Kone huutaa aina välillä et critical error: Malware ohjelmia koneella, kuitenkaan spyware fighter ja symantec anti-virus ei löydä mitään. sit joskus tulee et koneen toiminta hidastunut 47% ja toi netti on hidastunut olikse ny 38%, ja muutenkin kone lagailee koko ajan jostain tommosesta malware hommelista, aina välillä tulee kans ilmotus et backdoor trojan: ja jotain muuta tekstiä has infected your computer and your system is at high risk level. jelppiä kiitoksia. apua otetaan vastaan.
-> Lataa Hijackthis: http://koti.mbnet.fi/pattaya1/HijackThis.exe -> Tallenna hakemistoon C:\hjt ->Uudelleennimeä HijackThis.exe -> scanner.exe:ksi näin: 1. Klikkaa hiiren oikealla painikkeella HijackThis ikonia. 2. Valitse Uudelleennineä/ Rename. 3. Kirjoita scanner.exe -> Käynnistä HijackThis ja klikkaa: do a system scan and save a logfile. -> Lähetä ilmestynyt logisi tähän ketjuun
Täs on logi: Logfile of HijackThis v1.99.1 Scan saved at 19:27:14, on 4.5.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Video AX Object\bpmon.exe C:\Program Files\Video AX Object\smmain.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\PROGRA~1\SYMANT~1\VPTray.exe C:\Program Files\Video AX Object\smmon.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\WINDOWS\System32\PAStiSvc.exe C:\Program Files\Video AX Object\bpmini.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\Macrogaming\SweetIM\SweetIM.exe C:\Program Files\Seagate\DiscWizard\DiscWizardMonitor.exe C:\Program Files\Seagate\DiscWizard\TimounterMonitor.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe E:\Program Files\Winamp\winampa.exe E:\Programs\Daemon\DAEMON Tools\daemon.exe E:\Program Files\SPYWAREfighter\spftray.exe E:\Programs\PowerDVD\PDVDServ.exe C:\Program Files\Ahead\InCD\InCD.exe C:\WINDOWS\system32\ctfmon.exe E:\Programs\Multimedia Launcher\PowerBar.exe c:\progra~1\intern~1\iexplore.exe C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe E:\Program Files\SPYWAREfighter\spfprc.exe C:\Program Files\Symantec AntiVirus\vpc32.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Hjt\Scanner.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/ R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O2 - BHO: (no name) - {D34F5D71-99E4-4D96-91CA-F4104F69B8AE} - C:\Program Files\Video AX Object\bpvol.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: Protection Bar - {F0993251-2512-4710-AF6E-0A13EA199D02} - C:\Program Files\Video AX Object\splug.dll O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe O4 - HKLM\..\Run: [DiscWizardMonitor.exe] C:\Program Files\Seagate\DiscWizard\DiscWizardMonitor.exe O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files\Seagate\DiscWizard\TimounterMonitor.exe O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe" O4 - HKLM\..\Run: [WinampAgent] E:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [DAEMON Tools] "E:\Programs\Daemon\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [spywarefighterguard] E:\Program Files\SPYWAREfighter\spftray.exe O4 - HKLM\..\Run: [rtasks] C:\Program Files\AntivirusPCSuite\rtasks.exe O4 - HKLM\..\Run: [RemoteControl] E:\Programs\PowerDVD\PDVDServ.exe O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] ~"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe O4 - HKCU\..\Run: [32 Eq] C:\DOCUME~1\PERHEK~1\APPLIC~1\INTRAB~1\move log.exe O4 - HKCU\..\Run: [PowerBar] "E:\Programs\Multimedia Launcher\PowerBar.exe" /AtBootTime O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: Avaa uuteen etuvälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/230?db61e26085e4d24834bd9e83deff74e O8 - Extra context menu item: Avaa uuteen taustavälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/229?db61e26085e4d24834bd9e83deff74e O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1175955810155 O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: SPYWAREfighterRP - SpamFighter APS - E:\Program Files\SPYWAREfighter\spfprc.exe O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
Njaa, aloitetaan tälläsillä: ******* Lataa SmitfraudFix (by S!Ri) työpöydällesi. Tuplaklikkaa tiedostoa SmitfraudFix.exe Valitse optio #1 - Search kirjoittamalla 1 ja painamalla "Enter"; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa). Postita tämän tekstitiedoston sisältö viestiketjuusi. **Jos työkalu ei käynnisty työpöydältä niin siirrä SmitfraudFix.exe suoraan järjestelmäaseman juureen (yleensä C:). Kokeile sitten käynnistää ohjelma uudestaan sieltä. Huomaa : process.exe filun tunnistaa jotkut Anti-virus ohjelmat (AntiVir, Dr.Web, Kaspersky) "Haittakaluna"; se ei ole virus, vaan ohjelma joka pysäyttää prosesseja. A/V ohjelmat eivät pysty tunnistamaan hyvän ja pahan käytön tälläisten ohjelmian väliltä, silloin ne saattavat varoittaa käyttäjää. http://www.beyondlogic.org/consulting/processutil/processutil.htm ========== Printtaa ohjeet ulos tai tallenna nämä tekstitiedostoon. Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi. Vikasietotilaan pääset painamalla F8 käynnistyksen alussa piippauksen kuultuasi. Kun vikasietotilassa, tuplaklikkaa tiedostoa SmitfraudFix.exe Valitse optio #2 - Clean kirjoittamalla 2 ja painamalla "Enter" poistaaksesi tarttuneet tiedostot. Sinulta kysytään: "Registry cleaning - Do you want to clean the registry ?"; vastaa "Yes" kirjoittamalla Y ja paina "Enter" poistaaksesi työpöydän taustakuvan ja puhdistaaksesi tarttuneet rekisteriavaimet. Työkalu tarkistaa jos wininet.dll on tarttunut. Sinua saatetaan pyytää korvaamaan tarttunut .dll (jos löytyy); vastaa "Yes" kirjoittamalla Y ja painamalla "Enter". Työkalun saattaa tarvita käynnistää kone uudelleen; jos ei tee niin, käynnistä normaaliin Windowsiin. Tekstitiedosto ilmestyy, puhdistusprosessin jäljiltä; kopioi & liitä tämän raportin tulokset vastaukseesi. Raportti löytyy paikalliselta levyltäsi, useimmiten C:\rapport.txt. ========== Lataa NoLop työpöydällesi yhdestä seuraavista linkeistä... http://www.spywareedge.net/nolop/NoLop.exe1 http://www.spywaretimes.com/Tools/Download/Anti-malwareToolsLinkki http://www.thespykiller.co.uk/index.php?action=tpmod;dl=get16 * Sulje kaikki ohjelmat, koska tämä vaihe vaatii uudelleenkäynnistyksen * Tuplaklikkaa NoLop.exe ajaaksesi sen * Klikkaa nappulaa "Search and Destroy" <<Tietokoneesi skannataan saastuneiden tiedostojen osalta>> * Kun skannaus on valmis, sinua pyydetään käynnistämään kone uudestaan, jos infektio löytyy. Klikkaa OK * Klikkaa "REBOOT"-painiketta. * NoLopin pitäisi antaa viesti. Jos ei, tuplaklikkaa ohjelmaa ja se valmistuu. Lähetä C:\NoLop.log-tiedoston sisältö uuden HijackThis-lokin kera. -- Jos saat seuraavan virheen, "mscomctl.ocx or one of its dependencies are not correctly registered," lataa mscomctl.ocx http://www.boletrice.com/downloads/mscomctl.ocx ja tallenna se system32-hakemistoosi (yleensä c:\Windows\system32). Tämän jälkeen aja ohjelma uudestaan. -- ============ 1. Lataa combofix.exe työpöydällesi jommastakummasta linkistä: http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe http://download.bleepingcomputer.com/sUBs/ComboFix.exe 2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia. 3. Kun työkalu on valmis, se tuottaa lokin. (C:\ComboFix.txt) Lähetä tämä loki viesti ketjuusi. Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen. ======== Uusi hijackthis logi.
Sori et kesti, piti olla pari pvää muualla kun himassa mut tässä tulee smitfraudfix.exen loki:SmitFraudFix v2.174 Scan done at 12:59:50,45, su 06.05.2007 Run from C:\Documents and Settings\perhekone\Desktop\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» Process C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\WINDOWS\System32\PAStiSvc.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Video AX Object\smmain.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\PROGRA~1\SYMANT~1\VPTray.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\Macrogaming\SweetIM\SweetIM.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\Program Files\Seagate\DiscWizard\DiscWizardMonitor.exe C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe C:\Program Files\Seagate\DiscWizard\TimounterMonitor.exe E:\Program Files\Winamp\winampa.exe E:\Programs\Daemon\DAEMON Tools\daemon.exe E:\Program Files\SPYWAREfighter\spftray.exe E:\Programs\PowerDVD\PDVDServ.exe C:\Program Files\Ahead\InCD\InCD.exe C:\WINDOWS\system32\ctfmon.exe E:\Program Files\SPYWAREfighter\spfprc.exe E:\Programs\Multimedia Launcher\PowerBar.exe c:\progra~1\intern~1\iexplore.exe C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe C:\Program Files\MSN Messenger\usnsvc.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\cmd.exe »»»»»»»»»»»»»»»»»»»»»»»» hosts »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\perhekone »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\perhekone\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu C:\DOCUME~1\ALLUSE~1\STARTM~1\Online Security Guide.url FOUND ! C:\DOCUME~1\ALLUSE~1\STARTM~1\Security Troubleshooting.url FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\PERHEK~1\FAVORI~1 C:\DOCUME~1\PERHEK~1\FAVORI~1\Online Security Test.url FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» Desktop C:\DOCUME~1\ALLUSE~1\Desktop\Online Security Guide.url FOUND ! C:\DOCUME~1\ALLUSE~1\Desktop\Security Troubleshooting.url FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files C:\Program Files\Video AX Object\ FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] "{4233ac08-a2c4-4742-a0b4-83719613d62c}"="grassily" [HKEY_CLASSES_ROOT\CLSID\{4233ac08-a2c4-4742-a0b4-83719613d62c}\InProcServer32] @="C:\WINDOWS\system32\ilmpjy.dll" [HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{4233ac08-a2c4-4742-a0b4-83719613d62c}\InProcServer32] @="C:\WINDOWS\system32\ilmpjy.dll" »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32-huy32 »»»»»»»»»»»»»»»»»»»»»»»» DNS Description: Intel(R) PRO/100+ Management Adapter - Packet Scheduler Miniport DNS Server Search Order: 84.239.129.160 DNS Server Search Order: 84.239.128.160 DNS Server Search Order: 84.239.157.1 HKLM\SYSTEM\CCS\Services\Tcpip\..\{A22E1AC9-BD08-471B-BE21-2C1329609A39}: DhcpNameServer=84.239.129.160 84.239.128.160 84.239.157.1 HKLM\SYSTEM\CS1\Services\Tcpip\..\{A22E1AC9-BD08-471B-BE21-2C1329609A39}: DhcpNameServer=84.239.129.160 84.239.128.160 84.239.157.1 HKLM\SYSTEM\CS3\Services\Tcpip\..\{A22E1AC9-BD08-471B-BE21-2C1329609A39}: DhcpNameServer=84.239.129.160 84.239.128.160 84.239.157.1 HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=84.239.129.160 84.239.128.160 84.239.157.1 HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=84.239.129.160 84.239.128.160 84.239.157.1 HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=84.239.129.160 84.239.128.160 84.239.157.1 »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End
aja nuo kaikki ohjeessa mainitut ohjelmat ja kohdat, laita sitten niiden lokit sekä uusi hijackthislogi kiitos
OOkei, täs on hijackthis loki ennen smithfraudia ja nolopia. Logfile of HijackThis v1.99.1 Scan saved at 19:24:41, on 6.5.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\WINDOWS\System32\PAStiSvc.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\PROGRA~1\SYMANT~1\VPTray.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\Macrogaming\SweetIM\SweetIM.exe C:\Program Files\Seagate\DiscWizard\DiscWizardMonitor.exe C:\Program Files\Seagate\DiscWizard\TimounterMonitor.exe C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe E:\Program Files\Winamp\winampa.exe E:\Programs\Daemon\DAEMON Tools\daemon.exe E:\Program Files\SPYWAREfighter\spftray.exe E:\Programs\PowerDVD\PDVDServ.exe C:\Program Files\Ahead\InCD\InCD.exe C:\WINDOWS\system32\ctfmon.exe E:\Programs\Multimedia Launcher\PowerBar.exe E:\Program Files\SPYWAREfighter\spfprc.exe c:\progra~1\intern~1\iexplore.exe C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe C:\Kaspersky\mwavscan.com C:\Kaspersky\kavss.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\HJT\Scanner.exe C:\WINDOWS\system32\taskmgr.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/ R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe O4 - HKLM\..\Run: [DiscWizardMonitor.exe] C:\Program Files\Seagate\DiscWizard\DiscWizardMonitor.exe O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files\Seagate\DiscWizard\TimounterMonitor.exe O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe" O4 - HKLM\..\Run: [WinampAgent] E:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [DAEMON Tools] "E:\Programs\Daemon\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [spywarefighterguard] E:\Program Files\SPYWAREfighter\spftray.exe O4 - HKLM\..\Run: [RemoteControl] E:\Programs\PowerDVD\PDVDServ.exe O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe O4 - HKCU\..\Run: [PowerBar] "E:\Programs\Multimedia Launcher\PowerBar.exe" /AtBootTime O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [32 Eq] C:\DOCUME~1\PERHEK~1\APPLIC~1\INTRAB~1\move log.exe O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe O4 - Global Startup: NoLop.exe O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: Avaa uuteen etuvälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/230?db61e26085e4d24834bd9e83deff74e O8 - Extra context menu item: Avaa uuteen taustavälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/229?db61e26085e4d24834bd9e83deff74e O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1175955810155 O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: SPYWAREfighterRP - SpamFighter APS - E:\Program Files\SPYWAREfighter\spfprc.exe O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe Täs on sit smithfraudin loki SmitFraudFix v2.176 Scan done at 19:27:18,40, su 06.05.2007 Run from C:\Documents and Settings\perhekone\Desktop\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» Process C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\WINDOWS\System32\PAStiSvc.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\PROGRA~1\SYMANT~1\VPTray.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\Macrogaming\SweetIM\SweetIM.exe C:\Program Files\Seagate\DiscWizard\DiscWizardMonitor.exe C:\Program Files\Seagate\DiscWizard\TimounterMonitor.exe C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe E:\Program Files\Winamp\winampa.exe E:\Programs\Daemon\DAEMON Tools\daemon.exe E:\Program Files\SPYWAREfighter\spftray.exe E:\Programs\PowerDVD\PDVDServ.exe C:\Program Files\Ahead\InCD\InCD.exe C:\WINDOWS\system32\ctfmon.exe E:\Programs\Multimedia Launcher\PowerBar.exe E:\Program Files\SPYWAREfighter\spfprc.exe c:\progra~1\intern~1\iexplore.exe C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe C:\Kaspersky\mwavscan.com C:\Kaspersky\kavss.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\cmd.exe »»»»»»»»»»»»»»»»»»»»»»»» hosts »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\perhekone »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\perhekone\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\PERHEK~1\FAVORI~1 »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32-huy32 »»»»»»»»»»»»»»»»»»»»»»»» DNS Description: Intel(R) PRO/100+ Management Adapter - Packet Scheduler Miniport DNS Server Search Order: 84.239.129.160 DNS Server Search Order: 84.239.128.160 DNS Server Search Order: 84.239.157.1 HKLM\SYSTEM\CCS\Services\Tcpip\..\{A22E1AC9-BD08-471B-BE21-2C1329609A39}: DhcpNameServer=84.239.129.160 84.239.128.160 84.239.157.1 HKLM\SYSTEM\CS1\Services\Tcpip\..\{A22E1AC9-BD08-471B-BE21-2C1329609A39}: DhcpNameServer=84.239.129.160 84.239.128.160 84.239.157.1 HKLM\SYSTEM\CS3\Services\Tcpip\..\{A22E1AC9-BD08-471B-BE21-2C1329609A39}: DhcpNameServer=84.239.129.160 84.239.128.160 84.239.157.1 HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=84.239.129.160 84.239.128.160 84.239.157.1 HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=84.239.129.160 84.239.128.160 84.239.157.1 HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=84.239.129.160 84.239.128.160 84.239.157.1 »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End Nolop ei löytäny infected filejä, joten siit ei oo lokia, mutta kuitenkin kun sain neuvoks laittaa kaparskyn menee, niin se on kyl löytäny jo tähän mennessä 63 virusta ja se on pyöriny 2h 40min
Täs on kaparskyn loki et mitä se löys: File C:\DOCUME~1\PERHEK~1\APPLIC~1\INTRAB~1\MOVELO~1.EXE infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted. File C:\Documents and Settings\perhekone\Application Data\intra bind\loud long barb.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted. File C:\Documents and Settings\perhekone\Local Settings\Application Data\Mozilla\Firefox\Profiles\8xv7vpv3.default\Cache\63329BDCd01 tagged as not-a-virus:RiskTool.Win32.Reboot.f. No Action Taken. File C:\Program Files\Mozilla Firefox\plugins\npdlplug.dll tagged as not-a-virus:AdWare.Win32.PluginDL.e. No Action Taken. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP55\A0009497.exe infected by "Trojan-Downloader.Win32.Zlob.bst" Virus. Action Taken: File Deleted. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP55\A0009550.exe infected by "Trojan-Downloader.Win32.Zlob.bst" Virus. Action Taken: File Deleted. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP55\A0009557.exe infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP55\A0009574.dll infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP55\A0009575.exe infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP55\A0009576.exe infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP56\A0009638.dll infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP56\A0009639.exe infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP56\A0009640.exe infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP56\A0010637.dll infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP56\A0010638.exe infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP56\A0010639.exe infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP56\A0010649.dll infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP56\A0010650.exe infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP56\A0010651.exe infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP56\A0011649.dll infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP56\A0011650.exe infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP56\A0011651.exe infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP56\A0012649.dll infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP56\A0012650.exe infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP56\A0012651.exe infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP57\A0012658.dll infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP57\A0012659.exe infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP57\A0012660.exe infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP58\A0013658.dll infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP58\A0013659.exe infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP58\A0013660.exe infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP58\A0013677.dll infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP58\A0013678.exe infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP58\A0013679.exe infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP58\A0013685.dll infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP58\A0013686.exe infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP58\A0013687.exe infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP58\A0013696.dll infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP58\A0013697.exe infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP58\A0013698.exe infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP58\A0013711.dll infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP58\A0013712.exe infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP58\A0013713.exe infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP58\A0013718.dll infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP58\A0013719.exe infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP58\A0013720.exe infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP59\A0013726.dll infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP59\A0013727.exe infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP59\A0013728.exe infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP59\A0013733.dll infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP59\A0013734.exe infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP59\A0013735.exe infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP60\A0013744.dll infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP60\A0013745.exe infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP60\A0013746.exe infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP60\A0013792.exe infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP60\A0013793.exe infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP60\A0013794.dll infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP61\A0016811.exe infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP61\A0016843.exe tagged as not-a-virus:RiskTool.Win32.Reboot.f. No Action Taken. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP61\A0016849.exe tagged as not-a-virus:RiskTool.Win32.Reboot.f. No Action Taken. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP61\A0016861.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted. File C:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP61\A0016863.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted. File E:\Mutsin Tiedostot\Vastaanotetut tiedostot\adsizw.bmp infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File E:\Mutsin Tiedostot\Vastaanotetut tiedostot\TIINA.wma infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File E:\Programs\plugi crack\DlPlugin-Moz\buddy.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted. File E:\Programs\plugi crack\DlPlugin-Moz\npdlplug.dll tagged as not-a-virus:AdWare.Win32.PluginDL.e. No Action Taken. File E:\Programs\plugi crack\DlPlugin-Moz\setup2.exe tagged as not-a-virus:AdWare.Win32.PluginDL.e. No Action Taken. File E:\Programs\Setupit\mirc62.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.62. No Action Taken. File E:\Programs\Setupit\npdlplug-1.5.0.1-0147-setup.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted. File E:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP61\A0016865.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted. File E:\System Volume Information\_restore{003D42C7-3085-47B7-941A-43750F74C552}\RP61\A0016866.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted.
mikä on niin hiton vaikee tajuta että ei lokeja toisten ketjuihin, editoi omas pois ja tee niin kuin allekirjoituksessanikin lukee..
