1. Tämä sivusto käyttää keksejä (cookie). Jatkamalla sivuston käyttämistä hyväksyt keksien käyttämisen. Lue lisää.

Tietokone ja netti on hidas. Suoritin 100%

Viestiketju Virukset ja haittaohjelmat - HijackThis -logit -osiossa. Ketjun avasi makemanty 08.04.2008.

Sivu 1 / 2
  1. makemanty

    makemanty Regular member

    Liittynyt:
    29.08.2005
    Viestejä:
    298
    Kiitokset:
    0
    Pisteet:
    26
    tietoturva keskus ei ole käytössä en tiedä miksi ja windows update ei toimi.
    tässä olis logi.




    Logfile of HijackThis v1.99.1
    Scan saved at 20:07:46, on 8.4.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16608)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Windows Live\Contacts\wlcomm.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\WINDOWS\system32\msiexec.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\HJT\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\Npm\bin\ZLH.EXE /LOAD /SPLASH
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
    O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O6 "USB001" /M "Stylus Photo RX420"
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [drvsyskit] C:\WINDOWS\system32\drivers\hldrrr.exe
    O4 - HKCU\..\Run: [german.exe] C:\WINDOWS\system32\wintems.exe
    O4 - HKCU\..\Run: [PowerBar] "C:\Program Files\CyberLink DVD Solution\Multimedia Launcher\PowerBar.exe" /AtBootTime
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\npjpi160_05.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\npjpi160_05.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1207325697859
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1207389527718
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Unknown owner - C:\Norman\Npm\bin\ELOGSVC.EXE (file missing)
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
     
    makemanty, 08.04.2008
    #1
  2.  
  3. Hujo

    Hujo Guest

    Kopioi / liitä seuraava teksti alapuolella tyhjään muistioFiluun
    Varmista että tiedoston tyyppi on ”all Files” ja tallenna se Poisto.bat. nimisenä
    työpöydällesi.

    @echo off
    sc stop eLoggerSvc6
    sc delete eLoggerSvc6

    Tupla-klikkaa Poisto.bat. filua työpöydälläsi , ikkuna avautuu ja Sulkeutuu tämä on normaalia.

    ==================

    Poista kansio vikasiedossa

    C:\Norman

    ==================

    Lataa RustBFix by ejvindh http://www.uploads.ejvindh.net/rustbfix.exe
    ja tallenna se työpöydällesi.

    Tuplaklikkaa tiedostoa rustbfix.exe. Jos löytyy Rustock.b-infektio, sinua pyydetään pian käynnistämään kone uudelleen. Uudelleenkäynnistyminen saattaa kestää hetken ja joudut ehkä käynnistämään koneen vielä toisenkin kerran. Kaikki tämä tapahtuu automaattisesti. Uudelleenkäynnistyksen jälkeen kaksi lokitiedostoa avautuu (%root%\avenger.txt & %root%\rustbfix\pelog.txt).

    Kopioi ja liitä nämä kaksi lokitiedostoa seuraavaan vastaukseesi uuden HijackThis lokin kera.

    ============

    Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

    Käynnistä koneesi vikasietotilaan:

    sammuta ja käynnistä
    käynnistyksen yhteydessä hakkaa F8 nappia
    valitse nuolinäppäimellä vikasietotila
    paina enter ja enter
    valitse käyttäjätilisi
    paina kyllä

    Jossakin koneissa hakataan F8:sin sijasta F5:tä

    " Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
    " Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
    " Paina Y käynnistääksesi skriptin.
    " Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
    " Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
    " Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
    " Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
    " Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
    " Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.
     
    Moderaattorin viimeksi muokkaama: 08.04.2008
    Hujo, 08.04.2008
    #2
  4. makemanty

    makemanty Regular member

    Liittynyt:
    29.08.2005
    Viestejä:
    298
    Kiitokset:
    0
    Pisteet:
    26
    ************************* Rustock.b-fix v. 1.01 -- By ejvindh *************************
    ti 08.04.2008 21:28:43,10

    No Rustock.b-rootkits found

    ******************************* End of Logfile ********************************'



    HJT


    Logfile of HijackThis v1.99.1
    Scan saved at 21:30:35, on 8.4.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16608)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Windows Live\Contacts\wlcomm.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\HJT\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\Npm\bin\ZLH.EXE /LOAD /SPLASH
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
    O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O6 "USB001" /M "Stylus Photo RX420"
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [drvsyskit] C:\WINDOWS\system32\drivers\hldrrr.exe
    O4 - HKCU\..\Run: [german.exe] C:\WINDOWS\system32\wintems.exe
    O4 - HKCU\..\Run: [PowerBar] "C:\Program Files\CyberLink DVD Solution\Multimedia Launcher\PowerBar.exe" /AtBootTime
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\npjpi160_05.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\npjpi160_05.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1207325697859
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1207389527718
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

     
    makemanty, 08.04.2008
    #3
  5. Hujo

    Hujo Guest

    scannaa hjt:llä merkkaa paina Fix checked

    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\Npm\bin\ZLH.EXE /LOAD /SPLASH
    O4 - HKCU\..\Run: [drvsyskit] C:\WINDOWS\system32\drivers\hldrrr.exe
    O4 - HKCU\..\Run: [german.exe] C:\WINDOWS\system32\wintems.exe

    ==========

    sitten sdfix
     
    Hujo, 08.04.2008
    #4
  6. makemanty

    makemanty Regular member

    Liittynyt:
    29.08.2005
    Viestejä:
    298
    Kiitokset:
    0
    Pisteet:
    26
    En pässyt vikasietotilaan. rämppäsin f8 ja sitten vallkasin vikasietotila sitten se latas jotain ja sammu, sitten ruutuun tuli fujitsu siemens odottelin en painanut mitään.
    Tuli taas se sama ruutu otin uudestaan vikasietotila ja sama kävi.
    Poistanko ton kansion normaalissatillassa ja käytönkö ton ohjelman?
     
    makemanty, 08.04.2008
    #5
  7. Hujo

    Hujo Guest

    poista normaalissa tilassa.
    sdfix ei sitten onnistu kun ei pääse vikasietotilaan.

    =============

    aja tuokin sitten normaalissa tilassa.

    Ohje AVG:n Anti-Spyware 7.5:n käyttöön
    Huom! Tässä ohjeessa sammutetaan tuo reaaliaikasuojaus (Shield). Näin vältetään tilanteet joissa suojaus estäisi esim HijackThis:n työkalun toimintaa.

    Tallenna nämä ohjeet tekstitiedostoon tai tulosta nämä, muuten et pääse niihin käsiksi vikasietotilasta

    Lataa AVG:n Anti-Spyware 7.5:n
    ja tallenna ohjelma työpöydällesi.
    o Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa.
    o Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää.
    o Käynnistä AVG:n Anti-Spyware.
    o Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta.

    o Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa.

    o Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti.
    o Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine".

    o Sitten "Reports" valikon alta:
    o Laita täppi kohtaan "Automatically generate report after every scan"
    o Ota täppi pois kohdasta"Only if threats were found"

    o Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa
    o "Resident shield is", muuta tila active:sta inactive:ksi
    o Sulje ohjelma, ÄLÄ skannaa vielä.

    Käynnistä koneesi vikasietotilaan,
    sammuta ja käynnistä
    käynnistyksen yhteydessä naputtele F8
    valitse nuoli näppäimellä vikasietotila
    paina enter ja enter

    Toisissa koneissa paukutetaan F8:sin sijasta F5:tä

    HUOM! Älä käytä muita ohjelmia AVG:n skannauksen aikana, tämä saattaa häiritä skannausta.
    o Kun vikasietotilassa, käynnistä AVG:n Anti-Spyware.
    o Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan".
    o Ewido aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa.

    Kun skannaus on valmis:
    TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions"
    o Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta.
    o Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions"
    [​IMG]
    o Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta.
    o Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle.
    o Sulje ohjelma, käynnistä kone normaalisti ja lähetä AVG:n raportti viestikejuusi.
     
    Hujo, 08.04.2008
    #6
  8. makemanty

    makemanty Regular member

    Liittynyt:
    29.08.2005
    Viestejä:
    298
    Kiitokset:
    0
    Pisteet:
    26
    Tarkistan tolla huomenna, päivitän ja laitan asetukset valmiiksi.
     
    makemanty, 08.04.2008
    #7
  9. makemanty

    makemanty Regular member

    Liittynyt:
    29.08.2005
    Viestejä:
    298
    Kiitokset:
    0
    Pisteet:
    26
    AVG ei antanut reporttia löyty:
    1 troijan
    87 Trackingcookieta.
     
    makemanty, 08.04.2008
    #8
  10. Hujo

    Hujo Guest

    kun avaat avg anti-spyware 7.5:n pitäs löytyä reports kohdasta
     
    Hujo, 09.04.2008
    #9
  11. makemanty

    makemanty Regular member

    Liittynyt:
    29.08.2005
    Viestejä:
    298
    Kiitokset:
    0
    Pisteet:
    26
    siellä lukee ''no reports available''
     
    makemanty, 09.04.2008
    #10
  12. Hujo

    Hujo Guest

    Hujo, 09.04.2008
    #11
  13. makemanty

    makemanty Regular member

    Liittynyt:
    29.08.2005
    Viestejä:
    298
    Kiitokset:
    0
    Pisteet:
    26
    File C:\WINDOWS\system32\mdelk.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\wintems.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\2TTSGU4K\b64_1[1].jpg infected by "Trojan-Downloader.Win32.Bagle.ij" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\2TTSGU4K\b64_1[2].jpg infected by "Trojan-Downloader.Win32.Bagle.ij" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\2TTSGU4K\b64_3[1].jpg infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\2TTSGU4K\b64_3[2].jpg infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\2TTSGU4K\b64_3[3].jpg infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\DGENSL8L\b64_1[1].jpg infected by "Trojan-Downloader.Win32.Bagle.ij" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\DGENSL8L\b64_1[2].jpg infected by "Trojan-Downloader.Win32.Bagle.ij" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\DGENSL8L\b64_3[1].jpg infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\DGENSL8L\b64_3[2].jpg infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\DGENSL8L\b64_3[3].jpg infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\OTY1W5YG\b64_1[1].jpg infected by "Trojan-Downloader.Win32.Bagle.ij" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\OTY1W5YG\b64_1[2].jpg infected by "Trojan-Downloader.Win32.Bagle.ij" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\OTY1W5YG\b64_3[1].jpg infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\OTY1W5YG\b64_3[2].jpg infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\OTY1W5YG\b64_3[3].jpg infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\OTY1W5YG\b64_3[4].jpg infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\XG68A5Q3\b64_1[1].jpg infected by "Trojan-Downloader.Win32.Bagle.ij" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\XG68A5Q3\b64_1[2].jpg infected by "Trojan-Downloader.Win32.Bagle.ij" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\XG68A5Q3\b64_3[1].jpg infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\XG68A5Q3\b64_3[2].jpg infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\XG68A5Q3\b64_3[3].jpg infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\XG68A5Q3\b64_3[4].jpg infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Omistaja\Local Settings\Temporary Internet Files\Content.IE5\XG68A5Q3\b64_3[5].jpg infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP100\A0015015.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP100\A0015016.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP101\A0015028.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP101\A0015029.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP102\A0015041.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP102\A0015042.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP103\A0015057.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP103\A0015070.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP104\A0015207.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP104\A0015278.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP104\A0015279.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP92\A0013452.exe infected by "Trojan-Downloader.Win32.Bagle.mq" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP92\A0013463.exe infected by "Trojan-Downloader.Win32.Bagle.mq" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP92\A0013464.sys infected by "Trojan-Downloader.Win32.Bagle.mm" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP92\A0013465.exe infected by "Trojan-Downloader.Win32.Bagle.mq" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP92\A0013466.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP92\A0013467.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP92\A0013487.exe infected by "Trojan-Downloader.Win32.Bagle.mq" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP92\A0013489.sys infected by "Trojan-Downloader.Win32.Bagle.mm" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP93\A0013508.sys infected by "Trojan-Downloader.Win32.Bagle.mm" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP93\A0013509.exe infected by "Trojan-Downloader.Win32.Bagle.mq" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP93\A0013526.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP93\A0013527.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP93\A0013528.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP93\A0013529.exe infected by "Trojan-Downloader.Win32.Bagle.mq" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP93\A0013543.sys infected by "Trojan-Downloader.Win32.Bagle.mm" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP93\A0013544.exe infected by "Trojan-Downloader.Win32.Bagle.mq" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP93\A0013545.exe infected by "Trojan-Downloader.Win32.Bagle.mq" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP93\A0013546.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP93\A0013547.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP93\A0013561.exe infected by "Trojan-Downloader.Win32.Bagle.mq" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP93\A0013695.sys infected by "Trojan-Downloader.Win32.Bagle.mm" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP94\A0013705.sys infected by "Trojan-Downloader.Win32.Bagle.mm" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP95\A0013709.sys infected by "Trojan-Downloader.Win32.Bagle.mm" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP95\A0013740.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP95\A0013741.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP95\A0013742.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP95\A0013743.exe infected by "Trojan-Downloader.Win32.Bagle.mq" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP95\A0013744.exe infected by "Trojan-Downloader.Win32.Bagle.mq" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP95\A0013752.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP96\A0013789.sys infected by "Trojan-Downloader.Win32.Bagle.mm" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP97\A0013791.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP97\A0013793.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP98\A0013812.sys infected by "Trojan-Downloader.Win32.Bagle.mm" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP98\A0013824.sys infected by "Trojan-Downloader.Win32.Bagle.mm" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP98\A0013827.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP98\A0013828.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP98\A0013850.sys infected by "Trojan-Downloader.Win32.Bagle.mm" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP98\A0013856.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP98\A0013857.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP99\A0013980.sys infected by "Trojan-Downloader.Win32.Bagle.mm" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP99\A0014920.sys infected by "Trojan-Downloader.Win32.Bagle.mm" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP99\A0014924.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{EF7B5EB2-5712-4A3A-AC95-890626AD47DC}\RP99\A0014925.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\downld\14853031.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\downld\31343406.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\downld\31398421.exe infected by "Trojan-Downloader.Win32.Bagle.ij" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\downld\36906.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\downld\47063359.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\downld\47088421.exe infected by "Trojan-Downloader.Win32.Bagle.ij" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\downld\552859.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\downld\55921.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\downld\58906.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\downld\61953.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\downld\62312.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\downld\62375.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\downld\62516890.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\downld\62610937.exe infected by "Trojan-Downloader.Win32.Bagle.ij" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\downld\78192343.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\downld\78260953.exe infected by "Trojan-Downloader.Win32.Bagle.ij" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\downld\78796.exe infected by "Trojan-Downloader.Win32.Bagle.ij" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\downld\79375.exe infected by "Trojan-Downloader.Win32.Bagle.ij" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\downld\81968.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\downld\84703.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\downld\91906.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\downld\95744359.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\downld\95759265.exe infected by "Trojan-Downloader.Win32.Bagle.ij" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\downld\97312.exe infected by "Trojan-Downloader.Win32.Bagle.ij" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\hldrrr.exe infected by "Trojan-Downloader.Win32.Bagle.mq" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\mdelk.exe infected by "Trojan-Downloader.Win32.Bagle.mq" Virus. Action Taken: File Deleted.
     
    makemanty, 09.04.2008
    #12
  14. Hujo

    Hujo Guest

    1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
    combofix1
    combofix2

    2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
     
    Hujo, 09.04.2008
    #13
  15. makemanty

    makemanty Regular member

    Liittynyt:
    29.08.2005
    Viestejä:
    298
    Kiitokset:
    0
    Pisteet:
    26
    AVASTI KATOSI KUN AJOIN tämän ohjelman tuolta ala palkista.


    ComboFix 08-04-08.10 - Omistaja 2008-04-09 17:15:09.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.686 [GMT 3:00]
    Running from: C:\Documents and Settings\Omistaja\Työpöytä\ComboFix.exe
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\system32\ban_list.txt

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Service_srosa


    ((((( Tiedostot, jotka on luotu seuraavalla aikav„lill„: 2008-03-09 to 2008-04-09 )))))))))))))))))
    .

    2008-04-09 16:50 . 2008-04-09 16:50 0 --a------ C:\23990098.$$$
    2008-04-09 15:40 . 2008-04-09 15:56 <KANSIO> d-------- C:\Downloads
    2008-04-09 15:40 . 2008-04-09 15:55 <KANSIO> d-------- C:\Bases
    2008-04-09 15:38 . 2008-04-09 15:56 <KANSIO> d-------- C:\Kaspersky
    2008-04-09 15:33 . 2008-04-09 15:33 35,371 --a------ C:\Juomani.JPG
    2008-04-09 15:24 . 2008-04-09 15:38 20,952,576 --a------ C:\mwav.exe
    2008-04-08 22:02 . 2008-04-08 22:02 <KANSIO> d-------- C:\Documents and Settings\Omistaja\Application Data\Grisoft
    2008-04-08 22:02 . 2008-04-08 22:02 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
    2008-04-08 22:02 . 2007-05-30 15:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2008-04-08 21:28 . 2008-04-08 21:28 <KANSIO> d-------- C:\Rustbfix
    2008-04-08 20:51 . 2008-04-09 15:56 116 --a------ C:\WINDOWS\NeroDigital.ini
    2008-04-08 17:24 . 2008-04-08 17:24 <KANSIO> d-------- C:\hijackthis_v2.0.2
    2008-04-08 17:16 . 2008-04-08 21:44 <KANSIO> d-------- C:\HJT
    2008-04-08 17:10 . 2008-04-08 17:11 499,568 --a------ C:\hijackthis_v2.0.2.zip
    2008-04-08 15:24 . 2008-04-08 15:24 <KANSIO> d-------- C:\WINDOWS\.jagex_cache_32
    2008-04-08 15:22 . 2008-04-08 15:22 <KANSIO> dr------- C:\Documents and Settings\Tero\Omat tiedostot
    2008-04-08 15:21 . 2008-04-04 20:23 <KANSIO> d--h----- C:\Documents and Settings\Tero\Verkkoymp„rist”
    2008-04-08 15:21 . 2008-04-08 20:17 <KANSIO> d-------- C:\Documents and Settings\Tero\Ty”p”yt„
    2008-04-08 15:21 . 2008-04-04 20:23 <KANSIO> d--h----- C:\Documents and Settings\Tero\Tulostinymp„rist”
    2008-04-08 15:21 . 2008-04-08 15:22 <KANSIO> dr------- C:\Documents and Settings\Tero\Suosikit
    2008-04-08 15:21 . 2008-04-04 17:27 <KANSIO> d--h----- C:\Documents and Settings\Tero\Mallit
    2008-04-08 15:21 . 2008-04-04 20:23 <KANSIO> dr------- C:\Documents and Settings\Tero\K„ynnist„-valikko
    2008-04-07 19:57 . 2008-04-08 15:13 <KANSIO> d-------- C:\WINDOWS\system32\Adobe
    2008-04-07 19:40 . 2008-04-07 19:40 <KANSIO> d-------- C:\WINDOWS\Sun
    2008-04-06 21:32 . 2008-04-06 21:32 135 --a------ C:\WINDOWS\ODBC.INI
    2008-04-06 21:25 . 2008-03-29 20:31 75,856 --a------ C:\WINDOWS\system32\drivers\aswSP.sys
    2008-04-06 21:25 . 2008-03-29 20:35 20,560 --a------ C:\WINDOWS\system32\drivers\aswFsBlk.sys
    2008-04-06 20:58 . 2008-04-06 20:58 <KANSIO> d-------- C:\Program Files\Alwil Software
    2008-04-06 19:28 . 2008-04-06 19:28 <KANSIO> d-------- C:\Documents and Settings\Omistaja\Application Data\InstallShield
    2008-04-06 17:08 . 2008-04-09 16:47 <KANSIO> d-------- C:\WINDOWS\system32\drivers\downld
    2008-04-05 23:29 . 2008-04-05 23:29 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\nView_Profiles
    2008-04-05 22:30 . 2008-04-05 22:30 <KANSIO> d-------- C:\Program Files\Lavalys
    2008-04-05 21:37 . 2008-04-06 19:28 <KANSIO> d-------- C:\Program Files\SpeedFan
    2008-04-05 21:37 . 2008-04-05 21:37 45 --a------ C:\WINDOWS\system32\initdebug.nfo
    2008-04-05 19:01 . 2008-04-06 19:28 <KANSIO> d-------- C:\Program Files\CursorXP
    2008-04-05 18:30 . 2008-04-05 18:30 <KANSIO> d-------- C:\Program Files\MSXML 6.0
    2008-04-05 18:24 . 2003-07-01 00:00 46,080 --a------ C:\WINDOWS\system32\escimgd.dll
    2008-04-05 18:24 . 2003-08-06 00:00 29,184 --a------ C:\WINDOWS\system32\escwiadn.dll
    2008-04-05 18:24 . 2003-07-01 00:00 22,528 --a------ C:\WINDOWS\system32\esccmd.dll
    2008-04-05 18:24 . 2008-04-05 18:24 25 --a------ C:\WINDOWS\CDE RX420.ini
    2008-04-05 16:09 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
    2008-04-05 16:09 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
    2008-04-05 15:24 . 2008-04-05 18:27 <KANSIO> d-------- C:\Program Files\EPSON
    2008-04-05 15:24 . 2008-04-05 15:24 <KANSIO> d-------- C:\EPSON
    2008-04-05 15:24 . 2004-05-21 05:04 79,622 --------- C:\WINDOWS\system32\E_FLM9CE.DLL
    2008-04-05 15:24 . 2003-05-21 02:27 64,000 --a------ C:\WINDOWS\system32\E_FBCB9CE.DLL
    2008-04-05 15:24 . 2000-06-07 01:01 34,304 --a------ C:\WINDOWS\system32\E_FBCH9CE.DLL
    2008-04-05 15:24 . 2003-04-10 08:40 31,744 --a------ C:\WINDOWS\system32\E_DCINST.DLL
    2008-04-05 14:49 . 2008-04-05 14:49 <KANSIO> d-------- C:\Temp
    2008-04-05 14:48 . 2008-04-09 17:18 <KANSIO> d-------- C:\Program Files\lg_fwupdate
    2008-04-05 14:48 . 1998-06-24 00:00 115,016 --a------ C:\WINDOWS\system32\MSINET.OCX
    2008-04-05 14:48 . 1998-07-22 00:00 102,912 --a------ C:\WINDOWS\system32\Vb6stkit.dll
    2008-04-05 14:48 . 1998-07-22 00:00 102,160 --a------ C:\WINDOWS\system32\VB6KO.DLL
    2008-04-05 14:48 . 2006-02-17 14:19 16,384 --a------ C:\WINDOWS\system32\lgfwunis.exe
    2008-04-05 14:48 . 2008-04-09 17:18 289 --a------ C:\WINDOWS\lgfwup.ini
    2008-04-05 14:47 . 2008-04-05 14:47 <KANSIO> d-------- C:\Program Files\CyberLink DVD Solution
    2008-04-05 14:47 . 2004-10-01 15:00 40,960 --a------ C:\Program Files\Uninstall_CDS.exe
    2008-04-05 14:44 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
    2008-04-05 14:44 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
    2008-04-05 13:45 . 2008-04-05 13:45 <KANSIO> d-------- C:\Program Files\Microsoft Silverlight
    2008-04-05 13:43 . 2008-04-05 13:43 <KANSIO> d-------- C:\Program Files\MSBuild
    2008-04-05 13:42 . 2008-04-05 23:18 <KANSIO> d-------- C:\WINDOWS\system32\XPSViewer
    2008-04-05 13:42 . 2008-04-05 13:42 <KANSIO> d-------- C:\Program Files\Reference Assemblies
    2008-04-05 13:41 . 2008-04-05 13:41 <KANSIO> d-------- C:\Program Files\Windows Media Connect 2
    2008-04-05 13:41 . 2008-04-05 13:41 <KANSIO> d-------- C:\d22690575149d8da0a0d99
    2008-04-05 13:41 . 2006-06-29 13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll
    2008-04-05 13:40 . 2008-04-05 13:40 <KANSIO> d-------- C:\WINDOWS\system32\LogFiles
    2008-04-05 13:40 . 2008-04-05 13:40 <KANSIO> d-------- C:\WINDOWS\system32\drivers\UMDF
    2008-04-05 12:57 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
    2008-04-05 03:04 . 2008-04-05 03:10 <KANSIO> d-------- C:\i386
    2008-04-04 22:14 . 2008-04-04 22:14 <KANSIO> d-------- C:\Program Files\RealMedia
    2008-04-04 22:14 . 2008-04-04 22:14 <KANSIO> d-------- C:\Program Files\OpenSource Flash Video Splitter
    2008-04-04 22:14 . 2008-04-05 12:46 <KANSIO> d-------- C:\Program Files\CD Audio Reader Filter
    2008-04-04 22:11 . 2008-04-04 22:11 <KANSIO> d-------- C:\Program Files\SHOUTcast Source
    2008-04-04 22:10 . 2008-04-05 12:46 <KANSIO> d-------- C:\Program Files\DSP-worx
    2008-04-04 22:07 . 2008-04-05 12:47 <KANSIO> d-------- C:\Program Files\DirectVobSub
    2008-04-04 21:44 . 2008-04-05 12:47 <KANSIO> d-------- C:\Program Files\eMule
    2008-04-04 21:43 . 2008-04-07 19:58 1,289 --a------ C:\WINDOWS\mozver.dat
    2008-04-04 21:29 . 2008-04-04 21:29 189,690 --a------ C:\A-Patch141rc1b1_WLM.zip
    2008-04-04 21:28 . 2008-04-09 16:55 <KANSIO> d-------- C:\Documents and Settings\Omistaja\Tracing
    2008-04-04 21:25 . 2008-04-08 21:47 <KANSIO> d-------- C:\Pelit ja ohjelmia
    2008-04-04 21:25 . 2008-04-07 19:23 <KANSIO> d-------- C:\Kesken er„iset
    2008-04-04 21:23 . 2008-04-08 14:55 <KANSIO> d-------- C:\Documents and Settings\Omistaja\Application Data\uTorrent
    2008-04-04 21:23 . 2008-04-04 21:23 177,152 --a------ C:\utorrent.exe
    2008-04-04 21:05 . 2008-04-04 21:05 <KANSIO> d-------- C:\Program Files\IZArc
    2008-04-04 21:03 . 2008-04-04 21:08 <KANSIO> d-------- C:\Documents and Settings\Omistaja\Contacts
    2008-04-04 21:03 . 2008-04-04 21:05 3,723,454 --a------ C:\IZArc_Setup.exe
    2008-04-04 21:02 . 2008-04-04 21:02 <KANSIO> d----c--- C:\WINDOWS\system32\DRVSTORE
    2008-04-04 21:01 . 2008-04-04 21:01 193,951 --a------ C:\A-Patch140rc1b9_WLM.zip
    2008-04-04 19:16 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\system32\wups2.dll
    2008-04-04 19:16 . 2007-07-30 19:18 34,136 --a------ C:\WINDOWS\system32\wucltui.dll.mui
    2008-04-04 19:16 . 2007-07-30 19:18 30,040 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui
    2008-04-04 19:16 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuapi.dll.mui
    2008-04-04 19:16 . 2007-07-30 19:18 20,824 --a------ C:\WINDOWS\system32\wuaueng.dll.mui
    2008-04-04 19:09 . 2008-04-04 19:09 <KANSIO> d-------- C:\Program Files\Common Files\Ahead
    2008-04-04 19:09 . 2008-04-04 19:09 <KANSIO> d-------- C:\Program Files\Ahead
    2008-04-04 19:09 . 2004-07-26 17:16 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll
    2008-04-04 19:09 . 2004-07-26 17:16 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll
    2008-04-04 19:09 . 2004-07-26 17:16 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll
    2008-04-04 19:09 . 2004-07-26 17:16 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-04-08 16:59 --------- d-----w C:\Program Files\Java
    2008-04-06 18:43 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-04-04 18:27 --------- d-----w C:\Program Files\Windows Live
    2008-04-04 18:02 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
    2008-04-04 17:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-04-04 17:23 9,388 ----a-w C:\WINDOWS\system32\drivers\iaStor.PNF
    2008-04-04 17:23 7,280 ----a-w C:\WINDOWS\system32\drivers\viamraid.PNF
    2008-04-04 17:23 63,240 ----a-w C:\WINDOWS\system32\drivers\Si3112r.PNF
    2008-04-04 17:23 6,984 ----a-w C:\WINDOWS\system32\drivers\SiSRaid.PNF
    2008-04-04 17:23 20,152 ----a-w C:\WINDOWS\system32\drivers\INFCACHE.1
    2008-04-04 17:23 12,432 ----a-w C:\WINDOWS\system32\drivers\adpu320.PNF
    2008-04-04 17:23 12,228 ----a-w C:\WINDOWS\system32\drivers\nvraid.PNF
    2008-04-04 17:23 10,828 ----a-w C:\WINDOWS\system32\drivers\iaAHCI.PNF
    2008-04-04 15:23 --------- d-----w C:\Program Files\Common Files\InstallShield
    2008-04-04 14:32 --------- d-----w C:\Program Files\microsoft frontpage
    2008-04-04 14:31 --------- d-----w C:\Program Files\Common Files\Java
    2008-03-29 17:35 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
    2008-03-29 17:29 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
    2008-03-29 17:27 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
    2008-03-29 17:26 26,944 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
    .

    (((((((((((((((((((((((((((((( Rekisterin k„ynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhji„ arvoja ja laillisia oletusarvoja ei n„ytet„

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 15:00 15360]
    "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2008-04-04 21:32 3739672]
    "PowerBar"="C:\Program Files\CyberLink DVD Solution\Multimedia Launcher\PowerBar.exe" [2004-04-21 10:26 86016]
    "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 19:24 1694208]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SoundMan"="SOUNDMAN.EXE" [2006-08-03 07:12 577536 C:\WINDOWS\SOUNDMAN.EXE]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-07-20 22:58 7581696]
    "nwiz"="nwiz.exe" [2006-07-20 22:58 1519616 C:\WINDOWS\system32\nwiz.exe]
    "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
    "LGODDFU"="C:\Program Files\lg_fwupdate\fwupdate.exe" [2008-04-05 14:49 249856]
    "EPSON Stylus Photo RX420 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.exe" [2004-04-09 03:00 98304]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
    "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 12:25 6731312]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 15:00 15360]

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "C:\\utorrent.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

    R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 20:31]
    R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 20:35]
    S1 TDI_RD;Firewall Engine Type-R;C:\WINDOWS\system32\drivers\tdi_rd.sys []

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3b9afdc7-0405-11dd-964a-001a929682ed}]
    \Shell\AutoRun\command - J:\nideiect.com
    \Shell\explore\Command - J:\nideiect.com
    \Shell\open\Command - J:\nideiect.com

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{858139ad-0260-11dd-9630-001a929682ed}]
    \Shell\AutoRun\command - J:\nideiect.com
    \Shell\explore\Command - J:\nideiect.com
    \Shell\open\Command - J:\nideiect.com

    .
    **************************************************************************

    catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-04-09 17:17:57
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    ------------------------ Other Running Processes ------------------------
    .
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\Windows Live\Contacts\wlcomm.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\WINDOWS\system32\wscntfy.exe
    .
    **************************************************************************
    .
    Completion time: 2008-04-09 17:21:13 - machine was rebooted
    ComboFix-quarantined-files.txt 2008-04-09 14:21:05
    Pre-Run: 220,639,416,320 tavua vapaana
    Post-Run: 220,528,717,824 tavua vapaana
    .
    2008-04-05 20:21:21 --- E O F ---

     
    makemanty, 09.04.2008
    #14
  16. Hujo

    Hujo Guest

    No niin

    Lataa Atribunen ATF Cleaner

    Ohjeet;

    Tupla-klikkaa ATF-Cleaner.exe käynnistääksesi ohjelman.Main:n alla valitse: Select All
    Klikkaa Empty Selected valintaa.
    Jos käytät FireFoxia selaimenasi Klikkaa Firefox yläpuolelta ja valitse: Select All
    Klikkaa Empty Selected valintaa.
    HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy.
    Jos käytät Operaa selaimenasiKlikkaa Opera yläpuolelta ja valitse: Select All
    Klikkaa Empty Selected valintaa taas.
    HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy.
    Klikkaa Exit päävalikosta sulkeaksesi ohjelman.
    Teknistä tukea tulee jos tupla-klikkaat sähköpostiosoitetta joka sijaitsee jokaisen menun alapuolella kyseisessä työkalussa. (Huomatkaa että se tuki on sitten englanniksi)

    =============

    1. Klikkaa käynnistä > Oma tietokone oikean puoleisella hiiren napilla
    2. Valitse ominaisuudet
    3. Valitse järjestelmän palauttaminen välilehti
    4. Ruksi eteen ¤ poista järjestelmän palauttaminen kaikissa asemissa
    5. Paina Käytä
    6. Paina ok
    7. Sammuta ja käynnistä
    8. Ota ruksi pois ¤ poista järjestelmän palauttaminen kaikissa asemissa
    9. Käytä ja OK

    Asenna tuo avast uudelleen
     
    Hujo, 09.04.2008
    #15
  17. makemanty

    makemanty Regular member

    Liittynyt:
    29.08.2005
    Viestejä:
    298
    Kiitokset:
    0
    Pisteet:
    26
    Tehty noi tässä olis uus logi.


    Logfile of HijackThis v1.99.1
    Scan saved at 17:57:52, on 9.4.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\lg_fwupdate\fwupdate.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\CyberLink DVD Solution\Multimedia Launcher\PowerBar.exe
    C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\Windows Live\Contacts\wlcomm.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\HJT\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
    O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O6 "USB001" /M "Stylus Photo RX420"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [PowerBar] "C:\Program Files\CyberLink DVD Solution\Multimedia Launcher\PowerBar.exe" /AtBootTime
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1207325697859
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1207389527718
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

     
    makemanty, 09.04.2008
    #16
  18. makemanty

    makemanty Regular member

    Liittynyt:
    29.08.2005
    Viestejä:
    298
    Kiitokset:
    0
    Pisteet:
    26
    Windows ei löytänyt palomuuria, joten windowssin oma on käytössä.
    Olisiko ehdotuksia palomuuriksi?
    Kannattaako AVG:en Shield olla active
     
    makemanty, 09.04.2008
    #17
  19. makemanty

    makemanty Regular member

    Liittynyt:
    29.08.2005
    Viestejä:
    298
    Kiitokset:
    0
    Pisteet:
    26
    vikasietotila toimii jälleen niin myös windows update ja tietoturvakeskus.
     
    makemanty, 09.04.2008
    #18
  20. Hujo

    Hujo Guest

    se saa olla se inactive häirittee avastin taustasuojausta

    et rupesi toimimaan no sitten turauta tuolla vielä

    Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

    Käynnistä koneesi vikasietotilaan:

    sammuta ja käynnistä
    käynnistyksen yhteydessä hakkaa F8 nappia
    valitse nuolinäppäimellä vikasietotila
    paina enter ja enter
    valitse käyttäjätilisi
    paina kyllä

    Jossakin koneissa hakataan F8:sin sijasta F5:tä

    " Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
    " Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
    " Paina Y käynnistääksesi skriptin.
    " Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
    " Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
    " Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
    " Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
    " Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
    " Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.
     
    Hujo, 09.04.2008
    #19
  21. makemanty

    makemanty Regular member

    Liittynyt:
    29.08.2005
    Viestejä:
    298
    Kiitokset:
    0
    Pisteet:
    26
    jokin catchme tiedosto tuli myös työpöydälle.



    SDFix: Version 1.167
    Run by Omistaja on ke 09.04.2008 at 18:22

    Microsoft Windows XP [versio 5.1.2600]
    Running From: C:\DOCUME~1\Omistaja\TYPYT~1\SDFix\SDFix

    Checking Services :


    Restoring Windows Registry Values
    Restoring Windows Default Hosts File

    Rebooting


    Checking Files :

    No Trojan Files Found






    Removing Temp Files

    ADS Check :



    Final Check :

    catchme 0.3.1351.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-04-09 18:46:40
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden services & system hive ...

    scanning hidden registry entries ...

    scanning hidden files ...


    scan completed successfully
    hidden processes: 0
    hidden services: 0
    hidden files: 2


    Remaining Services :



    Authorized Application Key Export:

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"
    "C:\\utorrent.exe"="C:\\utorrent.exe:*:Enabled:æTorrent"
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
    "C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"="C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe:*:Enabled:Windows Live Messenger (Phone)"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
    "C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"="C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe:*:Enabled:Windows Live Messenger (Phone)"

    Remaining Files :


    File Backups: - C:\DOCUME~1\Omistaja\TYPYT~1\SDFix\SDFix\backups\backups.zip

    Files with Hidden Attributes :

    Sun 6 Apr 2008 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
    Sat 5 Apr 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"

    Finished!

     
    makemanty, 09.04.2008
    #20
Sivu 1 / 2

Jaa tämä sivu