Tällasta pukkaa itä-suomessa:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\OHJELMATIEDOSTOT\MESSENGER PLUS! 2\MSGPLUS.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\JAVAAD.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\LOADQM.EXE
D:\CANON\SCANGEAR TOOLBOX CS\SGTBOX.EXE
D:\CLONECD\CLONECDTRAY.EXE
D:\HEWLETT-PACKARD\DIGITAL IMAGING\UNLOAD\HPQCMON.EXE
D:\HEWLETT-PACKARD\HP SHARE-TO-WEB\HPGS2WND.EXE
C:\OHJELMATIEDOSTOT\YHTEISET TIEDOSTOT\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\RunDLL.exe
C:\OHJELMATIEDOSTOT\MATROX MGA POWERDESK\QDESK\MGAQDESK.EXE
C:\OHJELMATIEDOSTOT\MATROX MGA POWERDESK\MGACTRL.EXE
D:\HEWLETT-PACKARD\HP SHARE-TO-WEB\HPGS2WNF.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\HIJACKTHIS\HIJACKTHIS.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://mommykiss.com/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\qywmh.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\qywmh.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system\qywmh.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\qywmh.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\qywmh.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\qywmh.dll/sp.html#28129
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\qywmh.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja Sonera Plaza Oy
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.dial.inet.fi:800
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;*.*.fi;*.*.*.fi;
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {14267C3A-E5BD-19B4-6600-CE2B4D4BF833} - C:\WINDOWS\D3SV32.DLL
O3 - Toolbar: @msdxmLC.dll,-1@1035,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [SmcService] C:\OHJELM~1\SYGATE\SPF\SMC.EXE -startgui
O4 - HKLM\..\Run: [SGTBox] D:\CANON\SCANGE~1\SGTBOX.EXE
O4 - HKLM\..\Run: [CloneCDTray] "D:\CloneCD\CloneCDTray.exe"
O4 - HKLM\..\Run: [CamMonitor] D:\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] D:\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [mdac_runonce] C:\WINDOWS\SYSTEM\runonce.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Ohjelmatiedostot\Yhteiset tiedostot\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ghxxtcrniv] C:\WINDOWS\SYSTEM\kqswfb.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakLogon
O4 - HKLM\..\RunServices: [SmcService] C:\OHJELMATIEDOSTOT\SYGATE\SPF\SMC.EXE
O4 - HKLM\..\RunServices: [MessengerPlus2] "C:\Ohjelmatiedostot\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\RunServices: [APIRV32.EXE] C:\WINDOWS\APIRV32.EXE
O4 - HKLM\..\RunServices: [WINFO32.EXE] C:\WINDOWS\WINFO32.EXE
O4 - HKLM\..\RunServices: [JAVAAD.EXE] C:\WINDOWS\JAVAAD.EXE
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - HKCU\..\Run: [MessengerPlus2] "C:\Ohjelmatiedostot\Messenger Plus! 2\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [Matrox QuickDesk] C:\Ohjelmatiedostot\Matrox MGA PowerDesk\QDesk\mgaqdesk.exe
O4 - HKCU\..\Run: [Hxs] C:\WINDOWS\SYSTEM\ijosf.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O12 - Plugin for .avi: C:\OHJELM~1\INTERN~1\PLUGINS\npqtplugin.dll
O12 - Plugin for .MTD: C:\OHJELM~1\INTERN~1\Plugins\npmusicn.dll
O12 - Plugin for .mid: C:\OHJELM~1\INTERN~1\PLUGINS\npqtplugin2.dll
O15 - Trusted Zone: *.05p.com
O15 - Trusted Zone: *.searchmiracle.com
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.my-internet.info
O15 - Trusted Zone: *.scoobidoo.com
O16 - DPF: {BA0B385E-7143-11D1-BA8C-00600827878D} - http://www.alexa.com/download/alexa20.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20011217/qtinstall.info.apple.com/qt505/us/win/QuickTimeInstaller.exe
O16 - DPF: {f760cb9e-c60f-4a89-890e-fae8b849493e} -
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\OHJELMATIEDOSTOT\MESSENGER PLUS! 2\MSGPLUS.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\JAVAAD.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\LOADQM.EXE
D:\CANON\SCANGEAR TOOLBOX CS\SGTBOX.EXE
D:\CLONECD\CLONECDTRAY.EXE
D:\HEWLETT-PACKARD\DIGITAL IMAGING\UNLOAD\HPQCMON.EXE
D:\HEWLETT-PACKARD\HP SHARE-TO-WEB\HPGS2WND.EXE
C:\OHJELMATIEDOSTOT\YHTEISET TIEDOSTOT\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\RunDLL.exe
C:\OHJELMATIEDOSTOT\MATROX MGA POWERDESK\QDESK\MGAQDESK.EXE
C:\OHJELMATIEDOSTOT\MATROX MGA POWERDESK\MGACTRL.EXE
D:\HEWLETT-PACKARD\HP SHARE-TO-WEB\HPGS2WNF.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\HIJACKTHIS\HIJACKTHIS.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://mommykiss.com/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\qywmh.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\qywmh.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system\qywmh.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\qywmh.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\qywmh.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\qywmh.dll/sp.html#28129
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\qywmh.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja Sonera Plaza Oy
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.dial.inet.fi:800
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;*.*.fi;*.*.*.fi;
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {14267C3A-E5BD-19B4-6600-CE2B4D4BF833} - C:\WINDOWS\D3SV32.DLL
O3 - Toolbar: @msdxmLC.dll,-1@1035,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [SmcService] C:\OHJELM~1\SYGATE\SPF\SMC.EXE -startgui
O4 - HKLM\..\Run: [SGTBox] D:\CANON\SCANGE~1\SGTBOX.EXE
O4 - HKLM\..\Run: [CloneCDTray] "D:\CloneCD\CloneCDTray.exe"
O4 - HKLM\..\Run: [CamMonitor] D:\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] D:\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [mdac_runonce] C:\WINDOWS\SYSTEM\runonce.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Ohjelmatiedostot\Yhteiset tiedostot\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ghxxtcrniv] C:\WINDOWS\SYSTEM\kqswfb.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakLogon
O4 - HKLM\..\RunServices: [SmcService] C:\OHJELMATIEDOSTOT\SYGATE\SPF\SMC.EXE
O4 - HKLM\..\RunServices: [MessengerPlus2] "C:\Ohjelmatiedostot\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\RunServices: [APIRV32.EXE] C:\WINDOWS\APIRV32.EXE
O4 - HKLM\..\RunServices: [WINFO32.EXE] C:\WINDOWS\WINFO32.EXE
O4 - HKLM\..\RunServices: [JAVAAD.EXE] C:\WINDOWS\JAVAAD.EXE
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - HKCU\..\Run: [MessengerPlus2] "C:\Ohjelmatiedostot\Messenger Plus! 2\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [Matrox QuickDesk] C:\Ohjelmatiedostot\Matrox MGA PowerDesk\QDesk\mgaqdesk.exe
O4 - HKCU\..\Run: [Hxs] C:\WINDOWS\SYSTEM\ijosf.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O12 - Plugin for .avi: C:\OHJELM~1\INTERN~1\PLUGINS\npqtplugin.dll
O12 - Plugin for .MTD: C:\OHJELM~1\INTERN~1\Plugins\npmusicn.dll
O12 - Plugin for .mid: C:\OHJELM~1\INTERN~1\PLUGINS\npqtplugin2.dll
O15 - Trusted Zone: *.05p.com
O15 - Trusted Zone: *.searchmiracle.com
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.my-internet.info
O15 - Trusted Zone: *.scoobidoo.com
O16 - DPF: {BA0B385E-7143-11D1-BA8C-00600827878D} - http://www.alexa.com/download/alexa20.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20011217/qtinstall.info.apple.com/qt505/us/win/QuickTimeInstaller.exe
O16 - DPF: {f760cb9e-c60f-4a89-890e-fae8b849493e} -
Vastaukset 10
Vanhimmat
näillä scannereilla, anna poistaa kaikki mitä löytyy
http://housecall.trendmicro.com/housecall/start_corp.asp
http://www.bitdefender.com/scan/licence.php
Joo hyvä koitas putsata tuo logi.
Ajattelin seuraavaksi CWS:iä. Mutta jatka sinä tästä, minä seuraan (ja opettelen) ;)
Kiitokset tähänastisesta;pari ekaa skannausta vei sen verran aikaa, että harjoitukset jatkuu huomenna. Josko voimme palata asiaan, kunhan olen saanut kaikki hoitotoimenpiteet tehtyä. Ötyä.
Varmista että sulla on tuo versio
HijackThis v1.98.2
Pukkaa sitte uus logi tänne kokonaisena tosta aikasemmasta puuttuu se ylin osa
Logfile of HijackThis v1.98.2
Scan saved at 19:35:14, on 18.9.2004
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Pistä piilotiedostot näkyviin ohje tuolla
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/doci d/2002092715262339
Hae tuolta AboutBuster
http://www.subratam.org/?page=removal
Pura se työpöydälle omaan kansioon.
Avaa se ja kato jos siihen löytyy päivityksiä.
Sulje se sitte.
Sammuta tuo prosessi jos se on käynnissä
C:\WINDOWS\JAVAAD.EXE
Käynnistä kone vikasietotilassa scannaa Hijackillä,merkkaa nuo sulje selain ja muut avoimet ikkunat ja paina Fix checked
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://mommykiss.com/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\qywmh.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\qywmh.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system\qywmh.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\qywmh.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\qywmh.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\qywmh.dll/sp.html#28129
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\qywmh.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {14267C3A-E5BD-19B4-6600-CE2B4D4BF833} - C:\WINDOWS\D3SV32.DLL
O4 - HKLM\..\Run: [ghxxtcrniv] C:\WINDOWS\SYSTEM\kqswfb.exe
O4 - HKLM\..\RunServices: [APIRV32.EXE] C:\WINDOWS\APIRV32.EXE
O4 - HKLM\..\RunServices: [WINFO32.EXE] C:\WINDOWS\WINFO32.EXE
O4 - HKLM\..\RunServices: [JAVAAD.EXE] C:\WINDOWS\JAVAAD.EXE
O4 - HKCU\..\Run: [Hxs] C:\WINDOWS\SYSTEM\ijosf.exe
O15 - Trusted Zone: *.05p.com
O15 - Trusted Zone: *.searchmiracle.com
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.my-internet.info
O15 - Trusted Zone: *.scoobidoo.com
O16 - DPF: {f760cb9e-c60f-4a89-890e-fae8b849493e
Sitte etsi ja poista jos löytyy
qywmh.dll
D3SV32.DLL
kqswfb.exe
APIRV32.EXE
WINFO32.EXE
JAVAAD.EXE
ijosf.exe
Edelleen vikasietotilassa avaa se AboutBuster ja putsaa sillä 2 kertaa
Käynnistä sitte normaalisti ja pistä uus Hijack logi tänne kokonaisena eikä yläosa erikseen.
Ei toimi tuo Symatecin piilotiedosto linkki koita tätä
http://support.f-secure.fi/fin/home/virusproblem/howtoclean/cleansystemrestore.shtml
Siis tuo
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339
Mitähän minä oikein sekoilen.