Onkohan jotain vialla...

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by Supaah, Feb 10, 2008.

  1. Supaah

    Supaah Member

    Joined:
    Sep 24, 2006
    Messages:
    20
    Likes Received:
    0
    Trophy Points:
    11
    Kone on nykyään ollut aika hitaalla vähän aikaa ja olisi kiva tietää, että onko tässä logissa nyt jotain mitä ei kuulu olla:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:34:55, on 10/02/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\runservice.exe
    C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\Winamp\winampa.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Last.fm\LastFMHelper.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [Lcass] C:\WINDOWS\system32\lcass.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O17 - HKLM\System\CCS\Services\Tcpip\..\{CE595901-F1D8-4160-8531-3FEC051FA3AA}: NameServer = 192.168.0.254,192.168.0.255
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
    O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
    End of file - 4953 bytes
     
    Supaah, Feb 10, 2008
    #1
  2. Hujo

    Hujo Guest

    1.Lataa combofix.exe työpöydällesi jommastakummasta linkistä:
    combofix1
    combofix2

    2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
     
    Hujo, Feb 10, 2008
    #2
  3. Supaah

    Supaah Member

    Joined:
    Sep 24, 2006
    Messages:
    20
    Likes Received:
    0
    Trophy Points:
    11
    ComboFix 08-02.05.3 - Luukko 2008-02-10 12:55:12.2 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.358.1035.18.685 [GMT 2:00]
    Running from: C:\Documents and Settings\Luukko\Omat tiedostot\ComboFix(2).exe

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    ---- Previous Run -------
    .
    C:\RECYCLER\exlimt.exe

    .
    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-01-10 to 2008-02-10 )))))))))))))))))
    .

    2008-02-10 12:34 . 2008-02-10 12:34 <KANSIO> d-------- C:\Program Files\Trend Micro
    2008-02-10 12:07 . 2008-02-10 12:07 359,808 --a------ C:\WINDOWS\system32\drivers\TCPIP.SYS.ORIGINAL
    2008-02-03 17:48 . 2008-02-03 17:48 69 --a------ C:\WINDOWS\NeroDigital.ini
    2008-02-03 17:09 . 2008-02-03 17:09 8 --a------ C:\WINDOWS\system32\lcass
    2008-02-03 17:08 . 2008-02-03 17:08 38,934 --a------ C:\WINDOWS\system32\mssrv32.exe
    2008-02-03 16:31 . 2008-02-03 16:31 <KANSIO> d-------- C:\RCT3
    2008-02-03 16:20 . 2008-02-03 16:20 43,520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll
    2008-02-03 16:19 . 2008-02-03 16:19 <KANSIO> d-------- C:\Documents and Settings\Luukko\Application Data\Atari
    2008-02-03 15:48 . 2008-02-03 15:48 <KANSIO> d-------- C:\Documents and Settings\Luukko\Application Data\Leadertech
    2008-02-03 15:47 . 2008-02-03 15:47 <KANSIO> d-------- C:\Program Files\Common Files\PocketSoft
    2008-02-03 15:47 . 2002-02-27 18:50 197,120 --a------ C:\WINDOWS\patchw32.dll
    2008-02-03 15:42 . 2008-02-03 15:42 <KANSIO> d-------- C:\Program Files\Atari
    2008-02-03 12:36 . 2008-02-03 12:36 <KANSIO> d-------- C:\Documents and Settings\Luukko\Application Data\Nero
    2008-02-03 12:32 . 2008-02-03 12:32 <KANSIO> d-------- C:\Program Files\Nero
    2008-02-03 12:32 . 2008-02-03 12:34 <KANSIO> d-------- C:\Program Files\Common Files\Nero
    2008-02-03 12:32 . 2008-02-03 12:33 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Nero
    2008-02-03 12:27 . 2008-02-03 12:27 26,645 --a------ C:\WINDOWS\system32\lcass.exe
    2008-02-01 15:50 . 2008-02-01 15:50 <KANSIO> d-------- C:\Program Files\Hasbro Interactive
    2008-02-01 15:50 . 1999-05-29 10:08 45,568 --a------ C:\WINDOWS\UniFish3.exe
    2008-02-01 15:50 . 2008-02-01 15:51 291 --a------ C:\WINDOWS\PowerReg.dat
    2008-01-31 04:02 . 2008-01-31 04:02 54,608 --a------ C:\WINDOWS\system32\xfcodec.dll
    2008-01-26 16:29 . 2008-01-26 16:29 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Avg7
    2008-01-26 12:46 . 2008-01-26 12:57 <KANSIO> d-------- C:\Program Files\PC Health Optimizer
    2008-01-26 12:46 . 2002-12-20 14:02 1,077,336 --a------ C:\WINDOWS\system32\MSCOMCTL.OCX
    2008-01-26 12:46 . 2007-04-15 18:07 951,104 --a------ C:\WINDOWS\system32\tssOfficeMenu1d.ocx
    2008-01-26 12:46 . 2007-05-02 14:13 865,080 --a------ C:\WINDOWS\system32\ExplorerBarXP2.ocx
    2008-01-26 12:46 . 2000-05-22 16:58 647,872 --a------ C:\WINDOWS\system32\mscomct2.ocx
    2008-01-26 12:46 . 2007-04-14 23:16 312,128 --a------ C:\WINDOWS\system32\tssPopupNotify.ocx
    2008-01-26 12:46 . 2005-03-24 14:45 143,360 --a------ C:\WINDOWS\system32\LVbuttons.ocx
    2008-01-26 12:46 . 2000-05-22 15:58 140,488 --a------ C:\WINDOWS\system32\comdlg32.ocx
    2008-01-26 12:46 . 2000-07-20 12:59 65,536 --a------ C:\WINDOWS\system32\MBSplit.ocx
    2008-01-26 11:46 . 2008-01-26 11:53 <KANSIO> d-------- C:\Documents and Settings\Luukko\Application Data\Command & Conquer 3 Tiberium Wars
    2008-01-26 11:45 . 2008-01-26 11:45 98,304 --a------ C:\WINDOWS\system32CmdLineExt.dll
    2008-01-26 11:33 . 2008-01-26 11:33 <KANSIO> d-------- C:\Program Files\Electronic Arts
    2008-01-25 17:42 . 2008-01-26 12:57 <KANSIO> d-------- C:\Documents and Settings\Luukko\Application Data\Azureus
    2008-01-25 17:42 . 2008-01-25 17:42 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Azureus
    2008-01-22 17:55 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
    2008-01-22 17:55 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
    2008-01-22 17:55 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
    2008-01-20 14:42 . 2008-01-20 14:44 <KANSIO> d--h----- C:\Program Files\Zero G Registry
    2008-01-20 14:42 . 2008-01-20 14:42 <KANSIO> d--h----- C:\Documents and Settings\Luukko\InstallAnywhere
    2008-01-20 14:39 . 2008-01-20 14:40 <KANSIO> d-------- C:\Program Files\DAEMON Tools Lite
    2008-01-20 14:39 . 2008-01-20 14:39 <KANSIO> d-------- C:\Documents and Settings\Luukko\Application Data\DAEMON Tools
    2008-01-20 14:34 . 2008-01-20 14:34 716,272 --a------ C:\WINDOWS\system32\drivers\sptd.sys
    2008-01-17 18:11 . 2005-01-22 21:12 679,936 --a------ C:\WINDOWS\system32\D3DX81ab.dll
    2008-01-17 18:05 . 2008-01-17 18:06 <KANSIO> d-------- C:\Program Files\WinPcap
    2008-01-17 18:05 . 2008-01-17 19:12 <KANSIO> d-------- C:\Program Files\WC3Banlist
    2008-01-16 16:02 . 2008-02-06 21:34 54,156 --ah----- C:\WINDOWS\QTFont.qfn
    2008-01-16 16:02 . 2008-01-16 16:02 1,409 --a------ C:\WINDOWS\QTFont.for
    2008-01-16 16:01 . 2008-01-16 16:02 <KANSIO> d-------- C:\Program Files\QuickTime
    2008-01-16 16:01 . 2008-01-16 16:01 <KANSIO> d-------- C:\Program Files\Apple Software Update
    2008-01-16 16:01 . 2008-01-16 16:01 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
    2008-01-16 16:01 . 2008-01-16 16:01 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Apple
    2008-01-10 15:27 . 2008-01-10 15:27 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
    2008-01-10 15:27 . 2008-01-10 15:27 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-02-10 10:57 32,718,880 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
    2008-02-10 10:52 --------- d-----w C:\Program Files\Mozilla Firefox
    2008-02-10 10:50 1,991,748 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip
    2008-02-10 10:50 1,610,612,736 --sha-w C:\pagefile.sys
    2008-02-10 10:49 384,284 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
    2008-02-10 10:27 --------- d-----w C:\Documents and Settings\Luukko\Application Data\uTorrent
    2008-02-10 10:07 359,808 ----a-w C:\WINDOWS\system32\drivers\TCPIP.SYS
    2008-02-09 23:41 --------- d-----w C:\Documents and Settings\Luukko\Application Data\Winamp
    2008-02-09 23:32 --------- d-----w C:\Documents and Settings\Luukko\Application Data\NoNameScript
    2008-02-09 20:51 --------- d-----w C:\Program Files\Warcraft III
    2008-02-09 15:41 --------- d-----w C:\Documents and Settings\Luukko\Application Data\Xfire
    2008-02-09 12:38 --------- d-----w C:\Program Files\Winamp
    2008-02-09 10:56 --------- d-----w C:\Program Files\mIRC
    2008-02-08 15:15 --------- d-----w C:\Documents and Settings\Luukko\Application Data\LimeWire
    2008-02-08 05:05 --------- d-----w C:\Program Files\Xfire
    2008-02-03 13:47 --------- d-----w C:\Program Files\Common Files
    2008-02-03 13:42 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-02-03 10:31 --------- d-----w C:\Program Files\Common Files\Microsoft Shared
    2008-02-02 18:31 --------- d-----w C:\Program Files\DC++
    2008-01-26 14:24 3,166,208 ----a-w C:\WINDOWS\Internet Logs\xDB1.tmp
    2008-01-26 14:24 1,613,824 ----a-w C:\WINDOWS\Internet Logs\xDB2.tmp
    2008-01-26 10:57 --------- d-----w C:\Program Files\WinRAR
    2008-01-26 10:57 --------- d-----w C:\Program Files\PANZERS - Phase2
    2008-01-26 10:57 --------- d-----w C:\Program Files\LimeWire
    2008-01-26 10:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-01-20 13:12 --------- d-----w C:\Program Files\Ubisoft
    2008-01-20 13:11 --------- d-----w C:\Program Files\Common Files\InstallShield
    2008-01-20 12:42 --------- d-----w C:\Program Files\Sports Interactive
    2008-01-08 07:31 --------- d-----w C:\Program Files\Common Files\Blizzard Entertainment
    2008-01-04 11:14 --------- d-----w C:\Program Files\Last.fm
    2007-12-30 16:30 --------- d-----w C:\Documents and Settings\Luukko\Application Data\mIRC
    2007-12-29 21:21 --------- d-----w C:\Program Files\Activision
    2007-12-27 20:53 --------- d-----w C:\Program Files\Common Files\Adobe
    2007-12-27 20:52 --------- d-----w C:\Program Files\Adobe
    2007-12-27 09:53 --------- d-----w C:\Documents and Settings\LocalService\Application Data\Xfire
    2007-12-27 00:28 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
    2007-12-26 23:42 --------- d-----w C:\Documents and Settings\NetworkService\Application Data\Xfire
    2007-12-25 13:15 --------- d-----w C:\Program Files\EA Sports
    2007-12-24 18:00 --------- d-----w C:\Program Files\Rockstar Games
    2007-12-24 17:04 --------- d--h--r C:\Documents and Settings\Luukko\Application Data\SecuROM
    2007-12-23 18:22 8,972 ----a-w C:\WINDOWS\pchealth\helpctr\Config\Cntstore.bin
    2007-12-22 21:18 --------- d-----w C:\Program Files\Project64 1.6
    2007-12-22 14:37 --------- d-----w C:\Program Files\Lavasoft
    2007-12-22 14:37 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2007-12-22 14:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
    2007-12-21 21:09 --------- d-----w C:\Program Files\MSXML 4.0
    2007-12-21 21:06 --------- d-----w C:\Program Files\Microsoft Games
    2007-12-21 12:10 --------- d-----w C:\Program Files\Windows Media Components
    2007-12-20 20:36 --------- d-----w C:\Program Files\Futuremark
    2007-12-18 17:44 --------- d-----w C:\Program Files\Windows Media Player
    2007-12-18 17:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\Last.fm
    2007-12-17 14:23 --------- d-----w C:\Program Files\Yahoo!
    2007-12-16 13:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\nView_Profiles
    2007-12-16 13:31 --------- d-----w C:\Program Files\CCleaner
    2007-12-15 19:56 --------- d-----w C:\Program Files\SopCast
    2007-12-15 16:58 --------- d-----w C:\Documents and Settings\Luukko\Application Data\Sports Interactive
    2007-12-14 22:14 --------- d-----w C:\Program Files\PhotoFiltre
    2007-12-12 15:54 --------- d-----w C:\Program Files\Common Files\NSV
    2007-12-11 17:21 --------- d-----w C:\Program Files\Windows Live
    2007-12-11 17:20 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
    2007-12-11 15:34 --------- d-----w C:\Program Files\GDS
    2007-12-11 13:34 --------- d-----w C:\Documents and Settings\Luukko\Application Data\vlc
    2007-12-11 11:41 --------- d-----w C:\Program Files\VideoLAN
    2007-12-11 07:23 --------- d-----w C:\Program Files\uTorrent
    2007-12-10 22:06 139,264 ----a-w C:\WINDOWS\War3Unin.exe
    2007-12-10 19:36 --------- d-----w C:\Program Files\Common Files\AVSMedia
    2007-12-10 19:36 --------- d-----w C:\Program Files\AVSMedia
    2007-12-10 17:58 --------- d-----w C:\Program Files\Internet Explorer
    2007-12-10 17:55 --------- d-----w C:\Program Files\Outlook Express
    2007-12-10 17:55 --------- d-----w C:\Program Files\Common Files\System
    2007-12-10 17:48 --------- d-----w C:\Program Files\Valve
    2007-12-10 17:32 48,640 ----a-w C:\WINDOWS\mmfs.dll
    2007-12-10 17:17 --------- d-----w C:\Program Files\SystemRequirementsLab
    2007-12-10 17:17 --------- d-----w C:\Program Files\Java
    2007-12-10 17:17 --------- d-----w C:\Documents and Settings\Luukko\Application Data\SystemRequirementsLab
    2007-12-10 17:12 --------- d-----w C:\Program Files\Common Files\Java
    2007-12-10 16:46 --------- d-----w C:\Program Files\Alwil Software
    2007-12-10 16:38 --------- d-----w C:\Program Files\Zone Labs
    2007-12-10 16:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\MailFrontier
    2007-12-10 16:25 --------- d-----w C:\Program Files\Realtek
    2007-12-10 16:25 --------- d-----w C:\Program Files\Intel
    2007-12-10 16:24 --------- d-----w C:\Documents and Settings\Luukko\Application Data\InstallShield
    2007-12-10 16:21 315,392 ----a-w C:\WINDOWS\HideWin.exe
    2007-12-10 16:15 --------- d--h--w C:\Program Files\Uninstall Information
    2007-12-10 16:11 --------- d-----w C:\Program Files\xerox
    2007-12-10 16:11 --------- d-----w C:\Program Files\microsoft frontpage
    2007-12-10 16:10 --------- d-----w C:\Program Files\Windows Journal Viewer
    2007-12-10 16:10 --------- d-----w C:\Program Files\HighMAT CD Writing Wizard
    2007-12-10 16:09 0 --sha-r C:\MSDOS.SYS
    2007-12-10 16:09 0 --sha-r C:\IO.SYS
    2007-12-10 16:07 --------- d-----w C:\Program Files\NetMeeting
    2007-12-10 16:07 --------- d-----w C:\Program Files\Common Files\Services
    2007-12-10 16:06 --------- d-----w C:\Program Files\ComPlus Applications
    2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
    2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
    .

    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-14 15:12 15360]
    "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-09-06 16:14 919016]
    "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 15:00 79224]
    "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-01-16 00:54 37376]
    "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-10 15:27 385024]
    "Lcass"="C:\WINDOWS\system32\lcass.exe" [2008-02-03 12:27 26645]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-14 15:12 15360]

    C:\Documents and Settings\Luukko\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    Last.fm Helper.lnk - C:\Program Files\Last.fm\LastFMHelper.exe [2007-12-18 19:42:23 106496]

    R2 LicCtrlService;LicCtrl Service;C:\WINDOWS\runservice.exe [2007-12-10 19:32]
    S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2005-08-02 23:10]


    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{165150E1-F45A-FBC5-F2F6-6FC44B59DC30}]
    C:\WINDOWS\system32\lcass.exe
    .
    **************************************************************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-02-10 12:57:38
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    HKLM\Software\Microsoft\Windows\CurrentVersion\Run
    Lcass = C:\WINDOWS\system32\lcass.exe?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
     
    Supaah, Feb 10, 2008
    #3
  4. Hujo

    Hujo Guest

    scannaa hjt:llä merkkaa paina Fix checked

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O4 - HKLM\..\Run: [Lcass] C:\WINDOWS\system32\lcass.exe

    ==========

    Poista lisää poista sovelutuksesta

    Yahoo!

    Poista vikasiedossa kansio

    C:\Program Files\Yahoo!

    =========

    Lataa tuolta http://www.ccleaner.com/download/builds.aspx
    CCleaner v2.03.532- Standard Build, ÄLÄ aseenna Yahoo toolbaria!

    laita asetukset näin:
    Valinnat --> Lisäasetukset --> Ota ruksi pois kohdasta Poista vain yli 48 tuntia vanhat tilapäistiedostot.

    aja Puhdistaja > tutki nappi > aja ccleaner nappi oikea alakulma
    aja Virheet > etsi rekisteri virheitä nappi > Korjaa rekisteri virheet. nappi

    =========

    Lataa: RegSeeker.zip työpöydälle:

    Pura zip C:\RegSeeker\ kansioon. Sieltä käynnistät RegSeeker.exe ohjelman.
    Oikeasa yläkulmassa on Languages.... linkki, josta valitset Suomenkielen.
    Vasemmasta alakulmasta ruksit Luo vrmuuskopio ja sitten linkki Puhdista rekisteri
    Ruksit kaikkiin muihin kohtiin paitsi "Käyttökelvottomat.." sitten "OK" (odotat hetken).
    Ruutuun ilmestyy lista epäkelvoista rekisterimerkinnöistä, jotka alapalkista Valitse kohdasta
    klikkaat Valitse kaikki jolloin valitut saavat keltaisen pohjavärin.
    Alapalkin Toiminnot linkistä klikkaat Poista valitut kohteet
    Ponnahdusikkunaan "Kaikki valitut kohteet poistetaan ? vastaat "OK".
    Seuraavaan Ponnahdusikkunaan "Varmuuskopiot" vastaat "OK".
    Klikaa vasemmalta Lopeta RegSeeker ja käynnistä koneesi uudelleen.

    ================

    Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

    Käynnistä koneesi vikasietotilaan:

    sammuta ja käynnistä
    käynnistyksen yhteydessä hakkaa F8 nappia
    valitse nuolinäppäimellä vikasietotila
    paina enter ja enter
    valitse käyttäjätilisi
    paina kyllä

    Jossakin koneissa hakataan F8:sin sijasta F5:tä

    " Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
    " Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
    " Paina Y käynnistääksesi skriptin.
    " Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
    " Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
    " Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
    " Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
    " Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
    " Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.
     
    Last edited by a moderator: Feb 10, 2008
    Hujo, Feb 10, 2008
    #4
  5. Supaah

    Supaah Member

    Joined:
    Sep 24, 2006
    Messages:
    20
    Likes Received:
    0
    Trophy Points:
    11
    Tässä SDfix:


    SDFix: Version 1.140

    Run by J„rjestelm„nvalvoja on su 10.02.2008 at 13:58

    Microsoft Windows XP [versio 5.1.2600]

    Running From: C:\SDFix

    Safe Mode:
    Checking Services:


    Restoring Windows Registry Values
    Restoring Windows Default Hosts File

    Rebooting...


    Normal Mode:
    Checking Files:

    Trojan Files Found:

    C:\WINDOWS\system32\mssrv32.exe - Deleted





    Removing Temp Files...

    ADS Check:



    Final Check:

    catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-02-10 14:02:08
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden services & system hive ...

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
    "s1"=dword:2df9c43f
    "s2"=dword:110480d0
    "h0"=dword:00000001

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
    "p0"="C:\Program Files\DAEMON Tools Lite\"
    "h0"=dword:00000000
    "khjeh"=hex:37,60,77,1c,8c,87,c3,f0,5b,27,02,c2,56,02,f8,d0,0a,6b,88,89,41,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
    "a0"=hex:20,01,00,00,7d,7e,16,80,9a,e5,6c,ee,45,ec,e3,01,2b,2e,8d,9e,83,..
    "khjeh"=hex:7c,69,c1,d6,26,5e,79,a1,28,ff,5e,a6,e3,61,81,56,d8,ac,1d,51,af,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
    "khjeh"=hex:f3,7d,76,ce,32,ea,6d,b1,91,a2,3a,9f,7b,49,e9,f7,f1,a2,69,c8,db,..
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
    "p0"="C:\Program Files\DAEMON Tools Lite\"
    "h0"=dword:00000000
    "khjeh"=hex:37,60,77,1c,8c,87,c3,f0,5b,27,02,c2,56,02,f8,d0,0a,6b,88,89,41,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
    "a0"=hex:20,01,00,00,7d,7e,16,80,9a,e5,6c,ee,45,ec,e3,01,2b,2e,8d,9e,83,..
    "khjeh"=hex:7c,69,c1,d6,26,5e,79,a1,28,ff,5e,a6,e3,61,81,56,d8,ac,1d,51,af,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
    "khjeh"=hex:f3,7d,76,ce,32,ea,6d,b1,91,a2,3a,9f,7b,49,e9,f7,f1,a2,69,c8,db,..

    scanning hidden registry entries ...

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\BITS]
    "StateIndex"=dword:00000001
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\\x90\x2022\x20ac|\xff\xff\xff\xff"\x2022\x20ac|\xfe\xbb\xd3w\2]
    "b049C053C7D38EE4AB9A00CB3B5D2472"="C?\Program Files\Common Files\Microsoft Shared\Web Folders\PUBPLACE.HTT"

    scanning hidden files ...


    scan completed successfully
    hidden processes: 0
    hidden services: 0
    hidden files: 1


    Remaining Services:
    ------------------



    Authorized Application Key Export:

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:µTorrent"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

    Remaining Files:
    ---------------

    File Backups: - C:\SDFix\backups\backups.zip

    Files with Hidden Attributes:

    Sun 10 Feb 2008 1,249 A.SH. --- "C:\WINDOWS\system32\mmf.sys"
    Thu 20 Dec 2007 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
    Mon 10 Dec 2007 1,577,248 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\3014b396f61c00143c1634a1b93ff498\BIT4.tmp"
    Sat 26 Jan 2008 444 ...HR --- "C:\Documents and Settings\Luukko\Application Data\SecuROM\UserData\securom_v7_01.bak"
    Thu 20 Dec 2007 4,348 ...H. --- "C:\Documents and Settings\Luukko\Omat tiedostot\Omat musiikkitiedostot\K„ytt”oikeuden varmuuskopio\drmv1key.bak"
    Tue 25 Dec 2007 20 A..H. --- "C:\Documents and Settings\Luukko\Omat tiedostot\Omat musiikkitiedostot\K„ytt”oikeuden varmuuskopio\drmv1lic.bak"
    Thu 20 Dec 2007 400 A.SH. --- "C:\Documents and Settings\Luukko\Omat tiedostot\Omat musiikkitiedostot\K„ytt”oikeuden varmuuskopio\drmv2key.bak"

    Finished!

    Tässä Hijack:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 14:07, on 2008-02-10
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\runservice.exe
    C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\Winamp\winampa.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Last.fm\LastFMHelper.exe
    C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O17 - HKLM\System\CCS\Services\Tcpip\..\{CE595901-F1D8-4160-8531-3FEC051FA3AA}: NameServer = 192.168.0.254,192.168.0.255
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
    O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
    End of file - 4711 bytes


    Toivottavasti tein kaiken oikein. :/
     
    Supaah, Feb 10, 2008
    #5
  6. Hujo

    Hujo Guest

    Ohjauspaneli ja internet asetukset sinne laitat aloitus sivun mallia

    www.mtv3.fi
     
    Hujo, Feb 10, 2008
    #6
  7. Supaah

    Supaah Member

    Joined:
    Sep 24, 2006
    Messages:
    20
    Likes Received:
    0
    Trophy Points:
    11
    Pitääkö sitten vielä tehdä jotain?


     
    Supaah, Feb 10, 2008
    #7
  8. Hujo

    Hujo Guest

    Ohje AVG:n Anti-Spyware 7.5:n käyttöön
    Huom! Tässä ohjeessa sammutetaan tuo reaaliaikasuojaus (Shield). Näin vältetään tilanteet joissa suojaus estäisi esim HijackThis:n työkalun toimintaa.

    Tallenna nämä ohjeet tekstitiedostoon tai tulosta nämä, muuten et pääse niihin käsiksi vikasietotilasta

    Lataa AVG:n Anti-Spyware 7.5:n
    ja tallenna ohjelma työpöydällesi.
    o Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa.
    o Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää.
    o Käynnistä AVG:n Anti-Spyware.
    o Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta.

    o Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa.

    o Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti.
    o Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine".

    o Sitten "Reports" valikon alta:
    o Laita täppi kohtaan "Automatically generate report after every scan"
    o Ota täppi pois kohdasta"Only if threats were found"

    o Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa
    o "Resident shield is", muuta tila active:sta inactive:ksi
    o Sulje ohjelma, ÄLÄ skannaa vielä.

    Käynnistä koneesi vikasietotilaan,
    sammuta ja käynnistä
    käynnistyksen yhteydessä naputtele F8
    valitse nuoli näppäimellä vikasietotila
    paina enter ja enter

    Toisissa koneissa paukutetaan F8:sin sijasta F5:tä

    HUOM! Älä käytä muita ohjelmia AVG:n skannauksen aikana, tämä saattaa häiritä skannausta.
    o Kun vikasietotilassa, käynnistä AVG:n Anti-Spyware.
    o Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan".
    o Ewido aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa.

    Kun skannaus on valmis:
    TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions"
    o Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta.
    o Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions"
    [​IMG]
    o Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta.
    o Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle.
    o Sulje ohjelma, käynnistä kone normaalisti ja lähetä AVG:n raportti viestikejuusi.
     
    Hujo, Feb 10, 2008
    #8
  9. Supaah

    Supaah Member

    Joined:
    Sep 24, 2006
    Messages:
    20
    Likes Received:
    0
    Trophy Points:
    11
    Tuota en saa edes tehtyä kun ei tuo ohjelma anna mitään reporttia. Pakko tulla taas tänne kun kone on nyt mielestäni vielä pahemmassa pöhnässä kuin ennen. Tässä uusi hijacklogi:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 17:52, on 2008-06-01
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\runservice.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Winamp\winamp.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\Last.fm\LastFM.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.iltasanomat.fi/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{212B48AC-DF38-4656-9299-D7258BD50303}: NameServer = 192.168.0.254,192.168.0.253
    O17 - HKLM\System\CS1\Services\Tcpip\..\{212B48AC-DF38-4656-9299-D7258BD50303}: NameServer = 192.168.0.254,192.168.0.253
    O17 - HKLM\System\CS2\Services\Tcpip\..\{212B48AC-DF38-4656-9299-D7258BD50303}: NameServer = 192.168.0.254,192.168.0.253
    O20 - AppInit_DLLs:
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    O24 - Desktop Component 0: (no name) - http://www.ehmtheblueline.com/adm-playoffs2008/1024.jpg

    --
    End of file - 5934 bytes
     
    Supaah, Jun 1, 2008
    #9

Share This Page