[Selvitetty!]HjT-logi: Ilkeä virus estää käyttämästä chromea se FF:ää ja IE pyörii taustalla!

Ilkeä virus on estänyt minua käyttämästä chromea sekä firefoxia sillä tavalla että jos kirjoitan jotain hakuun ja painan ENTER niin se lataa sen sivun! kyseinen virus on nimeltänsä scsss.exe jota en saa edes HjT poistolla pois. Ja toinen juttu on se että kun yritän sammuttaa ie:n joa pyörii taustalla niin käynnistyy uudelleen!! [Siis IE] Auttakaa oon yrittänyt kaikkea!! Tässä HjT-Logi:

Koodi:

Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 16:05:03, on 22.3.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Avira\AntiVir Desktop\sched.exe
D:\Program Files\Avira\AntiVir Desktop\avfwsvc.exe
D:\Program Files\Avira\AntiVir Desktop\avguard.exe
D:\Program Files\Avira\AntiVir Desktop\avshadow.exe
D:\Program Files\Application Updater\ApplicationUpdater.exe
D:\Program Files\Cacheman\CachemanServ.exe
D:\Program Files\Java\jre6\bin\jqs.exe
D:\WINDOWS\system32\libusbd-nt.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
D:\Program Files\Avira\AntiVir Desktop\avmailc.exe
D:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
D:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
D:\WINDOWS\Explorer.EXE
D:\install\scsss.exe
D:\Program Files\Logitech\iTouch\iTouch.exe
D:\Program Files\Analog Devices\SoundMAX\SMTray.exe
D:\Program Files\Avira\AntiVir Desktop\avgnt.exe
D:\Program Files\Logitech\MouseWare\system\em_exec.exe
D:\Program Files\Common Files\Java\Java Update\jusched.exe
D:\WINDOWS\system32\RUNDLL32.EXE
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
D:\Program Files\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner.exe
D:\Program Files\Stardock\ObjectDock\ObjectDock.exe
D:\WINDOWS\system32\dllhost.exe
D:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [url]http://www.windowsxlive.net[/url]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [url]http://go.microsoft.com/fwlink/?LinkId=69157[/url]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [url]http://go.microsoft.com/fwlink/?LinkId=54896[/url]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [url]http://go.microsoft.com/fwlink/?LinkId=54896[/url]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [url]http://www.bigseekpro.com/hypercam/{246AF7A6-CA8B-4DA9-B8B5-FE755126034E}[/url]
R3 - URLSearchHook: (no name) - {CA3EB689-8F09-4026-AA10-B9534C691CE0} - (no file)
R3 - URLSearchHook: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - D:\Program Files\YouTube Downloader Toolbar\SearchSettings.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - D:\Program Files\YouTube Downloader Toolbar\SearchSettings.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: YouTube Downloader Toolbar - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - D:\Program Files\YouTube Downloader Toolbar\IE\1.0\youtubedownloaderToolbarIE.dll
O3 - Toolbar: YouTube Downloader Toolbar - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - D:\Program Files\YouTube Downloader Toolbar\IE\1.0\youtubedownloaderToolbarIE.dll
O4 - HKLM\..\Run: [zBrowser Launcher] D:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [Smapp] D:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [avgnt] "D:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "D:\Program Files\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner.exe" /S
O4 - HKLM\..\Run: [%s] C:\Windows\system32\drivers\services.exe
O4 - HKLM\..\Run: [Windows Update] D:\WINDOWS\system32\winupd.exe
O4 - HKLM\..\Run: [HKLM] D:\install\scsss.exe
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Skype] "D:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [HKCU] D:\install\scsss.exe
O4 - HKLM\..\Policies\Explorer\Run: [scsss] D:\install\scsss.exe
O4 - HKCU\..\Policies\Explorer\Run: [scsss] D:\install\scsss.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Startup: RivaTuner.lnk = D:\Program Files\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner.exe
O4 - Startup: Stardock ObjectDock.lnk = D:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O4 - Global Startup: NaturalColorLoad.lnk = ?
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - [url]http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab[/url]
O17 - HKLM\System\CCS\Services\Tcpip\..\{5D41D592-E88E-4BFC-812B-5C02D8B2C05C}: NameServer = 192.168.1.1,192.168.1.36
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll
O20 - AppInit_DLLs:  
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - D:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - D:\WINDOWS\system32\browseui.dll
O23 - Service: Avira FireWall (AntiVirFirewallService) - Avira GmbH - D:\Program Files\Avira\AntiVir Desktop\avfwsvc.exe
O23 - Service: Avira AntiVir MailGuard (AntiVirMailService) - Avira GmbH - D:\Program Files\Avira\AntiVir Desktop\avmailc.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - D:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - D:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Avira AntiVir WebGuard (AntiVirWebService) - Avira GmbH - D:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
O23 - Service: AODService - Unknown owner - D:\Program Files\AMD\OverDrive\AODAssist.exe
O23 - Service: Application Updater - Spigot, Inc. - D:\Program Files\Application Updater\ApplicationUpdater.exe
O23 - Service: Cacheman Service (CachemanService) - Outertech - D:\Program Files\Cacheman\CachemanServ.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LibUsb-Win32 - Daemon, Version 0.1.10.1 (libusbd) - [url]http://libusb-win32.sourceforge.net[/url] - D:\WINDOWS\system32\libusbd-nt.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - D:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - D:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe

--
End of file - 8464 bytes

 

Plus tässä on tämän Malwarebytes Anti-Malware 1.44 tarkistus. Löyty 11 infektoitunutta tiedostoa.

Koodi:

Malwarebytes' Anti-Malware 1.44
Tietokantaversio: 3510
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

22.3.2010 19:24:03
mbam-log-2010-03-22 (19-23-58).txt

Tarkistustyyppi: Pikatarkistus
Tarkistetut kohteet: 153453
Kulunut aika: 27 minute(s), 44 second(s)

Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 5
Saastuneita rekisteriarvoja: 1
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 8

Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)

Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)

Saastuneita rekisteriavaimia:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{05i41m56-qw07-u20f-yx8t-vb4u6tp4ux63} (Generic.Bot.H) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{hm7i8qk0-1307-gw24-cy7i-rqo2g63j64p5} (Generic.Bot.H) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{u3r5emfj-56pc-u0ir-u735-fbu3555kurur} (Generic.Bot.H) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{2e3ae7e7-a9a8-0400-b628-049ac6a8a189} (Backdoor.IRCBot) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{05i41m56-qw07-u20f-yx8t-vb4u6tp4ux63} (Trojan.Agent) -> No action taken.

Saastuneita rekisteriarvoja:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windows update (Trojan.Agent) -> No action taken.

Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)

Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)

Saastuneita tiedostoja:
D:\install\scsss.exe (Generic.Bot.H) -> No action taken.
D:\Documents and Settings\Varpomaa\Application Data\logs.dat (Bifrose.Trace) -> No action taken.
D:\Documents and Settings\Varpomaa\Local Settings\Temp\UuU.uUu (Malware.Trace) -> No action taken.
D:\Documents and Settings\Varpomaa\Local Settings\Temp\XxX.xXx (Malware.Trace) -> No action taken.
D:\WINDOWS\system32\h@tkeysh@@k.dll (Trojan.Agent) -> No action taken.
D:\WINDOWS\system32\winupd.exe (Trojan.Agent) -> No action taken.
D:\Documents and Settings\Varpomaa\Application Data\addons.dat (Bifrose.Trace) -> No action taken.
D:\Documents and Settings\Varpomaa\Desktop\explorer.exe (Heuristics.Reserved.Word.Exploit) -> No action taken.

EDIT: Nyt sain sen kuntoon.