWS\SYSTEM32\winkcj32.dll
    O21 - SSODL: furnariidae - {89e4aaba-3b21-49b3-b922-8ca35193c68e} - C:\WINDOWS\system32\zlara.dll (file missing)
    O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Ohjelmat\AntiVir

    PersonalEdition Classic\sched.exe
    O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Ohjelmat\AntiVir

    PersonalEdition Classic\avguard.exe
    O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Ohjelmat\ewido anti-spyware

    4.0\guard.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - C:\Ohjelmat\Outpost Fir
     
    goljat, Jul 8, 2006
    #1
  2. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Lataa http://www.atribune.org/ccount/click.php?id=4
    VundoFix.exe työpöydällesi.
    [*]Tupla-klikkaa VundoFix.exe ajaaksesi työkalun.
    [*]Rastita Run VundoFix as a task valinta.
    [*]Klikkaa Scan for Vundo nappia.
    [*]Kun skannaus on valmis, klikkaa Remove Vundo nappia.
    [*]Saat viestin joka kysyy haluatko poistaa tiedostot, klikkaa YES.
    [*]Kun klikkaat yes, työpöytäsi muuttuu tyhjäksi kun Vundofix alkaa poistamaan tartuntaa.
    [*]Kun valmis, työkalu ilmoittaa sulkevansa koneesi, klikkaa OK.
    [*]Käynnistä koneesi uudelleen.

    Lataa SmitfraudFix (c) S!Ri
    http://siri.urz.free.fr/Fix/SmitfraudFix.zip
    Pura sisältö (kansio nimeltä SmitfraudFix) työpöydällesi:

    Avaa SmitfraudFix-kansio ja tuplaklikkaa smitfraudfix.cmd
    Valitse optio #1 - Search kirjoittamalla 1 ja painamalla "Enter"; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa).
    Postita tämän tekstitiedoston sisältö viestiketjuusi.

    Lähetä myös C:\vundofix.txt lokin sisältö ja tuore HijackThis loki
     
    -kemisti-, Jul 8, 2006
    #2
  3. goljat

    goljat Member

    Joined:
    Feb 2, 2005
    Messages:
    77
    Likes Received:
    0
    Trophy Points:
    16
    SmitfraudFix
    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

    C:\WINDOWS\system32\dcomcfg.exe FOUND !
    C:\WINDOWS\system32\hp???.tmp FOUND !
    C:\WINDOWS\system32\hp????.tmp FOUND !
    C:\WINDOWS\system32\ld???.tmp FOUND !
    C:\WINDOWS\system32\ld????.tmp FOUND !
    C:\WINDOWS\system32\ot.ico FOUND !
    C:\WINDOWS\system32\regperf.exe FOUND !
    C:\WINDOWS\system32\simpole.tlb FOUND !
    C:\WINDOWS\system32\stdole3.tlb FOUND !
    C:\WINDOWS\system32\ts.ico FOUND !
    C:\WINDOWS\system32\1024\ FOUND !

    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\koljat\Application Data


    »»»»»»»»»»»»»»»»»»»»»»»» Start Menu

    C:\DOCUME~1\koljat\STARTM~1\SpyQuake2.com 2.3.lnk FOUND !
    C:\DOCUME~1\koljat\STARTM~1\Programs\SpyQuake2.com FOUND !

    »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\koljat\FAVORI~1

    C:\DOCUME~1\koljat\FAVORI~1\Antivirus Test Online.url FOUND !

    »»»»»»»»»»»»»»»»»»»»»»»» Desktop


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


    »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


    »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
    "Source"="About:Home"
    "SubscribedURL"="About:Home"
    "FriendlyName"="My Current Home Page"


    »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
    "furnariidae"="{89e4aaba-3b21-49b3-b922-8ca35193c68e}"


    »»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection


    »»»»»»»»»»»»»»»»»»»»»»»» End






    VundoFix V5.1.0

    Running as SYSTEM
    from c:\windows\system32\VundoFix.exe

    Checking Java version...

    Sun Java not detected
    Scan started at 3:36:26 PM 7/7/2006

    Listing files found while scanning....

    C:\windows\system32\pmnkige.dll

    Beginning removal...

    The process smss.exe was successfully stopped

    The process winlogon.exe could not be stopped
    Vundofix may not be able to delete some files that were found.

    The process explorer.exe was successfully stopped

    The process iexplore.exe was successfully stopped

    The process rundll32.exe was successfully stopped

    Attempting to delete C:\windows\system32\pmnkige.dll
    C:\windows\system32\pmnkige.dll Could not be deleted.

    Performing Repairs to the registry.
    Done!




    Logfile of HijackThis v1.99.1
    Scan saved at 16:10:50, on 7.7.2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\dcomcfg.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
    C:\Program Files\Microsoft IntelliPoint\point32.exe
    C:\Ohjelmat\AntiVir PersonalEdition Classic\avgnt.exe
    C:\Ohjelmat\ewido anti-spyware 4.0\ewido.exe
    C:\Program Files\Common Files\{98ABF672-06C1-1033-1003-020705020166}\Update.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Ohjelmat\AntiVir PersonalEdition Classic\sched.exe
    C:\Ohjelmat\AntiVir PersonalEdition Classic\avguard.exe
    C:\Ohjelmat\ewido anti-spyware 4.0\guard.exe
    C:\WINDOWS\system32\inetsrv\inetinfo.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Ohjelmat\Outpost Firewall\outpost.exe
    C:\WINDOWS\System32\snmp.exe
    C:\Ohjelmat\Opera\Opera.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\cmd.exe
    C:\WINDOWS\NOTEPAD.EXE
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\hjt\HijackThis.exe

    O2 - BHO: (no name) - {5f4c3d09-b3b9-4f88-aa82-31332fee1c08} - C:\WINDOWS\system32\hp100.tmp
    O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\pmnkige.dll (file missing)
    O2 - BHO: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Program Files\ToolBar888\MyToolBar.dll (file missing)
    O3 - Toolbar: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Program Files\ToolBar888\MyToolBar.dll (file missing)
    O4 - HKLM\..\Run: [Outpost Firewall] "C:\Ohjelmat\Outpost Firewall\outpost.exe" /waitservice
    O4 - HKLM\..\Run: [OutpostFeedBack] C:\Ohjelmat\Outpost Firewall\feedback.exe /dump:eek:s_startup
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
    O4 - HKLM\..\Run: [avgnt] "C:\Ohjelmat\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKLM\..\Run: [!ewido] "C:\Ohjelmat\ewido anti-spyware 4.0\ewido.exe" /minimized
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O9 - Extra button: Outpost Firewall Pro Quick Tune - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\Ohjelmat\Outpost Firewall\Plugins\BrowserBar\ie_bar.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O20 - Winlogon Notify: winkcj32 - C:\WINDOWS\SYSTEM32\winkcj32.dll
    O21 - SSODL: furnariidae - {89e4aaba-3b21-49b3-b922-8ca35193c68e} - C:\WINDOWS\system32\zlara.dll (file missing)
    O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Ohjelmat\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Ohjelmat\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Ohjelmat\ewido anti-spyware 4.0\guard.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - C:\Ohjelmat\Outpost Firewall\outpost.exe

     
    goljat, Jul 8, 2006
    #3
  4. Marku2

    Marku2 Regular member

    Joined:
    Dec 7, 2005
    Messages:
    1,259
    Likes Received:
    0
    Trophy Points:
    46
    Mää voin vastata =)

    Printtaa ohjeet ulos.

    Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi.

    Kun vikasietotilassa, avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
    Valitse optio #2 - Clean kirjoittamalla 2 ja painamalla "Enter" poistaaksesi tarttuneet tiedostot.

    Sinulta kysytään: "Registry cleaning - Do you want to clean the registry ?"; vastaa "Yes" kirjoittamalla Y ja paina "Enter" poistaaksesi työpöydän taustakuvan ja puhdistaaksesi tarttuneet rekisteriavaimet.

    Työkalu tarkistaa jos wininet.dll on tarttunut. Sinua saatetaan pyytää korvaamaan tarttunut .dll (jos löytyy); vastaa "Yes" kirjoittamalla Y ja painamalla "Enter".

    Työkalun saattaa tarvita käynnistää kone uudelleen; jos ei tee niin, käynnistä normaaliin Windowsiin.
    Tekstitiedosto ilmestyy, puhdistusprosessin jäljiltä; kopioi & liitä tämän raportin tulokset vastaukseesi.
    Raportti löytyy paikalliselta levyltäsi, useimmiten C:\rapport.txt.

    Lähetä uusi HijackThis-loki ja C:\rapport.txt.
     
    Marku2, Jul 8, 2006
    #4
  5. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Lisäksi nuo fixiin:

    O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\pmnkige.dll (file missing)
    O2 - BHO: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Program Files\ToolBar888\MyToolBar.dll (file missing)
    O3 - Toolbar: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Program Files\ToolBar888\MyToolBar.dll (file missing)
    O21 - SSODL: furnariidae - {89e4aaba-3b21-49b3-b922-8ca35193c68e} - C:\WINDOWS\system32\zlara.dll (file missing)

    Ja katso löytyykö -> C:\WINDOWS\system32\pmnkige.dll Sen poisto tuskin onnistuu, vaikka löytyisikin.
     
    -kemisti-, Jul 8, 2006
    #5
  6. goljat

    goljat Member

    Joined:
    Feb 2, 2005
    Messages:
    77
    Likes Received:
    0
    Trophy Points:
    16
    SmitFraudFix v2.68b

    Scan done at 17:18:18,88, pe 07.07.2006
    Run from C:\Documents and Settings\koljat\Desktop\SmitfraudFix
    OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
    Fix ran in safe mode

    »»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
    "furnariidae"="{89e4aaba-3b21-49b3-b922-8ca35193c68e}"


    »»»»»»»»»»»»»»»»»»»»»»»» Killing process


    »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

    GenericRenosFix by S!Ri

    C:\WINDOWS\system32\zlara.dll -> Missing File


    »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

    C:\WINDOWS\system32\dcomcfg.exe Deleted
    C:\WINDOWS\system32\hp???.tmp Deleted
    C:\WINDOWS\system32\ld???.tmp Deleted
    C:\WINDOWS\system32\ot.ico Deleted
    C:\WINDOWS\system32\regperf.exe Deleted
    C:\WINDOWS\system32\simpole.tlb Deleted
    C:\WINDOWS\system32\stdole3.tlb Deleted
    C:\WINDOWS\system32\ts.ico Deleted
    C:\WINDOWS\system32\1024\ Deleted
    C:\DOCUME~1\koljat\FAVORI~1\Antivirus Test Online.url Deleted
    C:\DOCUME~1\koljat\STARTM~1\SpyQuake2.com 2.3.lnk Deleted
    C:\DOCUME~1\koljat\STARTM~1\Programs\SpyQuake2.com Deleted

    »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


    »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

    Registry Cleaning done.

    »»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll


    »»»»»»»»»»»»»»»»»»»»»»»» End



    Logfile of HijackThis v1.99.1
    Scan saved at 17:22:48, on 7.7.2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Ohjelmat\Outpost Firewall\outpost.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
    C:\Program Files\Microsoft IntelliPoint\point32.exe
    C:\Ohjelmat\AntiVir PersonalEdition Classic\avgnt.exe
    C:\Ohjelmat\ewido anti-spyware 4.0\ewido.exe
    C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
    C:\Ohjelmat\DAEMON Tools\daemon.exe
    C:\Program Files\Common Files\{98ABF672-06C1-1033-1003-020705020166}\Update.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Ohjelmat\AntiVir PersonalEdition Classic\sched.exe
    C:\Ohjelmat\AntiVir PersonalEdition Classic\avguard.exe
    C:\Ohjelmat\ewido anti-spyware 4.0\guard.exe
    C:\WINDOWS\system32\inetsrv\inetinfo.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Ohjelmat\Outpost Firewall\outpost.exe
    C:\WINDOWS\System32\snmp.exe
    C:\Ohjelmat\Opera\Opera.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\WINDOWS\system32\wuauclt.exe
    C:\hjt\HijackThis.exe
    C:\WINDOWS\system32\wuauclt.exe

    O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\pmnkige.dll (file missing)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
    O2 - BHO: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Program Files\ToolBar888\MyToolBar.dll (file missing)
    O3 - Toolbar: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Program Files\ToolBar888\MyToolBar.dll (file missing)
    O4 - HKLM\..\Run: [Outpost Firewall] "C:\Ohjelmat\Outpost Firewall\outpost.exe" /waitservice
    O4 - HKLM\..\Run: [OutpostFeedBack] C:\Ohjelmat\Outpost Firewall\feedback.exe /dump:eek:s_startup
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
    O4 - HKLM\..\Run: [avgnt] "C:\Ohjelmat\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKLM\..\Run: [!ewido] "C:\Ohjelmat\ewido anti-spyware 4.0\ewido.exe" /minimized
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
    O4 - HKLM\..\Run: [DAEMON Tools] "C:\Ohjelmat\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\npjpi150_07.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\npjpi150_07.dll
    O9 - Extra button: Outpost Firewall Pro Quick Tune - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\Ohjelmat\Outpost Firewall\Plugins\BrowserBar\ie_bar.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O20 - Winlogon Notify: winkcj32 - C:\WINDOWS\SYSTEM32\winkcj32.dll
    O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Ohjelmat\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Ohjelmat\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Ohjelmat\ewido anti-spyware 4.0\guard.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - C:\Ohjelmat\Outpost Firewall\outpost.exe


    O21 - SSODL: furnariidae - {89e4aaba-3b21-49b3-b922-8ca35193c68e} - C:\WINDOWS\system32\zlara.dll (file missing) tätä ei löydynyt enää Marku2 ohjeitten jälkeen. Tätäkään ei löytynyt C:\WINDOWS\system32\pmnkige.dll mikä taitaa olla vain hyvä asia :)


     
    goljat, Jul 8, 2006
    #6
  7. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Avaa HijackThis, klikkaa do a system scan only, laita rasti näiden rivien eteen ja paina fix checked:

    O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\pmnkige.dll (file missing)
    O2 - BHO: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Program Files\ToolBar888\MyToolBar.dll (file missing)
    O3 - Toolbar: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Program Files\ToolBar888\MyToolBar.dll (file missing)

    Hae KillBox

    http://www.bleepingcomputer.com/files/spyware/KillBox.zip

    Pura,avaa ja täppi kohtaan Delete on Reboot
    Sitte kopioi rivi tosta alapuolelta

    C:\WINDOWS\SYSTEM32\winkcj32.dll

    Sitten KillBoxissa ylhäältä File > Paste from Clipboard
    Valitse "All Files".Sen jälkeen paina Delete (punainen, jossa on valkonen X)
    Vastaa myöntävästi kysymyksiin ja jos kone ei itestään käynnisty uudestaan,niin käynnistä se.

    Lähetä sen jälkeen uus Hijack-logi.
     
    -kemisti-, Jul 8, 2006
    #7
  8. goljat

    goljat Member

    Joined:
    Feb 2, 2005
    Messages:
    77
    Likes Received:
    0
    Trophy Points:
    16
    No huhhuh ku oon saanu paskaseks.. Oiskohan nyt puhdas..

    Logfile of HijackThis v1.99.1
    Scan saved at 17:42:11, on 7.7.2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Ohjelmat\Outpost Firewall\outpost.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
    C:\Program Files\Microsoft IntelliPoint\point32.exe
    C:\Ohjelmat\AntiVir PersonalEdition Classic\avgnt.exe
    C:\Ohjelmat\ewido anti-spyware 4.0\ewido.exe
    C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
    C:\Ohjelmat\DAEMON Tools\daemon.exe
    C:\Program Files\Common

    Files\{98ABF672-06C1-1033-1003-020705020166}\Update.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Ohjelmat\AntiVir PersonalEdition Classic\sched.exe
    C:\Ohjelmat\AntiVir PersonalEdition Classic\avguard.exe
    C:\Ohjelmat\ewido anti-spyware 4.0\guard.exe
    C:\WINDOWS\system32\inetsrv\inetinfo.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Ohjelmat\Outpost Firewall\outpost.exe
    C:\WINDOWS\System32\snmp.exe
    C:\Ohjelmat\Opera\Opera.exe
    C:\hjt\HijackThis.exe
    C:\WINDOWS\system32\wuauclt.exe

    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -

    C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
    O4 - HKLM\..\Run: [Outpost Firewall] "C:\Ohjelmat\Outpost

    Firewall\outpost.exe" /waitservice
    O4 - HKLM\..\Run: [OutpostFeedBack] C:\Ohjelmat\Outpost Firewall\feedback.exe

    /dump:eek:s_startup
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE

    C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE

    C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA

    Corporation\NvMixer\NVMixerTray.exe"
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft

    IntelliPoint\point32.exe"
    O4 - HKLM\..\Run: [avgnt] "C:\Ohjelmat\AntiVir PersonalEdition

    Classic\avgnt.exe" /min
    O4 - HKLM\..\Run: [!ewido] "C:\Ohjelmat\ewido anti-spyware 4.0\ewido.exe"

    /minimized
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program

    Files\Java\jre1.5.0_07\bin\jusched.exe
    O4 - HKLM\..\Run: [DAEMON Tools] "C:\Ohjelmat\DAEMON Tools\daemon.exe" -lang

    1033
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe"

    /background
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

    C:\Program Files\Java\jre1.5.0_07\bin\npjpi150_07.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console -

    {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

    Files\Java\jre1.5.0_07\bin\npjpi150_07.dll
    O9 - Extra button: Outpost Firewall Pro Quick Tune -

    {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\Ohjelmat\Outpost

    Firewall\Plugins\BrowserBar\ie_bar.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -

    C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger -

    {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

    Files\Messenger\msmsgs.exe
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} -

    "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O20 - Winlogon Notify: winkcj32 - winkcj32.dll (file missing)
    O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) -

    Avira GmbH - C:\Ohjelmat\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA

    GmbH - C:\Ohjelmat\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. -

    C:\Ohjelmat\ewido anti-spyware 4.0\guard.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation -

    C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. -

    C:\Ohjelmat\Outpost Firewall\outpost.exe

     
    goljat, Jul 8, 2006
    #8
  9. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Tuo fixiin:

    O20 - Winlogon Notify: winkcj32 - winkcj32.dll (file missing)

    Käynnistä uudelleen.

    Skannaa koneesi http://www.kaspersky.com/downloads/kws/kavwebscan.html[b]Kaspersky Online Skannerilla[/b]

    Sinulta kysytään sallitko ActiveX -komponentin asentamisen Kasperskyltä, klikkaa Kyllä.
    • Ohjelma käynnistyy ja aloittaa viimeisimpien tunnistetiedostojen lataamisen.
    • Kun skanneri on asennettu ja tunnistetiedot ladattu, klikkaa Next.
    • Klikkaa nyt asetuksia, Scan Settings
    • Tarkista asetuksista, että seuraavat ovat valittuina:

      o Scan using the following Anti-Virus database:

      + Extended (Jos valittavissa, muuten valitse Standard)

      o Scan Options:

      + Scan Archives
      + Scan Mail Bases
    • Klikkaa OK
    • Nyt valitse "select a target to scan" otsikon alta Oma Tietokone, My Computer
    • Skannaus vie aikaa, joten ole kärsivällinen. Kun skannaus on valmis saat ilmoituksen, jos koneesi on saastunut.
    • Klikkaa nyt Save as Text-painiketta.
    • Tallenna tiedosto työpöydällesi.
    • Kopioi ja Liitä tiedoston sisältö seuraavaan vastaukseesi uuden HjT-lokin kanssa.
     
    -kemisti-, Jul 8, 2006
    #9
  10. goljat

    goljat Member

    Joined:
    Feb 2, 2005
    Messages:
    77
    Likes Received:
    0
    Trophy Points:
    16
    KASPERSKY ON-LINE SCANNER REPORT
    Friday, July 07, 2006 6:51:37 PM
    Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
    Kaspersky On-line Scanner version: 5.0.78.0
    Kaspersky Anti-Virus database last update: 8/07/2006
    Kaspersky Anti-Virus database records: 205828

    Scan Settings
    Scan using the following antivirus database extended
    Scan Archives true
    Scan Mail Bases true

    Scan Target My Computer
    A:\
    C:\
    D:\
    E:\
    F:\

    Scan Statistics
    Total number of scanned objects 41431
    Number of viruses found 7
    Number of infected objects 16
    Number of suspicious objects 0
    Duration of the scan process 00:33:08

    Infected Object Name Virus Name Last Action
    C:\!KillBox\winkcj32.dll Infected: Packed.Win32.Klone.g skipped

    C:\Documents and Settings\koljat\Local Settings\Temporary Internet Files\Content.IE5\SLY3O9M3\wlzip32[1].exe/stream/data0005 Infected: not-a-virus:AdWare.Win32.Softomate.q skipped

    C:\Documents and Settings\koljat\Local Settings\Temporary Internet Files\Content.IE5\SLY3O9M3\wlzip32[1].exe/stream Infected: not-a-virus:AdWare.Win32.Softomate.q skipped

    C:\Documents and Settings\koljat\Local Settings\Temporary Internet Files\Content.IE5\SLY3O9M3\wlzip32[1].exe NSIS: infected - 2 skipped

    C:\Documents and Settings\koljat\Local Settings\Temporary Internet Files\Content.IE5\WDAZOH6J\l11[1].exe Infected: Trojan-Downloader.Win32.Zlob.xr skipped

    C:\System Volume Information\_restore{6D22EA03-87FE-434B-BCF2-C7A03B94365D}\RP17\A0004593.exe Infected: Trojan-Dropper.Win32.Microjoin.bx skipped

    C:\System Volume Information\_restore{6D22EA03-87FE-434B-BCF2-C7A03B94365D}\RP18\A0004729.exe Infected: Trojan-Downloader.Win32.Zlob.xn skipped

    C:\System Volume Information\_restore{6D22EA03-87FE-434B-BCF2-C7A03B94365D}\RP18\A0004743.dll Infected: not-virus:Hoax.Win32.Renos.dw skipped

    C:\System Volume Information\_restore{6D22EA03-87FE-434B-BCF2-C7A03B94365D}\RP18\A0004773.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.cd skipped

    C:\System Volume Information\_restore{6D22EA03-87FE-434B-BCF2-C7A03B94365D}\RP19\A0004800.exe Infected: Trojan-Downloader.Win32.Zlob.xr skipped

    C:\System Volume Information\_restore{6D22EA03-87FE-434B-BCF2-C7A03B94365D}\RP19\A0004834.dll Infected: Packed.Win32.Klone.g skipped

    C:\VundoFix Backups\pmnkige.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.cd skipped

    C:\WINDOWS\system32\__delete_on_reboot__z_l_a_r_a_._d_l_l_ Infected: not-virus:Hoax.Win32.Renos.dw skipped

    C:\WINDOWS\Temp\win81.tmp.exe/stream/data0005 Infected: not-a-virus:AdWare.Win32.Softomate.q skipped

    C:\WINDOWS\Temp\win81.tmp.exe/stream Infected: not-a-virus:AdWare.Win32.Softomate.q skipped

    C:\WINDOWS\Temp\win81.tmp.exe NSIS: infected - 2 skipped

    Scan process completed.





    Logfile of HijackThis v1.99.1
    Scan saved at 18:53:01, on 7.7.2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
    C:\Program Files\Microsoft IntelliPoint\point32.exe
    C:\Ohjelmat\AntiVir PersonalEdition Classic\avgnt.exe
    C:\Ohjelmat\ewido anti-spyware 4.0\ewido.exe
    C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
    C:\Ohjelmat\DAEMON Tools\daemon.exe
    C:\Program Files\Common Files\{98ABF672-06C1-1033-1003-020705020166}\Update.exe
    C:\Ohjelmat\Opera\Opera.exe
    C:\Ohjelmat\AntiVir PersonalEdition Classic\sched.exe
    C:\Ohjelmat\AntiVir PersonalEdition Classic\avguard.exe
    C:\Ohjelmat\ewido anti-spyware 4.0\guard.exe
    C:\WINDOWS\system32\inetsrv\inetinfo.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Ohjelmat\Outpost Firewall\outpost.exe
    C:\WINDOWS\System32\snmp.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\hjt\HijackThis.exe

    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
    O4 - HKLM\..\Run: [Outpost Firewall] "C:\Ohjelmat\Outpost Firewall\outpost.exe" /waitservice
    O4 - HKLM\..\Run: [OutpostFeedBack] C:\Ohjelmat\Outpost Firewall\feedback.exe /dump:eek:s_startup
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
    O4 - HKLM\..\Run: [avgnt] "C:\Ohjelmat\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKLM\..\Run: [!ewido] "C:\Ohjelmat\ewido anti-spyware 4.0\ewido.exe" /minimized
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
    O4 - HKLM\..\Run: [DAEMON Tools] "C:\Ohjelmat\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
    O9 - Extra button: Outpost Firewall Pro Quick Tune - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\Ohjelmat\Outpost Firewall\Plugins\BrowserBar\ie_bar.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Ohjelmat\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Ohjelmat\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Ohjelmat\ewido anti-spyware 4.0\guard.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - C:\Ohjelmat\Outpost Firewall\outpost.exe


     
    goljat, Jul 8, 2006
    #10
  11. pkaksp

    pkaksp Moderator Staff Member

    Joined:
    Jan 10, 2005
    Messages:
    12,231
    Likes Received:
    53
    Trophy Points:
    128
    pkaksp, Jul 8, 2006
    #11
  12. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Tyhjennä nämä hakemistot:

    C:\!KillBox
    C:\VundoFix Backups\

    Lataa Atribunen http://www.atribune.org/ccount/click.php?id=1ATF Cleaner

    Ohjeet;

    Tupla-klikkaa ATF-Cleaner.exe käynnistääksesi ohjelman.
    Main-kohdassamerkkaa seuraava ruutu: Select All
    Klikkaa Empty Selected-valintaa.
    Jos käytät FireFoxia selaimenasi
    Klikkaa Firefox yläpuolelta ja valitse: Select All
    Klikkaa Empty Selected valintaa.
    HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy.
    Jos käytät Operaa selaimenasi
    Klikkaa Opera yläpuolelta ja valitse: Select All
    Klikkaa Empty Selected valintaa taas.
    HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy.
    Klikkaa Exit päävalikosta sulkeaksesi ohjelman.

    Putsaa järjestelmänpalautus:

    1. Valitse Oma tietokone (klikkaa oikealla).
    2. Valitse Ominaisuudet.
    3. Valitse Järjestelmän palauttaminen- välilehti.
    4. Valitse "Poista järjestelmän palauttaminen käytöstä".
    5. Paina Käytä.
    6. Paina OK.
    7. Käynnistä kone uudelleen
    8. Tee kohdat 1.-3.
    9. Ota rasti pois kohdasta "Poista järjestelmän palauttaminen käytöstä"
    10. Tee kohdat 5. ja 6.

    Skannaa uudestaan kasperskyllä.

    Lähetä uusi kasperskyn raportti.
     
    -kemisti-, Jul 8, 2006
    #12
  13. goljat

    goljat Member

    Joined:
    Feb 2, 2005
    Messages:
    77
    Likes Received:
    0
    Trophy Points:
    16
    Juu parempi otsikko ens kerralla..


    KASPERSKY ON-LINE SCANNER REPORT
    Friday, July 07, 2006 8:44:46 PM
    Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
    Kaspersky On-line Scanner version: 5.0.78.0
    Kaspersky Anti-Virus database last update: 8/07/2006
    Kaspersky Anti-Virus database records: 205860

    Scan Settings
    Scan using the following antivirus database extended
    Scan Archives true
    Scan Mail Bases true

    Scan Target My Computer
    A:\
    C:\
    D:\
    E:\
    F:\

    Scan Statistics
    Total number of scanned objects 35617
    Number of viruses found 1
    Number of infected objects 1
    Number of suspicious objects 0
    Duration of the scan process 00:23:49

    Infected Object Name Virus Name Last Action
    C:\WINDOWS\system32\__delete_on_reboot__z_l_a_r_a_._d_l_l_ Infected: not-virus:Hoax.Win32.Renos.dw skipped

    Scan process completed.
     
    Last edited: Jul 8, 2006
    goljat, Jul 8, 2006
    #13
  14. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Poista vielä tuo:

    C:\WINDOWS\system32\__delete_on_reboot__z_l_a_r_a_._d_l_l_

    Muuten olis ok. Vielä ongelmia?
     
    -kemisti-, Jul 8, 2006
    #14
  15. goljat

    goljat Member

    Joined:
    Feb 2, 2005
    Messages:
    77
    Likes Received:
    0
    Trophy Points:
    16
    Jei, kiitos avusta.. Nyt näyttää toimivan ihan hyvin.

    -kemisti- roks ;)
     
    goljat, Jul 8, 2006
    #15
  16. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Mukavaa, että tuli kuntoon :)
     
    -kemisti-, Jul 8, 2006
    #16

Share This Page