HJT-login tarkistus, selvä Troijalainen, apua?

Elikkäs, tässä kaverin konetta säädin ja huomasin omituisia pop-uppeja, jotka tarjosivat uusia virustorjuntaohjelmia jne.
Prosesseista sitten löysin omituisia scm.exe, scit.exe jne. Käytin
setä googlea ja http://koti.mbnet.fi/pattaya1/orkki_INFO.htm -sivulla
infon lisäksi kehotettiin kääntymään asiantuntijoiden puoleen. Tässä
sitten ollaan, mikä olisi avuksi?


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:50:57, on 13.4.2008
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)
Boot mode: Normal

Running processes:
G:\WINDOWS\System32\smss.exe
G:\WINDOWS\system32\winlogon.exe
G:\WINDOWS\system32\services.exe
G:\WINDOWS\system32\lsass.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\Explorer.EXE
G:\WINDOWS\system32\spoolsv.exe
G:\Program Files\Winamp\winampa.exe
E:\Hyötyohjelmat\Avira\AntiVir PersonalEdition Classic\avgnt.exe
E:\Hyötyohjelmat\ZoneAlarm\zlclient.exe
G:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
G:\WINDOWS\System32\ZoneLabs\vsmon.exe
E:\Hyötyohjelmat\Ad-Aware\aawservice.exe
E:\Hyötyohjelmat\Asennusohjelmat\ie6setup.exe
G:\DOCUME~1\Fahri\LOCALS~1\Temp\IXP000.TMP\ie6wzd.exe
G:\WINDOWS\System32\wuauclt.exe
G:\WINDOWS\System32\wuauclt.exe
G:\Program Files\Mozilla Firefox\firefox.exe
G:\Program Files\NetProject\sbmntr.exe
G:\Program Files\NetProject\scit.exe
G:\Program Files\NetProject\scm.exe
G:\Program Files\NetProject\sbsm.exe
E:\Hyötyohjelmat\Asennusohjelmat\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: 215651 helper - {0BC5E8C9-6EFF-4976-9A3C-D74148442CE7} - G:\WINDOWS\System32\215651\215651.dll
O2 - BHO: (no name) - {7C109800-A5D5-438F-9640-18D17E168B88} - G:\Program Files\NetProject\sbmdl.dll
O3 - Toolbar: Internet Service - {51D81DD5-55B7-497F-95DB-D356429BB54E} - G:\Program Files\NetProject\wamdl.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - G:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NeroCheck] G:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] "G:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [avgnt] "E:\Hyötyohjelmat\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [ZoneAlarm Client] "E:\Hyötyohjelmat\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\RunOnce: [wextract_cleanup0] rundll32.exe G:\WINDOWS\System32\advpack.dll,DelNodeRunDLL32 "G:\DOCUME~1\Fahri\LOCALS~1\Temp\IXP000.TMP\"
O4 - HKLM\..\RunOnce: [BrandClearStubs] RUNDLL32 IEDKCS32.DLL,BrandCleanInstallStubs >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS
O4 - HKLM\..\RunOnce: [Regsister WScript] wscript -regserver
O4 - HKCU\..\Run: [MsnMsgr] "G:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKLM\..\Policies\Explorer\Run: [some] G:\Program Files\NetProject\scit.exe
O4 - HKLM\..\Policies\Explorer\Run: [start] G:\Program Files\NetProject\sbmntr.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = G:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://G:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.ieservicegate.com/redirect.php (file missing)
O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.ieservicegate.com/redirect.php (file missing)
O22 - SharedTaskScheduler: asparagine - {65bbf06c-ea06-4818-92a3-f3550d0e1004} - G:\WINDOWS\System32\rkvdr.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - E:\Hyötyohjelmat\Ad-Aware\aawservice.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - G:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - G:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe (file missing)
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Unknown owner - G:\Program Files\Symantec AntiVirus\DefWatch.exe (file missing)
O23 - Service: LiveUpdate - Symantec Corporation - G:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: SAVRoam (SavRoam) - Unknown owner - G:\Program Files\Symantec AntiVirus\SavRoam.exe (file missing)
O23 - Service: Sygate Personal Firewall Pro (SmcService) - Unknown owner - G:\Program Files\Sygate\SPF\smc.exe (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Unknown owner - G:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe (file missing)
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Unknown owner - G:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe (file missing)
O23 - Service: Symantec AntiVirus - Unknown owner - G:\Program Files\Symantec AntiVirus\Rtvscan.exe (file missing)

--
End of file - 5041 bytes

 

Lataa SmitfraudFix (c) S!Ri
Pura sisältö (kansio nimeltä SmitfraudFix) työpöydällesi:

Avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
Valitse optio #1 - Search kirjoittamalla 1 ja painamalla "Enter"; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa).
Postita ponnahtava rapport – muistion sisältö viestiketjuusi.
Löytyy myös C:\rapport.txt

Huomaa : process.exe filun tunnistaa jotkut Anti-virus ohjelmat
(AntiVir, Dr.Web, Kaspersky) "Haittakaluna"; se ei ole virus, vaan ohjelma joka pysäyttää prosesseja.
A/V ohjelmat eivät pysty tunnistamaan hyvän ja pahan käytön tälläisten ohjelmian väliltä,
silloin ne saattavat varoittaa käyttäjää.

 

SmitFraudFix v2.314

Scan done at 22:21:58,65, to 17.04.2008
Run from G:\Documents and Settings\Fahri\Ty”p”yt„\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

G:\WINDOWS\System32\smss.exe
G:\WINDOWS\system32\csrss.exe
G:\WINDOWS\system32\winlogon.exe
G:\WINDOWS\system32\services.exe
G:\WINDOWS\system32\lsass.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\Explorer.EXE
E:\Hyötyohjelmat\Ad-Aware\aawservice.exe
G:\Program Files\Winamp\winampa.exe
E:\Hyötyohjelmat\Avira\AntiVir PersonalEdition Classic\avgnt.exe
E:\Hyötyohjelmat\ZoneAlarm\zlclient.exe
G:\WINDOWS\system32\spoolsv.exe
G:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
G:\WINDOWS\System32\wdfmgr.exe
G:\WINDOWS\System32\ZoneLabs\vsmon.exe
G:\WINDOWS\System32\wuauclt.exe
G:\WINDOWS\System32\wuauclt.exe
G:\Program Files\Mozilla Firefox\firefox.exe
G:\WINDOWS\System32\cmd.exe
G:\WINDOWS\system32\wmsoft42464.exe
G:\WINDOWS\System32\wbem\wmiprvse.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» G:\


»»»»»»»»»»»»»»»»»»»»»»»» G:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» G:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» G:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» G:\WINDOWS\system32

G:\WINDOWS\system32\215651\ FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» G:\Documents and Settings\Fahri


»»»»»»»»»»»»»»»»»»»»»»»» G:\Documents and Settings\Fahri\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu

G:\DOCUME~1\ALLUSE~1\KYNNIS~1\Online Security Guide.url FOUND !
G:\DOCUME~1\ALLUSE~1\KYNNIS~1\Security Troubleshooting.url FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» G:\DOCUME~1\Fahri\Suosikit

G:\DOCUME~1\Fahri\Suosikit\Online Security Test.url FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» Desktop

G:\DOCUME~1\ALLUSE~1\TYPYT~1\Online Security Guide.url FOUND !
G:\DOCUME~1\ALLUSE~1\TYPYT~1\Security Troubleshooting.url FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» G:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Nykyinen kotisivu"


»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{65bbf06c-ea06-4818-92a3-f3550d0e1004}"="asparagine"

[HKEY_CLASSES_ROOT\CLSID\{65bbf06c-ea06-4818-92a3-f3550d0e1004}\InProcServer32]
@="G:\WINDOWS\System32\rkvdr.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{65bbf06c-ea06-4818-92a3-f3550d0e1004}\InProcServer32]
@="G:\WINDOWS\System32\rkvdr.dll"



»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="G:\\WINDOWS\\system32\\userinit.exe,"
"System"="kdiwa.exe"

kdiwa.exe detected !


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Your computer may be victim of a DNS Hijack: 85.255.x.x detected !

Description: ADMtek AN983 10/100 PCI Adapter - Paketinajoituksen miniportti
DNS Server Search Order: 85.255.116.132
DNS Server Search Order: 85.255.112.144

HKLM\SYSTEM\CCS\Services\Tcpip\..\{7C45EC9A-764B-4CD9-819C-A284C809CA32}: DhcpNameServer=85.255.116.132,85.255.112.144
HKLM\SYSTEM\CCS\Services\Tcpip\..\{7C45EC9A-764B-4CD9-819C-A284C809CA32}: NameServer=85.255.116.132,85.255.112.144
HKLM\SYSTEM\CCS\Services\Tcpip\..\{D3A404B6-A4B1-45ED-833C-060C894849D0}: DhcpNameServer=85.255.116.132,85.255.112.144
HKLM\SYSTEM\CCS\Services\Tcpip\..\{D3A404B6-A4B1-45ED-833C-060C894849D0}: NameServer=85.255.116.132,85.255.112.144
HKLM\SYSTEM\CS1\Services\Tcpip\..\{7C45EC9A-764B-4CD9-819C-A284C809CA32}: DhcpNameServer=85.255.116.132,85.255.112.144
HKLM\SYSTEM\CS1\Services\Tcpip\..\{7C45EC9A-764B-4CD9-819C-A284C809CA32}: NameServer=85.255.116.132,85.255.112.144
HKLM\SYSTEM\CS1\Services\Tcpip\..\{D3A404B6-A4B1-45ED-833C-060C894849D0}: DhcpNameServer=85.255.116.132,85.255.112.144
HKLM\SYSTEM\CS1\Services\Tcpip\..\{D3A404B6-A4B1-45ED-833C-060C894849D0}: NameServer=85.255.116.132,85.255.112.144
HKLM\SYSTEM\CS2\Services\Tcpip\..\{7C45EC9A-764B-4CD9-819C-A284C809CA32}: DhcpNameServer=212.146.0.10 212.146.30.200 212.146.30.201
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=85.255.116.132 85.255.112.144
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: NameServer=85.255.116.132 85.255.112.144
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=85.255.116.132 85.255.112.144
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: NameServer=85.255.116.132 85.255.112.144
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=212.146.0.10 212.146.30.200 212.146.30.201


»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End


Tuossa on raportti.. pahoittelut viivästyksestä

 

Nojoo tuota noin sun koneessa ei ole kunnollista virustorjuntaa

Printtaa ohjeet ulos

Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi.

Vikasietotilaan:

sammuta ja käynnistä
käynnistyksen yhteydessä hakkaa F8 nappia
valitse nuolinäppäimellä vikasietotila
paina enter ja enter
valitse käyttäjätilisi
paina kyllä

Jossakin koneissa hakataan F8:sin sijasta F5:tä

Kun vikasietotilassa, avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
Valitse optio #2 - Clean kirjoittamalla 2 ja painamalla "Enter" poistaaksesi tarttuneet tiedostot.

Sinulta kysytään: "Registry cleaning - Do you want to clean the registry ?"; vastaa "Yes" kirjoittamalla Y ja paina "Enter" poistaaksesi työpöydän taustakuvan ja puhdistaaksesi tarttuneet rekisteriavaimet.

Työkalu tarkistaa jos wininet.dll on tarttunut. Sinua saatetaan pyytää korvaamaan tarttunut .dll (jos löytyy); vastaa "Yes" kirjoittamalla Y ja painamalla "Enter".

Työkalun saattaa tarvita käynnistää kone uudelleen; jos ei tee niin, käynnistä normaaliin Windowsiin.
Tekstitiedosto ilmestyy, puhdistusprosessin jäljiltä; kopioi & liitä tämän raportin tulokset vastaukseesi.
Raportti löytyy paikalliselta levyltäsi, useimmiten C:\rapport.txt.

Varoitus : Ajamalla optio 2:n EI-tarttuneessa tietokoneessa, poistaa sinun työpöytäsi taustakuvan.

=========================

ajas tuokin

Lataa fixwareout.exe täältä > FixWareout.exe
tai täältä >
FixWareout.exe
ja tallenna se työpöydälle. Tuplaklikkaa sitä ja seuraa ohjeita. Klikkaa Next, sitten Install ja varmistu, että "Run fixit" on valittu. Sinun pitää käynnistää kone uudelleen, kun niin käsketään.

Lähetä uusi HjT-loki ja c:\fixwareout\report.txt sisältö


===============

ota sitten uudestaan tuo smitfraudfix sillä ykkösellä.

 

Ei jostain kumman syystä aukaise sitä smitblaa.cmd:tä vikasietotilassa Ajanko tuon toisen ohjelman ensin?

 

aja se ensin

 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:08:52, on 19.4.2008
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)
Boot mode: Normal

Running processes:
G:\WINDOWS\System32\smss.exe
G:\WINDOWS\system32\winlogon.exe
G:\WINDOWS\system32\services.exe
G:\WINDOWS\system32\lsass.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\System32\svchost.exe
E:\Hyötyohjelmat\Ad-Aware\aawservice.exe
G:\WINDOWS\Explorer.EXE
G:\Program Files\Winamp\winampa.exe
E:\Hyötyohjelmat\ZoneAlarm\zlclient.exe
G:\WINDOWS\System32\rundll32.exe
G:\WINDOWS\system32\spoolsv.exe
G:\WINDOWS\System32\rundll32.exe
G:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
G:\WINDOWS\System32\urdvxc.exe
G:\WINDOWS\System32\ZoneLabs\vsmon.exe
G:\Program Files\Mozilla Firefox\firefox.exe
E:\Hyötyohjelmat\Asennusohjelmat\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - G:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NeroCheck] G:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] "G:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [avgnt] "E:\Hyötyohjelmat\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [ZoneAlarm Client] "E:\Hyötyohjelmat\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [8496d60d] rundll32.exe "G:\WINDOWS\System32\taynuutl.dll",b
O4 - HKLM\..\Run: [WinDLL (wingatey32.exe)] rundll32.exe G:\WINDOWS\System32\wingatey32.exe,start
O4 - HKCU\..\Run: [MsnMsgr] "G:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = G:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://G:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - G:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - G:\WINDOWS\web\related.htm
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - E:\Hyötyohjelmat\Ad-Aware\aawservice.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - G:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - G:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe (file missing)
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Unknown owner - G:\Program Files\Symantec AntiVirus\DefWatch.exe (file missing)
O23 - Service: LiveUpdate - Symantec Corporation - G:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Network Windows Service (MSWindows) - Unknown owner - G:\WINDOWS\System32\urdvxc.exe
O23 - Service: SAVRoam (SavRoam) - Unknown owner - G:\Program Files\Symantec AntiVirus\SavRoam.exe (file missing)
O23 - Service: Sygate Personal Firewall Pro (SmcService) - Unknown owner - G:\Program Files\Sygate\SPF\smc.exe (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Unknown owner - G:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe (file missing)
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Unknown owner - G:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe (file missing)
O23 - Service: Symantec AntiVirus - Unknown owner - G:\Program Files\Symantec AntiVirus\Rtvscan.exe (file missing)

--
End of file - 3858 bytes





SmitFraudFix v2.314

Scan done at 15:45:48,18, la 19.04.2008
Run from G:\Documents and Settings\Fahri\Ty”p”yt„\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{65bbf06c-ea06-4818-92a3-f3550d0e1004}"="asparagine"

[HKEY_CLASSES_ROOT\CLSID\{65bbf06c-ea06-4818-92a3-f3550d0e1004}\InProcServer32]
@="G:\WINDOWS\System32\rkvdr.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{65bbf06c-ea06-4818-92a3-f3550d0e1004}\InProcServer32]
@="G:\WINDOWS\System32\rkvdr.dll"


»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

G:\WINDOWS\System32\rkvdr.dll -> Hoax.Win32.Renos.gen.o
G:\WINDOWS\System32\rkvdr.dll -> Deleted


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

G:\WINDOWS\system32\215651\ Deleted
G:\DOCUME~1\ALLUSE~1\KYNNIS~1\Online Security Guide.url Deleted
G:\DOCUME~1\ALLUSE~1\KYNNIS~1\Security Troubleshooting.url Deleted
G:\DOCUME~1\ALLUSE~1\TYPYT~1\Online Security Guide.url Deleted
G:\DOCUME~1\ALLUSE~1\TYPYT~1\Security Troubleshooting.url Deleted
G:\DOCUME~1\Fahri\Suosikit\Online Security Test.url Deleted

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{7C45EC9A-764B-4CD9-819C-A284C809CA32}: DhcpNameServer=193.210.19.19 192.89.123.29
HKLM\SYSTEM\CS1\Services\Tcpip\..\{7C45EC9A-764B-4CD9-819C-A284C809CA32}: DhcpNameServer=193.210.19.19 192.89.123.29
HKLM\SYSTEM\CS2\Services\Tcpip\..\{7C45EC9A-764B-4CD9-819C-A284C809CA32}: DhcpNameServer=193.210.19.19 192.89.123.29
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=193.210.19.19 192.89.123.29
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=193.210.19.19 192.89.123.29
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=193.210.19.19 192.89.123.29


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"system"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End








Username "Fahri" - 18.04.2008 17:16:55 [Fixwareout edited 9/01/2007]

~~~~~ Prerun check
HKLM\SOFTWARE\~\Winlogon\ "System"="kdiwa.exe"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
"nameserver"="85.255.116.132 85.255.112.144" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{7C45EC9A-764B-4CD9-819C-A284C809CA32}
"nameserver"="85.255.116.132,85.255.112.144" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{D3A404B6-A4B1-45ED-833C-060C894849D0}
"nameserver"="85.255.116.132,85.255.112.144" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{D3A404B6-A4B1-45ED-833C-060C894849D0}
"DhcpNameServer"="85.255.116.132,85.255.112.144" <Value cleared.

DNS-tulkintatoiminnon välimuistin tyhjentäminen onnistui.


System was rebooted successfully.

~~~~~ Postrun check
HKLM\SOFTWARE\~\Winlogon\ "system"=""
....
....
~~~~~ Misc files.
....
~~~~~ Checking for older varients.
....
~~~~~ Other
G:\WINDOWS\Temp\kdiwa.ren 78472 09.10.2001

~~~~~ Current runs (hklm hkcu "run" Keys Only)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroCheck"="G:\\WINDOWS\\system32\\NeroCheck.exe"
"WinampAgent"="\"G:\\Program Files\\Winamp\\winampa.exe\""
"avgnt"="\"E:\\Hyötyohjelmat\\Avira\\AntiVir PersonalEdition Classic\\avgnt.exe\" /min"
"ZoneAlarm Client"="\"E:\\Hyötyohjelmat\\ZoneAlarm\\zlclient.exe\""
"8496d60d"="rundll32.exe \"G:\\WINDOWS\\System32\\taynuutl.dll\",b"
"WinDLL (wingatey32.exe)"="rundll32.exe G:\\WINDOWS\\System32\\wingatey32.exe,start"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="\"G:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background"
....
Hosts file was reset, If you use a custom hosts file please replace it...
~~~~~ End report ~~~~~



Tuossa on nyt nuo raportit. Aviran .exen oli jotenkin tuhonnut, eikä käynnisty enää, sama myös asennuspaketissa.

 

Lataa Malwarebytes' Anti-Malware työpöydällesi.

1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
8. Lähetä lokin sisältö seuraavassa viestissäsi.

 

Malwarebytes' Anti-Malware 1.11
Tietokantaversio: 652

Tarkistustyyppi: Täysi tarkistus (C:\|D:\|E:\|G:\|)
Tarkistetut kohteet: 48281
Kulunut aika: 33 minute(s), 37 second(s)

Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 3
Saastuneita rekisteriavaimia: 20
Saastuneita rekisteriarvoja: 4
Saastuneita rekisterikohteita: 2
Saastuneita hakemistoja: 1
Saastuneita tiedostoja: 46

Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)

Saastuneita muistimoduuleja:
G:\WINDOWS\system32\taynuutl.dll (Trojan.Vundo) -> Unloaded module successfully.
G:\WINDOWS\system32\tuvtSLed.dll (Trojan.Vundo) -> Unloaded module successfully.
G:\WINDOWS\system32\efcBqpMd.dll (Trojan.Vundo) -> Unloaded module successfully.

Saastuneita rekisteriavaimia:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3a27602c-2239-43c1-aa0b-f0b88cf5f432} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{3a27602c-2239-43c1-aa0b-f0b88cf5f432} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{25e0128d-aafc-49ff-ab11-1f12c2fcc391} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{25e0128d-aafc-49ff-ab11-1f12c2fcc391} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ee5a1465-1e73-4784-8f63-45983fdf0db8} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ee5a1465-1e73-4784-8f63-45983fdf0db8} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\efcbqpmd (Trojan.Vundo) -> Delete on reboot.
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{daed9266-8c28-4c1c-8b58-5c66eff1d302} (Search.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\jkwslist (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\aldd (Malware.Trace) -> Delete on reboot.
HKEY_CURRENT_USER\Software\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\E404.e404mgr (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Saastuneita rekisteriarvoja:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8496d60d (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\{9034a523-d068-4be8-a284-9df278be776e} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{ee5a1465-1e73-4784-8f63-45983fdf0db8} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BMbb2b4ef9 (Trojan.Agent) -> Delete on reboot.

Saastuneita rekisterikohteita:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: g:\windows\system32\tuvtsled -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages (Trojan.Vundo) -> Data: g:\windows\system32\tuvtsled -> Delete on reboot.

Saastuneita hakemistoja:
G:\WINDOWS\system32\892267 (Trojan.BHO) -> Quarantined and deleted successfully.

Saastuneita tiedostoja:
G:\WINDOWS\system32\taynuutl.dll (Trojan.Vundo) -> Delete on reboot.
G:\WINDOWS\system32\ltuunyat.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
G:\WINDOWS\system32\tuvtSLed.dll (Trojan.Vundo) -> Delete on reboot.
G:\WINDOWS\system32\deLStvut.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
G:\WINDOWS\system32\deLStvut.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
G:\WINDOWS\system32\892267\892267.dll (Trojan.BHO) -> Quarantined and deleted successfully.
G:\WINDOWS\system32\efcBqpMd.dll (Trojan.Vundo) -> Delete on reboot.
G:\System Volume Information\_restore{EEDA933E-BC31-4694-91E7-BB5309CE2015}\RP10\A0001658.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
G:\System Volume Information\_restore{EEDA933E-BC31-4694-91E7-BB5309CE2015}\RP10\A0001659.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
G:\System Volume Information\_restore{EEDA933E-BC31-4694-91E7-BB5309CE2015}\RP10\A0001677.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
G:\System Volume Information\_restore{EEDA933E-BC31-4694-91E7-BB5309CE2015}\RP10\A0001678.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
G:\System Volume Information\_restore{EEDA933E-BC31-4694-91E7-BB5309CE2015}\RP10\A0001688.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
G:\System Volume Information\_restore{EEDA933E-BC31-4694-91E7-BB5309CE2015}\RP10\A0001689.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
G:\System Volume Information\_restore{EEDA933E-BC31-4694-91E7-BB5309CE2015}\RP10\A0001698.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
G:\System Volume Information\_restore{EEDA933E-BC31-4694-91E7-BB5309CE2015}\RP10\A0001699.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
G:\System Volume Information\_restore{EEDA933E-BC31-4694-91E7-BB5309CE2015}\RP10\A0001705.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
G:\System Volume Information\_restore{EEDA933E-BC31-4694-91E7-BB5309CE2015}\RP10\A0001706.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
G:\System Volume Information\_restore{EEDA933E-BC31-4694-91E7-BB5309CE2015}\RP10\A0001716.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
G:\System Volume Information\_restore{EEDA933E-BC31-4694-91E7-BB5309CE2015}\RP10\A0001717.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
G:\System Volume Information\_restore{EEDA933E-BC31-4694-91E7-BB5309CE2015}\RP10\A0001723.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
G:\System Volume Information\_restore{EEDA933E-BC31-4694-91E7-BB5309CE2015}\RP10\A0001724.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
G:\System Volume Information\_restore{EEDA933E-BC31-4694-91E7-BB5309CE2015}\RP10\A0002722.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
G:\System Volume Information\_restore{EEDA933E-BC31-4694-91E7-BB5309CE2015}\RP10\A0002724.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
G:\System Volume Information\_restore{EEDA933E-BC31-4694-91E7-BB5309CE2015}\RP13\A0003007.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
G:\System Volume Information\_restore{EEDA933E-BC31-4694-91E7-BB5309CE2015}\RP13\A0003008.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
G:\System Volume Information\_restore{EEDA933E-BC31-4694-91E7-BB5309CE2015}\RP14\A0003023.exe (Trojan.Agent) -> Quarantined and deleted successfully.
G:\System Volume Information\_restore{EEDA933E-BC31-4694-91E7-BB5309CE2015}\RP14\A0003257.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
G:\System Volume Information\_restore{EEDA933E-BC31-4694-91E7-BB5309CE2015}\RP14\A0003258.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
G:\System Volume Information\_restore{EEDA933E-BC31-4694-91E7-BB5309CE2015}\RP14\A0003457.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
G:\System Volume Information\_restore{EEDA933E-BC31-4694-91E7-BB5309CE2015}\RP14\A0003459.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
G:\System Volume Information\_restore{EEDA933E-BC31-4694-91E7-BB5309CE2015}\RP14\A0003466.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
G:\System Volume Information\_restore{EEDA933E-BC31-4694-91E7-BB5309CE2015}\RP14\A0003468.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
G:\System Volume Information\_restore{EEDA933E-BC31-4694-91E7-BB5309CE2015}\RP14\A0003485.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
G:\System Volume Information\_restore{EEDA933E-BC31-4694-91E7-BB5309CE2015}\RP14\A0003486.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
G:\System Volume Information\_restore{EEDA933E-BC31-4694-91E7-BB5309CE2015}\RP14\A0003496.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
G:\System Volume Information\_restore{EEDA933E-BC31-4694-91E7-BB5309CE2015}\RP14\A0003498.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
G:\System Volume Information\_restore{EEDA933E-BC31-4694-91E7-BB5309CE2015}\RP14\A0003506.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
G:\System Volume Information\_restore{EEDA933E-BC31-4694-91E7-BB5309CE2015}\RP14\A0003507.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
G:\System Volume Information\_restore{EEDA933E-BC31-4694-91E7-BB5309CE2015}\RP15\A0004246.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
G:\System Volume Information\_restore{EEDA933E-BC31-4694-91E7-BB5309CE2015}\RP15\A0004248.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
G:\System Volume Information\_restore{EEDA933E-BC31-4694-91E7-BB5309CE2015}\RP7\A0001512.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
G:\System Volume Information\_restore{EEDA933E-BC31-4694-91E7-BB5309CE2015}\RP7\A0001513.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
G:\System Volume Information\_restore{EEDA933E-BC31-4694-91E7-BB5309CE2015}\RP8\A0001632.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
G:\System Volume Information\_restore{EEDA933E-BC31-4694-91E7-BB5309CE2015}\RP8\A0001633.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
G:\WINDOWS\system32\ajxdugcy.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
G:\WINDOWS\system32\iuddvqta.dll (Trojan.Agent) -> Delete on reboot.



Ensimmäisellä kerralla kun poisti noita tiedostoja, iski blue screenin ja teki jonkun vedostuksen. Toisella kerralla vasta onnistui.

 

Scannaa uusi hjt:n logi

 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:06:39, on 19.4.2008
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)
Boot mode: Normal

Running processes:
G:\WINDOWS\System32\smss.exe
G:\WINDOWS\system32\winlogon.exe
G:\WINDOWS\system32\services.exe
G:\WINDOWS\system32\lsass.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\System32\svchost.exe
E:\Hyötyohjelmat\Ad-Aware\aawservice.exe
G:\WINDOWS\Explorer.EXE
G:\Program Files\Winamp\winampa.exe
E:\Hyötyohjelmat\ZoneAlarm\zlclient.exe
G:\WINDOWS\System32\rundll32.exe
G:\WINDOWS\system32\spoolsv.exe
G:\WINDOWS\System32\ZoneLabs\vsmon.exe
G:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
G:\WINDOWS\System32\urdvxc.exe
G:\Program Files\Mozilla Firefox\firefox.exe
G:\WINDOWS\system32\cmd.exe
G:\WINDOWS\system32\rundll32.exe
E:\Hyötyohjelmat\Asennusohjelmat\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: {f4b86f54-f35c-d7e9-6e84-855039c44d39} - {93d44c93-0558-48e6-9e7d-c53f45f68b4f} - G:\WINDOWS\System32\jsxvqxqd.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - G:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NeroCheck] G:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] "G:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [avgnt] "E:\Hyötyohjelmat\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [ZoneAlarm Client] "E:\Hyötyohjelmat\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [WinDLL (wingatey32.exe)] rundll32.exe G:\WINDOWS\System32\wingatey32.exe,start
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [MsnMsgr] "G:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-21-1343024091-1580436667-1060284298-1003\..\Run: [MsnMsgr] "G:\Program Files\MSN Messenger\MsnMsgr.Exe" /background (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = G:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://G:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - G:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - G:\WINDOWS\web\related.htm
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - E:\Hyötyohjelmat\Ad-Aware\aawservice.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - G:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - G:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe (file missing)
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Unknown owner - G:\Program Files\Symantec AntiVirus\DefWatch.exe (file missing)
O23 - Service: LiveUpdate - Symantec Corporation - G:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Network helper Service (MSDisk) - Unknown owner - G:\WINDOWS\System32\irdvxc.exe (file missing)
O23 - Service: Network Windows Service (MSWindows) - Unknown owner - G:\WINDOWS\System32\urdvxc.exe
O23 - Service: SAVRoam (SavRoam) - Unknown owner - G:\Program Files\Symantec AntiVirus\SavRoam.exe (file missing)
O23 - Service: Sygate Personal Firewall Pro (SmcService) - Unknown owner - G:\Program Files\Sygate\SPF\smc.exe (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Unknown owner - G:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe (file missing)
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Unknown owner - G:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe (file missing)
O23 - Service: Symantec AntiVirus - Unknown owner - G:\Program Files\Symantec AntiVirus\Rtvscan.exe (file missing)

--
End of file - 4231 bytes

 

Tiedoksi vain vielä, etten pysty asentamaan mitään antivirus-ohjelmaa, koska osa niiden tiedostoista on korruptoituneita / korruptoituu aina kun yritän asentaa. Niin käy AVG:n, Aviran (Avira sanoo suoraan että virus mahdollisesti aiheuttaa hallaa) kuin Zone-Alarmin kanssa. Uuden asennuspaketin lataaminenkaan ei auta.

 

scannaa hjt:llä merkkaa paina Fix checked

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - G:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - G:\WINDOWS\web\related.htm

=====================

1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
combofix1
combofix2

2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

===========

Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

Käynnistä koneesi vikasietotilaan:

sammuta ja käynnistä
käynnistyksen yhteydessä hakkaa F8 nappia
valitse nuolinäppäimellä vikasietotila
paina enter ja enter
valitse käyttäjätilisi
paina kyllä

Jossakin koneissa hakataan F8:sin sijasta F5:tä

" Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
" Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
" Paina Y käynnistääksesi skriptin.
" Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
" Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
" Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
" Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
" Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
" Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.

 

ComboFix 08-04-18.3 - Fahri 2008-04-20 14:25:53.1 - NTFSx86

Running from: G:\Documents and Settings\Fahri\Työpöytä\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

G:\WINDOWS\pskt.ini
G:\WINDOWS\system32\.exe
G:\WINDOWS\system32\iuddvqta.dll
G:\WINDOWS\system32\jsxvqxqd.dll

.
((((( Tiedostot, jotka on luotu seuraavalla aikav„lill„: 2008-03-20 to 2008-04-20 )))))))))))))))))
.

2008-04-19 19:07 . 2008-04-19 19:07 <KANSIO> d-------- G:\Documents and Settings\LocalService\Application Data\AVG7
2008-04-19 19:06 . 2008-04-19 19:06 <KANSIO> d-------- G:\Documents and Settings\All Users\Application Data\Grisoft
2008-04-19 19:06 . 2008-04-19 19:49 <KANSIO> d-------- G:\Documents and Settings\All Users\Application Data\avg7
2008-04-19 19:06 . 2008-04-19 19:11 1,566,938 --a------ G:\WINDOWS\system32\at.dll
2008-04-19 18:34 . 2001-11-08 16:38 844,048 --a------ G:\WINDOWS\system32\msdxm.ocx
2008-04-19 18:34 . 2001-11-08 16:38 498,960 --a------ G:\WINDOWS\system32\dxmasf.dll
2008-04-19 18:34 . 2001-04-20 12:14 251,904 --a------ G:\WINDOWS\system32\strmdll.dll
2008-04-19 18:06 . 2008-04-19 18:06 114,462 --a------ G:\WINDOWS\system32\gs.dll
2008-04-19 17:04 . 2008-04-19 17:04 109,738 --a------ G:\WINDOWS\BMbb2b4ef9.xml
2008-04-19 16:20 . 2008-04-19 16:20 <KANSIO> d-------- G:\Documents and Settings\Fahri\Application Data\Malwarebytes
2008-04-19 16:19 . 2008-04-19 16:19 <KANSIO> d-------- G:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-04-19 16:11 . 2008-04-19 16:11 303,248 --a------ G:\WINDOWS\system32\ms.dll
2008-04-18 17:16 . 2008-04-18 17:44 <KANSIO> d-------- G:\fixwareout
2008-04-18 16:25 . 2008-04-20 14:25 1,138,688 --a------ G:\WINDOWS\system32\hqghumea.dll
2008-04-18 00:31 . 2008-04-18 00:31 122,368 --ahs---- G:\WINDOWS\system32\urdvxc.exe
2008-04-17 22:52 . 2008-04-17 22:52 1,138,688 ---hs---- G:\WINDOWS\system32\wingatey32.exe
2008-04-17 22:52 . 2008-04-17 22:52 33,952 --a------ G:\WINDOWS\system32\drivers\oreans32.sys
2008-04-17 22:30 . 2008-04-17 22:30 225,280 --a------ G:\WINDOWS\system32\wmsoft04433.exe
2008-04-17 22:28 . 2008-04-17 22:28 225,280 --a------ G:\WINDOWS\system32\wmsoft56246.exe
2008-04-17 22:22 . 2008-04-19 15:46 1,942 --a------ G:\WINDOWS\system32\tmp.reg
2008-04-17 22:21 . 2008-04-17 22:21 196,608 -r-hs---- G:\WINDOWS\wmssvc.exe
2008-04-17 22:21 . 2008-04-17 22:21 196,608 --a------ G:\WINDOWS\system32\wmsoft42464.exe
2008-04-17 22:21 . 2008-04-17 22:30 80 --a------ G:\WINDOWS\system32\i
2008-04-13 19:09 . 2008-04-13 19:10 <KANSIO> d-------- G:\WINDOWS\Windows Update Setup Files
2008-04-13 19:09 . 2008-04-13 19:09 <KANSIO> d-------- G:\WINDOWS\Sivuhistoria
2008-04-13 19:09 . 2008-04-13 19:10 32,768 --a------ G:\WINDOWS\Active Setup Log.BAK
2008-04-13 18:55 . 2008-04-13 18:56 <KANSIO> d-------- G:\Documents and Settings\All Users\Application Data\Lavasoft
2008-04-13 18:41 . 2008-04-13 18:41 <KANSIO> d-------- G:\Documents and Settings\All Users\Application Data\MailFrontier
2008-04-13 18:41 . 2008-04-13 18:42 4,212 ---h----- G:\WINDOWS\system32\zllictbl.dat
2008-04-13 18:40 . 2004-04-27 04:40 11,264 --a------ G:\WINDOWS\system32\SpOrder.dll
2008-04-13 18:39 . 2008-04-19 19:13 <KANSIO> d-------- G:\WINDOWS\Internet Logs
2008-04-13 18:35 . 2008-04-13 18:35 <KANSIO> d-------- G:\Documents and Settings\All Users\Application Data\Avira
2008-04-11 01:52 . 2008-04-11 01:52 <KANSIO> d-------- G:\WINDOWS\system32\bits
2008-04-11 01:40 . 2008-04-11 01:40 870,128 --a------ G:\WINDOWS\system32\mcs.rma
2008-04-11 01:40 . 2008-04-11 01:40 4 --a------ G:\WINDOWS\system32\DFAF0B
2008-04-11 01:32 . 2005-01-28 13:44 258,296 --a------ G:\WINDOWS\system32\setb0.tmp
2008-04-11 01:30 . 2008-04-11 01:31 <KANSIO> d-------- G:\Program Files\Common Files\Real
2008-04-11 01:30 . 2008-04-11 01:30 8,413 --a------ G:\WINDOWS\system32\drivers\mcstrm.sys
2008-04-11 01:26 . 2008-04-18 01:18 <KANSIO> d-------- G:\Program Files\Rhapsody
2008-04-11 01:19 . 2008-04-11 01:19 <KANSIO> d-------- G:\Documents and Settings\PC Doc Pro\backup
2008-04-11 01:18 . 2008-04-11 01:50 <KANSIO> d-a------ G:\Documents and Settings\All Users\Application Data\TEMP
2008-04-11 01:17 . 2008-04-11 01:47 <KANSIO> d-------- G:\Documents and Settings\PC Doc Pro
2008-04-11 01:17 . 2008-01-17 14:37 1,331,200 --a------ G:\Documents and Settings\PC Doc Pro\pcdocpro.exe
2008-04-11 01:17 . 2008-04-11 01:45 668,938 --a------ G:\Documents and Settings\PC Doc Pro\unins000.exe
2008-04-11 01:17 . 2004-03-09 09:30 662,288 --a------ G:\WINDOWS\system32\MSCOMCT2.OCX
2008-04-11 01:17 . 2000-05-22 10:30 608,448 --a------ G:\WINDOWS\system32\COMCTL32.OCX
2008-04-11 01:17 . 2001-08-17 00:00 494,352 --a------ G:\WINDOWS\system32\SHDOC401.DLL
2008-04-11 01:17 . 2007-03-05 11:51 360,580 --a------ G:\Documents and Settings\PC Doc Pro\eSellerateEngine.dll
2008-04-11 01:17 . 1998-06-24 00:00 164,144 --a------ G:\WINDOWS\system32\COMCT232.OCX
2008-04-11 01:17 . 2007-02-23 16:57 94,208 --a------ G:\Documents and Settings\PC Doc Pro\ESELLERATECONTROL365.DLL
2008-04-11 01:17 . 2000-05-22 15:58 83,144 --a------ G:\WINDOWS\system32\PICCLP32.OCX
2008-04-11 01:17 . 2007-12-19 16:12 53,248 --a------ G:\WINDOWS\system32\ArmAccess.dll
2008-04-11 01:17 . 2004-07-30 09:26 35,682 --a------ G:\Documents and Settings\PC Doc Pro\Comp1.avi
2008-04-11 01:17 . 2004-07-31 18:28 16,410 --a------ G:\Documents and Settings\PC Doc Pro\Comp 1_4.avi
2008-04-11 01:17 . 2008-04-11 01:47 5,097 --a------ G:\Documents and Settings\PC Doc Pro\unins000.dat
2008-04-11 01:17 . 2005-05-19 17:59 556 --a------ G:\Documents and Settings\PC Doc Pro\PCDOCPRO.exe.manifest
2008-04-09 20:07 . 2008-04-09 20:07 <KANSIO> dr------- G:\Documents and Settings\LocalService\Suosikit
2008-04-07 15:05 . 2004-07-02 01:05 360,448 --a--c--- G:\WINDOWS\system32\dllcache\qmgr.dll
2008-04-07 15:05 . 2004-07-02 01:05 331,776 --a------ G:\WINDOWS\system32\winhttp.dll
2008-04-07 15:05 . 2004-07-02 01:05 17,408 --a------ G:\WINDOWS\system32\qmgrprxy.dll
2008-04-07 15:05 . 2004-07-02 01:05 17,408 --a--c--- G:\WINDOWS\system32\dllcache\qmgrprxy.dll
2008-04-07 15:05 . 2004-07-02 01:05 7,680 -----c--- G:\WINDOWS\system32\dllcache\bitsprx2.dll
2008-04-07 15:05 . 2004-07-02 01:05 7,680 --------- G:\WINDOWS\system32\bitsprx2.dll
2008-04-07 15:05 . 2004-07-02 01:05 7,168 -----c--- G:\WINDOWS\system32\dllcache\bitsprx3.dll
2008-04-07 15:05 . 2004-07-02 01:05 7,168 --------- G:\WINDOWS\system32\bitsprx3.dll
2008-04-07 14:59 . 2007-07-30 19:19 549,720 --a------ G:\WINDOWS\system32\wuapi.dll
2008-04-07 14:59 . 2007-07-30 19:19 325,976 --a------ G:\WINDOWS\system32\wucltui.dll
2008-04-07 14:59 . 2007-07-30 19:19 216,408 --a------ G:\WINDOWS\system32\wuaucpl.cpl
2008-04-07 14:59 . 2007-07-30 19:19 203,096 --a------ G:\WINDOWS\system32\wuweb.dll
2008-04-07 14:59 . 2004-08-03 14:03 186,648 --a------ G:\WINDOWS\system32\wuaueng1.dll
2008-04-07 14:59 . 2004-08-03 14:02 168,728 --a------ G:\WINDOWS\system32\wuauclt1.exe
2008-04-07 14:59 . 2007-07-30 19:18 33,624 --a------ G:\WINDOWS\system32\wups.dll
2008-04-04 22:37 . 2008-04-04 22:37 <KANSIO> d-------- G:\Program Files\Common Files\NSV
2008-04-03 04:22 . 2008-04-19 20:43 670,625,792 --a------ G:\WINDOWS\MEMORY.DMP
2008-04-03 01:56 . 2001-10-09 15:00 843,832 --a--c--- G:\WINDOWS\system32\dllcache\tintlgnt.ime
2008-04-03 01:55 . 2001-10-09 15:00 1,875,968 --a--c--- G:\WINDOWS\system32\dllcache\msir3jp.lex
2008-04-03 01:54 . 2001-10-09 15:00 1,158,818 --a--c--- G:\WINDOWS\system32\dllcache\korwbrkr.lex
2008-04-03 01:53 . 2001-10-09 15:00 13,463,552 --a--c--- G:\WINDOWS\system32\dllcache\hwxjpn.dll
2008-04-03 01:52 . 2001-10-09 15:00 1,677,824 --a--c--- G:\WINDOWS\system32\dllcache\chsbrkr.dll
2008-04-03 01:51 . 2001-10-05 16:31 2,134,528 --a--c--- G:\WINDOWS\system32\dllcache\EXCH_smtpsnap.dll
2008-04-03 01:45 . 2008-04-03 01:45 749 -rah----- G:\WINDOWS\WindowsShell.Manifest
2008-04-03 01:45 . 2008-04-03 01:45 749 -rah----- G:\WINDOWS\system32\wuaucpl.cpl.manifest
2008-04-03 01:45 . 2008-04-03 01:45 749 -rah----- G:\WINDOWS\system32\sapi.cpl.manifest
2008-04-03 01:45 . 2008-04-03 01:45 749 -rah----- G:\WINDOWS\system32\nwc.cpl.manifest
2008-04-03 01:45 . 2008-04-03 01:45 749 -rah----- G:\WINDOWS\system32\ncpa.cpl.manifest
2008-04-03 01:45 . 2008-04-03 01:45 488 -rah----- G:\WINDOWS\system32\logonui.exe.manifest
2008-04-03 01:44 . 2001-10-09 15:00 159,744 --a--c--- G:\WINDOWS\system32\dllcache\icwhelp.dll
2008-04-03 01:44 . 2001-10-09 15:00 81,920 --a--c--- G:\WINDOWS\system32\dllcache\icwtutor.exe
2008-04-03 01:44 . 2001-10-09 15:00 61,440 --a--c--- G:\WINDOWS\system32\dllcache\icwres.dll
2008-04-03 01:44 . 2001-10-09 15:00 57,344 --a--c--- G:\WINDOWS\system32\dllcache\icwconn.dll
2008-04-03 01:44 . 2001-10-09 15:00 45,056 --a--c--- G:\WINDOWS\system32\dllcache\icwutil.dll
2008-04-03 01:44 . 2001-10-09 15:00 40,960 --a--c--- G:\WINDOWS\system32\dllcache\trialoc.dll
2008-04-03 01:44 . 2001-10-09 15:00 32,768 --a--c--- G:\WINDOWS\system32\dllcache\icwrmind.exe
2008-04-03 01:32 . 2001-10-09 15:00 1,085,938 -ra------ G:\WINDOWS\SET1C.tmp
2008-04-03 01:32 . 2001-10-09 15:00 13,923 -ra------ G:\WINDOWS\SET28.tmp
2008-04-03 00:52 . 2008-04-03 00:52 <KANSIO> d---s---- G:\WINDOWS\system32\Microsoft
2008-04-03 00:52 . 2008-04-03 00:52 <KANSIO> d-------- G:\Program Files\Real
2008-04-03 00:52 . 2008-04-03 00:52 <KANSIO> d-------- G:\Documents and Settings\All Users\Application Data\Windows Live Toolbar
2008-04-03 00:51 . 2008-04-03 02:10 <KANSIO> d-------- G:\Program Files\Windows Live Toolbar
2008-04-03 00:50 . 2008-04-03 02:11 <KANSIO> d----c--- G:\WINDOWS\system32\DRVSTORE
2008-04-03 00:50 . 2008-04-03 00:50 <KANSIO> d-------- G:\Documents and Settings\Fahri\Contacts
2008-04-02 22:37 . 2008-04-02 22:37 1,158 --a------ G:\WINDOWS\mozver.dat
2008-04-02 22:24 . 2008-04-02 22:24 0 --a------ G:\WINDOWS\nsreg.dat
2008-04-02 22:08 . 2008-04-02 23:22 <KANSIO> d-------- G:\Documents and Settings\All Users\Application Data\Winamp Toolbar
2008-04-02 22:06 . 2007-03-08 02:51 129,784 --a------ G:\WINDOWS\system32\pxafs.dll
2008-04-02 22:00 . 2008-04-13 18:10 0 --ah----- G:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG
2008-04-02 20:58 . 2008-04-02 21:00 <KANSIO> d-------- G:\WINDOWS\system32\MsDtc

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-17 22:20 122,368 ----a-w G:\WINDOWS\Web\qksljtjl.exe
2008-04-17 22:19 122,368 ----a-w G:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\wvwbkrnv.exe
2008-04-17 22:19 122,368 ----a-w G:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\ljbrjlkw.exe
2008-04-17 22:19 122,368 ----a-w G:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\ljbrjlkw.exe
2008-04-17 22:19 122,368 ----a-w G:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\ljbrjlkw.exe
2008-04-17 22:19 122,368 ----a-w G:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\ljbrjlkw.exe
2008-04-17 22:19 122,368 ----a-w G:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\nnxxkrwr.exe
2008-04-17 22:19 122,368 ----a-w G:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\lqjtssls.exe
2008-04-17 22:19 122,368 ----a-w G:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\enrhheeh.exe
2008-04-17 22:19 122,368 ----a-w G:\WINDOWS\PCHEALTH\HELPCTR\System\UpdateCtr\rncrqxrh.exe
2008-04-17 22:19 122,368 ----a-w G:\WINDOWS\PCHEALTH\HELPCTR\System\UpdateCtr\ksvtsesj.exe
2008-04-17 22:19 122,368 ----a-w G:\WINDOWS\PCHEALTH\HELPCTR\System\UpdateCtr\esjenrkz.exe
2008-04-17 22:19 122,368 ----a-w G:\WINDOWS\PCHEALTH\HELPCTR\System\UpdateCtr\csvrjxkj.exe
2008-04-13 15:53 --------- d-----w G:\Program Files\Common Files\Wise Installation Wizard
2008-04-13 15:33 --------- d-----w G:\Program Files\Symantec
2008-04-13 15:33 --------- d-----w G:\Program Files\Common Files\Symantec Shared
2008-04-13 15:32 --------- d-----w G:\Documents and Settings\All Users\Application Data\Symantec
2008-04-10 22:23 --------- d-----w G:\Program Files\RevConnect
2008-04-07 12:44 --------- d-----w G:\Documents and Settings\Fahri\Application Data\uTorrent
2008-04-02 22:18 19,200 ----a-w G:\WINDOWS\system32\drivers\usbuhci.sys
2008-04-02 20:20 --------- d-----w G:\Program Files\Winamp
2008-04-02 20:19 --------- d-----w G:\Program Files\uTorrent
2008-04-02 20:07 --------- d-----w G:\Program Files\Yahoo!
2008-04-02 18:46 765,952 ----a-w G:\WINDOWS\Unnero.exe
2008-04-02 18:46 532,480 ----a-w G:\WINDOWS\system32\imagx5.dll
2008-04-02 18:46 507,904 ----a-w G:\WINDOWS\system32\imagr5.dll
2008-04-02 18:46 49,152 ----a-w G:\WINDOWS\system32\MultiSZ.dll
2008-04-02 18:46 35,328 ----a-w G:\WINDOWS\system32\picn20.dll
2008-04-02 18:46 275,312 ----a-w G:\WINDOWS\system32\ImagXpr5.dll
2008-04-02 18:46 163,840 ----a-w G:\WINDOWS\system32\NeroCheck.exe
2008-04-02 18:46 106,496 ----a-w G:\WINDOWS\system32\TwnLib20.dll
2008-04-02 18:46 --------- d-----w G:\Program Files\Ahead
2008-04-02 18:41 --------- d-----w G:\Program Files\Lavasoft
2008-04-02 18:09 --------- d-----w G:\Program Files\microsoft frontpage
.

------- Sigcheck -------

2001-10-09 15:00 1008640 247b5dc9206f345e5448b3a172fa0b7a G:\WINDOWS\explorer.exe
2004-09-15 02:12 1039872 b295977b5097090db58528725a8dcc6a G:\WINDOWS\SoftwareDistribution\Download\3250f16dc7c5e58e0cb0716ffd5d66f6\explorer.exe
2001-10-09 15:00 1008640 3a18440d99f7656913b4f2f17a38ae12 G:\WINDOWS\system32\dllcache\explorer.exe

2004-09-15 02:12 22528 52df7604953cab785eedf66b0da90311 G:\WINDOWS\SoftwareDistribution\Download\3250f16dc7c5e58e0cb0716ffd5d66f6\ctfmon.exe
2001-10-09 15:00 20480 ceca05d49e9dc49df7c1391ff09eaeae G:\WINDOWS\system32\ctfmon.exe
2001-10-09 15:00 20480 5afc633eaf11a669eaa6b3de56d4b5ba G:\WINDOWS\system32\dllcache\ctfmon.exe
.
(((((((((((((((((((((((((((((( Rekisterin k„ynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhji„ arvoja ja laillisia oletusarvoja ei n„ytet„

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="G:\Program Files\MSN Messenger\MsnMsgr.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroCheck"="G:\WINDOWS\system32\NeroCheck.exe" [2008-04-02 21:46 163840]
"WinampAgent"="G:\Program Files\Winamp\winampa.exe" [2008-04-01 21:49 43520]
"avgnt"="E:\Hyötyohjelmat\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [ ]
"WinDLL (wingatey32.exe)"="G:\WINDOWS\System32\wingatey32.exe" [2008-04-17 22:52 1138688]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="G:\WINDOWS\System32\CTFMON.EXE" [2001-10-09 15:00 20480]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"wmssvc.exe"= wmssvc.exe:SYSTEM

R0 avgntmgr;avgntmgr;G:\WINDOWS\System32\DRIVERS\avgntmgr.sys [2007-07-18 14:22]
R1 avgntdd;avgntdd;G:\WINDOWS\System32\DRIVERS\avgntdd.sys [2007-08-09 13:04]
R1 oreans32;oreans32;G:\WINDOWS\system32\drivers\oreans32.sys [2008-04-17 22:52]
R2 MSWindows;Network Windows Service;"G:\WINDOWS\System32\urdvxc.exe" /service []
R2 NET Service;NET Service;"G:\WINDOWS\wmssvc.exe" [2008-04-17 22:21]
R3 AN983;ADMtek AN983/AN985/ADM951X 10/100Mbps Fast Ethernet Adapter;G:\WINDOWS\System32\DRIVERS\AN983.sys [2001-08-17 21:11]
S2 MSDisk;Network helper Service;"G:\WINDOWS\System32\irdvxc.exe" /service []

*Newly Created Service* - ALG
*Newly Created Service* - IPNAT
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-20 14:29:29
Windows 5.1.2600 NTFS

detected NTDLL code modification:
ZwOpenFile

scanning hidden processes ...

G:\WINDOWS\wmssvc.exe [976] 0x825A15F0

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
E:\Hyötyohjelmat\Ad-Aware\aawservice.exe
G:\WINDOWS\system32\rundll32.exe
G:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
G:\WINDOWS\system32\wdfmgr.exe
.
**************************************************************************
.
Completion time: 2008-04-20 14:33:41 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-20 11:33:36

Pre-Run: 2,690,760,704 tavua vapaana
Post-Run: 2,635,509,760 tavua vapaana

228 --- E O F --- 2008-04-10 22:53:07





SDFix: Version 1.173
Run by Fahri on su 20.04.2008 at 14:54

Microsoft Windows XP [versio 5.1.2600]
Running From: G:\SDFix

Checking Services :

Name :
MSDisk
MSWindows

Path :
"G:\WINDOWS\System32\irdvxc.exe" /service
"G:\WINDOWS\System32\urdvxc.exe" /service

MSDisk - Deleted
MSWindows - Deleted



Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting


Checking Files :

Trojan Files Found:

G:\WINDOWS\system32\wmsoft32347.exe - Deleted
G:\WINDOWS\system32\wmsoft42464.exe - Deleted
G:\WINDOWS\system32\wmsoft46311.exe - Deleted
G:\WINDOWS\system32\wmsoft56246.exe - Deleted
G:\WINDOWS\system32\i - Deleted
G:\WINDOWS\system32\urdvxc.exe - Deleted





Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1353.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-20 15:02:26
Windows 5.1.2600 NTFS

detected NTDLL code modification:
ZwOpenFile

scanning hidden processes ...

G:\WINDOWS\wmssvc.exe [784] 0x826E0BF0

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...


scan completed successfully
hidden processes: 1
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"wmssvc.exe"="wmssvc.exe:*:Enabled:SYSTEM"
"\\??\\G:\\WINDOWS\\system32\\winlogon.exe"="\\??\\G:\\WINDOWS\\system32\\winlogon.exe:*:enabledshell32.dll,-1"

Remaining Files :

G:\WINDOWS\system32\i Found

File Backups: - G:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Thu 17 Apr 2008 1,138,688 ..SH. --- "G:\WINDOWS\system32\wingatey32.exe"
Fri 11 Apr 2008 4,348 A.SH. --- "G:\Documents and Settings\All Users\DRM\DRMv1.bak"
Fri 11 Apr 2008 400 A.SH. --- "G:\Documents and Settings\All Users\DRM\v2ks.bla.bak"
Fri 11 Apr 2008 48 A.SH. --- "G:\Documents and Settings\All Users\DRM\v2ks.sec.bak"
Fri 11 Apr 2008 4,348 ...H. --- "G:\Documents and Settings\Fahri\Application Data\Real\rhapsody\wmlicbackup\drmv1key.bak"
Fri 11 Apr 2008 20 A..H. --- "G:\Documents and Settings\Fahri\Application Data\Real\rhapsody\wmlicbackup\drmv1lic.bak"
Fri 11 Apr 2008 312 ...H. --- "G:\Documents and Settings\Fahri\Application Data\Real\rhapsody\wmlicbackup\drmv2key.bak"
Fri 11 Apr 2008 1,536 A..H. --- "G:\Documents and Settings\Fahri\Application Data\Real\rhapsody\wmlicbackup\drmv2lic.bak"

Finished!




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:09:36, on 20.4.2008
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)
Boot mode: Normal

Running processes:
G:\WINDOWS\System32\smss.exe
G:\WINDOWS\system32\winlogon.exe
G:\WINDOWS\system32\services.exe
G:\WINDOWS\system32\lsass.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\Explorer.EXE
E:\Hyötyohjelmat\Ad-Aware\aawservice.exe
G:\WINDOWS\system32\spoolsv.exe
G:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
G:\WINDOWS\system32\notepad.exe
G:\Program Files\Winamp\winampa.exe
G:\WINDOWS\System32\rundll32.exe
G:\Program Files\Mozilla Firefox\firefox.exe
G:\WINDOWS\system32\NOTEPAD.EXE
E:\Hyötyohjelmat\Asennusohjelmat\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - G:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NeroCheck] G:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] "G:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [avgnt] "E:\Hyötyohjelmat\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [WinDLL (wingatey32.exe)] rundll32.exe G:\WINDOWS\System32\wingatey32.exe,start
O4 - HKCU\..\Run: [MsnMsgr] "G:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = G:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://G:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - E:\Hyötyohjelmat\Ad-Aware\aawservice.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - E:\HYTYOH~1\AVG\avgamsvr.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - G:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - G:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe (file missing)
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Unknown owner - G:\Program Files\Symantec AntiVirus\DefWatch.exe (file missing)
O23 - Service: LiveUpdate - Symantec Corporation - G:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: SAVRoam (SavRoam) - Unknown owner - G:\Program Files\Symantec AntiVirus\SavRoam.exe (file missing)
O23 - Service: Sygate Personal Firewall Pro (SmcService) - Unknown owner - G:\Program Files\Sygate\SPF\smc.exe (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Unknown owner - G:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe (file missing)
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Unknown owner - G:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe (file missing)
O23 - Service: Symantec AntiVirus - Unknown owner - G:\Program Files\Symantec AntiVirus\Rtvscan.exe (file missing)

--
End of file - 3748 bytes

 

lataa koneelle valmiiksi joku virustorjunta setup

=====================

Poistas toi norton lisää poista sovelutuksesta ja poista sitten kansiot
vikasiedossa.

G:\Program Files\Common Files\Symantec Shared
G:\Program Files\Symantec AntiVirus

aja poistotyökalu
Nortonin poistoon

============

asenna virustorjunta

============

scannaa uusi hjt:m loki

 

Eipä onnistu virustorjunnan asentaminen..
Aviralla:
"The CRC sum of
G:\DOCUME~1\Fahri\LOCALS~1\Temp\RarSFX0\basic\setup.exe
has been changed! This could be due to a virus!
Do you want to shut down Setup?

 

Myös AVG:lla tekee virheen asennuksen aikana .dll tiedostoissa.

 

otetaas tällä kone lävitse

Escan
Ohjeet tuolla sivulla.
http://koti.mbnet.fi/pattaya1/escanmwav.htm
lataa tuosta
http://www.spywareinfo.dk/download/mwav.exe
päivitä tuosta
http://koti.mbnet.fi/pattaya1/lataus/Mwav.bat
laita täpit merkkauksien mukaan
http://koti.mbnet.fi/pattaya1/eScan6.jpg

scannaa

jos ala luukkuun tulee jotain niin kopioi se näin:
Käytä komentoa Ctrl+A.
Kopioi rivit komennolla Ctrl+C.
Liitä rivit komennolla Ctrl+V.

Laita virus log tänne.

================

sitten jos sulla on killbox koneella niin poista se ensin

Lataa Killbox Option^Explicitiltä
Huomaa: Jos sinulla on jo Killbox, tämä on uusi versio joka sinun tulee asentaa. Poista aikaisempi.

Tallenna työpöydällesi.
Tupla-klikkaa Killbox.exe ajaaksesi ohjelman.
Valitse:
Delete on Reboot sitten klikkaa All Files valintaa.
Kopioi ja liitä alapuolella olevat tiedostopolut leikepöydälle mustaamalla KAIKKI ne ja painamalla CTRL + C (tai, mustaamisen jälkeen, oikea klikki hiirellä ja valitse kopioi):

G:\WINDOWS\System32\wingatey32.exe

Palaa Killboxiin, mene File valikkoon, ja valitse Paste from Clipboard.

Klikkaa puna-valkoista Delete File valintaa. Klikkaa Yes "Delete on Reboot" pyyntöön. Klikkaa OK mihin vain PendingFileRenameOperations pyyntöön.
Käynnistä koneesi itse jos se ei sitä automaattisesti tee.

 

Eipä onnista vieläkään... Ohjeitten mukaan tein ja silti valittaa:
"Some of MWAV.EXE infected by virus! Try again.."

 

katos laitoin tohon ylös lisää.