valoa tunnelin päässä

Tilanne on jo hieman parempi, eli ainoastaan kuusi ongelmaa on enää riesana. Mitä mä näille teen? Tässä on jo loppukirin makua... ;) Joten auttakkee...

C:\WINDOWS\system32\TFTP3004.0 Virustartunta: Worm.Win32.Lovesan.a
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\YT636NUV\213.173.69[1].gif Virustartunta: TrojanProxy.Win32.Bobax.c
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\KP4RM72L\213.30.85[1].gif Virustartunta: TrojanProxy.Win32.Bobax.c
C:\RECYCLER\S-1-5-21-162025716-2704639424-2437969446-500\Dc1.0eg Virustartunta: Trojan.WinREG.StartPage
C:\RECYCLER\S-1-5-21-162025716-2704639424-2437969446-500\Dc3.exe Virustartunta: TrojanProxy.Win32.Bobax.c
C:\Documents and Settings\All Users\Tiedostot\OPEN_ME.1XE Virustartunta: Backdoor.SdBot.gen


--------------------------------------------------------------------------------

Tiedoston C:\hiberfil.sys avaaminen ei onnistu.
Tiedoston C:\pagefile.sys avaaminen ei onnistu.
Tiedoston C:\WINDOWS\Temp\ZLT04ef6.TMP avaaminen ei onnistu.
Tiedoston C:\WINDOWS\system32\config\DEFAULT avaaminen ei onnistu.
Tiedoston C:\WINDOWS\system32\config\SAM avaaminen ei onnistu.
Tiedoston C:\WINDOWS\system32\config\SECURITY avaaminen ei onnistu.
Tiedoston C:\WINDOWS\system32\config\SYSTEM avaaminen ei onnistu.
Tiedosto C:\Program Files\WINZIP81.EXE\SETUP.WZ\WINZIP32.EX_ on salattu.
Tiedoston C:\Program Files\F-Secure\Common\policy.ipf avaaminen ei onnistu.
Tiedoston C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\chandir.dat avaaminen ei onnistu.
Tiedoston C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\D0000000.FCS avaaminen ei onnistu.
Tiedoston C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\L0000001.FCS avaaminen ei onnistu.
Tiedoston C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\prs.dat avaaminen ei onnistu.
Tiedoston C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\storydb.dat avaaminen ei onnistu.
Tiedoston C:\Documents and Settings\NetworkService\NTUSER.DAT avaaminen ei onnistu.
Tiedoston C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat avaaminen ei onnistu.
Tiedoston C:\Documents and Settings\LocalService\NTUSER.DAT avaaminen ei onnistu.
Tiedoston C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat avaaminen ei onnistu.
Tiedoston C:\Documents and Settings\Xxxxx Xxxxxxxx\NTUSER.DAT avaaminen ei onnistu.
Tiedoston C:\Documents and Settings\Xxxxx Xxxxxxxx\Local Settings\Temp\Perflib_Perfdata_85c.dat avaaminen ei onnistu.
Tiedoston C:\Documents and Settings\Xxxxx Xxxxxxxx\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat avaaminen ei onnistu.
Tiedosto C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\AlexaRelated.zip\related.htm on salattu.
Tiedosto C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CommonName.zip\sbRecovery.ini on salattu.
Tiedosto C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DCON.zip\sbRecovery.reg on salattu.
Tiedosto C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit.zip\sbRecovery.reg on salattu.
Tiedosto C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit1.zip\sbRecovery.reg on salattu.
Tiedosto C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit10.zip\sbRecovery.reg on salattu.
Tiedosto C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit11.zip\sbRecovery.reg on salattu.
Tiedosto C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit12.zip\sbRecovery.reg on salattu.
Tiedosto C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit13.zip\sbRecovery.reg on salattu.
Tiedosto C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit14.zip\sbRecovery.reg on salattu.
Tiedosto C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit15.zip\sbRecovery.reg on salattu.
Tiedosto C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit16.zip\sbRecovery.reg on salattu.
Tiedosto C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit17.zip\sbRecovery.reg on salattu.
Tiedosto C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit18.zip\sbRecovery.reg on salattu.
Tiedosto C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit19.zip\sbRecovery.reg on salattu.
Tiedosto C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit2.zip\sbRecovery.reg on salattu.
Tiedosto C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit20.zip\sbRecovery.reg on salattu.
Tiedosto C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit21.zip\sbRecovery.reg on salattu.
Tiedosto C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit22.zip\sbRecovery.reg on salattu.
Tiedosto C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit23.zip\sbRecovery.reg on salattu.
Tiedosto C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit24.zip\sbRecovery.reg on salattu.
Tiedosto C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit25.zip\sbRecovery.reg on salattu.
Tiedosto C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit26.zip\sbRecovery.reg on salattu.
Tiedosto C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit27.zip\sbRecovery.reg on salattu.
Tiedosto C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit3.zip\sbRecovery.reg on salattu.
Tiedosto C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit4.zip\sbRecovery.reg on salattu.
Tiedosto C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit5.zip\sbRecovery.reg on salattu.
Tiedosto C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit6.zip\sbRecovery.reg on salattu.
Tiedosto C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit7.zip\sbRecovery.reg on salattu.
Tiedosto C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit8.zip\sbRecovery.reg on salattu.
Tiedosto C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit9.zip\sbRecovery.reg on salattu.
Tiedosto C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\GAINGator.zip\WinZip Quick Pick.lnk on salattu.
Tiedosto C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\GAINGator1.zip\PrecisionTime.lnk on salattu.
Tiedosto C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\GAINGator2.zip\Date Manager.lnk on salattu.
Tiedosto C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\GAINGator3.zip\sbRecovery.reg on salattu.
Tiedosto C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\GAINGator4.zip\Date Manager Website.lnk on salattu.
Tiedosto C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\GAINGator5.zip\PrecisionTime.lnk on salattu.
Tiedoston avaaminen arkistosta C:\Compaq\Works\Redist\IE5\mmssetup.cab\blogo.gi_ ei onnistu.

Ja sitten vielä Hijackin logi:

Logfile of HijackThis v1.97.7
Scan saved at 0:03:56, on 11.6.2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\Program Files\Compaq\Easy Access Button Support\CPQEAKSYSTEMTRAY.EXE
C:\Program Files\Microsoft Works\WksSb.exe
C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\Compaq\EAKDRV\EAUSBKBD.EXE
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\Internet Explorer\iexplore.exe
A:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\COMPAQ\Coloreal\coloreal.exe"
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Microsoft Works Kalenterin muistutukset.lnk = ?
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://housecall.trendmicro-europe.com/housecall/Xscan53.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38147.2513657407
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab