Elikkä tässä olisi [bold]TAAS[/bold] yksi HjT logi tarkastettavaksi fiksummille, pääsi joku pirun spyware installer tms. lätkiin kaikkee roinaa tänne. Osan jo poistin itse mutta nyt täytyy nostaa kädet pystyyn. Logfile of HijackThis v1.99.1 Scan saved at 21:05:10, on 14.12.2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\NetLimiter\NetLimiter.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\System32\LVCOMSX.EXE C:\Program Files\Logitech\Video\LogiTray.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe C:\Program Files\MessengerPlus! 3\MsgPlus.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\PROGRA~1\COMMON~1\ozqm\ozqma.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\mIRC\mirc.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\Explorer.EXE C:\HjT\HijackThis.exe C:\WINDOWS\system32\NOTEPAD.EXE R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [NetLimiter] C:\Program Files\NetLimiter\NetLimiter.exe /s O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe" O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [PayTime] C:\WINDOWS\system32\paytime.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [Steam] "d:\program files\valve\steam\steam.exe" -silent O4 - HKCU\..\Run: [Pulse] C:\Program Files\Pulse\Pulse.exe -splash O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [Shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe" O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe O4 - HKCU\..\Run: [ozqm] C:\PROGRA~1\COMMON~1\ozqm\ozqmm.exe O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe O4 - Global Startup: hpoddt01.exe.lnk = ? O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Norton AntiVirus Auto-Protect -palvelu (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
Jees eli kyseinen logi on mun koneeltani, olen tuon LyC0:n veli ja huomasin tässä selaillessa että tossa alempana oli postaus saman nimisestä systeemistä http://keskustelu.afterdawn.com/thread_view.cfm/270331 Tuolla alempana oli jonkin sorttista juttua että tolla systeemillä menis työpöydältä pikakuvakkeet, jota en kaipais just tähän saumaan. Elikkä onko tuohon mitään muuta keinoa?
Tuo on eri örkki tietääkseni eli ei vaadi samaa fixiä, joka hävittää pikakuvakkeet. Fixaa HjT:llä (do a system scan only, merkkaa ja paina fix checked): R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html O4 - HKLM\..\Run: [PayTime] C:\WINDOWS\system32\paytime.exe O4 - HKCU\..\Run: [Shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe" O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe O4 - HKCU\..\Run: [ozqm] C:\PROGRA~1\COMMON~1\ozqm\ozqmm.exe Laita piilotiedostot näkyviin, ohje ->http://keskustelu.afterdawn.com/thread_view.cfm/248944 Hae ewido -> http://www.ewido.net/en/download Asenna ja päivitä se. Käynnistä vikasietotilaan (F8 käynnistyksen yhteydessä) Poista nämä: c:\==>secure32.html<== C:\WINDOWS\system32\==>paytime.exe<== C:\Program Files\Common Files\Microsoft Shared\Web Folders\==>ibm00001.exe<== C:\==>winstall.exe<== C:\PROGRA~1\COMMON~1\==>ozqm<== Skannaa ewidolla vikasiedossa. Anna poistaa, mitä löytää ja tallenna raportti. Käynnistä kone uudelleen. Lähetä uusi HjT-loki ja ewidon raportti tänne.
Ewidon raportti: --------------------------------------------------------- ewido security suite - Scan report --------------------------------------------------------- + Created on: 17:17:50, 15.12.2005 + Report-Checksum: 9289CBA2 + Scan result: :mozilla.7:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\1t7har5c.default\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup :mozilla.14:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\1t7har5c.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup :mozilla.25:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\1t7har5c.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.26:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\1t7har5c.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.27:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\1t7har5c.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup :mozilla.28:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\1t7har5c.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup :mozilla.29:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\1t7har5c.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup :mozilla.30:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\1t7har5c.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup :mozilla.31:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\1t7har5c.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup :mozilla.32:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\1t7har5c.default\cookies.txt -> Spyware.Cookie.Itrack : Cleaned with backup :mozilla.38:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\1t7har5c.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.39:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\1t7har5c.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.40:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\1t7har5c.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.78:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\1t7har5c.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup :mozilla.80:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\1t7har5c.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup :mozilla.82:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\1t7har5c.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup :mozilla.83:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\1t7har5c.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup :mozilla.90:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\1t7har5c.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.91:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\1t7har5c.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.129:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Paypopup : Cleaned with backup :mozilla.130:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Paypopup : Cleaned with backup :mozilla.131:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Paypopup : Cleaned with backup :mozilla.132:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Paypopup : Cleaned with backup :mozilla.133:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Paypopup : Cleaned with backup :mozilla.134:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Paypopup : Cleaned with backup :mozilla.135:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Paypopup : Cleaned with backup :mozilla.136:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Paypopup : Cleaned with backup :mozilla.138:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Paypopup : Cleaned with backup :mozilla.139:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Paypopup : Cleaned with backup :mozilla.141:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.fusk-access : Cleaned with backup :mozilla.144:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup :mozilla.145:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup :mozilla.146:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup :mozilla.147:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup :mozilla.148:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup :mozilla.170:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.171:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.172:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.173:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.174:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup :mozilla.175:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup :mozilla.194:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.195:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.196:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.197:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.198:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.205:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup :mozilla.206:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup :mozilla.209:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup :mozilla.213:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.214:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.215:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.216:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.217:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.218:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.226:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.227:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.228:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.229:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.230:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.231:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup :mozilla.233:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup :mozilla.234:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup :mozilla.235:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup :mozilla.237:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup :mozilla.238:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup :mozilla.239:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup :mozilla.240:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup :mozilla.241:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup :mozilla.261:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup :mozilla.262:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup :mozilla.263:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup :mozilla.264:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup :mozilla.265:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup :mozilla.273:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.274:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.275:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.292:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup :mozilla.319:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.247realmedia : Cleaned with backup :mozilla.320:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.325:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.326:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup :mozilla.327:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup :mozilla.328:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup :mozilla.339:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Spylog : Cleaned with backup :mozilla.341:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup :mozilla.359:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup :mozilla.390:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup :mozilla.403:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Onestat : Cleaned with backup :mozilla.404:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Onestat : Cleaned with backup :mozilla.406:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Ivwbox : Cleaned with backup :mozilla.407:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Popularix : Cleaned with backup :mozilla.421:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Revenue : Cleaned with backup :mozilla.436:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup :mozilla.437:C:\Documents and Settings\Rami\Application Data\Mozilla\Firefox\Profiles\uq3nty18.Oletuskäyttäjä\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup C:\Documents and Settings\Rami\Cookies\rami@atdmt[1].txt -> Spyware.Cookie.Atdmt : Cleaned with backup C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe -> Logger.Small.dg : Cleaned with backup C:\Program Files\Common Files\ozqm\ozqmd\ozqmc.dll -> Downloader.Small : Cleaned with backup C:\Program Files\DAEMON Tools\SetupDTSB.exe -> Adware.SaveNow : Cleaned with backup C:\WINDOWS\country.exe -> Trojan.Small : Cleaned with backup C:\WINDOWS\hosts -> Trojan.Qhost.el : Cleaned with backup C:\WINDOWS\kl.exe -> Logger.Small.dg : Cleaned with backup C:\WINDOWS\tool1.exe -> Trojan.Small : Cleaned with backup C:\WINDOWS\tool3.exe -> Downloader.Small.bwr : Cleaned with backup C:\WINDOWS\tool4.exe -> Trojan.Small : Cleaned with backup C:\WINDOWS\tool5.exe -> Trojan.Small : Cleaned with backup C:\WINDOWS\toolbar.exe -> Downloader.Adload.j : Cleaned with backup ::Report End HjT logi skannauksen jälkeen: Logfile of HijackThis v1.99.1 Scan saved at 17:20:40, on 15.12.2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\NetLimiter\NetLimiter.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\System32\LVCOMSX.EXE C:\Program Files\Logitech\Video\LogiTray.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\MessengerPlus! 3\MsgPlus.exe C:\Program Files\DAEMON Tools\daemon.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\ewido\security suite\ewidoctrl.exe C:\Program Files\ewido\security suite\ewidoguard.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Logitech\Video\FxSvr2.exe C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\WINDOWS\Explorer.EXE C:\HjT\HijackThis.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [NetLimiter] C:\Program Files\NetLimiter\NetLimiter.exe /s O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe" O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [Steam] "d:\program files\valve\steam\steam.exe" -silent O4 - HKCU\..\Run: [Pulse] C:\Program Files\Pulse\Pulse.exe -splash O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe O4 - Global Startup: hpoddt01.exe.lnk = ? O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Norton AntiVirus Auto-Protect -palvelu (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -Enää ei ulkosesti näytä olevan mitään vaikutuksia, mutta saa nyt nähä mitä tuolta löydät.
On siellä vielä yks toimenpiteitä vaativa juttu tai siis oli Nimittäin toi qhost. Hae hoster -> http://www.funkytoad.com/download/hoster.zip Pura zippi ja tuplaklikkaa hoster.exe Paina "Restore original hosts" ja ok.
