win32.worm.tibick

Viestiketju Virukset ja haittaohjelmat - HijackThis -logit -osiossa. Ketjun avasi japah 04.09.2006.

Viestiketjun tila:
Viestiketju on suljettu.
  1. japah

    japah Member

    Liittynyt:
    04.09.2006
    Viestejä:
    4
    Kiitokset:
    0
    Pisteet:
    11
    Moi!

    Koneeni on juminut viime viikkojen aikana. Olen nyt muutamaan otteeseen tehnyt kaverini kehotuksesta ad-awaren komennon ja äskettäin tein myös hijackthis:n. Ad-aware ilmoitti logissaan tällaisia tiedostoja löytyneen: Win32.Worm.Tibick. Yhteensä näitä oli 4 kpl.
    Uskoisin näiden olevan joitain viruksia mutta en saa niitä poistettua koneelta.

    Kertokaa ihmiset miten saisin nämä roskat pois.

    Tässä Ad-awaren ja HiJackThisn tulokset:


    Ad-Aware SE Build 1.06r1
    Logfile Created on:4. syyskuuta 2006 11:45:05
    Created with Ad-Aware SE Personal, free for private use.
    Using definitions file:SE1R121 28.08.2006
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

    References detected during the scan:
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    MRU List(TAC index:0):10 total references
    Tracking Cookie(TAC index:3):2 total references
    Win32.Worm.Tibick(TAC index:10):4 total references
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

    Ad-Aware SE Settings
    ===========================
    Set : Search for negligible risk entries
    Set : Safe mode (always request confirmation)
    Set : Scan active processes
    Set : Scan registry
    Set : Deep-scan registry
    Set : Scan my IE Favorites for banned URLs
    Set : Scan my Hosts file

    Extended Ad-Aware SE Settings
    ===========================
    Set : Unload recognized processes & modules during scan
    Set : Scan registry for all users instead of current user only
    Set : Always try to unload modules before deletion
    Set : During removal, unload Explorer and IE if necessary
    Set : Let Windows remove files in use at next reboot
    Set : Delete quarantined objects after restoring
    Set : Include basic Ad-Aware settings in log file
    Set : Include additional Ad-Aware settings in log file
    Set : Include reference summary in log file
    Set : Include alternate data stream details in log file
    Set : Play sound at scan completion if scan locates critical objects


    4.9.2006 11:45:05 - Scan started. (Full System Scan)

    MRU List Object Recognized!
    Location: : S-1-5-21-2274271023-4255898902-1967802988-1006\software\adobe\photoshop\7.0\visiteddirs
    Description : adobe photoshop 7 recent work folders


    MRU List Object Recognized!
    Location: : S-1-5-21-2274271023-4255898902-1967802988-1006\software\microsoft\internet explorer\typedurls
    Description : list of recently entered addresses in microsoft internet explorer


    MRU List Object Recognized!
    Location: : S-1-5-21-2274271023-4255898902-1967802988-1006\software\microsoft\mediaplayer\medialibraryui
    Description : last selected node in the microsoft windows media player media library


    MRU List Object Recognized!
    Location: : S-1-5-21-2274271023-4255898902-1967802988-1006\software\microsoft\mediaplayer\player\settings
    Description : last open directory used in jasc paint shop pro


    MRU List Object Recognized!
    Location: : S-1-5-21-2274271023-4255898902-1967802988-1006\software\microsoft\mediaplayer\preferences
    Description : last playlist index loaded in microsoft windows media player


    MRU List Object Recognized!
    Location: : S-1-5-21-2274271023-4255898902-1967802988-1006\software\microsoft\mediaplayer\preferences
    Description : last playlist loaded in microsoft windows media player


    MRU List Object Recognized!
    Location: : S-1-5-21-2274271023-4255898902-1967802988-1006\software\microsoft\windows\currentversion\explorer\comdlg32\lastvisitedmru
    Description : list of recent programs opened


    MRU List Object Recognized!
    Location: : S-1-5-21-2274271023-4255898902-1967802988-1006\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru
    Description : list of recently saved files, stored according to file extension


    MRU List Object Recognized!
    Location: : S-1-5-21-2274271023-4255898902-1967802988-1006\software\microsoft\windows\currentversion\explorer\runmru
    Description : mru list for items opened in start | run


    MRU List Object Recognized!
    Location: : S-1-5-21-2274271023-4255898902-1967802988-1006\software\microsoft\windows media\wmsdk\general
    Description : windows media sdk


    Listing running processes
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

    #:1 [smss.exe]
    FilePath : \SystemRoot\System32\
    ProcessID : 664
    ThreadCreationTime : 4.9.2006 6:48:01
    BasePriority : Normal


    #:2 [csrss.exe]
    FilePath : \??\C:\WINDOWS\system32\
    ProcessID : 744
    ThreadCreationTime : 4.9.2006 6:48:03
    BasePriority : Normal


    #:3 [winlogon.exe]
    FilePath : \??\C:\WINDOWS\system32\
    ProcessID : 816
    ThreadCreationTime : 4.9.2006 6:48:06
    BasePriority : High


    #:4 [services.exe]
    FilePath : C:\WINDOWS\system32\
    ProcessID : 892
    ThreadCreationTime : 4.9.2006 6:48:07
    BasePriority : Normal
    FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion : 5.1.2600.2180
    ProductName : Microsoft® Windows® -käyttöjärjestelmä
    CompanyName : Microsoft Corporation
    FileDescription : Palvelu- ja ohjainohjelma
    InternalName : services.exe
    LegalCopyright : © Microsoft Corporation. Kaikki oikeudet pidätetään.
    OriginalFilename : services.exe

    #:5 [lsass.exe]
    FilePath : C:\WINDOWS\system32\
    ProcessID : 904
    ThreadCreationTime : 4.9.2006 6:48:07
    BasePriority : Normal
    FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion : 5.1.2600.2180
    ProductName : Microsoft® Windows® Operating System
    CompanyName : Microsoft Corporation
    FileDescription : LSA Shell (Export Version)
    InternalName : lsass.exe
    LegalCopyright : © Microsoft Corporation. All rights reserved.
    OriginalFilename : lsass.exe

    #:6 [ati2evxx.exe]
    FilePath : C:\WINDOWS\system32\
    ProcessID : 1084
    ThreadCreationTime : 4.9.2006 6:48:09
    BasePriority : Normal
    FileVersion : 6.14.10.4112
    ProductVersion : 6.14.10.4112.01
    ProductName : ATI External Event Utility for WindowsNT and Windows9X
    CompanyName : ATI Technologies Inc.
    FileDescription : ATI External Event Utility EXE Module
    InternalName : ATI2EVXX.EXE
    LegalCopyright : Copyright © 1999-2004 ATI Technologies Inc.
    OriginalFilename : ATI2EVXX.EXE

    #:7 [svchost.exe]
    FilePath : C:\WINDOWS\system32\
    ProcessID : 1112
    ThreadCreationTime : 4.9.2006 6:48:09
    BasePriority : Normal
    FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion : 5.1.2600.2180
    ProductName : Microsoft® Windows® Operating System
    CompanyName : Microsoft Corporation
    FileDescription : Generic Host Process for Win32 Services
    InternalName : svchost.exe
    LegalCopyright : © Microsoft Corporation. All rights reserved.
    OriginalFilename : svchost.exe

    #:8 [svchost.exe]
    FilePath : C:\WINDOWS\system32\
    ProcessID : 1172
    ThreadCreationTime : 4.9.2006 6:48:10
    BasePriority : Normal
    FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion : 5.1.2600.2180
    ProductName : Microsoft® Windows® Operating System
    CompanyName : Microsoft Corporation
    FileDescription : Generic Host Process for Win32 Services
    InternalName : svchost.exe
    LegalCopyright : © Microsoft Corporation. All rights reserved.
    OriginalFilename : svchost.exe

    #:9 [svchost.exe]
    FilePath : C:\WINDOWS\System32\
    ProcessID : 1240
    ThreadCreationTime : 4.9.2006 6:48:10
    BasePriority : Normal
    FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion : 5.1.2600.2180
    ProductName : Microsoft® Windows® Operating System
    CompanyName : Microsoft Corporation
    FileDescription : Generic Host Process for Win32 Services
    InternalName : svchost.exe
    LegalCopyright : © Microsoft Corporation. All rights reserved.
    OriginalFilename : svchost.exe

    #:10 [svchost.exe]
    FilePath : C:\WINDOWS\system32\
    ProcessID : 1332
    ThreadCreationTime : 4.9.2006 6:48:10
    BasePriority : Normal
    FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion : 5.1.2600.2180
    ProductName : Microsoft® Windows® Operating System
    CompanyName : Microsoft Corporation
    FileDescription : Generic Host Process for Win32 Services
    InternalName : svchost.exe
    LegalCopyright : © Microsoft Corporation. All rights reserved.
    OriginalFilename : svchost.exe

    #:11 [svchost.exe]
    FilePath : C:\WINDOWS\system32\
    ProcessID : 1392
    ThreadCreationTime : 4.9.2006 6:48:10
    BasePriority : Normal
    FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion : 5.1.2600.2180
    ProductName : Microsoft® Windows® Operating System
    CompanyName : Microsoft Corporation
    FileDescription : Generic Host Process for Win32 Services
    InternalName : svchost.exe
    LegalCopyright : © Microsoft Corporation. All rights reserved.
    OriginalFilename : svchost.exe

    #:12 [spoolsv.exe]
    FilePath : C:\WINDOWS\system32\
    ProcessID : 1528
    ThreadCreationTime : 4.9.2006 6:48:11
    BasePriority : Normal
    FileVersion : 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)
    ProductVersion : 5.1.2600.2696
    ProductName : Microsoft® Windows® Operating System
    CompanyName : Microsoft Corporation
    FileDescription : Spooler SubSystem App
    InternalName : spoolsv.exe
    LegalCopyright : © Microsoft Corporation. All rights reserved.
    OriginalFilename : spoolsv.exe

    #:13 [ati2evxx.exe]
    FilePath : C:\WINDOWS\system32\
    ProcessID : 1916
    ThreadCreationTime : 4.9.2006 6:48:14
    BasePriority : Normal
    FileVersion : 6.14.10.4112
    ProductVersion : 6.14.10.4112.01
    ProductName : ATI External Event Utility for WindowsNT and Windows9X
    CompanyName : ATI Technologies Inc.
    FileDescription : ATI External Event Utility EXE Module
    InternalName : ATI2EVXX.EXE
    LegalCopyright : Copyright © 1999-2004 ATI Technologies Inc.
    OriginalFilename : ATI2EVXX.EXE

    #:14 [explorer.exe]
    FilePath : C:\WINDOWS\
    ProcessID : 1988
    ThreadCreationTime : 4.9.2006 6:48:14
    BasePriority : Normal
    FileVersion : 6.00.2900.2527 (xpsp.040919-1030)
    ProductVersion : 6.00.2900.2527
    ProductName : Microsoft® Windows® -käyttöjärjestelmä
    CompanyName : Microsoft Corporation
    FileDescription : Resurssienhallinta
    InternalName : explorer
    LegalCopyright : © Microsoft Corporation. All rights reserved.
    OriginalFilename : EXPLORER.EXE

    #:15 [soundman.exe]
    FilePath : C:\WINDOWS\
    ProcessID : 244
    ThreadCreationTime : 4.9.2006 6:48:17
    BasePriority : Normal
    FileVersion : 1, 0, 0, 14
    ProductVersion : 1, 0, 0, 14
    ProductName : Realtek HD Sound Manager
    CompanyName : Realtek Semiconductor Corp.
    FileDescription : Realtek Sound Manager
    InternalName : ALSMTray
    LegalCopyright : Copyright (c) 2004 Realtek Semiconductor Corp.
    OriginalFilename : ALSMTray.exe
    Comments : Realtek HD Audio Sound Manager

    #:16 [alcwzrd.exe]
    FilePath : C:\WINDOWS\
    ProcessID : 252
    ThreadCreationTime : 4.9.2006 6:48:17
    BasePriority : Normal
    FileVersion : 1.1.0.18
    ProductVersion : 1.1.0.17
    ProductName : ALCWZRD
    CompanyName : RealTek Semicoductor Corp.
    FileDescription : RealTek AlcWzrd Application
    InternalName : ALCWZRD.EXE
    LegalCopyright : Copyright (C) 2003-2004 Realtek Semiconductor Corp.
    OriginalFilename : ALCWZRD.EXE

    #:17 [atiptaxx.exe]
    FilePath : C:\ATI-CPanel\
    ProcessID : 268
    ThreadCreationTime : 4.9.2006 6:48:17
    BasePriority : Normal
    FileVersion : 6.14.10.5140
    ProductVersion : 6.14.10.5140
    ProductName : ATI Desktop Component
    CompanyName : ATI Technologies, Inc.
    FileDescription : ATI Desktop Control Panel
    InternalName : Atiptaxx.exe
    LegalCopyright : Copyright (C) 1998-2005 ATI Technologies Inc.
    OriginalFilename : Atiptaxx.exe

    #:18 [daemon.exe]
    FilePath : C:\Program Files\D-Tools\
    ProcessID : 360
    ThreadCreationTime : 4.9.2006 6:48:17
    BasePriority : Normal


    #:19 [jusched.exe]
    FilePath : C:\Program Files\Java\jre1.5.0_06\bin\
    ProcessID : 388
    ThreadCreationTime : 4.9.2006 6:48:18
    BasePriority : Normal


    #:20 [ico.exe]
    FilePath : C:\WINDOWS\system32\
    ProcessID : 400
    ThreadCreationTime : 4.9.2006 6:48:18
    BasePriority : Normal
    FileVersion : 1, 0, 0, 7
    ProductVersion : 1.0.0.0
    ProductName : MouseSuite 98
    CompanyName : Primax Electronics Ltd.
    FileDescription : Mouse Suite 98 Daemon
    InternalName : pelmiced.exe
    LegalCopyright : Copyright (c) 1997, Primax Electronics Ltd.
    LegalTrademarks : Primax Electronics Ltd.

    #:21 [pelmiced.exe]
    FilePath : C:\WINDOWS\system32\
    ProcessID : 428
    ThreadCreationTime : 4.9.2006 6:48:18
    BasePriority : Normal
    FileVersion : 1, 0, 7, 9
    ProductVersion : 1.0.0.0
    ProductName : MouseSuite 98
    CompanyName : Primax Electronics Ltd.
    FileDescription : Mouse Suite 98 Daemon
    InternalName : pelmiced.exe
    LegalCopyright : Copyright (c) 1997, Primax Electronics Ltd.
    LegalTrademarks : Primax Electronics Ltd.

    #:22 [qttask.exe]
    FilePath : C:\Program Files\QuickTime\
    ProcessID : 424
    ThreadCreationTime : 4.9.2006 6:48:18
    BasePriority : Normal
    FileVersion : 7.0.3
    ProductVersion : QuickTime 7.0.3
    ProductName : QuickTime
    CompanyName : Apple Computer, Inc.
    FileDescription : QuickTime Task
    InternalName : QuickTime Task
    LegalCopyright : Copyright Apple Computer, Inc. 1989-2005
    OriginalFilename : QTTask.exe

    #:23 [realsched.exe]
    FilePath : C:\Program Files\Common Files\Real\Update_OB\
    ProcessID : 444
    ThreadCreationTime : 4.9.2006 6:48:18
    BasePriority : Normal
    FileVersion : 0.1.0.3510
    ProductVersion : 0.1.0.3510
    ProductName : RealPlayer (32-bit)
    CompanyName : RealNetworks, Inc.
    FileDescription : RealNetworks Scheduler
    InternalName : schedapp
    LegalCopyright : Copyright © RealNetworks, Inc. 1995-2004
    LegalTrademarks : RealAudio(tm) is a trademark of RealNetworks, Inc.
    OriginalFilename : realsched.exe

    #:24 [svcnet.exe]
    FilePath : C:\WINDOWS\system32\
    ProcessID : 448
    ThreadCreationTime : 4.9.2006 6:48:18
    BasePriority : Normal


    #:25 [kpf4ss.exe]
    FilePath : C:\Program Files\Kerio\Personal Firewall 4\
    ProcessID : 124
    ThreadCreationTime : 4.9.2006 6:48:21
    BasePriority : Normal
    FileVersion : 4.0.16
    ProductVersion : 4.0.16
    ProductName : Kerio Personal Firewall 4
    CompanyName : Kerio Technologies
    FileDescription : Kerio Personal Firewall 4 - Service
    InternalName : kpf4ss
    LegalCopyright : Copyright (C) 1997-2004 Kerio Technologies
    OriginalFilename : kpf4ss.EXE
    Comments : Kerio Personal Firewall 4 - Service

    #:26 [slserv.exe]
    FilePath : C:\WINDOWS\system32\
    ProcessID : 1216
    ThreadCreationTime : 4.9.2006 6:48:25
    BasePriority : Normal
    FileVersion : 2.80.00(24Apr2000)
    ProductVersion : 2.80.00
    ProductName : Modem
    FileDescription : User-Level Modem Service
    InternalName : slserv
    LegalCopyright : Copyright © 1999-2000
    OriginalFilename : slserv.exe

    #:27 [svchost.exe]
    FilePath : C:\WINDOWS\system32\
    ProcessID : 1404
    ThreadCreationTime : 4.9.2006 6:48:26
    BasePriority : Normal
    FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion : 5.1.2600.2180
    ProductName : Microsoft® Windows® Operating System
    CompanyName : Microsoft Corporation
    FileDescription : Generic Host Process for Win32 Services
    InternalName : svchost.exe
    LegalCopyright : © Microsoft Corporation. All rights reserved.
    OriginalFilename : svchost.exe

    #:28 [wdfmgr.exe]
    FilePath : C:\WINDOWS\system32\
    ProcessID : 1488
    ThreadCreationTime : 4.9.2006 6:48:26
    BasePriority : Normal
    FileVersion : 5.2.3790.1230 built by: dnsrv(bld4act)
    ProductVersion : 5.2.3790.1230
    ProductName : Microsoft® Windows® Operating System
    CompanyName : Microsoft Corporation
    FileDescription : Windows User Mode Driver Manager
    InternalName : WdfMgr
    LegalCopyright : © Microsoft Corporation. All rights reserved.
    OriginalFilename : WdfMgr.exe

    #:29 [kpf4gui.exe]
    FilePath : C:\Program Files\Kerio\Personal Firewall 4\
    ProcessID : 796
    ThreadCreationTime : 4.9.2006 6:48:33
    BasePriority : Normal
    FileVersion : 4.0.16
    ProductVersion : 4.0.16
    ProductName : Kerio Personal Firewall 4
    CompanyName : Kerio Technologies
    FileDescription : Kerio Personal Firewall 4 - GUI
    InternalName : kpf4gui
    LegalCopyright : Copyright (C) 1997-2004 Kerio Technologies
    OriginalFilename : kpf4gui.EXE
    Comments : Kerio Personal Firewall 4 - GUI

    #:30 [kpf4gui.exe]
    FilePath : C:\Program Files\Kerio\Personal Firewall 4\
    ProcessID : 2160
    ThreadCreationTime : 4.9.2006 6:48:35
    BasePriority : Normal
    FileVersion : 4.0.16
    ProductVersion : 4.0.16
    ProductName : Kerio Personal Firewall 4
    CompanyName : Kerio Technologies
    FileDescription : Kerio Personal Firewall 4 - GUI
    InternalName : kpf4gui
    LegalCopyright : Copyright (C) 1997-2004 Kerio Technologies
    OriginalFilename : kpf4gui.EXE
    Comments : Kerio Personal Firewall 4 - GUI

    #:31 [wscntfy.exe]
    FilePath : C:\WINDOWS\system32\
    ProcessID : 2192
    ThreadCreationTime : 4.9.2006 6:48:35
    BasePriority : Normal
    FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion : 5.1.2600.2180
    ProductName : Microsoft® Windows® Operating System
    CompanyName : Microsoft Corporation
    FileDescription : Windows Security Center Notification App
    InternalName : wscntfy.exe
    LegalCopyright : © Microsoft Corporation. All rights reserved.
    OriginalFilename : wscntfy.exe

    #:32 [alg.exe]
    FilePath : C:\WINDOWS\System32\
    ProcessID : 2284
    ThreadCreationTime : 4.9.2006 6:48:36
    BasePriority : Normal
    FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion : 5.1.2600.2180
    ProductName : Microsoft® Windows® Operating System
    CompanyName : Microsoft Corporation
    FileDescription : Application Layer Gateway Service
    InternalName : ALG.exe
    LegalCopyright : © Microsoft Corporation. All rights reserved.
    OriginalFilename : ALG.exe

    #:33 [winamp.exe]
    FilePath : C:\Program Files\Winamp\
    ProcessID : 3652
    ThreadCreationTime : 4.9.2006 8:07:12
    BasePriority : Normal
    FileVersion : 5.094
    ProductVersion : 5.094
    ProductName : Winamp
    CompanyName : Nullsoft
    FileDescription : Winamp
    InternalName : WINAMP
    LegalCopyright : Copyright © 1997-2005, Nullsoft, Inc.
    LegalTrademarks : Nullsoft and Winamp are trademarks of Nullsoft, Inc.
    OriginalFilename : Winamp.exe
    Comments : Visit http://www.winamp.com/ for updates.

    #:34 [hijackthis.exe]
    FilePath : C:\DOCUME~1\Joke\LOCALS~1\Temp\Rar$EX00.282\
    ProcessID : 3012
    ThreadCreationTime : 4.9.2006 8:39:59
    BasePriority : Normal
    FileVersion : 1.99.0001
    ProductVersion : 1.99.0001
    ProductName : HijackThis
    CompanyName : Soeperman Enterprises Ltd.
    FileDescription : HijackThis
    InternalName : HijackThis
    LegalCopyright : Freeware
    OriginalFilename : HijackThis.exe
    Comments : Version history is in Help section

    #:35 [notepad.exe]
    FilePath : C:\WINDOWS\system32\
    ProcessID : 176
    ThreadCreationTime : 4.9.2006 8:40:14
    BasePriority : Normal
    FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion : 5.1.2600.2180
    ProductName : Microsoft® Windows® -käyttöjärjestelmä
    CompanyName : Microsoft Corporation
    FileDescription : Notepad
    InternalName : Notepad
    LegalCopyright : © Microsoft Corporation. All rights reserved.
    OriginalFilename : NOTEPAD.EXE

    #:36 [opera.exe]
    FilePath : C:\Program Files\Opera\
    ProcessID : 3276
    ThreadCreationTime : 4.9.2006 8:42:58
    BasePriority : Normal
    FileVersion : 7712
    ProductVersion : 8.51
    ProductName : Opera Internet Browser
    CompanyName : Opera Software
    FileDescription : Opera Internet Browser
    InternalName : Opera
    LegalCopyright : Copyright © Opera Software 1995-2005
    OriginalFilename : Opera.exe

    #:37 [ad-aware.exe]
    FilePath : C:\Program Files\Lavasoft\Ad-Aware SE Personal\
    ProcessID : 3228
    ThreadCreationTime : 4.9.2006 8:44:55
    BasePriority : Normal
    FileVersion : 6.2.0.236
    ProductVersion : SE 106
    ProductName : Lavasoft Ad-Aware SE
    CompanyName : Lavasoft Sweden
    FileDescription : Ad-Aware SE Core application
    InternalName : Ad-Aware.exe
    LegalCopyright : Copyright © Lavasoft AB Sweden
    OriginalFilename : Ad-Aware.exe
    Comments : All Rights Reserved

    Memory scan result:
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    New critical objects: 0
    Objects found so far: 10


    Started registry scan
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

    Registry Scan result:
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    New critical objects: 0
    Objects found so far: 10


    Started deep registry scan
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

    Deep registry scan result:
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    New critical objects: 0
    Objects found so far: 10


    Started Tracking Cookie scan
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»


    Tracking Cookie Object Recognized!
    Type : IECache Entry
    Data : joke@revenue[1].txt
    TAC Rating : 3
    Category : Data Miner
    Comment : Hits:1
    Value : Cookie:joke@revenue.net/
    Expires : 10.6.2022 8:05:42
    LastSync : Hits:1
    UseCount : 0
    Hits : 1

    Tracking Cookie Object Recognized!
    Type : IECache Entry
    Data : joke@casalemedia[2].txt
    TAC Rating : 3
    Category : Data Miner
    Comment : Hits:4
    Value : Cookie:joke@casalemedia.com/
    Expires : 26.8.2007 6:10:18
    LastSync : Hits:4
    UseCount : 0
    Hits : 4

    Tracking cookie scan result:
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    New critical objects: 2
    Objects found so far: 12



    Deep scanning and examining files (C:)
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

    Win32.Worm.Tibick Object Recognized!
    Type : File
    Data : temp.fr21D0
    TAC Rating : 10
    Category : Worm
    Comment :
    Object : C:\Documents and Settings\Joke\Local Settings\Temp\



    Win32.Worm.Tibick Object Recognized!
    Type : File
    Data : A0025457.exe
    TAC Rating : 10
    Category : Worm
    Comment :
    Object : C:\System Volume Information\_restore{DBF5AB2F-C80C-4DD6-A3B0-8CA6901A90F5}\RP329\



    Win32.Worm.Tibick Object Recognized!
    Type : File
    Data : A0025467.exe
    TAC Rating : 10
    Category : Worm
    Comment :
    Object : C:\System Volume Information\_restore{DBF5AB2F-C80C-4DD6-A3B0-8CA6901A90F5}\RP329\



    Win32.Worm.Tibick Object Recognized!
    Type : File
    Data : Blitzkrieg - Burning Horizon CDV Software GmbH crack.exe
    TAC Rating : 10
    Category : Worm
    Comment :
    Object : C:\WINDOWS\system32\msview\



    Disk Scan Result for C:\
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    New critical objects: 0
    Objects found so far: 16


    Scanning Hosts file......
    Hosts file location:"C:\WINDOWS\system32\drivers\etc\hosts".
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

    Hosts file scan result:
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    1 entries scanned.
    New critical objects:0
    Objects found so far: 16




    Performing conditional scans...
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

    Conditional scan result:
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    New critical objects: 0
    Objects found so far: 16

    11:54:11 Scan Complete

    Summary Of This Scan
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    Total scanning time:00:09:05.765
    Objects scanned:157952
    Objects identified:12
    Objects ignored:6
    New critical objects:6







    Logfile of HijackThis v1.99.1
    Scan saved at 11:40:14, on 4.9.2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\ALCWZRD.EXE
    C:\ATI-CPanel\atiptaxx.exe
    C:\Program Files\D-Tools\daemon.exe
    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    C:\WINDOWS\system32\ICO.EXE
    C:\WINDOWS\system32\Pelmiced.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\system32\svcnet.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Winamp\winamp.exe
    C:\DOCUME~1\Joke\LOCALS~1\Temp\Rar$EX00.282\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fi/0SEFIFI/SAOS01
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.iltalehti.fi/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = dna Internet Explorer
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
    O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [High Definition Audio -ominaisuussivun pikakuvake] HDAShCut.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
    O4 - HKLM\..\Run: [ToniArts EasyCleaner] "C:\Program Files\ToniArts\EasyCleaner\EasyClea.exe" -s -startup
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [Shellapi32] svcnet.exe
    O4 - HKCU\..\Run: [Shellapi32] svcnet.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/CDT/ie/bridge-c18.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
    O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\NORMAN\Nvc\BIN\nipsvc.exe (file missing)
    O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\Nvc\BIN\Zanda.exe (file missing)
    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe





    Että tällaista...

    Apua tarvitaan, kiitos!
     
    japah, 04.09.2006
    #1
  2.  
  3. Jurppis

    Jurppis Regular member

    Liittynyt:
    22.02.2006
    Viestejä:
    659
    Kiitokset:
    0
    Pisteet:
    26
    Moi

    Siirrä ensin HijackThis omaan kansioon, esim C:\Hjt

    Avaa HijackThis, paina do a system scan only ja merkkaa nämä:

    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [Shellapi32] svcnet.exe
    O4 - HKCU\..\Run: [Shellapi32] svcnet.exe
    O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/CDT/ie/bridge-c18.cab[/b]

    Ja paina fix cheked.

    Käynnistä tietokoneesi vikasietotilaan näpyttämällä F8:a käynnistyksen yhteydessä
    http://www.pchell.com/support/safemode.shtml

    Laita piilotiedostot näkyviin

    1.Napsauta Käynnistä-painiketta ja valitse Ohjauspaneeli.
    2.Valitse "Kansion asetukset"
    3.Siirry" Näytä välilehdelle"
    4.Valitse Näytä-välilehden Piilotetut tiedostot ja kansiot -kohdassa" Näytä piilotetut tiedostot ja kansiot."

    Poista tämä tiedosto vikasietotilassa:

    C:\WINDOWS\system32\->svcnet.exe

    Ota piilotiedosto pois näkyvistä ja käynnistä tietokoneesi normaalisti uudelleen jotta pääsisit takaisin normaalitilaan.
    Normaalitilassa lähetä uusi HijackThis loki.
     
    Jurppis, 04.09.2006
    #2
  4. japah

    japah Member

    Liittynyt:
    04.09.2006
    Viestejä:
    4
    Kiitokset:
    0
    Pisteet:
    11
    No niin, eli tein nyt ohjeiden mukaisesti ja tässä tulos äskeisestä HJT:stä...

    Ja vielä tiedoksi, jos on tarpeen mainita... käytän siis selaimena Operaa, Exploreria en juuri koskaan. Ihmettelin vain miksi tuolla välillä näkyy suoritettuna explorer.exe ?



    Logfile of HijackThis v1.99.1
    Scan saved at 21:10:18, on 4.9.2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\ALCWZRD.EXE
    C:\ATI-CPanel\atiptaxx.exe
    C:\Program Files\D-Tools\daemon.exe
    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    C:\WINDOWS\system32\ICO.EXE
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\system32\Pelmiced.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
    C:\DOCUME~1\Joke\LOCALS~1\Temp\Rar$EX00.719\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fi/0SEFIFI/SAOS01
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.iltalehti.fi/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = dna Internet Explorer
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
    O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [High Definition Audio -ominaisuussivun pikakuvake] HDAShCut.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
    O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
    O4 - HKLM\..\Run: [ToniArts EasyCleaner] "C:\Program Files\ToniArts\EasyCleaner\EasyClea.exe" -s -startup
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
    O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\NORMAN\Nvc\BIN\nipsvc.exe (file missing)
    O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\Nvc\BIN\Zanda.exe (file missing)
    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

     
    japah, 04.09.2006
    #3
  5. japah

    japah Member

    Liittynyt:
    04.09.2006
    Viestejä:
    4
    Kiitokset:
    0
    Pisteet:
    11
    Ja vielä lisäys äskeiseen.
    Ajoin äskettäin myös Ad-Awaren ja sieltä löytyi taas 4 kappaletta Win32.Worm.Tibick-tiedostoja. Laitoin ne jälleen kerran karanteeniin ja poistin tiedostot. Mistä nämä tulevat?


    WIN32.WORM.TIBICK
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    obj[0]=File : C:\Documents and Settings\Joke\Local Settings\Temp\temp.fr2A55
    obj[1]=File : C:\System Volume Information\_restore{DBF5AB2F-C80C-4DD6-A3B0-8CA6901A90F5}\RP332\A0025618.exe
    obj[2]=File : C:\System Volume Information\_restore{DBF5AB2F-C80C-4DD6-A3B0-8CA6901A90F5}\RP332\A0025623.exe
    obj[3]=File : C:\WINDOWS\system32\msview\Blitzkrieg - Burning Horizon CDV Software GmbH crack.exe


     
    japah, 04.09.2006
    #4
  6. Sebu92

    Sebu92 Active member

    Liittynyt:
    15.10.2005
    Viestejä:
    2,778
    Kiitokset:
    0
    Pisteet:
    66
    Tuo explorer.exe käynnistyy aina, se on nuo kaikki työpöytä, resurssienhallinta ja työkalupalkki. iexplore.exe on sitten taas internet explorer.
     
    Sebu92, 04.09.2006
    #5
  7. Jurppis

    Jurppis Regular member

    Liittynyt:
    22.02.2006
    Viestejä:
    659
    Kiitokset:
    0
    Pisteet:
    26
    Puhdista system restore:

    1. Klikkaa oikealla käynnistävalikon My Computer- tai oma tietokone-kuvaketta
    2. Valitse Properties/ominaisuudet
    3. Valitse System Restore/järjestelmän palauttaminen välilehti
    4. Valitse "Turn off System Restore"/poista järjestelmän palauttaminen kaikissa asemissa
    5. Paina Apply/käytä
    6. Paina OK
    7. Käynnistä kone uudelleen
    8. Tarkista kone (mielellään kahdella) online scannereilla ja omalla virustorjuntaohjelmalla
    9. Poista kaikki saastuneet tiedostot
    10. Palauta asetukset takaisin

    Tyhjennä väliaikaistiedostot ATF - Cleanerilla, linkki:
    http://www.atribune.org/ccount/click.php?id=1

    Tupla-klikkaa ATF-Cleaner.exe käynnistääksesi ohjelman.
    Main:n alla valitse: Select All
    Klikkaa Empty Selected valintaa.
    Jos käytät FireFoxia selaimenasi
    Klikkaa Firefox yläpuolelta ja valitse: Select All
    Klikkaa Empty Selected valintaa.
    HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy.
    Jos käytät Operaa selaimenasi
    Klikkaa Opera yläpuolelta ja valitse: Select All
    Klikkaa Empty Selected valintaa taas.
    HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy.
    Klikkaa Exit päävalikosta sulkeaksesi ohjelman.
    Teknistä tukea tulee jos tupla-klikkaat sähköpostiosoitetta joka sijaitsee jokaisen menun alapuolella kyseisessä työkalussa. (Huomatkaa että se tuki on sitten englanniksi)

    Javan päivitys ja välimuistin tyhjennys

    1. Klikkaa Käynnistä > Ohjauspaneeli ja tupla-klikkaa Lisää tai poista sovellus Ohjauspaneelissa.
    2. Etsi listasta kaikki entiset Java versiosi. (J2SE Runtime Environment.... )
    Niissä pitäisi olla seuraava kuva vieressä:
    3. Valitse kaikki entiset Java versiosi ja valitse Poista.
    4. Asenna uusin Java päivitys seuraavasta linkistä..
    5. Käynnistä kone uudelleen asennuksen jälkeen:

    http://java.sun.com/javase/downloads/index.jsp

    6. Käynnistyksen jälkeen, mene takaisin Ohjauspaneeliin ja avaa Java asetuksesi (Muita Ohjauspaneelin asetuksia -> Java kahvikuppi).
    7. Temporary Internet Files -osion alla, klikkaa Delete Files nappia.
    8. Varmista että kaikki kolme valintaa ovat rastitettuja:

    Downloaded Applets
    Downloaded Applications
    Other Files

    9. Klikkaa OK "Delete Temporary Internet Files" -ikkunassasi.
    Huomaa: Tämä poistaa kaikki ladatut sovellukset ja appletit VÄLIMUISTISTA.
    10. Klikkaa OK jättääksesi Java asetusikkunasi.
     
    Viimeksi muokattu: 05.09.2006
    Jurppis, 05.09.2006
    #6
  8. japah

    japah Member

    Liittynyt:
    04.09.2006
    Viestejä:
    4
    Kiitokset:
    0
    Pisteet:
    11
    Kiitokset Jurppis!

    Edellä mainitut tehtävät on nyt suoritettu ja latasin tosiaan koneelle nyt uusia torjunta-ja poisto-ohjelmia.
    Tein vielä äskettäin tarkistuksen HJT:llä ja Ad-Awarella.
    Ad-Awaren tulos oli puhdas ja HJT- logi näyttää seuraavanlaiselta:


    Logfile of HijackThis v1.99.1
    Scan saved at 15:33:00, on 7.9.2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\ALCWZRD.EXE
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\ATI-CPanel\atiptaxx.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\Program Files\D-Tools\daemon.exe
    C:\WINDOWS\system32\ICO.EXE
    C:\Program Files\QuickTime\qttask.exe
    C:\WINDOWS\system32\Pelmiced.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\SpywareGuard\sgmain.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
    C:\Program Files\SpywareGuard\sgbhp.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
    C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe
    C:\DOCUME~1\Joke\LOCALS~1\Temp\Rar$EX01.188\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fi/0SEFIFI/SAOS01
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.iltalehti.fi/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = dna Internet Explorer
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
    O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
    O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
    O4 - HKLM\..\Run: [High Definition Audio -ominaisuussivun pikakuvake] HDAShCut.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
    O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
    O4 - HKLM\..\Run: [ToniArts EasyCleaner] "C:\Program Files\ToniArts\EasyCleaner\EasyClea.exe" -s -startup
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
    O4 - HKLM\..\Run: [OPSE reminder] "C:\Program Files\ScanSoft\OmniPageSE2.0\EregEng\Ereg.exe" -r "C:\Program Files\ScanSoft\OmniPageSE2.0\EregEng\ereg.ini"
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
    O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
    O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
    O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
    O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\npjpi150_07.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\npjpi150_07.dll
    O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols/fscax.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
    O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://www.freedom.net/viruscenter/onlineviruscheck/cabs/cssweb.cab
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
    O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\NORMAN\Nvc\BIN\nipsvc.exe (file missing)
    O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\Nvc\BIN\Zanda.exe (file missing)
    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe


    Näyttääkö tämä jo normaalilta, puhtaalta koneelta? Vai täytyykö vielä tehdä jotain?
    Uusien ohjelmien asetuksien yms. tekemisessä saattaa vierähtää jokin tovi, että osaan niitä oikein ja järkevästi käyttää. Joitain vinkkejä ottaisin toki mielelläni vastaan.

    Jos tämä operaatio oli nyt selvä, kiitokset vielä suuresti!
     
    japah, 07.09.2006
    #7
  9. Jurppis

    Jurppis Regular member

    Liittynyt:
    22.02.2006
    Viestejä:
    659
    Kiitokset:
    0
    Pisteet:
    26
    Puhtaalta näyttää, tosin huonojen ohjeitteni takia otit väärän javan, joten poista tuo vanha ja rulla alaspäin antamastani javan päivityslinkistä kohtaan
    Java Runtime Environment (JRE) 5.0 Update 8
     
    Jurppis, 08.09.2006
    #8
  10. Sami73

    Sami73 Member

    Liittynyt:
    21.03.2006
    Viestejä:
    44
    Kiitokset:
    0
    Pisteet:
    16
    Pakko mainita, vaikkei asia minulle kuulu... Jäi ensimmäinen ohje suorittamatta : siirrä htj omaan hakemistoon. ;)
     
    Sami73, 08.09.2006
    #9
Viestiketjun tila:
Viestiketju on suljettu.

Jaa tämä sivu