Eli, nyt on ilmeisesti käynyt näin, että hyvinkin jykevä haittaohjelma/virus on pesiytynyt koneeseemme. Ohjelma nostaa CPU:n 100% ja tekee tietokoneen käytöstä täysin mahdotonta. Samalla tämä ohjelma lataa Troyan Downloadereita koneelle, jotka F-secure tosin bloccaa. Olemme yrittäneet poistaa ohjelmaa F-secure 06 versiolla, mutta secure ei edes löydä koko tiedostoa. Olisi kiva saada taas kone toimimaan. Kiitos.
-> Lataa Hijackthis: http://koti.mbnet.fi/pattaya1/HijackThis.exe -> Tallenna hakemistoon C:\hjt ->Uudelleennimeä HijackThis.exe -> scanner.exe:ksi näin: 1. Klikkaa hiiren oikealla painikkeella HijackThis ikonia. 2. Valitse Uudelleennineä/ Rename. 3. Kirjoita scanner.exe -> Käynnistä HijackThis ja klikkaa: do a system scan and save a logfile. -> Lähetä ilmestynyt logisi tähän ketjuun
Tässä olisi: Logfile of HijackThis v1.99.1 Scan saved at 18:36:42, on 17.7.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16473) Running processes: D:\WINDOWS\System32\smss.exe D:\WINDOWS\system32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\system32\Ati2evxx.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\system32\Ati2evxx.exe D:\WINDOWS\system32\spoolsv.exe D:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE C:\Ohjelmat\BlueSoleil\BTNtService.exe D:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe D:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe D:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE D:\Program Files\F-Secure\Common\FSMA32.EXE D:\Program Files\F-Secure\Anti-Virus\fssm32.exe D:\Program Files\F-Secure\Common\FSMB32.EXE D:\WINDOWS\System32\svchost.exe D:\Program Files\F-Secure\Common\FCH32.EXE D:\Program Files\F-Secure\Common\FAMEH32.EXE D:\Program Files\F-Secure\Anti-Virus\fsqh.exe D:\Program Files\F-Secure\Anti-Virus\fsrw.exe D:\Program Files\F-Secure\Anti-Virus\fsav32.exe D:\Program Files\F-Secure\Common\FNRB32.EXE D:\Program Files\F-Secure\FWES\Program\fsdfwd.exe D:\Program Files\F-Secure\Common\FIH32.EXE D:\WINDOWS\Explorer.EXE D:\Program Files\F-Secure\Common\FSM32.EXE D:\Program Files\Java\jre1.6.0_01\bin\jusched.exe D:\Program Files\VIAudioi\SBADeck\ADeck.exe D:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe D:\Program Files\Common Files\InstallShield\UpdateService\issch.exe D:\PROGRA~1\F-Secure\ANTI-S~1\fsaw.exe D:\Program Files\Common Files\Real\Update_OB\realsched.exe D:\WINDOWS\system32\rundll32.exe D:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE C:\Ohjelmat\Quicktime\QTTask.exe D:\WINDOWS\system32\ctfmon.exe D:\Program Files\F-Secure\FSGUI\fsguidll.exe D:\Program Files\MSN Messenger\MsnMsgr.Exe C:\Ohjelmat\BlueSoleil\BlueSoleil.exe D:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe D:\Program Files\WinZip\WZQKPICK.EXE D:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe D:\Program Files\ATI Technologies\ATI.ACE\cli.exe D:\Program Files\ATI Technologies\ATI.ACE\cli.exe D:\Program Files\MSN Messenger\usnsvc.exe D:\Program Files\Mozilla Firefox\firefox.exe D:\WINDOWS\system32\taskmgr.exe D:\Program Files\Internet Explorer\iexplore.exe C:\DOWNLOAD\scanner.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: (no name) - {0157F166-6274-7F00-BB5B-9CD0BEA7B9AF} - D:\DOCUME~1\Jari\APPLIC~1\ACEGRA~1\jumphide.exe (file missing) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - D:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: (no name) - {55CBD2FB-4BE0-4756-8115-8CD32CC2B9A0} - D:\WINDOWS\system32\awtqn.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: (no name) - {938A8A03-A938-4019-B764-03FF8D167D79} - D:\WINDOWS\system32\fifprapv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar4.dll O2 - BHO: (no name) - {FD2A7D3A-3DA1-4CA5-AD39-B4C3A72B567F} - D:\WINDOWS\system32\iifcdcb.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - D:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar4.dll O4 - HKLM\..\Run: [F-Secure Manager] "D:\Program Files\F-Secure\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [F-Secure TNB] "D:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [AudioDeck] D:\Program Files\VIAudioi\SBADeck\ADeck.exe 1 O4 - HKLM\..\Run: [PrinTray] D:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe O4 - HKLM\..\Run: [ISUSPM Startup] D:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "D:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [ATICCC] "D:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" O4 - HKLM\..\Run: [NeroFilterCheck] D:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [PCSuiteTrayApplication] D:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM\..\Run: [Fivesoftpopsixth] D:\Documents and Settings\All Users\Application Data\armyaboutfivesoft\Rdr Setup.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Ohjelmat\Quicktime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [icq.com] rundll32.exe "D:\WINDOWS\system32\jdafwdpt.dll",forkonce O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [managertime] D:\DOCUME~1\Jari\APPLIC~1\ENCLOG~1\1 bows rule.exe O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [M3GATE PUSH AGENT] C:\Ohjelmat\M\PushAgent.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: BlueSoleil.lnk = C:\Ohjelmat\BlueSoleil\BlueSoleil.exe O4 - Global Startup: F-Secure Automatic Update.lnk = D:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe O4 - Global Startup: Microsoft Office.lnk = C:\Ohjelmat\Word\Office\OSA9.EXE O4 - Global Startup: WinZip Quick Pick.lnk = D:\Program Files\WinZip\WZQKPICK.EXE O4 - Global Startup: Works Kalenterin muistutukset.lnk = ? O8 - Extra context menu item: &Block this popup - D:\Program Files\F-Secure\Anti-Spyware\blockpopups.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: IE Shield - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - D:\Program Files\F-Secure\Anti-Spyware\ieshield.dll O9 - Extra 'Tools' menuitem: IE Shield... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - D:\Program Files\F-Secure\Anti-Spyware\ieshield.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: d:\program files\f-secure\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: d:\program files\f-secure\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: d:\program files\f-secure\fsps\program\fslsp.dll O11 - Options group: [INTERNATIONAL] International* O15 - Trusted Zone: http://webmail.kolumbus.fi O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: awtqn - D:\WINDOWS\system32\awtqn.dll O20 - Winlogon Notify: iifcdcb - D:\WINDOWS\SYSTEM32\iifcdcb.dll O20 - Winlogon Notify: WgaLogon - D:\WINDOWS\ O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - D:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - F-Secure Automatic Update - D:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Ohjelmat\BlueSoleil\BTNtService.exe O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - D:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - D:\Program Files\F-Secure\Common\FNRB32.EXE O23 - Service: fsbwsys - F-Secure Corp. - D:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - D:\Program Files\F-Secure\FWES\Program\fsdfwd.exe O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - D:\Program Files\F-Secure\Common\FSMA32.EXE O23 - Service: Google Updater Service (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: NBService - Nero AG - D:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: ServiceLayer - Nokia. - D:\Program Files\PC Connectivity Solution\ServiceLayer.exe
