Mitäköhän tarkoittaa??????? **** Run Keys ****
RUN: [Wizard]
RUN: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
RUN: [SoundMan] SOUNDMAN.EXE
RUN: [CnxDslTaskBar] "C:\Program Files\\TW-IA300C ADSL\CnxDslTb.exe"
RUN: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
RUN: [F-Secure Manager] "C:\Program Files\TW-IA300C ADSL\Common\FSM32.EXE" /splash
RUN: [F-Secure TNB] "C:\Program Files\TW-IA300C ADSL\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
RUN: [News Service] "C:\Program Files\TW-IA300C ADSL\FSGUI\ispnews.exe"
RUN: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
RUN: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
RUN: [AVSCHED32] C:\Program Files\AVPersonal\AVSched32.EXE /min
RUN: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
RUN: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
RUN: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
RUN: [CSRSSW] C:\WINDOWS\System32\CSRSSW.EXE
RUN: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
RUN: [CTFMONSS] C:\WINDOWS\System32\CTFMONSS.EXE
**** Browser Helper Objects ****
BHO: [AcroIEHlprObj Class] C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
BHO: [] C:\PROGRA~1\SPYBOT~1\SDHelper.dll
BHO: [CPub Object] C:\WINDOWS\System32\EniroToolbar\PopupBlocker.dll
BHO: [VDOMP Class] C:\WINDOWS\wtlbass32.dll
**** IE Toolbars ****
TOOLBAR: [Eniro] C:\WINDOWS\System32\EniroToolbar\Toolband.dll
**** IE Extensions ****
IEExt: [Web-suodatin]
IEExt: [Web-suodatin]
IEExt: [Web-suodatin]
IEExt: [Web-suodatin]
IEExt: [Web-suodatin]
IEExt: [Messenger] C:\Program Files\Messenger\msmsgs.exe
**** Hosts File Entries ****
HOSTS: 127.0.0.1 localhost
HOSTS: 127.0.0.1 localhost
**** IE Settings ****
IEProxy: proxy.dial.inet.fi:800
IEBypass: *.fi;*.*.fi;*.*.*.fi;
Default Page: http://www.soneraplaza.fi
Default Search: http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Local Page: C:\WINDOWS\system32\blank.htm
Search Page: http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
**** IE Context Menu (Right click) ****
IEContext: [Hae Eniron avulla] res://C:\WINDOWS\System32\EniroToolbar\Toolband.dll/MENUSEARCH_FI.HTM
**** Layered Service Providers ****
LSP: MSAFD Tcpip [TCP/IP]
LSP: MSAFD Tcpip [UDP/IP]
LSP: RSVP UDP Service Provider
LSP: RSVP TCP Service Provider
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{DB110D20-277B-4F3A-874B-8D1E809E2848}] SEQPACKET 5
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{DB110D20-277B-4F3A-874B-8D1E809E2848}] DATAGRAM 5
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{FD4CAE22-B097-4C61-87BE-0F513D884E82}] SEQPACKET 4
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{FD4CAE22-B097-4C61-87BE-0F513D884E82}] DATAGRAM 4
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{D8771E8C-A9F4-42A3-901A-CE43F8F8D1A8}] SEQPACKET 1
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{D8771E8C-A9F4-42A3-901A-CE43F8F8D1A8}] DATAGRAM 1
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{4D64AB99-34C7-4B9B-B360-E7B3315BAD3C}] SEQPACKET 0
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{4D64AB99-34C7-4B9B-B360-E7B3315BAD3C}] DATAGRAM 0
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{A5BB3413-DBEB-48C6-9BDD-93502ED6F678}] SEQPACKET 2
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{A5BB3413-DBEB-48C6-9BDD-93502ED6F678}] DATAGRAM 2
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{116A2413-0764-40E8-9CE8-BE1A8BF6ED53}] SEQPACKET 3
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{116A2413-0764-40E8-9CE8-BE1A8BF6ED53}] DATAGRAM 3
**** Blocked Control Panel Items ****
BLOCKED: [ncpa.cpl] No
BLOCKED: [odbccp32.cpl] No
**** Downloaded Program Files ****
{2A32B14F-4D29-4EA3-AC54-E9B19F436CE7} [http://www.windowsecurity.com/trojanscan/TDECntrl.CAB]
{6414512B-B978-451D-A0D8-FCFDF33E833C} [http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1105904013203] C:\WINDOWS\System32\wuweb.dll
{D27CDB6E-AE6D-11CF-96B8-444553540000} [http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab]
**** Custom IE Search Items ****
SEARCH: [SearchAssistant] http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
SEARCH: [CustomizeSearch] http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
RUN: [Wizard]
RUN: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
RUN: [SoundMan] SOUNDMAN.EXE
RUN: [CnxDslTaskBar] "C:\Program Files\\TW-IA300C ADSL\CnxDslTb.exe"
RUN: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
RUN: [F-Secure Manager] "C:\Program Files\TW-IA300C ADSL\Common\FSM32.EXE" /splash
RUN: [F-Secure TNB] "C:\Program Files\TW-IA300C ADSL\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
RUN: [News Service] "C:\Program Files\TW-IA300C ADSL\FSGUI\ispnews.exe"
RUN: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
RUN: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
RUN: [AVSCHED32] C:\Program Files\AVPersonal\AVSched32.EXE /min
RUN: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
RUN: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
RUN: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
RUN: [CSRSSW] C:\WINDOWS\System32\CSRSSW.EXE
RUN: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
RUN: [CTFMONSS] C:\WINDOWS\System32\CTFMONSS.EXE
**** Browser Helper Objects ****
BHO: [AcroIEHlprObj Class] C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
BHO: [] C:\PROGRA~1\SPYBOT~1\SDHelper.dll
BHO: [CPub Object] C:\WINDOWS\System32\EniroToolbar\PopupBlocker.dll
BHO: [VDOMP Class] C:\WINDOWS\wtlbass32.dll
**** IE Toolbars ****
TOOLBAR: [Eniro] C:\WINDOWS\System32\EniroToolbar\Toolband.dll
**** IE Extensions ****
IEExt: [Web-suodatin]
IEExt: [Web-suodatin]
IEExt: [Web-suodatin]
IEExt: [Web-suodatin]
IEExt: [Web-suodatin]
IEExt: [Messenger] C:\Program Files\Messenger\msmsgs.exe
**** Hosts File Entries ****
HOSTS: 127.0.0.1 localhost
HOSTS: 127.0.0.1 localhost
**** IE Settings ****
IEProxy: proxy.dial.inet.fi:800
IEBypass: *.fi;*.*.fi;*.*.*.fi;
Default Page: http://www.soneraplaza.fi
Default Search: http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Local Page: C:\WINDOWS\system32\blank.htm
Search Page: http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
**** IE Context Menu (Right click) ****
IEContext: [Hae Eniron avulla] res://C:\WINDOWS\System32\EniroToolbar\Toolband.dll/MENUSEARCH_FI.HTM
**** Layered Service Providers ****
LSP: MSAFD Tcpip [TCP/IP]
LSP: MSAFD Tcpip [UDP/IP]
LSP: RSVP UDP Service Provider
LSP: RSVP TCP Service Provider
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{DB110D20-277B-4F3A-874B-8D1E809E2848}] SEQPACKET 5
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{DB110D20-277B-4F3A-874B-8D1E809E2848}] DATAGRAM 5
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{FD4CAE22-B097-4C61-87BE-0F513D884E82}] SEQPACKET 4
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{FD4CAE22-B097-4C61-87BE-0F513D884E82}] DATAGRAM 4
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{D8771E8C-A9F4-42A3-901A-CE43F8F8D1A8}] SEQPACKET 1
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{D8771E8C-A9F4-42A3-901A-CE43F8F8D1A8}] DATAGRAM 1
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{4D64AB99-34C7-4B9B-B360-E7B3315BAD3C}] SEQPACKET 0
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{4D64AB99-34C7-4B9B-B360-E7B3315BAD3C}] DATAGRAM 0
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{A5BB3413-DBEB-48C6-9BDD-93502ED6F678}] SEQPACKET 2
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{A5BB3413-DBEB-48C6-9BDD-93502ED6F678}] DATAGRAM 2
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{116A2413-0764-40E8-9CE8-BE1A8BF6ED53}] SEQPACKET 3
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{116A2413-0764-40E8-9CE8-BE1A8BF6ED53}] DATAGRAM 3
**** Blocked Control Panel Items ****
BLOCKED: [ncpa.cpl] No
BLOCKED: [odbccp32.cpl] No
**** Downloaded Program Files ****
{2A32B14F-4D29-4EA3-AC54-E9B19F436CE7} [http://www.windowsecurity.com/trojanscan/TDECntrl.CAB]
{6414512B-B978-451D-A0D8-FCFDF33E833C} [http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1105904013203] C:\WINDOWS\System32\wuweb.dll
{D27CDB6E-AE6D-11CF-96B8-444553540000} [http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab]
**** Custom IE Search Items ****
SEARCH: [SearchAssistant] http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
SEARCH: [CustomizeSearch] http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
Vastaukset 14
Vanhimmat
F-secure "hakkaa" jatkuvasti mm. tämmöi **** Run Keys ****
RUN: [Wizard]
RUN: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
RUN: [SoundMan] SOUNDMAN.EXE
RUN: [CnxDslTaskBar] "C:\Program Files\\TW-IA300C ADSL\CnxDslTb.exe"
RUN: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
RUN: [F-Secure Manager] "C:\Program Files\TW-IA300C ADSL\Common\FSM32.EXE" /splash
RUN: [F-Secure TNB] "C:\Program Files\TW-IA300C ADSL\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
RUN: [News Service] "C:\Program Files\TW-IA300C ADSL\FSGUI\ispnews.exe"
RUN: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
RUN: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
RUN: [AVSCHED32] C:\Program Files\AVPersonal\AVSched32.EXE /min
RUN: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
RUN: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
RUN: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
RUN: [CSRSSW] C:\WINDOWS\System32\CSRSSW.EXE
RUN: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
RUN: [CTFMONSS] C:\WINDOWS\System32\CTFMONSS.EXE
**** Browser Helper Objects ****
BHO: [AcroIEHlprObj Class] C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
BHO: [] C:\PROGRA~1\SPYBOT~1\SDHelper.dll
BHO: [CPub Object] C:\WINDOWS\System32\EniroToolbar\PopupBlocker.dll
BHO: [VDOMP Class] C:\WINDOWS\wtlbass32.dll
**** IE Toolbars ****
TOOLBAR: [Eniro] C:\WINDOWS\System32\EniroToolbar\Toolband.dll
**** IE Extensions ****
IEExt: [Web-suodatin]
IEExt: [Web-suodatin]
IEExt: [Web-suodatin]
IEExt: [Web-suodatin]
IEExt: [Web-suodatin]
IEExt: [Messenger] C:\Program Files\Messenger\msmsgs.exe
**** Hosts File Entries ****
HOSTS: 127.0.0.1 localhost
HOSTS: 127.0.0.1 localhost
**** IE Settings ****
IEProxy: proxy.dial.inet.fi:800
IEBypass: *.fi;*.*.fi;*.*.*.fi;
Default Page: http://www.soneraplaza.fi
Default Search: http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Local Page: C:\WINDOWS\system32\blank.htm
Search Page: http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
**** IE Context Menu (Right click) ****
IEContext: [Hae Eniron avulla] res://C:\WINDOWS\System32\EniroToolbar\Toolband.dll/MENUSEARCH_FI.HTM
**** Layered Service Providers ****
LSP: MSAFD Tcpip [TCP/IP]
LSP: MSAFD Tcpip [UDP/IP]
LSP: RSVP UDP Service Provider
LSP: RSVP TCP Service Provider
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{DB110D20-277B-4F3A-874B-8D1E809E2848}] SEQPACKET 5
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{DB110D20-277B-4F3A-874B-8D1E809E2848}] DATAGRAM 5
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{FD4CAE22-B097-4C61-87BE-0F513D884E82}] SEQPACKET 4
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{FD4CAE22-B097-4C61-87BE-0F513D884E82}] DATAGRAM 4
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{D8771E8C-A9F4-42A3-901A-CE43F8F8D1A8}] SEQPACKET 1
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{D8771E8C-A9F4-42A3-901A-CE43F8F8D1A8}] DATAGRAM 1
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{4D64AB99-34C7-4B9B-B360-E7B3315BAD3C}] SEQPACKET 0
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{4D64AB99-34C7-4B9B-B360-E7B3315BAD3C}] DATAGRAM 0
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{A5BB3413-DBEB-48C6-9BDD-93502ED6F678}] SEQPACKET 2
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{A5BB3413-DBEB-48C6-9BDD-93502ED6F678}] DATAGRAM 2
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{116A2413-0764-40E8-9CE8-BE1A8BF6ED53}] SEQPACKET 3
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{116A2413-0764-40E8-9CE8-BE1A8BF6ED53}] DATAGRAM 3
**** Blocked Control Panel Items ****
BLOCKED: [ncpa.cpl] No
BLOCKED: [odbccp32.cpl] No
**** Downloaded Program Files ****
{2A32B14F-4D29-4EA3-AC54-E9B19F436CE7} [http://www.windowsecurity.com/trojanscan/TDECntrl.CAB]
{6414512B-B978-451D-A0D8-FCFDF33E833C} [http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1105904013203] C:\WINDOWS\System32\wuweb.dll
{D27CDB6E-AE6D-11CF-96B8-444553540000} [http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab]
**** Custom IE Search Items ****
SEARCH: [SearchAssistant] http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
SEARCH: [CustomizeSearch] http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
stä:
Vaikuttaa ainakin, että koneellasi olisi cws-kaappari, suht uus variantti. Laita Hijack This-logi tänne, niin katsotaan, Ohjeet ja ohjelma tuolta: http://koti.mbnet.fi/pattaya1/hijackthis.htm
Ei kaunista???????????
Logfile of HijackThis v1.99.0
Scan saved at 19:44:42, on 26.1.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\TW-IA3~1\backweb\4436233\Program\SERVIC~1.EXE
C:\Program Files\TW-IA300C ADSL\Anti-Virus\fsgk32st.exe
C:\Program Files\TW-IA300C ADSL\backweb\4436233\program\fsbwsys.exe
C:\Program Files\TW-IA300C ADSL\Anti-Virus\FSGK32.EXE
C:\Program Files\TW-IA300C ADSL\Common\FSMA32.EXE
C:\Program Files\TW-IA300C ADSL\Anti-Virus\fssm32.exe
C:\Program Files\TW-IA300C ADSL\Common\FSMB32.EXE
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TW-IA300C ADSL\Common\FCH32.EXE
C:\Program Files\TW-IA300C ADSL\Common\FAMEH32.EXE
C:\Program Files\TW-IA300C ADSL\FSPC\fspc.exe
C:\Program Files\TW-IA300C ADSL\Anti-Virus\fsav32.exe
C:\Program Files\TW-IA300C ADSL\FWES\Program\fsdfwd.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\ATI-CPanel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\TW-IA300C ADSL\CnxDslTb.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\TW-IA300C ADSL\Common\FSM32.EXE
C:\Program Files\TW-IA300C ADSL\FSGUI\ispnews.exe
C:\Program Files\TW-IA300C ADSL\FSGUI\fsguiexe.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TW-IA300C ADSL\backweb\4436233\Program\fspex.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\RIIKON~1\LOCALS~1\Temp\Tilapäinen kansio 1 hijackthis[1].zip\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://default.home
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.soneraplaza.fi
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://default.home
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://security.kolla.de/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja Sonera Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.dial.inet.fi:800
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;*.*.fi;*.*.*.fi;
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Popup Blocker - {593FA054-6BFB-4ce5-B87A-0A68DB7C0F08} - C:\WINDOWS\System32\EniroToolbar\PopupBlocker.dll
O2 - BHO: VDOMP Class - {A0ED918D-B8E6-4c3d-BD15-1DB1AE9A5DD3} - C:\WINDOWS\wtlbass32.dll
O3 - Toolbar: Eniro - {A3C4086C-097C-46b0-AFB0-76B5CC294233} - C:\WINDOWS\System32\EniroToolbar\Toolband.dll
O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\\TW-IA300C ADSL\CnxDslTb.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\TW-IA300C ADSL\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\TW-IA300C ADSL\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [News Service] "C:\Program Files\TW-IA300C ADSL\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [AVSCHED32] C:\Program Files\AVPersonal\AVSched32.EXE /min
O4 - HKLM\..\Run: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [CSRSSW] C:\WINDOWS\System32\CSRSSW.EXE
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [CTFMONSS] C:\WINDOWS\System32\CTFMONSS.EXE
O8 - Extra context menu item: Hae Eniron avulla - res://C:\WINDOWS\System32\EniroToolbar\Toolband.dll/MENUSEARCH_FI.HTM
O9 - Extra button: Web-suodatin - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\TW-IA300C ADSL\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\TW-IA300C ADSL\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: Näytä &Web-sivuluettelo... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\TW-IA300C ADSL\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\TW-IA300C ADSL\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: &Keskeytä Web-sivujen suodatus - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\TW-IA300C ADSL\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\TW-IA300C ADSL\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: &Kiellä tämä Web-sivusto - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\TW-IA300C ADSL\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\TW-IA300C ADSL\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: &Salli tämä Web-sivusto - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\TW-IA300C ADSL\FSPC\fspcmsie.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O13 - WWW. Prefix: http://ehttp.cc/?
O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
O16 - DPF: {2A32B14F-4D29-4EA3-AC54-E9B19F436CE7} (Scanner Class) - http://www.windowsecurity.com/trojanscan/TDECntrl.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1105904013203
O23 - Service: Sonera Tietoturva - Unknown - C:\PROGRA~1\TW-IA3~1\backweb\4436233\Program\SERVIC~1.EXE
O23 - Service: Loogisen levyn hallinnan valvontapalvelu - Unknown - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Tapahtumaloki - Unknown - C:\WINDOWS\system32\services.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - Unknown - C:\Program Files\TW-IA300C ADSL\Anti-Virus\fsgk32st.exe
O23 - Service: Fax - Unknown - C:\WINDOWS\system32\fxssvc.exe
O23 - Service: fsbwsys - Unknown - C:\Program Files\TW-IA300C ADSL\backweb\4436233\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon - F-Secure Corporation - C:\Program Files\TW-IA300C ADSL\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure HTTP Server - F-Secure Corporation - C:\Program Files\TW-IA300C ADSL\FSPC\fshttps\fshttps.exe
O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\TW-IA300C ADSL\Common\FSMA32.EXE
O23 - Service: CD-levyjen kirjoittamisen IMAPI COM -palvelu - Unknown - C:\WINDOWS\System32\imapi.exe
O23 - Service: NetMeeting etätyöpöydän jakaminen - Unknown - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: Plug and Play - Unknown - C:\WINDOWS\system32\services.exe
O23 - Service: Etätyöpöydän ohjeen istunnonhallinta - Unknown - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Älykortti - Unknown - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: SmartLinkService - Unknown - slserv.exe (file missing)
O23 - Service: Resurssilokit ja -hälytykset - Unknown - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Aseman tilannevedos - Unknown - C:\WINDOWS\System32\vssvc.exe
O23 - Service: WMI resurssisovitin - Unknown - C:\WINDOWS\System32\wbem\wmiapsrv.exe
sulje selain ja muut ikkunat
sekä FIX:saa nämä
O2 - BHO: VDOMP Class - {A0ED918D-B8E6-4c3d-BD15-1DB1AE9A5DD3} - C:\WINDOWS\wtlbass32.dll
O4 - HKCU\..\Run: [CSRSSW] C:\WINDOWS\System32\CSRSSW.EXE
O4 - HKCU\..\Run: [CTFMONSS] C:\WINDOWS\System32\CTFMONSS.EXE
O13 - WWW. Prefix: http://ehttp.cc/?
Boottaa kone ja poista nämä tiedostot (EI kansioita)
piilotiedostot näkyviin, jos ei muuten löydy
tuosta ohje http://www.xtra.co.nz/help/0,,4155-1916458,00.html
C:\WINDOWS\wtlbass32.dll
C:\WINDOWS\System32\CSRSSW.EXE
C:\WINDOWS\System32\CTFMONSS.EXE
uusi logi
Operaatio vaatii monta toimenpidettä. Lataa ensiksi Cwshredder ja Killbox; linkit: http://cwshredder.net/bin/CWShredder.exe
http://www.downloads.subratam.org/KillBox.exe
Asenna ne koneelle.
Laita piilotiedostot näkyviin, Ohje:
http://www.xtra.co.nz/help/0,,4155-1916458,00.html
Jos sulla on tulostin, niin tulosta nämä ohjeet tästä eteenpäin, koska joudut sammuttamaan selaimen ja muut ohjelmat nyt.
Käynnistä Killbox.
Laita merkki ympyrään "delete on reboot"
Kirjoita tai kopioi seuraava rivi ruutuun:
C:\WINDOWS\System32\CSRSSW.EXE
Paina nappia hiirellä jossa on punainen ympyrä ja siinä ruksi.
Vastaa "no" Kysymykseen "reboot".
Laita merkki taas "delete on reboot" ympyrään.
JA ruutuun sitten seuraava rivi:
C:\WINDOWS\System32\CTFMONSS.EXE
Paina nappia hiirellä jossa on punainen ympyrä ja siinä ruksi.
Vastaa "no" Kysymykseen "reboot".
Laita merkki taas "delete on reboot" ympyrään.
Ja ruutuun rivi:
C:\WINDOWS\wtlbass32.dll
Paina nappia hiirellä jossa on punainen ympyrä ja siinä ruksi.
Vastaa "Yes" Kysymykseen "reboot".
Koneen käynnistyttyä käynnistä Cwshredder ja paina nappia: "FIX".
Käynnistä Hijack This ja scanna sillä.
Ruksaa seuraavat jos löytyy:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://default.home
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://default.home
O2 - BHO: VDOMP Class - {A0ED918D-B8E6-4c3d-BD15-1DB1AE9A5DD3} - C:\WINDOWS\wtlbass32.dll
O4 - HKCU\..\Run: [CSRSSW] C:\WINDOWS\System32\CSRSSW.EXE
O4 - HKCU\..\Run: [CTFMONSS] C:\WINDOWS\System32\CTFMONSS.EXE
O13 - WWW. Prefix: http://ehttp.cc/?
Sammuta muut ohjelmat paitsi HJT ja paina Fix Checked
Boottaa kone ja lähetä uusi logi.
Jotain tässä:Logfile of HijackThis v1.99.0
Scan saved at 22:26:14, on 26.1.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\TW-IA3~1\backweb\4436233\Program\SERVIC~1.EXE
C:\Program Files\TW-IA300C ADSL\Anti-Virus\fsgk32st.exe
C:\Program Files\TW-IA300C ADSL\backweb\4436233\program\fsbwsys.exe
C:\Program Files\TW-IA300C ADSL\Anti-Virus\FSGK32.EXE
C:\Program Files\TW-IA300C ADSL\Common\FSMA32.EXE
C:\Program Files\TW-IA300C ADSL\Anti-Virus\fssm32.exe
C:\Program Files\TW-IA300C ADSL\Common\FSMB32.EXE
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TW-IA300C ADSL\Common\FCH32.EXE
C:\Program Files\TW-IA300C ADSL\Common\FAMEH32.EXE
C:\Program Files\TW-IA300C ADSL\FSPC\fspc.exe
C:\Program Files\TW-IA300C ADSL\Anti-Virus\fsav32.exe
C:\Program Files\TW-IA300C ADSL\FWES\Program\fsdfwd.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\ATI-CPanel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\TW-IA300C ADSL\CnxDslTb.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\TW-IA300C ADSL\Common\FSM32.EXE
C:\Program Files\TW-IA300C ADSL\FSGUI\ispnews.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\TW-IA300C ADSL\FSGUI\fsguiexe.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\TW-IA300C ADSL\backweb\4436233\Program\fspex.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\RIIKON~1\LOCALS~1\Temp\Tilapäinen kansio 2 hijackthis[1].zip\HijackThis.exe
C:\DOCUME~1\RIIKON~1\LOCALS~1\Temp\Tilapäinen kansio 4 hijackthis[1].zip\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://default.home/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.soneraplaza.fi
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://default.home
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://security.kolla.de/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja Sonera Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.dial.inet.fi:800
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;*.*.fi;*.*.*.fi;
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Popup Blocker - {593FA054-6BFB-4ce5-B87A-0A68DB7C0F08} - C:\WINDOWS\System32\EniroToolbar\PopupBlocker.dll
O3 - Toolbar: Eniro - {A3C4086C-097C-46b0-AFB0-76B5CC294233} - C:\WINDOWS\System32\EniroToolbar\Toolband.dll
O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\\TW-IA300C ADSL\CnxDslTb.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\TW-IA300C ADSL\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\TW-IA300C ADSL\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [News Service] "C:\Program Files\TW-IA300C ADSL\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [AVSCHED32] C:\Program Files\AVPersonal\AVSched32.EXE /min
O4 - HKLM\..\Run: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [CSRSSW] C:\WINDOWS\System32\CSRSSW.EXE
O4 - HKCU\..\Run: [CTFMONSS] C:\WINDOWS\System32\CTFMONSS.EXE
O8 - Extra context menu item: Hae Eniron avulla - res://C:\WINDOWS\System32\EniroToolbar\Toolband.dll/MENUSEARCH_FI.HTM
O9 - Extra button: Web-suodatin - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\TW-IA300C ADSL\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\TW-IA300C ADSL\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: Näytä &Web-sivuluettelo... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\TW-IA300C ADSL\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\TW-IA300C ADSL\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: &Keskeytä Web-sivujen suodatus - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\TW-IA300C ADSL\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\TW-IA300C ADSL\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: &Kiellä tämä Web-sivusto - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\TW-IA300C ADSL\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\TW-IA300C ADSL\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: &Salli tämä Web-sivusto - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\TW-IA300C ADSL\FSPC\fspcmsie.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
O16 - DPF: {2A32B14F-4D29-4EA3-AC54-E9B19F436CE7} (Scanner Class) - http://www.windowsecurity.com/trojanscan/TDECntrl.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1105904013203
O23 - Service: Sonera Tietoturva - Unknown - C:\PROGRA~1\TW-IA3~1\backweb\4436233\Program\SERVIC~1.EXE
O23 - Service: Loogisen levyn hallinnan valvontapalvelu - Unknown - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Tapahtumaloki - Unknown - C:\WINDOWS\system32\services.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - Unknown - C:\Program Files\TW-IA300C ADSL\Anti-Virus\fsgk32st.exe
O23 - Service: Fax - Unknown - C:\WINDOWS\system32\fxssvc.exe
O23 - Service: fsbwsys - Unknown - C:\Program Files\TW-IA300C ADSL\backweb\4436233\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon - F-Secure Corporation - C:\Program Files\TW-IA300C ADSL\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure HTTP Server - F-Secure Corporation - C:\Program Files\TW-IA300C ADSL\FSPC\fshttps\fshttps.exe
O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\TW-IA300C ADSL\Common\FSMA32.EXE
O23 - Service: CD-levyjen kirjoittamisen IMAPI COM -palvelu - Unknown - C:\WINDOWS\System32\imapi.exe
O23 - Service: NetMeeting etätyöpöydän jakaminen - Unknown - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: Plug and Play - Unknown - C:\WINDOWS\system32\services.exe
O23 - Service: Etätyöpöydän ohjeen istunnonhallinta - Unknown - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Älykortti - Unknown - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: SmartLinkService - Unknown - slserv.exe (file missing)
O23 - Service: Resurssilokit ja -hälytykset - Unknown - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Aseman tilannevedos - Unknown - C:\WINDOWS\System32\vssvc.exe
O23 - Service: WMI resurssisovitin - Unknown - C:\WINDOWS\System32\wbem\wmiapsrv.exe
vielä
eli FIX:saa
O4 - HKCU\..\Run: [CSRSSW] C:\WINDOWS\System32\CSRSSW.EXE
O4 - HKCU\..\Run: [CTFMONSS] C:\WINDOWS\System32\CTFMONSS.EXE
boottaa ja poista nuo tiedostot
CSRSSW.EXE
CTFMONSS.EXE
meni pieleen, sillä kaksi kolmesta on jäljellä:
Ensiksi Tee c:/ juureen oma hakemisto Hijack This:lle ja siirrä Hijackthis.exe sinne;
Esim. C:/HJT/Hijackthis.exe
Ja nuolle kahdelle: Toista Killbox:lla sama kierros
C:\WINDOWS\System32\CSRSSW.EXE
C:\WINDOWS\System32\CTFMONSS.EXE
Sitte bootin jälkeen Cwshredder Fix:aus
Ja scannaus HJT:llä
Ruksaa seuraavat:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://default.home/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://default.home
O4 - HKCU\..\Run: [CSRSSW] C:\WINDOWS\System32\CSRSSW.EXE
O4 - HKCU\..\Run: [CTFMONSS] C:\WINDOWS\System32\CTFMONSS.EXE
Käynnistä kone vikasietotilaan.
Etsi ja poista jos löytyy, (Piilotiedostot näkyvillä)
C:\WINDOWS\wtlbass32.dll
Ei vanha oikein osaa, mutta tässä tuotosta kehiin:
Logfile of HijackThis v1.99.0
Scan saved at 15:57:12, on 27.1.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\TW-IA3~1\backweb\4436233\Program\SERVIC~1.EXE
C:\Program Files\TW-IA300C ADSL\Anti-Virus\fsgk32st.exe
C:\Program Files\TW-IA300C ADSL\backweb\4436233\program\fsbwsys.exe
C:\Program Files\TW-IA300C ADSL\Anti-Virus\FSGK32.EXE
C:\Program Files\TW-IA300C ADSL\Common\FSMA32.EXE
C:\Program Files\TW-IA300C ADSL\Anti-Virus\fssm32.exe
C:\Program Files\TW-IA300C ADSL\Common\FSMB32.EXE
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TW-IA300C ADSL\Common\FCH32.EXE
C:\Program Files\TW-IA300C ADSL\Common\FAMEH32.EXE
C:\Program Files\TW-IA300C ADSL\FSPC\fspc.exe
C:\Program Files\TW-IA300C ADSL\Anti-Virus\fsav32.exe
C:\Program Files\TW-IA300C ADSL\FWES\Program\fsdfwd.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\ATI-CPanel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\TW-IA300C ADSL\CnxDslTb.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\TW-IA300C ADSL\Common\FSM32.EXE
C:\Program Files\TW-IA300C ADSL\FSGUI\ispnews.exe
C:\Program Files\TW-IA300C ADSL\FSGUI\fsguiexe.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\TW-IA300C ADSL\backweb\4436233\Program\fspex.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Riikonen juha\Local Settings\Temporary Internet Files\Content.IE5\0DINKTEZ\HijackThis[1].exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://default.home/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.soneraplaza.fi
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://default.home
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://security.kolla.de/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja Sonera Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.dial.inet.fi:800
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;*.*.fi;*.*.*.fi;
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Popup Blocker - {593FA054-6BFB-4ce5-B87A-0A68DB7C0F08} - C:\WINDOWS\System32\EniroToolbar\PopupBlocker.dll
O3 - Toolbar: Eniro - {A3C4086C-097C-46b0-AFB0-76B5CC294233} - C:\WINDOWS\System32\EniroToolbar\Toolband.dll
O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\\TW-IA300C ADSL\CnxDslTb.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\TW-IA300C ADSL\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\TW-IA300C ADSL\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [News Service] "C:\Program Files\TW-IA300C ADSL\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [AVSCHED32] C:\Program Files\AVPersonal\AVSched32.EXE /min
O4 - HKLM\..\Run: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [CSRSSW] C:\WINDOWS\System32\CSRSSW.EXE
O4 - HKCU\..\Run: [CTFMONSS] C:\WINDOWS\System32\CTFMONSS.EXE
O8 - Extra context menu item: Hae Eniron avulla - res://C:\WINDOWS\System32\EniroToolbar\Toolband.dll/MENUSEARCH_FI.HTM
O9 - Extra button: Web-suodatin - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\TW-IA300C ADSL\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\TW-IA300C ADSL\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: Näytä &Web-sivuluettelo... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\TW-IA300C ADSL\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\TW-IA300C ADSL\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: &Keskeytä Web-sivujen suodatus - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\TW-IA300C ADSL\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\TW-IA300C ADSL\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: &Kiellä tämä Web-sivusto - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\TW-IA300C ADSL\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\TW-IA300C ADSL\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: &Salli tämä Web-sivusto - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\TW-IA300C ADSL\FSPC\fspcmsie.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
O16 - DPF: {2A32B14F-4D29-4EA3-AC54-E9B19F436CE7} (Scanner Class) - http://www.windowsecurity.com/trojanscan/TDECntrl.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1105904013203
O23 - Service: Sonera Tietoturva - Unknown - C:\PROGRA~1\TW-IA3~1\backweb\4436233\Program\SERVIC~1.EXE
O23 - Service: Loogisen levyn hallinnan valvontapalvelu - Unknown - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Tapahtumaloki - Unknown - C:\WINDOWS\system32\services.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - Unknown - C:\Program Files\TW-IA300C ADSL\Anti-Virus\fsgk32st.exe
O23 - Service: Fax - Unknown - C:\WINDOWS\system32\fxssvc.exe
O23 - Service: fsbwsys - Unknown - C:\Program Files\TW-IA300C ADSL\backweb\4436233\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon - F-Secure Corporation - C:\Program Files\TW-IA300C ADSL\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure HTTP Server - F-Secure Corporation - C:\Program Files\TW-IA300C ADSL\FSPC\fshttps\fshttps.exe
O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\TW-IA300C ADSL\Common\FSMA32.EXE
O23 - Service: CD-levyjen kirjoittamisen IMAPI COM -palvelu - Unknown - C:\WINDOWS\System32\imapi.exe
O23 - Service: NetMeeting etätyöpöydän jakaminen - Unknown - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: Plug and Play - Unknown - C:\WINDOWS\system32\services.exe
O23 - Service: Etätyöpöydän ohjeen istunnonhallinta - Unknown - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Älykortti - Unknown - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: SmartLinkService - Unknown - slserv.exe (file missing)
O23 - Service: Resurssilokit ja -hälytykset - Unknown - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Aseman tilannevedos - Unknown - C:\WINDOWS\System32\vssvc.exe
O23 - Service: WMI resurssisovitin - Unknown - C:\WINDOWS\System32\wbem\wmiapsrv.exe
kerro vähä kumpiako ohjeita noudatit? Ja kuinka onnistui?
Ja kerro mitä ongelmia koneessa esiintyy?
Nuo kaksi sielä näkyy olevan edelleen:
O4 - HKCU\..\Run: [CSRSSW] C:\WINDOWS\System32\CSRSSW.EXE
O4 - HKCU\..\Run: [CTFMONSS] C:\WINDOWS\System32\CTFMONSS.EXE
olla palautus kansiossa piilossa !!!
ENSIMMÄISENÄ poista järjestelmän palautus käytöstä ja
FIX:saa nuo
O4 - HKCU\..\Run: [CSRSSW] C:\WINDOWS\System32\CSRSSW.EXE
O4 - HKCU\..\Run: [CTFMONSS] C:\WINDOWS\System32\CTFMONSS.EXE
Käynnistä vikasietotilaan ja poista nämä tiedostot
CSRSSW.EXE ( kansiota ei poisteta )
CTFMONSS.EXE
Bottaa normaalitilaan ja ota uusi logi
Katso ovatko nuo tiedostot vielä logissa, jos eivät ole niin järjestelmän palautus päälle. Muussa tapauksessa vielä FIX:saat KO.kohdat uudelleen ja poistat ne tiedostot vikasietotilassa
HUOM: piilotiedostot näkyviin !!!! niin löydät ne paremmin
ohjeitasi. Kone toimii jotenkuten, mutta kotisivu ei vieläkään toimi moitteettomasti "blancia" tulee avauksessa Spybot "löytää" ja "poistaa", tulee takaisin,kuin Kankkunen lepikosta. Ongelma meinaan. Tyhmiä taasen kyselen, miten päästä vikasietotilaan, helposti?
, kun käynnistät uudelleen.....paina F8 nappia
lataa vielä tuo ohjelma ja scannaa sillä koneesi
http://www.spychecker.com/program/counterspy.html
Sammuta kone.
Käynnistä uudelleen ja näpyttele F8:ia kun kone alkaa käynnistymään.
Ennen kuin meet vikasietotilaan niin laita järjestelmän palautus pois päältä; ohje:
http://support.f-secure.fi/fin/home/virusproblem/howtoclean/cleansystemrestore.shtml
Suorita Hijack this scannaus vikasietotilassa ja Ruksaa ja Fixaa seuraavat:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://default.home/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://default.home
O4 - HKCU\..\Run: [CSRSSW] C:\WINDOWS\System32\CSRSSW.EXE
O4 - HKCU\..\Run: [CTFMONSS] C:\WINDOWS\System32\CTFMONSS.EXE
Sitten etsi ja poista nuo kaksi
C:\WINDOWS\System32\CSRSSW.EXE
C:\WINDOWS\System32\CTFMONSS.EXE