Loistava SuperAntiSpyware, vielä HJT-tarkistus

Ei auttanut Avast, AVG AntiSpy eikä F-Securen live-skanneri poistamaan koneelta kakkaa pysyvästi (aina buutin aikana ilmaantui takaisin).
SuperAntiSpyware sen sijaan poisti mainiosti kaiken, vai poistiko ?

HJT-logi:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:35:15, on 22.9.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [Application Layer Gateway Service] C:\WINDOWS\system32\algs.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SearchIndexer] rundll32.exe "C:\WINDOWS\system32\vxiohbpn.dll",sitypnow
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1189856969406
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u2-windows-i586-jc.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: lxce_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxcecoms.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 6437 bytes

 

Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi:
" Käynnistä tietokone
" Kun kuulet koneen piippaavan, paina F8, kuitenkin ennen Windowsin logon esiintuloa
" Seuraavaksi pitäisi ilmestyä valikko
" Valitse valikosta vikasietotila.

" Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
" Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
" Paina Y käynnistääksesi skriptin.
" Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
" Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
" Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
" Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
" Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
" Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.

 

SDFix: Version 1.107

Run by Omistaja on su 23.09.2007 at 13:23

Microsoft Windows XP [versio 5.1.2600]

Running From: C:\DOCUME~1\Omistaja\TYPYT~1\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files:

No Trojan Files Found




Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

Remaining Services:
------------------




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019"
"C:\\WINDOWS\\system32\\bumsdt.exe"="C:\\WINDOWS\\system32\\bumsdt.exe:*:Enabled:bumsdt"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\WINDOWS\\system32\\ZoneLabs\\avsys\\ScanningProcess.exe"="C:\\WINDOWS\\system32\\ZoneLabs\\avsys\\ScanningProcess.exe:*:Enabled:Kaspersky AV Scanner"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000"

Remaining Files:
---------------


Files with Hidden Attributes:

Sat 15 Sep 2007 6,488 ..SH. --- "C:\WINDOWS\system32\knnmp.bak1"
Sat 22 Sep 2007 654,092 ..SH. --- "C:\WINDOWS\system32\knnmp.bak2"

Finished!

 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:29:47, on 23.9.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SearchIndexer] rundll32.exe "C:\WINDOWS\system32\vxiohbpn.dll",sitypnow
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1189856969406
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u2-windows-i586-jc.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: lxce_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxcecoms.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 6176 bytes


--------------------------------------------
Tässä varmuuden vuoksi logi siitä, mitä SAS alun perin poisti:

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 09/22/2007 at 01:23 PM

Application Version : 3.9.1008

Core Rules Database Version : 3311
Trace Rules Database Version: 1315

Scan type : Complete Scan
Total Scan Time : 00:34:36

Memory items scanned : 396
Memory threats detected : 2
Registry items scanned : 3561
Registry threats detected : 13
File items scanned : 24072
File threats detected : 51

Adware.Vundo Variant/Resident
C:\WINDOWS\SYSTEM32\MLJIGED.DLL
C:\WINDOWS\SYSTEM32\MLJIGED.DLL

Trojan.WinFixer
C:\WINDOWS\SYSTEM32\PMNNK.DLL
C:\WINDOWS\SYSTEM32\PMNNK.DLL
HKLM\Software\Classes\CLSID\{BA160440-1EC2-4377-9125-F09AEBC04C98}
HKCR\CLSID\{BA160440-1EC2-4377-9125-F09AEBC04C98}
HKCR\CLSID\{BA160440-1EC2-4377-9125-F09AEBC04C98}\InprocServer32
HKCR\CLSID\{BA160440-1EC2-4377-9125-F09AEBC04C98}\InprocServer32#ThreadingModel
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BA160440-1EC2-4377-9125-F09AEBC04C98}

Adware.Vundo Variant
HKLM\Software\Classes\CLSID\{733E9132-53CA-4C97-9AC9-145C4502FA20}
HKCR\CLSID\{733E9132-53CA-4C97-9AC9-145C4502FA20}
HKCR\CLSID\{733E9132-53CA-4C97-9AC9-145C4502FA20}\InprocServer32
HKCR\CLSID\{733E9132-53CA-4C97-9AC9-145C4502FA20}\InprocServer32#ThreadingModel
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{733E9132-53CA-4C97-9AC9-145C4502FA20}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks#{733E9132-53CA-4C97-9AC9-145C4502FA20}
HKCR\CLSID\{733E9132-53CA-4C97-9AC9-145C4502FA20}

Trojan.Downloader-Gen/HitItQuitIt
Software\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\mljiged
C:\WINDOWS\SYSTEM32\URQNLLJ.DLL

Adware.Tracking Cookie
C:\Documents and Settings\Omistaja\Cookies\omistaja@2o7[1].txt
C:\Documents and Settings\Omistaja\Cookies\omistaja@stats1.reliablestats[2].txt
C:\Documents and Settings\Omistaja\Cookies\omistaja@msnportal.112.2o7[1].txt
C:\Documents and Settings\Omistaja\Cookies\omistaja@cpvfeed[2].txt
C:\Documents and Settings\Omistaja\Cookies\omistaja@tacoda[2].txt
C:\Documents and Settings\Omistaja\Cookies\omistaja@drivecleaner[1].txt

Trojan.Downloader-Gen/TStamp
C:\DOCUMENTS AND SETTINGS\OMISTAJA\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\8TE7KH6B\LKJH[1].0
C:\DOCUMENTS AND SETTINGS\OMISTAJA\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\W92NGX2F\LKJH[1]

Adware.eZula
C:\DOCUMENTS AND SETTINGS\OMISTAJA\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\GTAN0DQV\VALERA[1]

Trace.Known Threat Sources
C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\8TE7KH6B\index[2].htm
C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\8TE7KH6B\ico2[1].gif
C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\WPMBWLEV\checksoft[2].js
C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\WPMBWLEV\index[2].htm
C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\WPMBWLEV\bar[1].gif
C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\8TE7KH6B\index[3].htm
C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\GTAN0DQV\test[1].gif
C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\W92NGX2F\top1_menu[1].gif
C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\W92NGX2F\styles[1].css
C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\WPMBWLEV\checksoft[1].js
C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\GTAN0DQV\button2[1].gif
C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\GTAN0DQV\wav_banner[1].swf
C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\GTAN0DQV\top1[1].gif
C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\GTAN0DQV\index[3].htm
C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\WPMBWLEV\ico3[2].gif
C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\W92NGX2F\top1[1].gif
C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\W92NGX2F\functions.js[1].htm
C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\WPMBWLEV\index[1].htm
C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\8TE7KH6B\logo[2].gif
C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\GTAN0DQV\index[1].htm
C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\8TE7KH6B\top1_menu[2].gif
C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\W92NGX2F\ico2[1].gif
C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\WPMBWLEV\ico1[1].gif
C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\W92NGX2F\top_pic2[1].gif
C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\WPMBWLEV\default[1].js
C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\GTAN0DQV\default[1].gif
C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\8TE7KH6B\ico5[1].gif
C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\W92NGX2F\wav_banner[1].swf
C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\GTAN0DQV\checksoft[1].js
C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\W92NGX2F\spacer[2].gif
C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\W92NGX2F\favicon[1].ico
C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\GTAN0DQV\button2[2].gif
C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\GTAN0DQV\top1[2].gif
C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\WPMBWLEV\logo[1].gif
C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\W92NGX2F\index[2].htm
C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\GTAN0DQV\logo[1].gif
C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\W92NGX2F\spacer[1].gif
C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\W92NGX2F\ico4[1].gif
C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\WPMBWLEV\index[3].htm

 

Lataa VundoFix.exe työpöydällesi.

Tupla-klikkaa VundoFix.exe ajaaksesi sen.
Klikkaa Scan for Vundo valintaa.
Kun skannaus on valmis, klikkaa Remove Vundo valintaa.
Sinulta kysytään haluatko poistaa filut - klikkaa YES.
Kun olet klikannut yes, työpöytäsi tyhjenee kun se alkaa poistamaan Vundoa.
Kun se on valmis, fiksi ilmoittaa käynnistäväsi koneesi uudelleen, klikkaa OK.
Postita C:\vundofix.txt lokin sekä tuoreen HijackThis lokin sisältö.

Huomaa: Se on mahdollista että VundoFix löysi tiedoston jota se ei pystynyt poistamaan.
Tässä tilanteessa, VundoFix ajaa itsensä rebootissa, seuraa vain yläpuolelle olevia ohjeita alkaen kohdasta "Klikkaa Scan for Vundo valintaa." kun VundoFix ilmaantuu uudelleenkäynnistyksen yhteydessä.

 

Tuota VundoFixiä kokeilin ihan ensimmäisenä ennen SAS:siakaan.
Ei löytänyt silloin, eikä löytänyt nytkään mitään.

 

no sitten tuo

1) Lataa VirtumundoBegone
2) Tallenna VirtumundoBeGone.exe työpöydällesi.
3) Aja VirtumundoBeGone.exe ja seuraa ohjeita. Älä huoli jos näet sinisen ruudun "Fatal Error" viestin, tämä on normaalia.
4) Kun työkalu on valmis, käynnistä kone uudelleen

 

[09/23/2007, 14:51:07] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Omistaja\Työpöytä\VirtumundoBeGone.exe" )
[09/23/2007, 14:51:14] - Detected System Information:
[09/23/2007, 14:51:14] - Windows Version: 5.1.2600, Service Pack 2
[09/23/2007, 14:51:14] - Current Username: Omistaja (Admin)
[09/23/2007, 14:51:14] - Windows is in NORMAL mode.
[09/23/2007, 14:51:15] - Searching for Browser Helper Objects:
[09/23/2007, 14:51:15] - BHO 1: {22BF413B-C6D2-4d91-82A9-A0F997BA588C} (Skype add-on (mastermind))
[09/23/2007, 14:51:15] - BHO 2: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[09/23/2007, 14:51:15] - BHO 3: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[09/23/2007, 14:51:15] - WARNING: BHO has no default name. Checking for Winlogon reference.
[09/23/2007, 14:51:15] - No filename found. Continuing.
[09/23/2007, 14:51:15] - Finished Searching Browser Helper Objects
[09/23/2007, 14:51:15] - Finishing up...
[09/23/2007, 14:51:15] - Nothing found! Exiting...

 

Kone taitaa siis olla puhdas ? <3

 

juu ainakin näitten mukaan.
ja koneen toiminnasta sen näät toimiiko kone hyvin