Mesevirus iski ja ehkä muutakin

moi,

voisko joku auttaa, mesevirus iski ja jotain on yritetty räpeltää sen poistamiseksi. Tässäpä Htj logi:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:29, on 2008-06-13
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\WINDOWS\winudspm.exe
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Windows Desktop Search\WindowsSearchIndexer.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\PROGRA~1\OULUNP~1\BAANAC~1\app\pppoeservice.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://login.yahoo.com/config/login_verify2?&.src=ym
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - C:\Program Files\Windows Desktop Search\dsWebAllow.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.3.28.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Windows UDP Control] winudspm.exe
O4 - HKLM\..\Run: [Windows svchost] service.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Windows-työpöytähaku.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Avaa uuteen etuvälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/230?46d652a5b07546b181be0eb4d0fec1f6
O8 - Extra context menu item: Avaa uuteen taustavälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/229?46d652a5b07546b181be0eb4d0fec1f6
O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: PPPoE Service (PPPoEService) - Unknown owner - C:\PROGRA~1\OULUNP~1\BAANAC~1\app\pppoeservice.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 7713 bytes

 

1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
combofix1
combofix2

2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

 

tässäpä tämä:

ComboFix 08-06-11.7 - Aaro 2008-06-13 19:21:49.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.258 [GMT 3:00]
Running from: C:\Documents and Settings\Aaro\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-05-13 to 2008-06-13 )))))))))))))))))))))))))))))))
.

2008-06-12 21:20 . 2008-06-12 21:35 <DIR> d-------- C:\Documents and Settings\Aaro\Application Data\Nokia Multimedia Player
2008-06-11 21:30 . 2008-04-14 14:01 272,128 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-06-11 21:30 . 2008-04-14 14:01 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-08 19:25 . 2008-06-08 19:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-08 19:25 . 2008-06-05 16:04 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-08 19:25 . 2008-06-05 16:04 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-08 17:17 . 2008-06-08 17:17 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-08 16:58 . 2007-11-14 16:04 103,912 --a------ C:\WINDOWS\system32\~GLH0012.TMP
2008-06-08 16:56 . 2007-11-14 16:04 472,552 --a------ C:\WINDOWS\system32\~GLH0018.TMP
2008-06-08 16:56 . 2007-11-14 16:04 157,160 --a------ C:\WINDOWS\system32\~GLH001a.TMP
2008-06-08 16:34 . 2008-06-13 19:11 <DIR> d-------- C:\QUARANTINE
2008-06-08 16:31 . 2007-11-14 16:04 99,816 --a------ C:\WINDOWS\system32\~GLH0027.TMP
2008-06-08 16:30 . 2008-06-08 17:00 <DIR> d-------- C:\WINDOWS\system32\ZoneLabs
2008-06-08 16:30 . 2008-06-08 18:55 <DIR> d-------- C:\WINDOWS\Internet Logs
2008-06-08 16:30 . 2008-06-08 16:30 <DIR> d-------- C:\Program Files\Zone Labs
2008-06-08 16:30 . 2007-11-14 16:04 472,552 --a------ C:\WINDOWS\system32\~GLH001d.TMP
2008-06-08 16:30 . 2008-06-08 16:58 351,908 --a------ C:\WINDOWS\system32\vsconfig.xml
2008-06-08 16:30 . 2007-11-14 16:04 275,944 --a------ C:\WINDOWS\system32\~GLH0017.TMP
2008-06-08 16:30 . 2007-11-14 16:04 157,160 --a------ C:\WINDOWS\system32\~GLH0021.TMP
2008-06-08 16:30 . 2007-11-14 16:04 103,912 --a------ C:\WINDOWS\system32\~GLH0015.TMP
2008-06-08 16:30 . 2007-11-14 16:04 83,432 --a------ C:\WINDOWS\system32\~GLH0010.TMP
2008-06-08 16:27 . 2008-06-08 18:37 2,231 --a------ C:\is154890.exe
2008-06-08 16:18 . 2008-06-08 16:18 <DIR> d-------- C:\Program Files\Common Files\Cisco Systems
2008-06-08 16:18 . 2008-06-08 16:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee
2008-06-08 16:18 . 2006-11-17 03:06 1,495,552 --a------ C:\WINDOWS\system32\epoPGPsdk.dll
2008-06-08 16:18 . 2006-11-30 08:50 168,776 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys
2008-06-08 16:18 . 2006-11-30 08:50 72,264 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys
2008-06-08 16:18 . 2006-11-30 08:50 64,360 --a------ C:\WINDOWS\system32\drivers\mfeapfk.sys
2008-06-08 16:18 . 2006-11-30 08:50 52,136 --a------ C:\WINDOWS\system32\drivers\mfetdik.sys
2008-06-08 16:18 . 2006-11-30 08:50 34,152 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys
2008-06-08 16:18 . 2006-11-17 03:06 280 --a------ C:\WINDOWS\system32\epoPGPsdk.dll.sig
2008-06-08 16:17 . 2008-06-08 16:17 <DIR> d-------- C:\Program Files\McAfee
2008-06-08 16:17 . 2008-06-08 16:17 <DIR> d-------- C:\Program Files\Common Files\McAfee
2008-06-08 16:12 . 2008-06-08 16:12 0 --a------ C:\WINDOWS\system32\config.nt
2008-06-05 18:35 . 2004-08-04 15:00 4,224 --a------ C:\WINDOWS\system32\beep.sys
2008-06-05 18:35 . 2008-06-05 18:35 29 --a------ C:\WINDOWS\system32\afsrqiwp.tmp
2008-06-05 18:35 . 2008-06-05 18:35 2 --a------ C:\606042305
2008-06-05 18:34 . 2008-06-05 18:34 12,800 --a------ C:\vieiiy.exe
2008-06-05 18:34 . 2008-06-05 18:34 12,288 --a------ C:\abhwevhi.exe
2008-06-04 15:30 . 2008-06-05 18:33 75,776 --a------ C:\hldtlwe.exe
2008-06-03 19:15 . 2008-06-03 19:15 86,548 --a------ C:\ssetup.exe
2008-06-03 19:08 . 2008-06-03 19:08 4,217 --a------ C:\WINDOWS\is154890.exe
2008-06-03 14:40 . 2008-06-03 14:40 96,950 -r-hs---- C:\WINDOWS\mservice.exe
2008-06-02 17:35 . 2008-06-02 17:35 60,114 --a------ C:\bot1.exe
2008-06-01 19:45 . 2008-06-01 20:46 86,502 --a------ C:\sexy.com
2008-05-31 18:53 . 2008-05-31 18:53 86,512 --a------ C:\Documents and Settings\Aaro\setup1.exe
2008-05-31 14:10 . 2008-05-31 14:12 86,512 --a------ C:\setup1.exe
2008-05-30 19:08 . 2008-05-30 19:08 86,498 --a------ C:\Documents and Settings\Aaro\setup.exe
2008-05-30 18:47 . 2008-05-30 18:50 83,400 -r-hs---- C:\WINDOWS\winudpmgr.exe
2008-05-30 18:47 . 2008-05-30 19:04 83,400 --a------ C:\img.exe
2008-05-30 14:29 . 2008-05-30 21:49 60,132 --a------ C:\dci.exe
2008-05-30 14:16 . 2008-06-13 18:27 2,206 --a------ C:\WINDOWS\system32\wpa.dbl
2008-05-29 20:18 . 2008-05-29 20:18 86,340 --a------ C:\img.com
2008-05-29 19:38 . 2008-05-29 20:11 40,960 --a------ C:\dsdc.exe
2008-05-29 18:19 . 2008-05-29 21:08 60,132 --a------ C:\ddc.exe
2008-05-29 18:18 . 2008-05-29 18:16 56,832 -r-hs---- C:\WINDOWS\winudspm.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-05 15:35 14,336 ----a-w C:\WINDOWS\system32\svchost.exe
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2008-04-21 07:04 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2007-09-19 15:32 21,769,888 ----a-w C:\Program Files\Nokia_PC_Suite_6_84_10_3_fin_web.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15:00 15360]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 13:55 5674352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 17:05 81920]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-06-21 20:14 35328]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"Cmaudio"="cmicnfg.cpl" []
"SoundMan"="SOUNDMAN.EXE" [2004-12-01 15:54 77824 C:\WINDOWS\SOUNDMAN.EXE]
"AtiPTA"="atiptaxx.exe" [2006-02-22 03:05 344064 C:\WINDOWS\system32\atiptaxx.exe]
"NeroCheck"="C:\WINDOWS\system32\\NeroCheck.exe" [2001-07-09 11:50 155648]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-07 00:46 57344]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 15:10 271360]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"Windows UDP Control"="winudspm.exe" [2008-05-29 18:16 56832 C:\WINDOWS\winudspm.exe]
"Windows svchost"="service.exe" []
"ShStatEXE"="C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.exe" [2006-11-30 08:50 112216]
"McAfeeUpdaterUI"="C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [2006-11-17 13:39 136768]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15:00 15360]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 10:17 1241088]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]
Windows-ty”p”yt„haku.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe [2006-03-26 23:44:08 257752]
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2006-09-12 21:18:51 122880]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2006-03-13 14:11 233472]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.avis"= ff_acm.acm

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winby13.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winjv05.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winvk75.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\NetMeeting\\conf.exe"=
"C:\\Program Files\\TVUPlayer\\TVUPlayer.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=
"C:\\Program Files\\BitComet\\BitComet.exe"=
"C:\\WINDOWS\\system32\\rtcshare.exe"=

R2 PPPoEService;PPPoE Service;C:\PROGRA~1\OULUNP~1\BAANAC~1\app\pppoeservice.exe [2000-07-11 11:48]
R3 NTSPPPOE;Efficient Networks Enternet P.P.P.o.E LAN Miniport Driver;C:\WINDOWS\system32\DRIVERS\ntspppoe.sys [2002-03-06 12:44]
S0 Winvk75;Winvk75;C:\WINDOWS\system32\Drivers\Winvk75.sys []
S3 NTSTPL1;NTSTPL1;C:\PROGRA~1\OULUNP~1\BAANAC~1\app\NTSTPL1.SYS [2002-03-06 12:42]
S3 RAWESR;RAWESR;C:\PROGRA~1\OULUNP~1\BAANAC~1\app\RAWESR.SYS [2002-03-06 12:39]
S3 TAPBIND;TAPBIND;C:\PROGRA~1\OULUNP~1\BAANAC~1\app\TAPBIND1.SYS [2002-03-06 12:42]

.
Contents of the 'Scheduled Tasks' folder
"2008-06-13 16:02:02 C:\WINDOWS\Tasks\Tarkistetaan Windows Live -työkalurivin päivitykset.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-13 19:22:52
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


C:\WINDOWS\system32\drivers\qandr.sys 124416 bytes executable

scan completed successfully
hidden files: 1

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\qandr]
"ImagePath"="\??\C:\WINDOWS\system32\drivers\qandr.sys"
.
Completion time: 2008-06-13 19:23:45
ComboFix-quarantined-files.txt 2008-06-13 16:23:41
ComboFix2.txt 2008-06-13 16:18:06

Pre-Run: 4,831,105,024 bytes free
Post-Run: 4,821,237,760 bytes free

155 --- E O F --- 2008-06-11 18:53:19

 

Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:

Tallenna se nimellä CFScript.txt

Sitten raahaa CFScript ComboFix.exeen kuten alla.


Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.

============

scannaa hjt:llä merkkaa paina Fix checked

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Windows UDP Control] winudspm.exe
O4 - HKLM\..\Run: [Windows svchost] service.exe

 

tässä tulee:

ComboFix 08-06-11.7 - Aaro 2008-06-13 20:32:19.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.226 [GMT 3:00]
Running from: C:\Documents and Settings\Aaro\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Aaro\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\606042305
C:\abhwevhi.exe
C:\bot1.exe
C:\dci.exe
C:\ddc.exe
C:\Documents and Settings\Aaro\setup.exe
C:\Documents and Settings\Aaro\setup1.exe
C:\dsdc.exe
C:\hldtlwe.exe
C:\img.com
C:\img.exe
C:\is154890.exe
C:\setup1.exe
C:\sexy.com
C:\ssetup.exe
C:\vieiiy.exe
C:\WINDOWS\is154890.exe
C:\WINDOWS\mservice.exe
C:\WINDOWS\service.exe
C:\WINDOWS\winudpmgr.exe
C:\WINDOWS\winudspm.exe
.

((((((((((((((((((((((((( Files Created from 2008-05-13 to 2008-06-13 )))))))))))))))))))))))))))))))
.

2008-06-12 21:20 . 2008-06-12 21:35 <DIR> d-------- C:\Documents and Settings\Aaro\Application Data\Nokia Multimedia Player
2008-06-11 21:30 . 2008-04-14 14:01 272,128 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-06-11 21:30 . 2008-04-14 14:01 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-08 19:25 . 2008-06-08 19:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-08 19:25 . 2008-06-05 16:04 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-08 19:25 . 2008-06-05 16:04 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-08 17:17 . 2008-06-08 17:17 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-08 16:58 . 2007-11-14 16:04 103,912 --a------ C:\WINDOWS\system32\~GLH0012.TMP
2008-06-08 16:56 . 2007-11-14 16:04 472,552 --a------ C:\WINDOWS\system32\~GLH0018.TMP
2008-06-08 16:56 . 2007-11-14 16:04 157,160 --a------ C:\WINDOWS\system32\~GLH001a.TMP
2008-06-08 16:34 . 2008-06-13 20:22 <DIR> d-------- C:\QUARANTINE
2008-06-08 16:31 . 2007-11-14 16:04 99,816 --a------ C:\WINDOWS\system32\~GLH0027.TMP
2008-06-08 16:30 . 2008-06-08 17:00 <DIR> d-------- C:\WINDOWS\system32\ZoneLabs
2008-06-08 16:30 . 2008-06-08 18:55 <DIR> d-------- C:\WINDOWS\Internet Logs
2008-06-08 16:30 . 2008-06-08 16:30 <DIR> d-------- C:\Program Files\Zone Labs
2008-06-08 16:30 . 2007-11-14 16:04 472,552 --a------ C:\WINDOWS\system32\~GLH001d.TMP
2008-06-08 16:30 . 2008-06-08 16:58 351,908 --a------ C:\WINDOWS\system32\vsconfig.xml
2008-06-08 16:30 . 2007-11-14 16:04 275,944 --a------ C:\WINDOWS\system32\~GLH0017.TMP
2008-06-08 16:30 . 2007-11-14 16:04 157,160 --a------ C:\WINDOWS\system32\~GLH0021.TMP
2008-06-08 16:30 . 2007-11-14 16:04 103,912 --a------ C:\WINDOWS\system32\~GLH0015.TMP
2008-06-08 16:30 . 2007-11-14 16:04 83,432 --a------ C:\WINDOWS\system32\~GLH0010.TMP
2008-06-08 16:18 . 2008-06-08 16:18 <DIR> d-------- C:\Program Files\Common Files\Cisco Systems
2008-06-08 16:18 . 2008-06-08 16:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee
2008-06-08 16:18 . 2006-11-17 03:06 1,495,552 --a------ C:\WINDOWS\system32\epoPGPsdk.dll
2008-06-08 16:18 . 2006-11-30 08:50 168,776 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys
2008-06-08 16:18 . 2006-11-30 08:50 72,264 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys
2008-06-08 16:18 . 2006-11-30 08:50 64,360 --a------ C:\WINDOWS\system32\drivers\mfeapfk.sys
2008-06-08 16:18 . 2006-11-30 08:50 52,136 --a------ C:\WINDOWS\system32\drivers\mfetdik.sys
2008-06-08 16:18 . 2006-11-30 08:50 34,152 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys
2008-06-08 16:18 . 2006-11-17 03:06 280 --a------ C:\WINDOWS\system32\epoPGPsdk.dll.sig
2008-06-08 16:17 . 2008-06-08 16:17 <DIR> d-------- C:\Program Files\McAfee
2008-06-08 16:17 . 2008-06-08 16:17 <DIR> d-------- C:\Program Files\Common Files\McAfee
2008-06-08 16:12 . 2008-06-08 16:12 0 --a------ C:\WINDOWS\system32\config.nt
2008-06-05 18:35 . 2004-08-04 15:00 4,224 --a------ C:\WINDOWS\system32\beep.sys
2008-06-05 18:35 . 2008-06-05 18:35 29 --a------ C:\WINDOWS\system32\afsrqiwp.tmp
2008-05-30 14:16 . 2008-06-13 18:27 2,206 --a------ C:\WINDOWS\system32\wpa.dbl

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-05 15:35 14,336 ----a-w C:\WINDOWS\system32\svchost.exe
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2008-04-21 07:04 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2007-09-19 15:32 21,769,888 ----a-w C:\Program Files\Nokia_PC_Suite_6_84_10_3_fin_web.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15:00 15360]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 13:55 5674352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 17:05 81920]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-06-21 20:14 35328]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"Cmaudio"="cmicnfg.cpl" []
"SoundMan"="SOUNDMAN.EXE" [2004-12-01 15:54 77824 C:\WINDOWS\SOUNDMAN.EXE]
"AtiPTA"="atiptaxx.exe" [2006-02-22 03:05 344064 C:\WINDOWS\system32\atiptaxx.exe]
"NeroCheck"="C:\WINDOWS\system32\\NeroCheck.exe" [2001-07-09 11:50 155648]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-07 00:46 57344]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 15:10 271360]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"Windows UDP Control"="winudspm.exe" []
"Windows svchost"="service.exe" []
"ShStatEXE"="C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.exe" [2006-11-30 08:50 112216]
"McAfeeUpdaterUI"="C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [2006-11-17 13:39 136768]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15:00 15360]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 10:17 1241088]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]
Windows-ty”p”yt„haku.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe [2006-03-26 23:44:08 257752]
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2006-09-12 21:18:51 122880]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2006-03-13 14:11 233472]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.avis"= ff_acm.acm

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winby13.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winjv05.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winvk75.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\NetMeeting\\conf.exe"=
"C:\\Program Files\\TVUPlayer\\TVUPlayer.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=
"C:\\Program Files\\BitComet\\BitComet.exe"=
"C:\\WINDOWS\\system32\\rtcshare.exe"=

R2 PPPoEService;PPPoE Service;C:\PROGRA~1\OULUNP~1\BAANAC~1\app\pppoeservice.exe [2000-07-11 11:48]
R3 NTSPPPOE;Efficient Networks Enternet P.P.P.o.E LAN Miniport Driver;C:\WINDOWS\system32\DRIVERS\ntspppoe.sys [2002-03-06 12:44]
S0 Winvk75;Winvk75;C:\WINDOWS\system32\Drivers\Winvk75.sys []
S3 NTSTPL1;NTSTPL1;C:\PROGRA~1\OULUNP~1\BAANAC~1\app\NTSTPL1.SYS [2002-03-06 12:42]
S3 RAWESR;RAWESR;C:\PROGRA~1\OULUNP~1\BAANAC~1\app\RAWESR.SYS [2002-03-06 12:39]
S3 TAPBIND;TAPBIND;C:\PROGRA~1\OULUNP~1\BAANAC~1\app\TAPBIND1.SYS [2002-03-06 12:42]

.
Contents of the 'Scheduled Tasks' folder
"2008-06-13 17:02:02 C:\WINDOWS\Tasks\Tarkistetaan Windows Live -työkalurivin päivitykset.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-13 20:33:29
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


C:\WINDOWS\system32\drivers\qandr.sys 124416 bytes executable

scan completed successfully
hidden files: 1

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\qandr]
"ImagePath"="\??\C:\WINDOWS\system32\drivers\qandr.sys"
.
Completion time: 2008-06-13 20:35:27
ComboFix-quarantined-files.txt 2008-06-13 17:34:57
ComboFix2.txt 2008-06-13 17:28:04
ComboFix3.txt 2008-06-13 16:23:46
ComboFix4.txt 2008-06-13 16:18:06

Pre-Run: 4,781,993,984 bytes free
Post-Run: 4,773,720,064 bytes free

161 --- E O F --- 2008-06-11 18:53:19

 

Lataa Malwarebytes' Anti-Malware työpöydällesi.

1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
8. Lähetä lokin sisältö seuraavassa viestissäsi.

 

Malwarebytes' Anti-Malware 1.17
Database version: 853

21:32:36 13.6.2008
mbam-log-6-13-2008 (21-32-36).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 68886
Time elapsed: 15 minute(s), 8 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 46

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\QooBox\Quarantine\C\bot1.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\dci.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\ddc.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\dsdc.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\hldtlwe.exe.vir (Trojan.Agent) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\img.com.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\img.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\setup.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\setup1.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\Aaro\setup.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\Aaro\setup1.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\mservice.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\winudpmgr.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\winudspm.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{857CF496-21FF-4D38-ABFA-F70410FA409D}\RP282\A0030307.com (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{857CF496-21FF-4D38-ABFA-F70410FA409D}\RP282\A0030308.com (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{857CF496-21FF-4D38-ABFA-F70410FA409D}\RP282\A0030309.com (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{857CF496-21FF-4D38-ABFA-F70410FA409D}\RP282\A0030387.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{857CF496-21FF-4D38-ABFA-F70410FA409D}\RP282\A0030479.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{857CF496-21FF-4D38-ABFA-F70410FA409D}\RP282\A0030480.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{857CF496-21FF-4D38-ABFA-F70410FA409D}\RP282\A0030560.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{857CF496-21FF-4D38-ABFA-F70410FA409D}\RP282\A0030561.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{857CF496-21FF-4D38-ABFA-F70410FA409D}\RP282\A0030569.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{857CF496-21FF-4D38-ABFA-F70410FA409D}\RP282\A0030614.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{857CF496-21FF-4D38-ABFA-F70410FA409D}\RP282\A0030651.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{857CF496-21FF-4D38-ABFA-F70410FA409D}\RP282\A0030680.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{857CF496-21FF-4D38-ABFA-F70410FA409D}\RP282\A0030759.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{857CF496-21FF-4D38-ABFA-F70410FA409D}\RP282\A0030811.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{857CF496-21FF-4D38-ABFA-F70410FA409D}\RP284\A0031090.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{857CF496-21FF-4D38-ABFA-F70410FA409D}\RP286\A0031302.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{857CF496-21FF-4D38-ABFA-F70410FA409D}\RP287\A0031365.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{857CF496-21FF-4D38-ABFA-F70410FA409D}\RP287\A0031366.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{857CF496-21FF-4D38-ABFA-F70410FA409D}\RP287\A0031367.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{857CF496-21FF-4D38-ABFA-F70410FA409D}\RP287\A0031368.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{857CF496-21FF-4D38-ABFA-F70410FA409D}\RP287\A0031369.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{857CF496-21FF-4D38-ABFA-F70410FA409D}\RP287\A0031370.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{857CF496-21FF-4D38-ABFA-F70410FA409D}\RP287\A0031371.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{857CF496-21FF-4D38-ABFA-F70410FA409D}\RP287\A0031372.com (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{857CF496-21FF-4D38-ABFA-F70410FA409D}\RP287\A0031373.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{857CF496-21FF-4D38-ABFA-F70410FA409D}\RP287\A0031375.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{857CF496-21FF-4D38-ABFA-F70410FA409D}\RP287\A0031380.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{857CF496-21FF-4D38-ABFA-F70410FA409D}\RP287\A0031381.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{857CF496-21FF-4D38-ABFA-F70410FA409D}\RP287\A0031382.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
D:\ARPALLE TALTEEN\Pikku ohjelmia\Asennetut\Nero 6.6.0.13 + Nero Vision Express 3.1.0.0d + NeroNet 1.2.0.2 + InCD 4.3.11.1 + Media Player 1.4.0.21 + Serials + Plugins + Language PT BR\Keygen-6.6.0.13.exe (Trojan.Agent) -> Quarantined and deleted successfully.
D:\ARPALLE TALTEEN\Pikku ohjelmia\KeyGeneraattoriNeroon\CORE10k.EXE (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\qandr.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

 

1. Klikkaa käynnistä > Oma tietokone oikean puoleisella hiiren napilla
2. Valitse ominaisuudet
3. Valitse järjestelmän palauttaminen välilehti
4. Ruksi eteen ¤ poista järjestelmän palauttaminen kaikissa asemissa
5. Paina Käytä
6. Paina ok
7. Sammuta ja käynnistä
8. Ota ruksi pois ¤ poista järjestelmän palauttaminen kaikissa asemissa
9. Käytä ja OK

 

Tehty on ja nyt on roskat koneesta listitty?
Suuri kiitos ja sywä kumarrus.

-BB

 

miltäs kone tuntuu

 

jep, kyllähän tämä toimii kait niinku ennenki, yhtä hitaasti

 

paljos koneessa keskusmuistia

 

vanha kone ja eihän tässä oo ku 512Mb, prosa pentium 4 2,6GHz

 

no toinen sama lisää muistia

 

joo, niin pitäsi laittaa, mut kyllä tällä surffailee...
Mut kiitti sulle.