mulle tuli toi kanssa kun systeri meni ja avas jonku viestin mun koneella. kuinka sen voi poistaa? tässä hjt. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:22:20, on 5.6.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Sygate\SPF\smc.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\PowerISO\PWRISOVM.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\WINDOWS\winudspm.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\D-Link AirPlus\AirPlus.exe C:\Program Files\honestech One Touch DVD\Receiver.exe C:\Program Files\MagicDisc\MagicDisc.exe C:\Program Files\Lavasoft\Ad-Aware\Ad-Watch.exe C:\WINDOWS\explorer.exe C:\Program Files\MSN Messenger\usnsvc.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fi\msntb.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fi\msntb.dll O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\Ad-Watch.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [PowerBar] "C:\Program Files\CyberLink DVD Solution\Multimedia Launcher\PowerBar.exe" /AtBootTime O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: D-Link AirPlus.lnk = ? O4 - Global Startup: honestech One Touch DVD Receiver.lnk = C:\Program Files\honestech One Touch DVD\Receiver.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing) O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe -- End of file - 5941 bytes
1.Lataa combofix.exe työpöydällesi yhdestä linkistä: combofix1 combofix2 2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia. 3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi. Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
tässä logi ComboFix 08-06-05.3 - meylimak 2008-06-06 13:05:26.1 - NTFSx86 Running from: C:\Documents and Settings\meylimak\Desktop\ComboFix.exe * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . /wow section not completed ((((((((((((((((((((((((( Files Created from 2008-05-06 to 2008-06-06 ))))))))))))))))))))))))))))))) . 2008-06-06 13:02 . 2008-06-06 13:03 <DIR> d-------- C:\327882R2FWJFW 2008-06-05 20:57 . 2008-06-05 20:57 <DIR> d-------- C:\Program Files\Lavasoft 2008-06-05 17:15 . 2008-06-05 21:09 <DIR> d-------- C:\Documents and Settings\meylimak\.housecall6.6 2008-06-05 17:15 . 2008-06-05 17:15 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys 2008-06-05 16:57 . 2008-06-05 16:59 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-06-05 16:46 . 2008-06-05 16:46 <DIR> d-------- C:\Program Files\Trend Micro 2008-06-03 18:36 . 2008-06-03 18:36 86,548 --a------ C:\Documents and Settings\meylimak\setupa.exe 2008-06-03 13:00 . 2008-06-03 13:00 57,344 --a------ C:\WINDOWS\system32\pmnkHWpm.dll 2008-05-30 09:35 . 2008-06-03 19:39 86,548 -r-hs---- C:\WINDOWS\service.exe 2008-05-29 15:26 . 2008-05-29 15:25 56,832 -r-hs---- C:\WINDOWS\winudspm.exe 2008-05-18 21:44 . 2008-05-18 21:44 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-05-18 21:44 . 2008-05-18 21:44 1,409 --a------ C:\WINDOWS\QTFont.for 2008-05-18 21:41 . 2008-05-18 21:43 <DIR> d-------- C:\Program Files\Common Files\AVSMedia 2008-05-18 21:41 . 2008-05-18 21:41 <DIR> d-------- C:\Program Files\AVSMedia 2008-05-18 21:41 . 2003-05-21 23:50 1,700,352 --a------ C:\WINDOWS\system32\GdiPlus.dll 2008-05-18 21:41 . 2002-02-01 15:00 1,497,088 --a------ C:\WINDOWS\system32\cc3260mt.dll 2008-05-18 21:41 . 2002-02-01 15:00 620,544 --a------ C:\WINDOWS\system32\stlpmt45.dll 2008-05-18 21:41 . 2001-09-10 22:26 38,912 --a------ C:\WINDOWS\system32\alf2cd.acm 2008-05-18 21:41 . 2003-05-21 12:50 24,576 --a------ C:\WINDOWS\system32\msxml3a.dll 2008-05-18 21:30 . 2008-05-18 21:47 <DIR> d-------- C:\Program Files\TotalAudioConverter 2008-05-18 21:30 . 2008-05-18 21:30 <DIR> d-------- C:\Documents and Settings\meylimak\Application Data\Softplicity 2008-05-18 21:09 . 2008-05-18 21:30 <DIR> d-------- C:\Program Files\AudioCommander 2008-05-18 21:08 . 2008-05-18 21:08 <DIR> d-------- C:\Documents and Settings\meylimak\Application Data\Seven Zip 2008-05-16 17:31 . 2008-06-04 19:27 <DIR> d-------- C:\Program Files\Betsson Poker 2008-05-16 11:58 . 2008-05-16 11:58 12,632 --a------ C:\WINDOWS\system32\lsdelete.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-05 18:44 --------- d-----w C:\Program Files\lg_fwupdate 2008-06-05 17:56 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-06-01 13:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\ZoomBrowser 2008-06-01 10:16 --------- d-----w C:\Documents and Settings\meylimak\Application Data\ZoomBrowser EX 2008-05-26 15:23 --------- d-----w C:\Program Files\MSN Messenger 2008-05-19 12:47 --------- d-----w C:\Program Files\Gabest 2008-04-29 08:20 15,648 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys 2008-04-29 08:19 15,648 ----a-w C:\WINDOWS\system32\drivers\Awrtrd.sys 2008-04-29 08:19 12,960 ----a-w C:\WINDOWS\system32\drivers\Awrtpd.sys 2008-04-08 17:35 --------- d-----w C:\Program Files\B2BPOKER 2006-10-10 18:01 81,920 ----a-w C:\Documents and Settings\meylimak\Application Data\ezpinst.exe 2006-10-10 18:01 47,360 ----a-w C:\Documents and Settings\meylimak\Application Data\pcouffin.sys 2005-11-04 08:25 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe 2005-09-13 14:18 5,116,152 ----a-w C:\Program Files\Firefox Setup 1.0.6.exe 2005-06-15 06:27 5,115,016 ----a-w C:\Program Files\Firefox Setup 1.0.4.exe 2004-04-06 12:30 234,608 ----a-w C:\Program Files\CDStart.exe 2004-03-31 15:33 6,312 ----a-w C:\Program Files\FAQ.txt 2001-08-03 09:35 103 ----a-w C:\Program Files\autorun.inf . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Ad-Watch"="C:\Program Files\Lavasoft\Ad-Aware\Ad-Watch.exe" [2008-06-05 20:59 2468200] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:56 15360] C:\Documents and Settings\meylimak\Start Menu\Programs\Startup\ MagicDisc.lnk - C:\Program Files\MagicDisc\MagicDisc.exe [2007-11-18 21:42:55 534016] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-06-23 16:38:46 113664] D-Link AirPlus.lnk - C:\Program Files\D-Link AirPlus\AirPlus.exe [2005-06-14 16:33:15 262144] honestech One Touch DVD Receiver.lnk - C:\Program Files\honestech One Touch DVD\Receiver.exe [2006-09-27 19:23:13 225280] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.X264"= x264vfw.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\LimeWire\\LimeWire.exe"= "C:\\StubInstaller.exe"= "C:\\Program Files\\BitComet\\BitComet.exe"= "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "C:\\Program Files\\MSN Messenger\\livecall.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "13007:TCP"= 13007:TCP:BitComet 13007 TCP "13007:UDP"= 13007:UDP:BitComet 13007 UDP R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16] *Newly Created Service* - CATCHME . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-06 13:07:53 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\vsdatant] "ImagePath"="" .
1. Klikkaa hiiren oikella Ad-Watch-kuvaketta tehtäväpalkissa ja valitse "Restore Ad-Watch". 2. Ruudun alalaidassa on kaksi rastitettavaa ruutua "Active" ja "Automatic". Active: Switches Monitoring On or Off without closing Automatic: Switches Automatic Blocking On or Off 3. Ota rasti pois molemmista (punainen X). ============= Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne: Tallenna se nimellä CFScript.txt Sitten raahaa CFScript ComboFix.exeen kuten alla. Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne. ================ Lataa Malwarebytes' Anti-Malware työpöydällesi. 1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman. 2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish. 3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version. 4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan. 5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset. 6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected. 7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt 8. Lähetä lokin sisältö seuraavassa viestissäsi.
