Moi, ongelmana on ainakin tollannen troija tai mikä nyt onkaan,kun vundo.gen192 löytyy system3\mIJDMgd.dll tiedostosta. Millai sen saa pois tai mikä ohjelma siihen tehoaa, kun norman ei näköjään kykene sitä poistaa?
Norman on ihan kuraa Lataa Malwarebytes' Anti-Malware työpöydällesi. * Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman. * Lopuksi varmistu, että seuraavat on valittu: Päivitä Malwarebytes' Anti-Malware ja Käynnistä Malwarebytes' Anti-Malware ja sen jälkeen klikkaa Lopeta. * Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version. * Kun ohjelma on latautunut, valitse Suorita täysi tarkistus ja klikkaa Tarkista. * Kun skanni on valmis, klikkaa OK ja sitten Näytä tulokset nähdäksesi tulokset. * Varmistu, että kaikki on merkitty ja klikkaa Poista valitut. * Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt * Lähetä lokin sisältö seuraavassa viestissäsi + uusi hjt-loki. 1. Lataa Combofix.exe työpöydällesi jommastakummasta linkistä: Combofix.exe Combofix.exe Avaa Combofix.exe ja seuraa näyttöön tulevia ohjeita Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen. Käynnistä kone uudelleen, jos niin pyydetään ja lähetä combofix.txt-tiedoston sisältö tänne. Tyhjennä roskakori ja käynnistä koneesi uudelleen. Postita tänne seuraavat lokit: * Tuore HijackThis loki (Otetaan viimeisenä ennen postitusta) * (C:\ComboFix.txt) raportti *
dodii, tässä näitä jotakin lokeja on... Malwarebytes' Anti-Malware 1.23 Tietokantaversio: 998 Windows 5.1.2600 Service Pack 2 9:13:11 28.7.2008 mbam-log-7-28-2008 (09-13-11).txt Tarkistustyyppi: Täysi tarkistus (C:\|) Tarkistetut kohteet: 103520 Kulunut aika: 1 hour(s), 42 minute(s), 29 second(s) Saastuneita muistiprosesseja: 2 Saastuneita muistimoduuleja: 4 Saastuneita rekisteriavaimia: 18 Saastuneita rekisteriarvoja: 8 Saastuneita rekisterikohteita: 3 Saastuneita hakemistoja: 1 Saastuneita tiedostoja: 78 Saastuneita muistiprosesseja: C:\WINDOWS\portsv.exe (Trojan.Downloader) -> Unloaded process successfully. C:\WINDOWS\winself.exe (Trojan.Agent) -> Unloaded process successfully. Saastuneita muistimoduuleja: C:\WINDOWS\system32\jkkkhEvu.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\system32\yakxudea.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\system32\dvkkygit.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\system32\mlJDWMgd.dll (Trojan.Vundo) -> Delete on reboot. Saastuneita rekisteriavaimia: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{45bf1f3b-765d-4d02-b664-31ac7ad138fd} (Trojan.Vundo) -> Delete on reboot. HKEY_CLASSES_ROOT\CLSID\{45bf1f3b-765d-4d02-b664-31ac7ad138fd} (Trojan.Vundo) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9bdf5b58-0d3b-4211-988d-75e77a1f5986} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{9bdf5b58-0d3b-4211-988d-75e77a1f5986} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{59cf8d60-f8d7-42f5-9808-cd4594816fd0} (Trojan.Vundo) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{59cf8d60-f8d7-42f5-9808-cd4594816fd0} (Trojan.Vundo) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mljdwmgd (Trojan.Vundo) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{34bc0f8a-c8f0-44e0-9c05-232bc3c4b2f5} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{34bc0f8a-c8f0-44e0-9c05-232bc3c4b2f5} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{597000e0-0ec4-40e5-a279-0589c0702cb1} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{597000e0-0ec4-40e5-a279-0589c0702cb1} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PlugPlayRPC (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mssecurity1.209.4 (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Trojan.Vundo) -> Quarantined and deleted successfully. Saastuneita rekisteriarvoja: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\446d3d3e (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bm475e0ea2 (Trojan.Vundo) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{59cf8d60-f8d7-42f5-9808-cd4594816fd0} (Trojan.Vundo) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bf (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bk (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\iu (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\mu (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\General\wallpaper (Hijack.Desktop) -> Quarantined and deleted successfully. Saastuneita rekisterikohteita: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo) -> Data: c:\windows\system32\jkkkhevu -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\jkkkhevu -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.UserInit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\uoyzsydz.exe,) Good: (userinit.exe) -> Quarantined and deleted successfully. Saastuneita hakemistoja: C:\Documents and Settings\Mikko\Application Data\Microsoft\dtsc (Trojan.Agent) -> Quarantined and deleted successfully. Saastuneita tiedostoja: C:\WINDOWS\system32\jkkkhEvu.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\system32\uvEhkkkj.ini (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\system32\uvEhkkkj.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\xllnaw.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\yakxudea.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\system32\aeduxkay.ini (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\dvkkygit.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\system32\mlJDWMgd.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\portsv.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Mikko\Local Settings\Temporary Internet Files\Content.IE5\KTIFO3UP\3077ahntdksr[1].dll (Trojan.BHO) -> Quarantined and deleted successfully. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\89ABCDEF\3077ahntdksr[1].dll (Adware.Agent) -> Quarantined and deleted successfully. C:\Documents and Settings\Mikko\Local Settings\Temporary Internet Files\Content.IE5\ESDB36XB\kb767887[1] (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Documents and Settings\Mikko\Local Settings\Temporary Internet Files\Content.IE5\KTIFO3UP\kb456456[1] (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Documents and Settings\Mikko\Local Settings\Temporary Internet Files\Content.IE5\V7MWMFMD\kb671231[1] (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{390ED88B-3C35-4337-B326-E68EE519901A}\RP309\A0021132.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{390ED88B-3C35-4337-B326-E68EE519901A}\RP309\A0022146.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\afiursjq.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\axumlvpu.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\ibbdmbcv.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\xjhhwwhx.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Documents and Settings\Mikko\Application Data\Microsoft\dtsc\ACD VideoMagic DivXPro 1.0 SR-1 by Bidjan.torrent (Trojan.Agent) -> Quarantined and deleted successfully. C:\Documents and Settings\Mikko\Application Data\Microsoft\dtsc\s (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\explore.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\iexplorer.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\x.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\y.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\xxxvideo.hta (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\default.htm (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\svchost32.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\loader.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\internet.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\cookies.ini (Malware.Trace) -> Quarantined and deleted successfully. C:\WINDOWS\accesss.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\astctl32.ocx (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\avpcc.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\clrssn.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\cpan.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\ctfmon32.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\ctrlpan.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\directx32.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\dnsrelay.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\editpad.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\Explorer32.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\funniest.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\funny.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\gfmnaaa.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\helpcvs.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\iedll.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\inetinf.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\msconfd.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\msspi.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\msupdate.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\mswsc10.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\mswsc20.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\mtwirl32.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\notepad32.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\olehelp.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\qttasks.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\quicken.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\rundll16.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\winself.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\rundll32.vbe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\searchword.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\sistem.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\svcinit.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\systeem.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\systemcritical.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\time.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\users32.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\waol.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\win32e.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\win64.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\winajbm.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\window.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\winmgnt.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\xplugin.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\WINDOWS\BM475e0ea2.xml (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\BM475e0ea2.txt (Trojan.Vundo) -> Quarantined and deleted successfully. ja sitte seuraava. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 9:40:16, on 28.7.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Norman\Npm\bin\ELOGSVC.EXE C:\Norman\Npm\Bin\Zanda.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\bgsvcgen.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\AVC Finger-sensing Pad Driver\fspadsvr.exe C:\Program Files\Option\GlobeTrotter Connect\GtDetectSc.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\AVC Finger-sensing Pad Driver\fscp.exe C:\Program Files\Hotkey Management\FuncKey.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Norman\Npm\bin\ZLH.EXE C:\WINDOWS\ehome\mcrdsvc.exe C:\Program Files\Java\jre1.5.0\bin\jusched.exe C:\Ohjelmat\AnyDVD\AnyDVD.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\Program Files\Option\GlobeTrotter Connect\GlobeTrotter Connect.exe C:\Norman\Npm\bin\NJEEVES.EXE C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\dllhost.exe C:\Norman\Nvc\BIN\NVCSCHED.EXE C:\Norman\Nvc\bin\nvcoas.exe C:\Norman\Nvc\BIN\NIP.EXE C:\Norman\Nvc\bin\cclaw.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\explorer.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Ohjelmat\hijack\HijackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.jippii.fi/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe O4 - HKLM\..\Run: [fscp] C:\Program Files\AVC Finger-sensing Pad Driver\fscp.exe O4 - HKLM\..\Run: [FuncKey] "C:\Program Files\Hotkey Management\FuncKey.exe" O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [Norman ZANDA] "C:\Norman\Npm\bin\ZLH.EXE" /LOAD /SPLASH O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe O4 - HKLM\..\Run: [ElbyCheckAnyDVD] "C:\Ohjelmat\AnyDVD\ElbyCheck.exe" /L AnyDVD O4 - HKLM\..\Run: [AnyDVD] C:\Ohjelmat\AnyDVD\AnyDVD.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: GlobeTrotter Connect.lnk = C:\Program Files\Option\GlobeTrotter Connect\GlobeTrotter Connect.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: Avaa uuteen etuvälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/230?7f7a1714c462495ab2230058ba1a2a27 O8 - Extra context menu item: Avaa uuteen taustavälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/229?7f7a1714c462495ab2230058ba1a2a27 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab O16 - DPF: {3AD09ACB-EE3C-4B13-8371-38DD65947DCE} (HD300Controller Control) - http://207.145.139.244/HD300CTL.cab O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} (AxisMediaControl Class) - http://cam1.rcon.nl/activex/AMC.cab O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\WINDOWS\msxml4.cab O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://toimisto.fns.fi:8088/activex/AxisCamControl.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://80.160.169.182/activex/AMC.cab O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - C:\Norman\Npm\bin\ELOGSVC.EXE O23 - Service: FspadSvc - Unknown owner - C:\Program Files\AVC Finger-sensing Pad Driver\fspadsvr.exe O23 - Service: GtDetectSc - OptionNV - C:\Program Files\Option\GlobeTrotter Connect\GtDetectSc.exe O23 - Service: Norman NJeeves - Norman ASA - C:\Norman\Npm\bin\NJEEVES.EXE O23 - Service: Norman ZANDA - Norman ASA - C:\Norman\Npm\Bin\Zanda.exe O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - C:\Norman\Nvc\BIN\NVCSCHED.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 7687 bytes ja sitten oli vielä tuo combofixi. ComboFix 08-07-27.5 - Mikko 2008-07-28 9:25:12.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1577 [GMT 3:00] Running from: C:\Documents and Settings\Mikko\Desktop\ComboFix.exe * Created a new restore point * Resident AV is active WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\Downloaded Program Files\setup.inf C:\WINDOWS\mainms.vpi C:\WINDOWS\megavid.cdt C:\WINDOWS\muotr.so C:\WINDOWS\pskt.ini C:\WINDOWS\system32\emreavlr.ini C:\WINDOWS\system32\hljwugsf.bin C:\WINDOWS\system32\hubsyunj.dll C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\pwpuer.dll C:\WINDOWS\system32\qoryexey.ini C:\WINDOWS\yoursearchnet_com.exe . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_MSSECURITY1.209.4 -------\Legacy_NSESVC -------\Service_nsesvc ((((((((((((((((((((((((( Files Created from 2008-06-28 to 2008-07-28 ))))))))))))))))))))))))))))))) . 2008-07-27 18:47 . 2008-07-27 18:47 <KANSIO> d-------- C:\Documents and Settings\Mikko\Application Data\Malwarebytes 2008-07-27 18:47 . 2008-07-27 18:47 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-07-27 18:47 . 2008-07-23 20:09 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-07-27 18:47 . 2008-07-23 20:09 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-07-24 12:08 . 2008-07-27 19:17 <KANSIO> d-------- C:\WINDOWS\system32\4490 2008-07-21 20:06 . 2008-07-21 21:36 <KANSIO> d-------- C:\Program Files\uTorrent 2008-07-21 19:16 . 2008-07-21 19:22 15,000,000 --a------ C:\NYMPHO-SGPOV3.R00 2008-07-21 19:16 . 2008-07-21 19:16 1,372,160 --a------ C:\RUNDII32.EXE 2008-07-20 05:09 . 2008-07-20 05:09 268 --ah----- C:\sqmdata18.sqm 2008-07-20 05:09 . 2008-07-20 05:09 244 --ah----- C:\sqmnoopt18.sqm 2008-07-19 08:25 . 2008-07-19 08:25 268 --ah----- C:\sqmdata17.sqm 2008-07-19 08:25 . 2008-07-19 08:25 244 --ah----- C:\sqmnoopt17.sqm 2008-07-18 23:15 . 2008-07-18 23:15 268 --ah----- C:\sqmdata16.sqm 2008-07-18 23:15 . 2008-07-18 23:15 244 --ah----- C:\sqmnoopt16.sqm . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-21 17:19 --------- d-----w C:\Documents and Settings\Mikko\Application Data\uTorrent 2008-06-28 13:53 --------- d-----w C:\Documents and Settings\Mikko\Application Data\Skype 2008-06-28 05:04 --------- d-----w C:\Documents and Settings\Mikko\Application Data\skypePM 2008-06-17 05:06 --------- d-----w C:\Program Files\Option 2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys 2008-01-26 19:12 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 15:00 15360] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 12:55 5674352] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AzMixerSel"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" [2006-01-25 19:45 53248] "fscp"="C:\Program Files\AVC Finger-sensing Pad Driver\fscp.exe" [2006-09-18 11:38 995328] "FuncKey"="C:\Program Files\Hotkey Management\FuncKey.exe" [2006-09-05 21:29 139264] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2005-04-15 17:13 45056] "Norman ZANDA"="C:\Norman\Npm\bin\ZLH.EXE" [2008-06-02 14:46 273520] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0\bin\jusched.exe" [2006-12-26 17:19 36972] "ElbyCheckAnyDVD"="C:\Ohjelmat\AnyDVD\ElbyCheck.exe" [2003-09-20 22:23 45056] "AnyDVD"="C:\Ohjelmat\AnyDVD\AnyDVD.exe" [2003-09-29 22:17 175616] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-16 11:42 7585792] "nwiz"="nwiz.exe" [2006-08-16 11:42 1617920 C:\WINDOWS\system32\nwiz.exe] "RTHDCPL"="RTHDCPL.EXE" [2006-07-21 17:56 16261632 C:\WINDOWS\RTHDCPL.exe] "SkyTel"="SkyTel.EXE" [2006-05-16 19:04 2879488 C:\WINDOWS\SkyTel.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-10 15:00 15360] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2006-10-12 15:54:53 29696] GlobeTrotter Connect.lnk - C:\Program Files\Option\GlobeTrotter Connect\GlobeTrotter Connect.exe [2008-01-10 15:51:02 864256] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 20:05:56 65588] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Ohjelmat\\utorrent\\utorrent.exe"= "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "C:\\Program Files\\MSN Messenger\\livecall.exe"= "C:\\Ohjelmat\\LimeWire\\LimeWire.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= R2 FspadSvc;FspadSvc;C:\Program Files\AVC Finger-sensing Pad Driver\fspadsvr.exe [2006-08-23 15:05] R2 GtDetectSc;GtDetectSc;C:\Program Files\Option\GlobeTrotter Connect\GtDetectSc.exe [2007-12-18 11:48] R2 Ndiskio;Ndiskio;C:\Norman\Nse\bin\NDISKIO.SYS [2007-01-02 10:55] R3 fspad;AVC Finger-sensing Pad Driver for Windows 2000/XP;C:\WINDOWS\system32\DRIVERS\fspad.sys [2006-09-18 11:40] R3 NvcMFlt;NvcMFlt;C:\WINDOWS\system32\DRIVERS\nvcw32mf.sys [2008-02-11 15:56] R3 nvcoas;Norman Virus Control on-access component;C:\Norman\Nvc\bin\nvcoas.exe [2008-04-29 10:58] R3 NVCScheduler;Norman Virus Control Scheduler;C:\Norman\Nvc\BIN\NVCSCHED.EXE [2008-03-11 15:00] S3 GT72NDISIPXP;GT 72 IP NDIS;C:\WINDOWS\system32\DRIVERS\Gt51Ip.sys [2007-11-13 15:50] S3 GT72UBUS;GT 72 U BUS;C:\WINDOWS\system32\DRIVERS\gt72ubus.sys [2007-10-09 12:53] S3 GTPTSER;GT PT SER;C:\WINDOWS\system32\DRIVERS\gtptser.sys [2007-03-30 12:38] S3 nvcfsr;nvcfsr;C:\Norman\Nvc\bin\nvcfsr.sys [2007-01-09 15:25] S3 nvcoafl51;nvcoafl51;C:\Norman\Nvc\bin\nvcoafl51.sys [2007-01-09 15:25] S3 nvcoaft51;nvcoaft51;C:\Norman\Nvc\bin\nvcoaft51.sys [2007-01-09 15:25] S3 nvcoarc51;nvcoarc51;C:\Norman\Nvc\bin\nvcoarc51.sys [2007-01-09 15:25] S3 SIS163u;SiS163 USB Wireless LAN Adapter Driver;C:\WINDOWS\system32\DRIVERS\sis163u.sys [2006-07-03 18:11] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fc9db0ce-3c2a-11dd-8903-00140b0510e4}] \Shell\AutoRun\command - E:\setup.exe AUTORUN=1 . Contents of the 'Scheduled Tasks' folder . - - - - ORPHANS REMOVED - - - - BHO-{2C5C0AAE-2210-40E7-B244-B0B07C7857Df} - C:\WINDOWS\system32\caamikrl.dll . ------- Supplementary Scan ------- . R0 -: HKCU-Main,Start Page = hxxp://www.jippii.fi/ R0 -: HKLM-Main,Start Page = R1 -: HKCU-Internet Connection Wizard,ShellNext = iexplore O8 -: &Windows Live Search - C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 -: Avaa uuteen etuvälilehteen - C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/230?7f7a1714c462495ab2230058ba1a2a27 O8 -: Avaa uuteen taustavälilehteen - C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/229?7f7a1714c462495ab2230058ba1a2a27 O16 -: {3AD09ACB-EE3C-4B13-8371-38DD65947DCE} - hxxp://207.145.139.244/HD300CTL.cab C:\WINDOWS\Downloaded Program Files\HD300CTL.inf C:\WINDOWS\Downloaded Program Files\HD300Controller.ocx C:\WINDOWS\system32\dtvdecoder.dll O16 -: {745395C8-D0E1-4227-8586-624CA9A10A8D} - hxxp://cam1.rcon.nl/activex/AMC.cab C:\WINDOWS\Downloaded Program Files\setup.inf O16 -: {88D969C0-F192-11D4-A65F-0040963251E5} - file://C:\WINDOWS\msxml4.cab C:\WINDOWS\Downloaded Program Files\msxml4.inf C:\WINDOWS\system32\msxml4a.dll C:\WINDOWS\system32\msxml4r.dll C:\WINDOWS\system32\msxml4.dll O16 -: {DE625294-70E6-45ED-B895-CFFA13AEB044} - hxxp://80.160.169.182/activex/AMC.cab C:\WINDOWS\Downloaded Program Files\setup.inf ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-28 09:30:32 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Norman\npm\bin\elogsvc.exe C:\Norman\npm\bin\Zanda.exe C:\WINDOWS\system32\bgsvcgen.exe C:\WINDOWS\ehome\ehrecvr.exe C:\WINDOWS\ehome\ehSched.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\ehome\mcrdsvc.exe C:\Norman\npm\bin\Njeeves.exe C:\WINDOWS\system32\dllhost.exe C:\Norman\NVC\Bin\Nip.exe C:\Norman\NVC\Bin\CClaw.exe . ************************************************************************** . Completion time: 2008-07-28 9:36:08 - machine was rebooted [Mikko] ComboFix-quarantined-files.txt 2008-07-28 06:35:58 Pre-Run: 39,542,349,824 bytes free Post-Run: 39,617,949,696 tavua vapaana 165 --- E O F --- 2008-06-19 21:24:10 jos noista vielä jotain selviää, ni hieno homma..
1. Lataa Combofix.exe työpöydällesi jommastakummasta linkistä: Combofix.exe Combofix.exe Avaa Muistio ja kopioi/liitä Lainaus: laatikon sisältö sinne: Tallenna nimellä CFScript (itse asiassa combofix tunnistaa tuon vaikka tiedostopääte ei olisi edes .txt). Sitten raahaa ja pudota CFScript ComboFix.exeen kuten alla.(Älä klikkaa) Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen. Käynnistä kone uudelleen, jos niin pyydetään ja lähetä combofix.txt-tiedoston sisältö tänne. Tyhjennä roskakori ja käynnistä koneesi uudelleen. Postita tänne seuraavat lokit: * Tuore HijackThis loki (Otetaan viimeisenä ennen postitusta) * (C:\ComboFix.txt) raportti * Tarkista koneesi F-Securen online skannerilla Huom, skanneri toimii vain Internet Explorer selaimella * Lue sivun ohjeet huolella läpi * Klikkaa Start scanning * Mikäli saat Internet Explorer -suojausvaroituksen, klikkaa Asenna * Klikkaa Accept * Klikkaa Custom Scan * Säädä asetukset seuraavasti o "Virus Scan Option" kohdasta valitse Scan whole system o "Other Scan Option" kohdasta valitse Scan All Files o Valitse Scan whole system for rootkits o Valitse Scan whole system for spyware o Laita ruksi kohtaan Scan inside archives o Varmista että Use advanced heuristics on valittuna * Klikkaa Start * Skannaus käynnistyy kun tarvittavat tiedostot/päivitykset on ladattu * Odota kärsivällisesti * Kun sakannaus on suoritettu, klikkaa Automatic cleaning * Klikkaa Show Report * Raportti aukeaa selaimessa, kopioi teksti kokonaan * Liitä kopioitu teksti esim. muistioon tai Wordiin ja tallenna työpöydälle * Voit sulkea skannerin * Lähetä raportti viestiketjuusi
