Yhtä konetta vaivaa joku todella sitkeä haittaohjelma. Olen siivoillut vaikka millä softilla eikä tunnu poistuvan. Malwarebytes Antimalware loki: Malwarebytes' Anti-Malware 1.24 Tietokantaversio: 1052 Windows 5.1.2600 Service Pack 3 17:01:43 25.8.2008 mbam-log-8-25-2008 (17-01-43).txt Tarkistustyyppi: Täysi tarkistus (C:\|D:\|) Tarkistetut kohteet: 132116 Kulunut aika: 1 hour(s), 36 minute(s), 15 second(s) Saastuneita muistiprosesseja: 0 Saastuneita muistimoduuleja: 1 Saastuneita rekisteriavaimia: 2 Saastuneita rekisteriarvoja: 1 Saastuneita rekisterikohteita: 0 Saastuneita hakemistoja: 0 Saastuneita tiedostoja: 3 Saastuneita muistiprosesseja: (Haitallisia kohteita ei löydetty) Saastuneita muistimoduuleja: C:\WINDOWS\system32\__c00526C4.dat (Trojan.Zlob) -> Delete on reboot. Saastuneita rekisteriavaimia: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c0022d2c (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c00526c4 (Trojan.Agent) -> Delete on reboot. Saastuneita rekisteriarvoja: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00f6c9405.exe (Trojan.Agent) -> Quarantined and deleted successfully. Saastuneita rekisterikohteita: (Haitallisia kohteita ei löydetty) Saastuneita hakemistoja: (Haitallisia kohteita ei löydetty) Saastuneita tiedostoja: D:\Documents and Settings\vilma.timonen\Local Settings\Temp\_A00F6C9405.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\~.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\WINDOWS\system32\__c00526C4.dat (Trojan.Agent) -> Delete on reboot. Combofix loki: ComboFix 08-08-24.02 - Administrator 2008-08-25 17:14:00.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1035.18.196 [GMT 3:00] Running from: D:\ComboFix.exe * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . (((((((((((((((((((((((((((((((((((((( Muut poistot )))))))))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\Cache C:\WINDOWS\system32\dao350.dll C:\WINDOWS\system32\mdm.exe C:\xcrashdump.dat D:\Documents and Settings\vilma.timonen\Application Data\macromedia\Flash Player\#SharedObjects\FRAMV38C\interclick.com D:\Documents and Settings\vilma.timonen\Application Data\macromedia\Flash Player\#SharedObjects\FRAMV38C\interclick.com\ud.sol D:\Documents and Settings\vilma.timonen\Application Data\macromedia\Flash Player\#SharedObjects\FRAMV38C\www.broadcaster.com D:\Documents and Settings\vilma.timonen\Application Data\macromedia\Flash Player\#SharedObjects\FRAMV38C\www.broadcaster.com\played_list.sol D:\Documents and Settings\vilma.timonen\Application Data\macromedia\Flash Player\#SharedObjects\FRAMV38C\www.broadcaster.com\video_queue.sol D:\Documents and Settings\vilma.timonen\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com D:\Documents and Settings\vilma.timonen\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol D:\Documents and Settings\vilma.timonen\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com D:\Documents and Settings\vilma.timonen\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol D:\Documents and Settings\vilma.timonen\Cookies\vilma.timonen@adtoma.expressen[2].txt D:\Documents and Settings\vilma.timonen\Cookies\vilma.timonen@contentum[1].txt D:\Documents and Settings\vilma.timonen\Cookies\vilma.timonen@metrixlab58.customers.luna[2].txt D:\Documents and Settings\vilma.timonen\Cookies\vilma.timonen@metrixlab61.customers.luna[1].txt D:\Documents and Settings\vilma.timonen\Cookies\vilma.timonen@ra01.relev-ant[2].txt D:\Documents and Settings\vilma.timonen\Cookies\vilma.timonen@stl.p.a1.traceworks[2].txt D:\Documents and Settings\vilma.timonen\Cookies\vilma.timonen@tradedoubler[2].txt D:\Documents and Settings\vilma.timonen\Cookies\vilma.timonen@www.damernasvarld[3].txt D:\Documents and Settings\vilma.timonen\Cookies\vilma.timonen@www.expressen[2].txt D:\Documents and Settings\vilma.timonen\Cookies\vilma.timonen@www.teloos[1].txt D:\Documents and Settings\vilma.timonen\Cookies\vilma.timonen@wwwb.aftonbladet[2].txt . ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-07-25 to 2008-08-25 ))))))))))))))))) . 2008-08-23 04:25 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2008-08-23 04:25 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui 2008-08-22 12:43 . 2008-08-22 12:43 <KANSIO> d-------- D:\Documents and Settings\administrator\Application Data\F-Secure 2008-08-22 12:21 . 2008-08-22 12:21 <KANSIO> d-------- C:\WINDOWS\system32\fi 2008-08-22 12:21 . 2008-08-22 12:21 <KANSIO> d-------- C:\WINDOWS\system32\bits 2008-08-22 12:21 . 2008-08-22 12:21 <KANSIO> d-------- C:\WINDOWS\l2schemas 2008-08-22 12:17 . 2008-08-22 12:21 <KANSIO> d-------- C:\WINDOWS\ServicePackFiles 2008-08-22 12:01 . 2004-08-03 22:29 25,471 --------- C:\WINDOWS\system32\drivers\watv10nt.sys 2008-08-22 12:01 . 2004-08-03 22:29 22,271 --------- C:\WINDOWS\system32\drivers\watv06nt.sys 2008-08-22 12:01 . 2004-08-03 22:29 11,935 --------- C:\WINDOWS\system32\drivers\wadv11nt.sys 2008-08-22 12:01 . 2004-08-03 22:29 11,871 --------- C:\WINDOWS\system32\drivers\wadv09nt.sys 2008-08-22 12:01 . 2004-08-03 22:29 11,807 --------- C:\WINDOWS\system32\drivers\wadv07nt.sys 2008-08-22 12:01 . 2004-08-03 22:29 11,295 --------- C:\WINDOWS\system32\drivers\wadv08nt.sys 2008-08-22 11:59 . 2004-07-17 22:55 129,045 --------- C:\WINDOWS\system32\drivers\cxthsfs2.cty 2008-08-22 10:48 . 2008-08-22 10:48 <KANSIO> d-------- D:\Documents and Settings\All Users\Application Data\TEMP 2008-08-22 10:48 . 2008-08-22 10:50 <KANSIO> d-------- C:\Program Files\SpywareBlaster 2008-08-22 10:43 . 2008-08-22 10:43 <KANSIO> d-------- D:\Documents and Settings\administrator\Application Data\Malwarebytes 2008-08-15 08:55 . 2008-05-01 17:35 331,776 --------- C:\WINDOWS\system32\dllcache\msadce.dll 2008-08-15 08:50 . 2008-04-11 22:05 691,712 --------- C:\WINDOWS\system32\dllcache\inetcomm.dll 2008-08-14 14:20 . 2008-08-14 14:20 <KANSIO> d-------- D:\Documents and Settings\vilma.timonen\Application Data\Malwarebytes 2008-08-14 14:20 . 2008-08-14 14:20 <KANSIO> d-------- D:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-08-14 14:20 . 2008-08-14 14:20 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-08-14 14:20 . 2008-07-30 20:07 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-08-14 14:20 . 2008-07-30 20:07 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-08-14 09:40 . 2008-08-14 09:40 <KANSIO> d-------- C:\VundoFix Backups 2008-08-14 09:39 . 2008-08-14 09:39 <KANSIO> d-------- C:\Program Files\Trend Micro . (((((((((((((((((((((((((((((((((((( Find3M-raportti )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-22 07:56 --------- d-----w C:\Program Files\F-Secure 2008-08-22 07:54 --------- d-----w D:\Documents and Settings\All Users\Application Data\fssg 2008-08-14 06:36 --------- d-----w C:\Program Files\Java 2008-07-07 20:28 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-07-07 20:28 253,952 ------w C:\WINDOWS\system32\dllcache\es.dll 2008-06-24 16:44 74,240 ----a-w C:\WINDOWS\system32\mscms.dll 2008-06-24 16:44 74,240 ------w C:\WINDOWS\system32\dllcache\mscms.dll 2008-06-24 07:29 3,592,192 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll 2008-06-23 09:21 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2008-06-23 09:21 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe 2008-06-23 09:20 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-06-21 05:23 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll 2008-06-20 17:47 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-06-20 17:47 246,784 ------w C:\WINDOWS\system32\dllcache\mswsock.dll 2008-06-20 17:47 147,968 ------w C:\WINDOWS\system32\dllcache\dnsapi.dll 2008-06-20 11:51 361,600 ------w C:\WINDOWS\system32\dllcache\tcpip.sys 2008-06-20 11:40 138,496 ------w C:\WINDOWS\system32\dllcache\afd.sys 2008-06-20 11:08 225,856 ------w C:\WINDOWS\system32\dllcache\tcpip6.sys 2008-06-14 17:34 272,128 ------w C:\WINDOWS\system32\dllcache\bthport.sys . (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet ))))))))))))))))))))))))))))))))))))))))))))) . . *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 19:12 15360] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-14 10:09 68856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-01-23 10:36 155648] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-01-23 10:31 126976] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784] "DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-26 10:04 53248] "F-Secure Manager"="C:\Program Files\F-Secure\Common\FSM32.EXE" [2008-06-19 12:19 182936] "F-Secure TNB"="C:\Program Files\F-Secure\FSGUI\TNBUtil.exe" [2008-06-19 12:18 895584] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 19:12 15360] D:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\ Acrobat Assistant.lnk - C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-05-15 02:19:50 217193] Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696] VintageReminder.lnk - C:\Program Files\Vineyard\Vintage 4\VintageReminder.exe [2006-10-28 02:35:44 151659] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"= "C:\Program Files\Qualcomm\Eudora\EuShlExt.dll" [2003-09-09 14:59 86016] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2008-06-19 12:18] R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\F-Secure\HIPS\fshs.sys [2008-06-19 12:18] R2 r_server;Remote Administrator Service;C:\WINDOWS\system32\r_server.exe [2001-07-24 18:15] R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure\Anti-Virus\minifilter\fsgk.sys [2008-06-19 12:18] S3 OracleOraHome81ClientCache;OracleOraHome81ClientCache;C:\Progra~1\Oracle\BIN\ONRSD.EXE [2000-10-19 11:55] S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSfilter.sys [2008-06-19 12:18] S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSrec.sys [2008-06-19 12:18] *Newly Created Service* - CATCHME *Newly Created Service* - PROCEXP90 . 'Ajoitetut tehtävät'-kansion sisältö 2008-08-22 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 15:57] . - - - - ORPHANS REMOVED - - - - Notify-__c00526C4 - C:\WINDOWS\system32\__c00526C4.dat . ------- Supplementary Scan ------- . R0 -: HKCU-Main,Start Page = hxxp://www.euro.dell.com/ O8 -: Vie Microsoft E&xceliin - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-25 17:17:54 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-08-25 17:20:23 ComboFix-quarantined-files.txt 2008-08-25 14:20:20 Pre-Run: 6,564,229,120 tavua vapaana Post-Run: 6,561,333,248 tavua vapaana 150 --- E O F --- 2008-08-25 06:02:40 Fixwareout loki: Username "Administrator" - 2008-08-25 17:23:41 [Fixwareout edited 9/01/2007] ~~~~~ Prerun check DNS-tulkintatoiminnon välimuistin tyhjentäminen onnistui. System was rebooted successfully. ~~~~~ Postrun check HKLM\SOFTWARE\~\Winlogon\ "System"="" .... .... ~~~~~ Misc files. .... ~~~~~ Checking for older varients. .... ~~~~~ Current runs (hklm hkcu "run" Keys Only) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\\WINDOWS\\system32\\igfxtray.exe" "HotKeysCmds"="C:\\WINDOWS\\system32\\hkcmd.exe" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_07\\bin\\jusched.exe\"" "DVDLauncher"="\"C:\\Program Files\\CyberLink\\PowerDVD\\DVDLauncher.exe\"" "F-Secure Manager"="\"C:\\Program Files\\F-Secure\\Common\\FSM32.EXE\" /splash" "F-Secure TNB"="\"C:\\Program Files\\F-Secure\\FSGUI\\TNBUtil.exe\" /CHECKALL /WAITFORSW" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe" "swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe" .... Hosts file was reset, If you use a custom hosts file please replace it... ~~~~~ End report ~~~~~ HJT-loki (em. softien ajon jälkeen): Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:31, on 2008-08-25 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16705) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe C:\Program Files\F-Secure\Common\FSMA32.EXE C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE C:\Program Files\Dell\OpenManage\Client\Iap.exe C:\WINDOWS\system32\inetsrv\inetinfo.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\F-Secure\Common\FSMB32.EXE C:\WINDOWS\system32\r_server.exe C:\Program Files\F-Secure\Common\FCH32.EXE C:\Program Files\F-Secure\Anti-Virus\fssm32.exe C:\Program Files\F-Secure\Common\FNRB32.EXE C:\Program Files\F-Secure\Anti-Virus\fsqh.exe C:\Program Files\F-Secure\Common\FAMEH32.EXE C:\Program Files\F-Secure\FSAUA\program\fsaua.exe C:\Program Files\F-Secure\Common\FIH32.EXE C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe C:\Program Files\F-Secure\Anti-Virus\fsav32.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\hkcmd.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\Program Files\F-Secure\Common\FSM32.EXE C:\Program Files\F-Secure\FSGUI\fsguidll.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\Program Files\Vineyard\Vintage 4\VintageReminder.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar5.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar5.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: VintageReminder.lnk = C:\Program Files\Vineyard\Vintage 4\VintageReminder.exe O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1219393993612 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = toy.local O17 - HKLM\Software\..\Telephony: DomainName = toy.local O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = toy.local O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = toy.local O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corporation - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure\FSAUA\program\fsaua.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Iap - Dell Inc - C:\Program Files\Dell\OpenManage\Client\Iap.exe O23 - Service: OracleOraHome81ClientCache - Unknown owner - C:\Progra~1\Oracle\BIN\ONRSD.EXE O23 - Service: Remote Administrator Service (r_server) - Unknown owner - C:\WINDOWS\system32\r_server.exe -- End of file - 7302 bytes Vieläkö jotain putsattavaa olisi? F-Secure ei löydä enää mitään.
Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi. Käynnistä koneesi vikasietotilaan: sammuta ja käynnistä käynnistyksen yhteydessä hakkaa F8 nappia valitse nuolinäppäimellä vikasietotila paina enter ja enter valitse käyttäjätilisi paina kyllä Jossakin koneissa hakataan F8:sin sijasta F5:tä " Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix. " Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman. " Paina Y käynnistääksesi skriptin. " Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot". " Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen. " Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta. " Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished". " Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle. " Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.
