Hei! Koneseen sattui "viirusepidemia" iskemään tällä kertaa ja kaikkea roskaa tuli mukaan. Ad-awaret, viiruksentorjunnat yms on käyty läpi. Escani näyttää tälläistä: File C:\WINDOWS\system32\expIorer.exe tagged as not-a-virus:AdWare.Win32.WinAD.bq. No Action Taken. File C:\WINDOWS\system32\expIorer.exe tagged as not-a-virus:AdWare.Win32.WinAD.bq. No Action Taken. HJT-logi varmuuden vuoksi: Logfile of HijackThis v1.99.1 Scan saved at 17:23:35, on 1.12.2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Sygate\smc.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\D-Link\AirCFG.exe C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\AVPersonal\AVGNT.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE C:\Program Files\AVPersonal\AVWUPSRV.EXE C:\WINDOWS\system32\svchost.exe C:\Kaspersky\mwavscan.com C:\Kaspersky\kavss.exe C:\Ohjelmat\mIRC\mirc.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Ohjelmat\Winamp\winamp.exe C:\HJT\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\smc.exe -startgui O4 - HKLM\..\Run: [D-Link Air Utility] C:\Program Files\D-Link\AirCFG.exe O4 - HKLM\..\Run: [ANIWZCSService] C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [AVGCtrl] "C:\Program Files\AVPersonal\AVGNT.EXE" /min O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\smc.exe O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Ohjelmat\TuneUp Utilities 2004\WinStylerThemeSvc.exe Antivir ei löydä enään viiruksia, mutta varmaa se on että niitä on.
Loki on puhdas. Tämän voit poistaa vikasietotilassa (F8 käynnistyksen yhteydessä): C:\WINDOWS\system32\==>expIorer.exe<== (HUOM! iso I eikä pieni L) eScanilla olet jo tarkistanut, niin kokeillaan seuraavaksi ewidoa Hae ewido -> http://www.ewido.net/en/download Asenna, päivitä, skannaa. Anna poistaa, mitä löytää ja tallenna raportti. Lähetä ewidon raportti tänne.
--------------------------------------------------------- ewido security suite - Scan report --------------------------------------------------------- + Created on: 18:10:39, 1.12.2005 + Report-Checksum: 82DA749B + Scan result: :mozilla.25:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup :mozilla.26:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup :mozilla.29:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup :mozilla.47:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup :mozilla.48:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup :mozilla.49:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup :mozilla.50:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.51:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.52:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.53:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.54:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.55:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.56:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.57:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.58:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.107:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup :mozilla.118:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Adbrite : Cleaned with backup :mozilla.125:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup :mozilla.126:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup :mozilla.128:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Adbrite : Cleaned with backup :mozilla.139:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup :mozilla.140:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup :mozilla.144:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup :mozilla.145:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup :mozilla.146:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup :mozilla.147:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup :mozilla.148:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup :mozilla.149:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup :mozilla.150:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup :mozilla.151:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.152:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.153:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.154:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.157:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Adbrite : Cleaned with backup :mozilla.162:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.163:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.164:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.175:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup :mozilla.176:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Valuead : Cleaned with backup :mozilla.177:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Valuead : Cleaned with backup :mozilla.190:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.198:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.208:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.209:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.210:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.211:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.212:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.213:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.214:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.227:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Targetnet : Cleaned with backup :mozilla.240:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Ivwbox : Cleaned with backup :mozilla.250:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.251:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.252:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.253:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.254:C:\Documents and Settings\kwak\Application Data\Mozilla\Firefox\Profiles\dhr2a0x2.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup C:\WINDOWS\system32\expIorer.exe -> Spyware.WinAD : Cleaned with backup ::Report End Tiedän että vielä löytyy samasta kansiosta warez.exe, mutta en löydä sitä vaikka otin piilotiedostot näkyviin.
Ok, ewido poisti enimmäkseen eväisteitä ja sen C:\WINDOWS\system32\expIorer.exe:n. Mistä sit tiedät, että sellainen on, jos sitä ei löydy? Kokeillaas näin: Hae KillBox http://www.bleepingcomputer.com/files/spyware/KillBox.zip Pura,avaa ja täppi kohtaan Delete on Reboot Sitten kopioi rivi tosta alapuolelta C:\WINDOWS\system32\warez.exe Sitten KillBoxissa ylhäältä File > Paste from Clipboard Sen jälkeen paina Delete (punainen, jossa on valkonen X) Vastaa myöntävästi kysymyksiin ja jos kone ei itestään käynnisty uudestaan,niin käynnistä se. Jos KillBox valittaa, ettei tiedostoa ole, niin sitten sitä ei kyllä ole
Terve taas, huomasin että käynistyslistalla on ko. tiedosto. KillBox ei löytänyt kuiteskaan ko. tiedostoa enään, jotenka sitä ei ole enään... outoa Mutta pöpöt lähti, kiitoksia -kemisti- \o/
