Spyware koneessa :-/

Aras88 · Jun 29, 2006

Kaveri on sekoillut jotain koneellani ja nyt siinä joku spyware jota en saa pois vaikka kokeilin registery fix,ad-ware etc.
mut siin on vieläkin se.

Logfile of HijackThis v1.99.1
Scan saved at 0:18:17, on 30.6.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\atmclk.exe
C:\WINDOWS\system32\dcomcfg.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\BearShare\BearShare.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\YMANTE~1\dexplore.exe
C:\Documents and Settings\Aras88\Application Data\??stem32\l?gonui.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HPQ\shared\hpqwmi.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Aras88\Omat tiedostot\Spyware and Virus\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN Search -työkalurivi - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\fi-fi\msntb.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [InternetCalls] "C:\Program Files\InternetCalls.com\InternetCalls\InternetCalls.exe" -nosplash -minimized
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [Drst] "C:\WINDOWS\YMANTE~1\dexplore.exe" -vt yazb
O4 - HKCU\..\Run: [Fndjnch] C:\Documents and Settings\Aras88\Application Data\??stem32\l?gonui.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Windows-työpöytähaku.lnk = C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\fi-fi\bin\WindowsSearch.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\fi-fi\msntb.dll/search.htm
O8 - Extra context menu item: Avaa uuteen etuvälilehteen - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\fi-fi\msntabres.dll/230?b5928b1fd33d4d8ab4ceab25232f1f38
O8 - Extra context menu item: Avaa uuteen taustavälilehteen - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\fi-fi\msntabres.dll/229?b5928b1fd33d4d8ab4ceab25232f1f38
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1143927185625
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: C:\WINDOWS\system32\explorer.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\shared\hpqwmi.exe
O23 - Service: iPod-palvelu (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect -palvelu (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

Kellopeli · Jun 29, 2006

Terve Aras88!
Lataa SmitfraudFix -> http://siri.urz.free.fr/Fix/SmitfraudFix.zip
Pura sisältö (kansio nimeltä SmitfraudFix) työpöydällesi:

Avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
Valitse optio #1 - Search kirjoittamalla 1 ja painamalla "Enter"; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa).
Postita tämän tekstitiedoston sisältö viestiketjuusi.

Aras88 · Jun 30, 2006

Ei taida näyttää hyvältä :-/

SmitFraudFix v2.65

Scan done at 20:35:42,09, pe 30.06.2006
Run from C:\Documents and Settings\Aras88\Omat tiedostot\Spyware and Virus\SmitfraudFix
OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT
Fix ran in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\atmclk.exe FOUND !
C:\WINDOWS\system32\dcomcfg.exe FOUND !
C:\WINDOWS\system32\hp???.tmp FOUND !
C:\WINDOWS\system32\hp????.tmp FOUND !
C:\WINDOWS\system32\hvcycg.dll FOUND !
C:\WINDOWS\system32\ld????.tmp FOUND !
C:\WINDOWS\system32\ot.ico FOUND !
C:\WINDOWS\system32\regperf.exe FOUND !
C:\WINDOWS\system32\simpole.tlb FOUND !
C:\WINDOWS\system32\stdole3.tlb FOUND !
C:\WINDOWS\system32\ts.ico FOUND !
C:\WINDOWS\system32\1024\ FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Aras88\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Start Menu

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Aras88\Suosikit

C:\DOCUME~1\Aras88\Suosikit\Antivirus Test Online.url FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» Desktop

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Nykyinen kotisivu"

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{7916f057-223f-4612-ac84-e882cbe043d4}"="bals"

[HKEY_CLASSES_ROOT\CLSID\{7916f057-223f-4612-ac84-e882cbe043d4}\InProcServer32]
@="C:\WINDOWS\system32\hvcycg.dll"

[HKEY_CURRENT_USER\Software\Classes\CLSID\{7916f057-223f-4612-ac84-e882cbe043d4}\InProcServer32]
@="C:\WINDOWS\system32\hvcycg.dll"

»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection

»»»»»»»»»»»»»»»»»»»»»»»» End

-kemisti- · Jul 1, 2006

Etsi lisää/poista sovelluksesta PuritySCAN By OIN, OuterInfo, OIN tai ohjelma jolla samantapainen nimi (esim. Snowball wars by OIN) , ja poista sen asennus.

Käynnistä uudelleen ja poista tämä hakemisto, jos löytyy
C:\Program Files\PurityScan

Jos ohjelmaa ei löydy, lataa ja aja tämä
http://www.outerinfo.com/OiUninstaller.exe Uninstaller

http://www.outerinfo.com/howto.html
Ohje englanniksi uninstallerin käyttöön, jos tarvis

Käynnistä uudelleen ja poista tämä hakemisto, jos löytyy
C:\Program Files\PurityScan

Hae KillBox

http://www.bleepingcomputer.com/files/spyware/KillBox.zip

Pura,avaa ja täppi kohtaan Delete on Reboot
Sitte kopioi rivi tosta alapuolelta

C:\WINDOWS\system32\explorer.dll

Sitten KillBoxissa ylhäältä File > Paste from Clipboard
Valitse "All Files".Sen jälkeen paina Delete (punainen, jossa on valkonen X)
Vastaa myöntävästi kysymyksiin ja jos kone ei itestään käynnisty uudestaan,niin käynnistä se.

Printtaa ohjeet ulos.

Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi.

Kun vikasietotilassa, avaa SmitfraudFix-kansio ja tuplaklikkaa smitfraudfix.cmd
Valitse optio #2 - Clean kirjoittamalla 2 ja painamalla "Enter" poistaaksesi tarttuneet tiedostot.

Sinulta kysytään: "Registry cleaning - Do you want to clean the registry ?"; vastaa "Yes" kirjoittamalla Y ja paina "Enter" poistaaksesi työpöydän taustakuvan ja puhdistaaksesi tarttuneet rekisteriavaimet.

Työkalu tarkistaa jos wininet.dll on tarttunut. Sinua saatetaan pyytää korvaamaan tarttunut .dll (jos löytyy); vastaa "Yes" kirjoittamalla Y ja painamalla "Enter".

Työkalun saattaa tarvita käynnistää kone uudelleen; jos ei tee niin, käynnistä normaaliin Windowsiin.
Tekstitiedosto ilmestyy, puhdistusprosessin jäljiltä; kopioi & liitä tämän raportin tulokset vastaukseesi.
Raportti löytyy paikalliselta levyltäsi, useimmiten C:\rapport.txt.

Lähetä sen sisältö ja uusi HjT-loki tänne.

Aras88 · Jul 1, 2006

oho! asia on tainnut ratketa

vai?

Logfile of HijackThis v1.99.1
Scan saved at 16:17:46, on 1.7.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HPQ\shared\hpqwmi.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\TEMP\winFA.tmp.exe
C:\Documents and Settings\Aras88\Omat tiedostot\Spyware and Virus\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nettiauto.com/home.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN Search Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [InternetCalls] "C:\Program Files\InternetCalls.com\InternetCalls\InternetCalls.exe" -nosplash -minimized
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\en-us\bin\WindowsSearch.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll/search.htm
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0001.1119\en-us\msntabres.dll/229?1e9f36b04edc41ed8a661e32624786
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0001.1119\en-us\msntabres.dll/230?1e9f36b04edc41ed8a661e32624786
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1143927185625
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: C:\WINDOWS\system32\explorer.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\shared\hpqwmi.exe
O23 - Service: iPod-palvelu (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect -palvelu (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

SmitFraudFix v2.65

Scan done at 16:04:08,71, la 01.07.2006
Run from C:\Documents and Settings\Aras88\Omat tiedostot\Spyware and Virus\SmitfraudFix
OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT
Fix ran in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{7916f057-223f-4612-ac84-e882cbe043d4}"="bals"

[HKEY_CLASSES_ROOT\CLSID\{7916f057-223f-4612-ac84-e882cbe043d4}\InProcServer32]
@="C:\WINDOWS\system32\hvcycg.dll"

[HKEY_CURRENT_USER\Software\Classes\CLSID\{7916f057-223f-4612-ac84-e882cbe043d4}\InProcServer32]
@="C:\WINDOWS\system32\hvcycg.dll"

»»»»»»»»»»»»»»»»»»»»»»»» Killing process

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

C:\WINDOWS\system32\hvcycg.dll -> Hoax.Win32.Renos.gen.b
C:\WINDOWS\system32\hvcycg.dll -> Deleted

»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\WINDOWS\system32\atmclk.exe Deleted
C:\WINDOWS\system32\dcomcfg.exe Deleted
C:\WINDOWS\system32\hp???.tmp Deleted
C:\WINDOWS\system32\ld????.tmp Deleted
C:\WINDOWS\system32\ot.ico Deleted
C:\WINDOWS\system32\regperf.exe Deleted
C:\WINDOWS\system32\simpole.tlb Deleted
C:\WINDOWS\system32\stdole3.tlb Deleted
C:\WINDOWS\system32\1024\ Deleted
C:\DOCUME~1\Aras88\Suosikit\Antivirus Test Online.url Deleted

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix

-kemisti- · Jul 1, 2006

Fixaa tuo rivi:

O20 - AppInit_DLLs: C:\WINDOWS\system32\explorer.dll

Lataa Atribunen http://www.atribune.org/ccount/click.php?id=1
ATF Cleaner

Ohjeet;

Tupla-klikkaa ATF-Cleaner.exe käynnistääksesi ohjelman.

Main:n alla valitse: Select All
Klikkaa Empty Selected-valintaa.

Jos käytät FireFoxia selaimenasiKlikkaa Firefox yläpuolelta ja valitse: Select All
Klikkaa Empty Selected valintaa.
HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy.

Jos käytät Operaa selaimenasiKlikkaa Opera yläpuolelta ja valitse: Select All
Klikkaa Empty Selected valintaa taas.
HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy.
Klikkaa Exit päävalikosta sulkeaksesi ohjelman.

Käynnistä kone uudelleen.

Skannaa koneesi http://www.kaspersky.com/downloads/kws/kavwebscan.html[b]Kaspersky Online Skannerilla[/b]

Sinulta kysytään sallitko ActiveX -komponentin asentamisen Kasperskyltä, klikkaa Kyllä.
[*] Ohjelma käynnistyy ja aloittaa viimeisimpien tunnistetiedostojen lataamisen.
[*] Kun skanneri on asennettu ja tunnistetiedot ladattu, klikkaa Next.
[*] Klikkaa nyt asetuksia, Scan Settings
[*] Tarkista asetuksista, että seuraavat ovat valittuina:

o Scan using the following Anti-Virus database:

+ Extended (Jos valittavissa, muuten valitse Standard)

o Scan Options:

+ Scan Archives
+ Scan Mail Bases

[*] Klikkaa OK
[*] Nyt valitse "select a target to scan" otsikon alta Oma Tietokone, My Computer
[*] Skannaus vie aikaa, joten ole kärsivällinen. Kun skannaus on valmis saat ilmoituksen, jos koneesi on saastunut.
[*] Klikkaa nyt Save as Text-painiketta.
[*] Tallenna tiedosto työpöydällesi.
[*] Kopioi ja Liitä tiedoston sisältö seuraavaan vastaukseesi.

Lähetä myös uusi HjT-loki.

Aras88 · Jul 3, 2006

Moro! sori et kesti

tässä olis se Kaspersky scan report ja hi-logi

Monday, July 03, 2006 5:07:01 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version: 5.0.78.0
Kaspersky Anti-Virus database last update: 3/07/2006
Kaspersky Anti-Virus database records: 204352

Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
C:\
D:\
E:\

Scan Statistics
Total number of scanned objects 84413
Number of viruses found 45
Number of infected objects 124
Number of suspicious objects 1
Duration of the scan process 02:08:31

Infected Object Name Virus Name Last Action
C:\!KillBox\explorer.dll Infected: not-a-virus:AdWare.Win32.PurityScan.en skipped

C:\Documents and Settings\All Users\Application Data\BlehDriveBitsThis\ROAM BASE.exe Infected: not-a-virus:AdWare.Win32.Lop.bb skipped

C:\Documents and Settings\Aras88\.housecall\Quarantine\VVSNInst.exe.bac_a05224 Infected: not-a-virus:AdWare.Win32.SaveNow.bo skipped

C:\Documents and Settings\Aras88\Local Settings\Temporary Internet Files\Content.IE5\2ZGXCTO3\yb[1].exe/data0002 Infected: Trojan-Downloader.Win32.PurityScan.cq skipped

C:\Documents and Settings\Aras88\Local Settings\Temporary Internet Files\Content.IE5\2ZGXCTO3\yb[1].exe NSIS: infected - 1 skipped

C:\Documents and Settings\Aras88\Local Settings\Temporary Internet Files\Content.IE5\5FBB1POA\install[1].htm Infected: Exploit.HTML.CodeBaseExec skipped

C:\Documents and Settings\Aras88\Local Settings\Temporary Internet Files\Content.IE5\AF2XC5YZ\18WheelsofSteelConvoy-dm[1].exe Infected: not-a-virus:AdWare.Win32.Trymedia.b skipped

C:\Documents and Settings\Aras88\Local Settings\Temporary Internet Files\Content.IE5\CP47K7SN\ie0604[1].htm Infected: Trojan-Downloader.JS.Agent.af skipped

C:\Documents and Settings\Aras88\Local Settings\Temporary Internet Files\Content.IE5\M4LNJ6DF\L[1].exe Infected: Trojan-Downloader.Win32.Small.cvw skipped

C:\Documents and Settings\Aras88\Local Settings\Temporary Internet Files\Content.IE5\RVDV31GW\adv470[1].htm Infected: Trojan-Downloader.JS.Agent.ab skipped

C:\Documents and Settings\Aras88\Local Settings\Temporary Internet Files\Content.IE5\UVQ34LY9\l11[1].exe Infected: Trojan-Downloader.Win32.Zlob.sh skipped

C:\Documents and Settings\Aras88\Local Settings\Temporary Internet Files\Content.IE5\UVQ34LY9\srveay[1].exe Infected: Trojan.Win32.Pakes skipped

C:\Documents and Settings\Aras88\Local Settings\Temporary Internet Files\Content.IE5\W7DFIUZ5\bgates[1].exe Infected: Trojan.Win32.Dialer.pz skipped

C:\Documents and Settings\Aras88\Local Settings\Temporary Internet Files\Content.IE5\WJ336S1L\13[1].htm Suspicious: Exploit.HTML.CodeBaseExec skipped

C:\Documents and Settings\Aras88\Local Settings\Temporary Internet Files\Content.IE5\XLFVMWUD\srvdvr[1].exe Infected: Trojan.Win32.Pakes skipped

C:\Documents and Settings\Aras88\Omat tiedostot\Spyware and Virus\backups\backup-20060429-151653-706.dll Infected: Trojan-Downloader.Win32.Swizzor.fg skipped

C:\Documents and Settings\HP users\Local Settings\Temporary Internet Files\Content.IE5\0HUV09EZ\bgates[1].exe Infected: Trojan.Win32.Dialer.pz skipped

C:\Documents and Settings\HP users\Local Settings\Temporary Internet Files\Content.IE5\85IF016R\srvxzj[1].exe Infected: Trojan.Win32.Pakes skipped

C:\My Downloads\(Crack) diner dash 2 key.zip/YSB_toolBar.exe/stream Infected: Trojan-Downloader.Win32.IstBar.no skipped

C:\My Downloads\(Crack) diner dash 2 key.zip/YSB_toolBar.exe Infected: Trojan-Downloader.Win32.IstBar.no skipped

C:\My Downloads\(Crack) diner dash 2 key.zip ZIP: infected - 2 skipped

C:\Program Files\BitTorrent\uninstall.exe/stream/data0003 Infected: not-a-virus:RiskTool.Win32.PsKill.n skipped

C:\Program Files\BitTorrent\uninstall.exe/stream Infected: not-a-virus:RiskTool.Win32.PsKill.n skipped

C:\Program Files\BitTorrent\uninstall.exe NSIS: infected - 2 skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\06DD42E7.exe Infected: Worm.Win32.VB.an skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\07532A65.exe Infected: Worm.Win32.VB.an skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\0A0762C8.htm Infected: Exploit.JS.CVE-2006-1359.b skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\0BD51056.zip/BlackBox.class Infected: Exploit.Java.ByteVerify skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\0BD51056.zip/VerifierBug.class Infected: Exploit.Java.ByteVerify skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\0BD51056.zip/Beyond.class Infected: Trojan-Downloader.Java.OpenConnection.aa skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\0BD51056.zip ZIP: infected - 3 skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\0BD51056.zip CryptFF: infected - 3 skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\0E9E55DC.exe Infected: Trojan-Downloader.Win32.Small.on skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\12550AAD.exe Infected: Trojan-Downloader.Win32.Small.on skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\13E130C3.exe Infected: Worm.Win32.VB.an skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\1E1653CE.wmf Infected: Exploit.Win32.IMG-WMF.v skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\1E197DCA.wmf Infected: Exploit.Win32.IMG-WMF.v skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\28417A1F.exe Infected: Trojan-Downloader.Win32.Small.on skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\28F875E3.wmf Infected: Exploit.Win32.IMG-WMF.v skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\29B01335.exe Infected: Trojan-Downloader.Win32.Small.on skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\2B484711.zip/BlackBox.class Infected: Exploit.Java.ByteVerify skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\2B484711.zip/VerifierBug.class Infected: Exploit.Java.ByteVerify skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\2B484711.zip/Beyond.class Infected: Trojan-Downloader.Java.OpenConnection.aa skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\2B484711.zip ZIP: infected - 3 skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\2B484711.zip CryptFF: infected - 3 skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\3B7B345B.zip/BlackBox.class Infected: Exploit.Java.ByteVerify skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\3B7B345B.zip/VerifierBug.class Infected: Exploit.Java.ByteVerify skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\3B7B345B.zip/Beyond.class Infected: Trojan-Downloader.Java.OpenConnection.aa skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\3B7B345B.zip ZIP: infected - 3 skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\3B7B345B.zip CryptFF: infected - 3 skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\3C8B0FDF.wmf Infected: Exploit.Win32.IMG-WMF.v skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\3C8E39DC.wmf Infected: Exploit.Win32.IMG-WMF.v skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\3CC13950.exe Infected: Trojan-Downloader.Win32.Small.cjd skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\3CD20B3E.htm Infected: Exploit.JS.CVE-2006-1359.c skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\40407B1C.exe Infected: Trojan.Win32.Crypt.e skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\44BA3815.wmf Infected: Exploit.Win32.IMG-WMF.v skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\452B7AD9.exe Infected: Worm.Win32.VB.an skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\452B7AD9.VBS Infected: Email-Worm.VBS.Gedza skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\45D25822.exe Infected: Worm.Win32.VB.an skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49E329A8.exe Infected: Worm.Win32.VB.an skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\4D344E01.exe Infected: Worm.Win32.VB.an skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\4F120ECD.exe Infected: Trojan.Win32.Crypt.e skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\51975A01.wmf Infected: Exploit.Win32.IMG-WMF.v skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\551A416D.exe Infected: Trojan-Downloader.Win32.Small.on skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\57846B6E.exe Infected: Worm.Win32.VB.an skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\5788156B.VBS Infected: Email-Worm.VBS.Gedza skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\5DDF5AD0.exe Infected: Trojan-Downloader.Win32.Small.cjd skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\5DE62EC9.htm Infected: Exploit.JS.CVE-2006-1359.c skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\624158F4.exe Infected: Trojan-Downloader.Win32.Small.on skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\6DB91ABD.exe Infected: Trojan-Downloader.Win32.Small.on skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP102\A0018223.tlb Infected: Trojan-Downloader.Win32.Zlob.wa skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP102\A0018282.exe Infected: Trojan-Downloader.Win32.Zlob.wa skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP102\A0018284.tlb Infected: Trojan-Downloader.Win32.Zlob.wa skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP102\A0018303.tlb Infected: Trojan-Downloader.Win32.Zlob.vy skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP102\A0018306.exe Infected: Trojan-Downloader.Win32.Zlob.vy skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP102\A0018307.exe Infected: Trojan-Downloader.Win32.Zlob.wb skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP102\A0018315.dll Infected: Trojan-Downloader.Win32.IstBar.ff skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP102\A0018325.tlb Infected: Trojan-Downloader.Win32.Zlob.vy skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP102\A0018337.tlb Infected: Trojan-Downloader.Win32.Zlob.vy skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP102\A0018342.exe Infected: Trojan-Downloader.Win32.Zlob.vy skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP103\A0018516.tlb Infected: Trojan-Downloader.Win32.Zlob.wd skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP103\A0018524.exe/stream/data0003 Infected: not-a-virus:RiskTool.Win32.PsKill.n skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP103\A0018524.exe/stream Infected: not-a-virus:RiskTool.Win32.PsKill.n skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP103\A0018524.exe NSIS: infected - 2 skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP103\A0018630.tlb Infected: Trojan-Downloader.Win32.Zlob.wd skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP103\A0018635.exe Infected: Trojan-Downloader.Win32.Zlob.wd skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP103\A0018636.exe Infected: Trojan-Downloader.Win32.Zlob.wi skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP103\A0018649.exe Infected: Trojan-Downloader.Win32.PurityScan.cq skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP103\A0018650.exe Infected: Trojan-Downloader.Win32.PurityScan.cq skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP103\A0018658.tlb Infected: Trojan-Downloader.Win32.Zlob.wj skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP103\A0018670.dll Infected: not-a-virus:AdWare.Win32.PurityScan.en skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP103\A0018678.tlb Infected: Trojan-Downloader.Win32.Zlob.wj skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP103\A0019695.tlb Infected: Trojan-Downloader.Win32.Zlob.wj skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP103\A0019706.dll Infected: not-virus:Hoax.Win32.Renos.dt skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP103\A0019707.exe Infected: Trojan-Downloader.Win32.Zlob.wk skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP103\A0019708.exe Infected: Trojan-Downloader.Win32.Zlob.wj skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP103\A0019710.exe Infected: Trojan-Downloader.Win32.Zlob.wf skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP103\A0019711.tlb Infected: Trojan-Downloader.Win32.Zlob.wj skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP106\A0022066.exe Infected: not-a-virus:AdWare.Win32.Trymedia.b skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP37\A0001772.exe Infected: not-a-virus:AdWare.Win32.Lop.ai skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP38\A0001792.exe Infected: not-a-virus:AdWare.Win32.SaveNow.by skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP38\A0001793.dll Infected: not-a-virus:AdWare.Win32.SaveNow.cb skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP45\A0005320.exe/data0002 Infected: not-a-virus:AdWare.Win32.Beginto.a skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP45\A0005320.exe/data0003 Infected: not-a-virus:AdWare.Win32.Beginto.a skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP45\A0005320.exe NSIS: infected - 2 skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP45\A0005321.exe/data0002 Infected: not-a-virus:AdWare.Win32.Beginto.a skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP45\A0005321.exe/data0003 Infected: not-a-virus:AdWare.Win32.Beginto.a skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP45\A0005321.exe NSIS: infected - 2 skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP47\A0005347.exe Infected: not-a-virus:AdWare.Win32.SaveNow.bo skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP48\A0005505.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.601 skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP49\A0006509.exe Infected: Trojan-Downloader.Win32.Adload.ai skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP49\A0006510.exe Infected: Trojan-Downloader.Win32.VB.zg skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP57\A0008039.exe Infected: Trojan-Downloader.Win32.Swizzor.fg skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP57\A0008056.exe Infected: Trojan-Downloader.Win32.Swizzor.fg skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP57\A0008057.exe Infected: Trojan-Downloader.Win32.Swizzor.co skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP57\A0008058.exe Infected: not-a-virus:AdWare.Win32.Lop.bb skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP99\A0018064.dll Infected: not-a-virus:AdWare.Win32.SaveNow.cb skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP99\A0018067.exe Infected: not-a-virus:AdWare.Win32.SaveNow.cb skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP99\A0018068.exe Infected: not-a-virus:AdWare.Win32.SaveNow.cb skipped

C:\WINDOWS\system32\mljijji.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.cd skipped

C:\WINDOWS\system32\winhab32.dll Infected: Trojan.Win32.Agent.vg skipped

C:\WINDOWS\Temp\win17.tmp.exe Infected: Trojan.Win32.Pakes skipped

C:\WINDOWS\Temp\win1D4.tmp.exe Infected: Trojan-Downloader.Win32.Small.cvw skipped

C:\WINDOWS\Temp\win77.tmp.exe Infected: Trojan-Downloader.Win32.Small.cvw skipped

C:\WINDOWS\Temp\winF47.tmp.exe Infected: Trojan.Win32.Pakes skipped

Scan process completed.

Logfile of HijackThis v1.99.1
Scan saved at 17:13:15, on 3.7.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HPQ\shared\hpqwmi.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Aras88\Omat tiedostot\Spyware and Virus\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nettiauto.com/home.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN Search Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [InternetCalls] "C:\Program Files\InternetCalls.com\InternetCalls\InternetCalls.exe" -nosplash -minimized
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\en-us\bin\WindowsSearch.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll/search.htm
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0001.1119\en-us\msntabres.dll/229?1e9f36b04edc41ed8a661e32624786
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0001.1119\en-us\msntabres.dll/230?1e9f36b04edc41ed8a661e32624786
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1143927185625
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\shared\hpqwmi.exe
O23 - Service: iPod-palvelu (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect -palvelu (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

-kemisti- · Jul 4, 2006

Sori myös että kesti

Poista:

C:\!KillBox\explorer.dll
C:\Documents and Settings\All Users\Application Data\BlehDriveBitsThis
C:\WINDOWS\system32\winhab32.dll
C:\WINDOWS\Temp\win17.tmp.exe
C:\WINDOWS\Temp\win1D4.tmp.exe
C:\WINDOWS\Temp\win77.tmp.exe
C:\WINDOWS\Temp\winF47.tmp.exe

Tyhjennä(poista kaikki tiedostot ja alihakemistot, älä itse hakemistoja):

C:\Documents and Settings\Aras88\Local Settings\Temporary Internet Files
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine
C:\Documents and Settings\Aras88\.housecall\Quarantine

Putsaa järjestelmän palautus -> http://www.pchell.com/virus/systemrestore.shtml

Skannaa uudelleen Kasperskyllä.

Lähetä uusi Kasperskyn raportti ja uusi HjT-loki.

Aras88 · Jul 5, 2006

Tässä ne raportit

KASPERSKY ON-LINE SCANNER REPORT
Wednesday, July 05, 2006 11:33:38 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version: 5.0.78.0
Kaspersky Anti-Virus database last update: 5/07/2006
Kaspersky Anti-Virus database records: 204958

Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
C:\
D:\
E:\

Scan Statistics
Total number of scanned objects 66444
Number of viruses found 7
Number of infected objects 13
Number of suspicious objects 0
Duration of the scan process 02:01:25

Infected Object Name Virus Name Last Action
C:\Documents and Settings\Aras88\Local Settings\Temporary Internet Files\Content.IE5\AF2XC5YZ\18WheelsofSteelConvoy-dm[1].exe Infected: not-a-virus:AdWare.Win32.Trymedia.b skipped

C:\Documents and Settings\Aras88\Local Settings\Temporary Internet Files\Content.IE5\M4LNJ6DF\bgates[1].exe Infected: Trojan.Win32.Dialer.pz skipped

C:\Documents and Settings\Aras88\Omat tiedostot\Spyware and Virus\backups\backup-20060429-151653-706.dll Infected: Trojan-Downloader.Win32.Swizzor.fg skipped

C:\Documents and Settings\HP users\Local Settings\Temporary Internet Files\Content.IE5\0HUV09EZ\bgates[1].exe Infected: Trojan.Win32.Dialer.pz skipped

C:\Documents and Settings\HP users\Local Settings\Temporary Internet Files\Content.IE5\85IF016R\srvxzj[1].exe Infected: Trojan.Win32.Pakes skipped

C:\Documents and Settings\Rahim.SUPERMACHINE\Local Settings\Temporary Internet Files\Content.IE5\EL2BAZUD\bgates[2].exe Infected: Trojan.Win32.Dialer.pz skipped

C:\Program Files\BitTorrent\uninstall.exe/stream/data0003 Infected: not-a-virus:RiskTool.Win32.PsKill.n skipped

C:\Program Files\BitTorrent\uninstall.exe/stream Infected: not-a-virus:RiskTool.Win32.PsKill.n skipped

C:\Program Files\BitTorrent\uninstall.exe NSIS: infected - 2 skipped

C:\WINDOWS\system32\mljijji.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.cd skipped

C:\WINDOWS\system32\winhab32.dll Infected: Trojan.Win32.Agent.vg skipped

C:\WINDOWS\Temp\win9D.tmp.exe Infected: Trojan.Win32.Pakes skipped

C:\WINDOWS\Temp\winD28.tmp.exe Infected: Trojan.Win32.Pakes skipped

Scan process completed.

Logfile of HijackThis v1.99.1
Scan saved at 23:42:28, on 5.7.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HPQ\shared\hpqwmi.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Toolbar Suite\SL\02.05.0001.1119\en-us\msn_sl.exe
C:\Documents and Settings\Aras88\Omat tiedostot\Spyware and Virus\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nettiauto.com/home.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.hp.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN Search Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [InternetCalls] "C:\Program Files\InternetCalls.com\InternetCalls\InternetCalls.exe" -nosplash -minimized
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\en-us\bin\WindowsSearch.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll/search.htm
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0001.1119\en-us\msntabres.dll/229?1e9f36b04edc41ed8a661e32624786
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0001.1119\en-us\msntabres.dll/230?1e9f36b04edc41ed8a661e32624786
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1143927185625
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\shared\hpqwmi.exe
O23 - Service: iPod-palvelu (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect -palvelu (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

-kemisti- · Jul 6, 2006

Poista:

C:\WINDOWS\system32\winhab32.dll (voi vaatia poistoa vikasietotilassa)
C:\WINDOWS\Temp\win9D.tmp.exe
C:\WINDOWS\Temp\winD28.tmp.exe

Tyhjennä IE:n väliaikaistiedostot.

Skannaa uudelleen Kasperskyllä.

Lähetä uusi Kasperskyn raportti ja uusi HjT-loki.

laski92 · Jul 6, 2006

mulle tuli kerran melkein trojjalainen mut ku anti sano et on tulos niin nyppäsin netti johon seinäst ja tarkistin mitää ei ollu tullu

Aras88 · Jul 7, 2006

KASPERSKY ON-LINE SCANNER REPORT
Friday, July 07, 2006 9:02:27 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version: 5.0.78.0
Kaspersky Anti-Virus database last update: 7/07/2006
Kaspersky Anti-Virus database records: 205698

Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
C:\
D:\
E:\

Scan Statistics
Total number of scanned objects 59099
Number of viruses found 7
Number of infected objects 11
Number of suspicious objects 0
Duration of the scan process 01:32:07

Infected Object Name Virus Name Last Action
C:\Documents and Settings\Aras88\Local Settings\Temporary Internet Files\Content.IE5\AF2XC5YZ\18WheelsofSteelConvoy-dm[1].exe Infected: not-a-virus:AdWare.Win32.Trymedia.b skipped

C:\Documents and Settings\Aras88\Omat tiedostot\Spyware and Virus\backups\backup-20060429-151653-706.dll Infected: Trojan-Downloader.Win32.Swizzor.fg skipped

C:\Documents and Settings\HP users\Local Settings\Temporary Internet Files\Content.IE5\0HUV09EZ\bgates[1].exe Infected: Trojan.Win32.Dialer.pz skipped

C:\Documents and Settings\HP users\Local Settings\Temporary Internet Files\Content.IE5\85IF016R\srvxzj[1].exe Infected: Trojan.Win32.Pakes skipped

C:\Documents and Settings\Rahim.SUPERMACHINE\Local Settings\Temporary Internet Files\Content.IE5\EL2BAZUD\bgates[2].exe Infected: Trojan.Win32.Dialer.pz skipped

C:\Program Files\BitTorrent\uninstall.exe/stream/data0003 Infected: not-a-virus:RiskTool.Win32.PsKill.n skipped

C:\Program Files\BitTorrent\uninstall.exe/stream Infected: not-a-virus:RiskTool.Win32.PsKill.n skipped

C:\Program Files\BitTorrent\uninstall.exe NSIS: infected - 2 skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP1\A0000021.exe Infected: Trojan.Win32.Pakes skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP1\A0000071.dll Infected: Trojan.Win32.Agent.vg skipped

C:\WINDOWS\system32\mljijji.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.cd skipped

Scan process completed.

Logfile of HijackThis v1.99.1
Scan saved at 21:12:09, on 7.7.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HPQ\shared\hpqwmi.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\MSN Toolbar Suite\SL\02.05.0001.1119\en-us\msn_sl.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Aras88\Omat tiedostot\Spyware and Virus\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nettiauto.com/home.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.hp.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN Search Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [InternetCalls] "C:\Program Files\InternetCalls.com\InternetCalls\InternetCalls.exe" -nosplash -minimized
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\en-us\bin\WindowsSearch.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll/search.htm
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0001.1119\en-us\msntabres.dll/229?1e9f36b04edc41ed8a661e32624786
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0001.1119\en-us\msntabres.dll/230?1e9f36b04edc41ed8a661e32624786
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1143927185625
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\shared\hpqwmi.exe
O23 - Service: iPod-palvelu (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect -palvelu (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

-kemisti- · Jul 8, 2006

Näköjään et sitten tyhjentänyt IE:n väliaikaistiedostoja?

Poista:

C:\Documents and Settings\Aras88\Local Settings\Temporary Internet Files\Content.IE5\AF2XC5YZ\18WheelsofSteelConvoy-dm[1].exe

C:\Documents and Settings\Aras88\Local Settings\Temporary Internet Files\Content.IE5\M4LNJ6DF\bgates[1].exe

C:\Documents and Settings\Aras88\Omat tiedostot\Spyware and Virus\backups\backup-20060429-151653-706.dll

C:\Documents and Settings\HP users\Local Settings\Temporary Internet Files\Content.IE5\0HUV09EZ\bgates[1].exe

C:\Documents and Settings\HP users\Local Settings\Temporary Internet Files\Content.IE5\85IF016R\srvxzj[1].exe

C:\Documents and Settings\Rahim.SUPERMACHINE\Local Settings\Temporary Internet Files\Content.IE5\EL2BAZUD\bgates[2].exe

Lataa http://www.atribune.org/ccount/click.php?id=4
VundoFix.exe] työpöydällesi.
[*]Tupla-klikkaa VundoFix.exe ajaaksesi työkalun.
[*]Rastita Run VundoFix as a task valinta.
[*]Klikkaa Scan for Vundo nappia.
[*]Kun skannaus on valmis, klikkaa Remove Vundo nappia.
[*]Saat viestin joka kysyy haluatko poistaa tiedostot, klikkaa YES.
[*]Kun klikkaat yes, työpöytäsi muuttuu tyhjäksi kun Vundofix alkaa poistamaan tartuntaa.
[*]Kun valmis, työkalu ilmoittaa sulkevansa koneesi, klikkaa OK.
[*]Käynnistä koneesi uudelleen.

Skannaa kasperskyllä

[*]Postita C:\vundofix.txt lokin sisältö, kasperskyn raportti ja tuore HijackThis loki

Aras88 · Jul 8, 2006

En löytänyt 18WheelsofSteelConvoy-dm[1].exe

KASPERSKY ON-LINE SCANNER REPORT
Saturday, July 08, 2006 8:48:19 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version: 5.0.78.0
Kaspersky Anti-Virus database last update: 8/07/2006
Kaspersky Anti-Virus database records: 205823

Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
C:\
D:\
E:\

Scan Statistics
Total number of scanned objects 59140
Number of viruses found 6
Number of infected objects 9
Number of suspicious objects 0
Duration of the scan process 01:22:46

Infected Object Name Virus Name Last Action
C:\Documents and Settings\Aras88\Local Settings\Temporary Internet Files\Content.IE5\AF2XC5YZ\18WheelsofSteelConvoy-dm[1].exe Infected: not-a-virus:AdWare.Win32.Trymedia.b skipped

C:\Documents and Settings\Aras88\Omat tiedostot\Spyware and Virus\backups\backup-20060429-151653-706.dll Infected: Trojan-Downloader.Win32.Swizzor.fg skipped

C:\Program Files\BitTorrent\uninstall.exe/stream/data0003 Infected: not-a-virus:RiskTool.Win32.PsKill.n skipped

C:\Program Files\BitTorrent\uninstall.exe/stream Infected: not-a-virus:RiskTool.Win32.PsKill.n skipped

C:\Program Files\BitTorrent\uninstall.exe NSIS: infected - 2 skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP1\A0000021.exe Infected: Trojan.Win32.Pakes skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP1\A0000071.dll Infected: Trojan.Win32.Agent.vg skipped

C:\VundoFix Backups\mljijji.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.cd skipped

C:\WINDOWS\system32\mljijji.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.cd skipped

Scan process completed.

VundoFix V5.1.0

Running as SYSTEM
from c:\windows\system32\VundoFix.exe

Checking Java version...

Java version is 1.5.0.2

Java version is 1.5.0.6

Scan started at 13:51:09 8.7.2006

Listing files found while scanning....

C:\windows\system32\awtqr.dll
C:\windows\system32\rqtwa.ini
C:\windows\system32\rqtwa.bak2
C:\windows\system32\rqtwa.ini2
C:\windows\system32\rqtwa.tmp
C:\windows\system32\mljijji.dll

Beginning removal...

The process smss.exe was successfully stopped

The process winlogon.exe was successfully stopped

The process explorer.exe was successfully stopped

The process iexplore.exe was successfully stopped

The process rundll32.exe was successfully stopped

Attempting to delete C:\windows\system32\awtqr.dll
C:\windows\system32\awtqr.dll Has been deleted!

Attempting to delete C:\windows\system32\rqtwa.ini
C:\windows\system32\rqtwa.ini Has been deleted!

Attempting to delete C:\windows\system32\rqtwa.bak2
C:\windows\system32\rqtwa.bak2 Has been deleted!

Attempting to delete C:\windows\system32\rqtwa.ini2
C:\windows\system32\rqtwa.ini2 Has been deleted!

Attempting to delete C:\windows\system32\rqtwa.tmp
C:\windows\system32\rqtwa.tmp Has been deleted!

Attempting to delete C:\windows\system32\mljijji.dll
C:\windows\system32\mljijji.dll Could not be deleted.

Performing Repairs to the registry.
Done!

Logfile of HijackThis v1.99.1
Scan saved at 21:01:07, on 8.7.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HPQ\shared\hpqwmi.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Aras88\Omat tiedostot\Spyware and Virus\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nettiauto.com/home.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.hp.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: MSN Search Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {CED703AC-A457-4754-B41D-F1473E61CA09} - C:\WINDOWS\system32\awtqr.dll (file missing)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN Search Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [InternetCalls] "C:\Program Files\InternetCalls.com\InternetCalls\InternetCalls.exe" -nosplash -minimized
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\en-us\bin\WindowsSearch.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll/search.htm
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0001.1119\en-us\msntabres.dll/229?1e9f36b04edc41ed8a661e32624786
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0001.1119\en-us\msntabres.dll/230?1e9f36b04edc41ed8a661e32624786
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1143927185625
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: winhab32 - winhab32.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\shared\hpqwmi.exe
O23 - Service: iPod-palvelu (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect -palvelu (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

-kemisti- · Jul 8, 2006

Fixaa tämä:

O20 - Winlogon Notify: winhab32 - winhab32.dll (file missing)

1. Lataa ttp://swandog46.geekstogo.com/avenger.zip []The Avenger (c) työpöydällesi.
[*]Klikkaa Avenger.zip filua avataksesi sen.
[*]Pura Avenger.exe työpöydällesi.

2. Kopioi kaikki teksti mustalla lainausboksissa alapuolella tyhjälle muistiolle:

Files to delete:
C:\Documents and Settings\Aras88\Local Settings\Temporary Internet Files\Content.IE5\AF2XC5YZ\18WheelsofSteelConvoy-dm[1].exe
C:\Documents and Settings\Aras88\Omat tiedostot\Spyware and Virus\backups\backup-20060429-151653-706.dll
C:\VundoFix Backups\mljijji.dll
C:\WINDOWS\system32\mljijji.dll

Click to expand...

Huomaa: yläpuolella oleva skripti on luotu erityisesti tälle käyttäjälle. Jos et ole tämä henkilö, ÄLÄ seuraa näitä ohjeita koska ne voisivat pilata koneesi toimintoja.

3. Nyt, aukaise The Avenger tupla-klikkaamalla sen kuvaketta pöydälläsi.
[*]"Script file to execute" alapuolelta valitse "Input Script Manually".
[*]Nyt klikkaa suurennuslasin kuvaa joka avaa uuden ikkunan nimeltä "View/edit script".
[*] Liitä se teksti jonka kopioit muistioon, tähän ikkunaan.
[*] Klikkaa Done.
[*] Nyt klikkaa vihreää valoa aloittaaksesi skriptin.
[*] Klikkaa "Yes" kun tulee kaksi varoitusboksia.
[/list]
Avenger tekee automaattisesti seuraavat:
[*] Käynnistää koneesi. (Tapauksissa joissa skripti sisältää "Drivers to Unload" -komennon, Avenger käynnistää koneesi kaksi kertaa].)
[*] Käynnistyksen yhteydessä, se lyhyesti avaa mustan komentoikkunan työpöydällesi, tämä on normaalia.
[*] Käynnistyksen jälkeen, se luo lokitiedoston] jonka pitäisi aueta Avengerin tekojen tuloksena. Tämän lokin tiedostopolku on C:\avenger.txt
[*] Avenger on myös tehnyt varmuuskopion kaikista tiedostoista jne.. jotka pyysit sen poistaa, ja on pakannut ja siirtänyt ne zip filuihin polussa C:\avenger\backup.zip.

Skannaa uudestaan kasperskyllä.

Kopioi ja liitä kaikki sisältö tiedostosta avenger.txt vastaukseesi tuoreen HJT lokin mukana. Lähetä myös kasperskyn tulokset.

Aras88 · Jul 9, 2006

KASPERSKY ON-LINE SCANNER REPORT
Sunday, July 09, 2006 4:41:11 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version: 5.0.78.0
Kaspersky Anti-Virus database last update: 9/07/2006
Kaspersky Anti-Virus database records: 205940

Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
C:\
D:\
E:\

Scan Statistics
Total number of scanned objects 74742
Number of viruses found 5
Number of infected objects 11
Number of suspicious objects 0
Duration of the scan process 01:28:16

Infected Object Name Virus Name Last Action
C:\avenger\backup.zip/avenger/18WheelsofSteelConvoy-dm[1].exe Infected: not-a-virus:AdWare.Win32.Trymedia.b skipped

C:\avenger\backup.zip/avenger/mljijji.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.cd skipped

C:\avenger\backup.zip/avenger/mljijji.dll-ren-423 Infected: not-a-virus:AdWare.Win32.Virtumonde.cd skipped

C:\avenger\backup.zip ZIP: infected - 3 skipped

C:\Program Files\BitTorrent\uninstall.exe/stream/data0003 Infected: not-a-virus:RiskTool.Win32.PsKill.n skipped

C:\Program Files\BitTorrent\uninstall.exe/stream Infected: not-a-virus:RiskTool.Win32.PsKill.n skipped

C:\Program Files\BitTorrent\uninstall.exe NSIS: infected - 2 skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP1\A0000021.exe Infected: Trojan.Win32.Pakes skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP1\A0000071.dll Infected: Trojan.Win32.Agent.vg skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP2\A0000285.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.cd skipped

C:\System Volume Information\_restore{DC3B6A35-1161-498E-A9BA-B89F4C3AF9AD}\RP2\A0000293.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.cd skipped

Scan process completed.

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\pyvfhedv

*******************

Script file located at: \??\C:\WINDOWS\xxrycpod.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\Documents and Settings\Aras88\Local Settings\Temporary Internet Files\Content.IE5\AF2XC5YZ\18WheelsofSteelConvoy-dm[1].exe deleted successfully.

File C:\Documents and Settings\Aras88\Omat tiedostot\Spyware and Virus\backups\backup-20060429-151653-706.dll not found!
Deletion of file C:\Documents and Settings\Aras88\Omat tiedostot\Spyware and Virus\backups\backup-20060429-151653-706.dll failed!

Could not process line:
C:\Documents and Settings\Aras88\Omat tiedostot\Spyware and Virus\backups\backup-20060429-151653-706.dll
Status: 0xc0000034

File C:\VundoFix Backups\mljijji.dll deleted successfully.
File C:\WINDOWS\system32\mljijji.dll deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

Logfile of HijackThis v1.99.1
Scan saved at 16:44:04, on 9.7.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HPQ\shared\hpqwmi.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\MSN Toolbar Suite\SL\02.05.0001.1119\en-us\msn_sl.exe
C:\Documents and Settings\Aras88\Omat tiedostot\Spyware and Virus\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nettiauto.com/home.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.hp.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: MSN Search Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {CED703AC-A457-4754-B41D-F1473E61CA09} - C:\WINDOWS\system32\awtqr.dll (file missing)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN Search Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [InternetCalls] "C:\Program Files\InternetCalls.com\InternetCalls\InternetCalls.exe" -nosplash -minimized
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\en-us\bin\WindowsSearch.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll/search.htm
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0001.1119\en-us\msntabres.dll/229?1e9f36b04edc41ed8a661e32624786
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0001.1119\en-us\msntabres.dll/230?1e9f36b04edc41ed8a661e32624786
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1143927185625
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\shared\hpqwmi.exe
O23 - Service: iPod-palvelu (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect -palvelu (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

-kemisti- · Jul 9, 2006

Nyt näyttää hyvältä

Putsaa järjestelmän palautus vaan ja fixaa tämä, niin on ok.

O2 - BHO: (no name) - {CED703AC-A457-4754-B41D-F1473E61CA09} - C:\WINDOWS\system32\awtqr.dll (file missing)

Sekä päivitä java:

Hae manuaalisesti täältä:

http://www.java.com/en/download/manual.jsp

[*]Käynnistyksen jälkeen, mene takaisin Ohjauspaneeliin ja siitä Java asetuksiisi.
[*]Temporary Internet Files -osion alla, klikkaa Delete Files nappia.
[*]Varmista että kaikki kolme valintaa ovat rastitettuja:

Downloaded Applets
Downloaded Applications
Other Files

[*]Klikkaa OK "Delete Temporary Internet Files" -ikkunassasi.
Huomaa: Tämä poistaa kaikki ladatut sovellukset ja appletit VÄLIMUISTISTA.
[*]Klikkaa OK jättääksesi Java asetusikkunasi.

Vielä ongelmia?

Log in or Sign up

Spyware koneessa :-/

Aras88 Regular member

Kellopeli Guest

Aras88 Regular member

-kemisti- Active member

Aras88 Regular member

-kemisti- Active member

Aras88 Regular member

-kemisti- Active member

Aras88 Regular member

-kemisti- Active member

laski92 Guest

Aras88 Regular member

-kemisti- Active member

Aras88 Regular member

-kemisti- Active member

Aras88 Regular member

-kemisti- Active member

Share This Page

Log in or Sign up

Spyware koneessa :-/

Aras88 Regular member

Kellopeli Guest

Aras88 Regular member

-kemisti- Active member

Aras88 Regular member

-kemisti- Active member

Aras88 Regular member

-kemisti- Active member

Aras88 Regular member

-kemisti- Active member

laski92 Guest

Aras88 Regular member

-kemisti- Active member

Aras88 Regular member

-kemisti- Active member

Aras88 Regular member

-kemisti- Active member

Share This Page

Useful Searches