Voisko joku tsekata tämän, olen juoksuttanut virusohjelmat ja ad-awaret mutta aina vaan exploreri muuttaa kotisivua
Logfile of HijackThis v1.99.0
Scan saved at 18:40:08, on 20.3.2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
D:\WINNT\System32\smss.exe
D:\WINNT\system32\winlogon.exe
D:\WINNT\system32\services.exe
D:\WINNT\system32\lsass.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\system32\spoolsv.exe
D:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
D:\WINNT\System32\svchost.exe
D:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
D:\Program Files\Sonera Tietoturva\Anti-Virus\FSGK32.EXE
D:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
D:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
D:\Program Files\Sonera Tietoturva\Anti-Virus\fssm32.exe
D:\Program Files\Sonera Tietoturva\Common\FSMB32.EXE
D:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe
D:\Program Files\Sonera Tietoturva\Common\FCH32.EXE
D:\WINNT\system32\regsvc.exe
D:\WINNT\System32\WBEM\WinMgmt.exe
D:\WINNT\system32\svchost.exe
D:\Program Files\Sonera Tietoturva\Common\FAMEH32.EXE
D:\WINNT\Explorer.EXE
D:\Program Files\Sonera Tietoturva\Anti-Virus\fsav32.exe
D:\Program Files\Sonera Tietoturva\Common\FSM32.EXE
D:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe
D:\Program Files\Microsoft AntiSpyware\gcasServ.exe
D:\WINNT\system32\internat.exe
D:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
D:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
D:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
D:\Program Files\Sonera Tietoturva\FSGUI\fsguiexe.exe
D:\PROGRA~1\EFFICI~1\ENTERN~1\app\EnterNet.exe
D:\Documents and Settings\Järjestelmänvalvoja\Omat tiedostot\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.uuaskmewzcjyzcotizzsw.com/wCV60han03Co7nT/kFHUAjlzsNOp/4kBFDGq9CNrORZHkOlKGwO_MQVO_sr3Fzq3.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.soneraplaza.fi
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - D:\Program Files\ICQToolbar\toolbaru.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - D:\Program Files\ICQToolbar\toolbaru.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [F-Secure Manager] "D:\Program Files\Sonera Tietoturva\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "D:\Program Files\Sonera Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [News Service] "D:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [gcasServ] "D:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [internat.exe] internat.exe
O8 - Extra context menu item: &ICQ Toolbar Search - res://D:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Program Files\ICQLite\ICQLite.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O23 - Service: Hälytys - Unknown - D:\WINNT\System32\services.exe
O23 - Service: Sovellusten hallinta - Unknown - D:\WINNT\system32\services.exe
O23 - Service: Sonera Tietoturva - Unknown - D:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
O23 - Service: Tietokoneiden selaus - Unknown - D:\WINNT\System32\services.exe
O23 - Service: DHCP-asiakas - Unknown - D:\WINNT\System32\services.exe
O23 - Service: Loogisen levyn hallinnan valvontapalvelu - Unknown - D:\WINNT\System32\dmadmin.exe
O23 - Service: Loogisen levyn hallinta - Unknown - D:\WINNT\System32\services.exe
O23 - Service: DNS-asiakas - Unknown - D:\WINNT\System32\services.exe
O23 - Service: Tapahtumaloki - Unknown - D:\WINNT\system32\services.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - Unknown - D:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
O23 - Service: Faksipalvelu - Unknown - D:\WINNT\system32\faxsvc.exe
O23 - Service: fsbwsys - Unknown - D:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon - F-Secure Corporation - D:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent - F-Secure Corporation - D:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
O23 - Service: Palvelin - Unknown - D:\WINNT\System32\services.exe
O23 - Service: Työasema - Unknown - D:\WINNT\System32\services.exe
O23 - Service: TCP/IP NetBIOS Helper -palvelu - Unknown - D:\WINNT\System32\services.exe
O23 - Service: Viestinvälitys - Unknown - D:\WINNT\System32\services.exe
O23 - Service: NetMeeting etätyöpöydän jakaminen - Unknown - D:\WINNT\System32\mnmsrvc.exe
O23 - Service: Verkon DDE - Unknown - D:\WINNT\system32\netdde.exe
O23 - Service: Verkon DDE DSDM - Unknown - D:\WINNT\system32\netdde.exe
O23 - Service: Verkkokirjautuminen - Unknown - D:\WINNT\System32\lsass.exe
O23 - Service: NT LM -suojaustuen toimittaja - Unknown - D:\WINNT\System32\lsass.exe
O23 - Service: Plug and Play - Unknown - D:\WINNT\system32\services.exe
O23 - Service: IP-suojauskäytäntöagentti - Unknown - D:\WINNT\System32\lsass.exe
O23 - Service: PPPoE Service - Unknown - D:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe
O23 - Service: Suojattu tallennuspaikka - Unknown - D:\WINNT\system32\services.exe
O23 - Service: Käyttöoikeustilien hallinta - Unknown - D:\WINNT\system32\lsass.exe
O23 - Service: Älykortti-apuohjelma - Unknown - D:\WINNT\System32\SCardSvr.exe
O23 - Service: Älykortti - Unknown - D:\WINNT\System32\SCardSvr.exe
O23 - Service: Tehtävien ajoitus - Unknown - D:\WINNT\system32\MSTask.exe
O23 - Service: RunAs-palvelu - Unknown - D:\WINNT\system32\services.exe
O23 - Service: Resurssilokit ja -hälytykset - Unknown - D:\WINNT\system32\smlogsvc.exe
O23 - Service: Telnet - Unknown - D:\WINNT\system32\tlntsvr.exe
O23 - Service: Tiedostolinkkijäljityksen asiakas - Unknown - D:\WINNT\system32\services.exe
O23 - Service: Toimintojen hallinta - Unknown - D:\WINNT\System32\UtilMan.exe
O23 - Service: Windows Time - Unknown - D:\WINNT\System32\services.exe
O23 - Service: WMI-palvelu (Windows Management Instrumentation) - Unknown - D:\WINNT\System32\WBEM\WinMgmt.exe
O23 - Service: WM -instrumenttien ohjainlaajennukset - Unknown - D:\WINNT\system32\Services.exe
Logfile of HijackThis v1.99.0
Scan saved at 18:40:08, on 20.3.2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
D:\WINNT\System32\smss.exe
D:\WINNT\system32\winlogon.exe
D:\WINNT\system32\services.exe
D:\WINNT\system32\lsass.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\system32\spoolsv.exe
D:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
D:\WINNT\System32\svchost.exe
D:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
D:\Program Files\Sonera Tietoturva\Anti-Virus\FSGK32.EXE
D:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
D:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
D:\Program Files\Sonera Tietoturva\Anti-Virus\fssm32.exe
D:\Program Files\Sonera Tietoturva\Common\FSMB32.EXE
D:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe
D:\Program Files\Sonera Tietoturva\Common\FCH32.EXE
D:\WINNT\system32\regsvc.exe
D:\WINNT\System32\WBEM\WinMgmt.exe
D:\WINNT\system32\svchost.exe
D:\Program Files\Sonera Tietoturva\Common\FAMEH32.EXE
D:\WINNT\Explorer.EXE
D:\Program Files\Sonera Tietoturva\Anti-Virus\fsav32.exe
D:\Program Files\Sonera Tietoturva\Common\FSM32.EXE
D:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe
D:\Program Files\Microsoft AntiSpyware\gcasServ.exe
D:\WINNT\system32\internat.exe
D:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
D:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
D:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
D:\Program Files\Sonera Tietoturva\FSGUI\fsguiexe.exe
D:\PROGRA~1\EFFICI~1\ENTERN~1\app\EnterNet.exe
D:\Documents and Settings\Järjestelmänvalvoja\Omat tiedostot\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.uuaskmewzcjyzcotizzsw.com/wCV60han03Co7nT/kFHUAjlzsNOp/4kBFDGq9CNrORZHkOlKGwO_MQVO_sr3Fzq3.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.soneraplaza.fi
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - D:\Program Files\ICQToolbar\toolbaru.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - D:\Program Files\ICQToolbar\toolbaru.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [F-Secure Manager] "D:\Program Files\Sonera Tietoturva\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "D:\Program Files\Sonera Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [News Service] "D:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [gcasServ] "D:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [internat.exe] internat.exe
O8 - Extra context menu item: &ICQ Toolbar Search - res://D:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Program Files\ICQLite\ICQLite.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O23 - Service: Hälytys - Unknown - D:\WINNT\System32\services.exe
O23 - Service: Sovellusten hallinta - Unknown - D:\WINNT\system32\services.exe
O23 - Service: Sonera Tietoturva - Unknown - D:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
O23 - Service: Tietokoneiden selaus - Unknown - D:\WINNT\System32\services.exe
O23 - Service: DHCP-asiakas - Unknown - D:\WINNT\System32\services.exe
O23 - Service: Loogisen levyn hallinnan valvontapalvelu - Unknown - D:\WINNT\System32\dmadmin.exe
O23 - Service: Loogisen levyn hallinta - Unknown - D:\WINNT\System32\services.exe
O23 - Service: DNS-asiakas - Unknown - D:\WINNT\System32\services.exe
O23 - Service: Tapahtumaloki - Unknown - D:\WINNT\system32\services.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - Unknown - D:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
O23 - Service: Faksipalvelu - Unknown - D:\WINNT\system32\faxsvc.exe
O23 - Service: fsbwsys - Unknown - D:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon - F-Secure Corporation - D:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent - F-Secure Corporation - D:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
O23 - Service: Palvelin - Unknown - D:\WINNT\System32\services.exe
O23 - Service: Työasema - Unknown - D:\WINNT\System32\services.exe
O23 - Service: TCP/IP NetBIOS Helper -palvelu - Unknown - D:\WINNT\System32\services.exe
O23 - Service: Viestinvälitys - Unknown - D:\WINNT\System32\services.exe
O23 - Service: NetMeeting etätyöpöydän jakaminen - Unknown - D:\WINNT\System32\mnmsrvc.exe
O23 - Service: Verkon DDE - Unknown - D:\WINNT\system32\netdde.exe
O23 - Service: Verkon DDE DSDM - Unknown - D:\WINNT\system32\netdde.exe
O23 - Service: Verkkokirjautuminen - Unknown - D:\WINNT\System32\lsass.exe
O23 - Service: NT LM -suojaustuen toimittaja - Unknown - D:\WINNT\System32\lsass.exe
O23 - Service: Plug and Play - Unknown - D:\WINNT\system32\services.exe
O23 - Service: IP-suojauskäytäntöagentti - Unknown - D:\WINNT\System32\lsass.exe
O23 - Service: PPPoE Service - Unknown - D:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe
O23 - Service: Suojattu tallennuspaikka - Unknown - D:\WINNT\system32\services.exe
O23 - Service: Käyttöoikeustilien hallinta - Unknown - D:\WINNT\system32\lsass.exe
O23 - Service: Älykortti-apuohjelma - Unknown - D:\WINNT\System32\SCardSvr.exe
O23 - Service: Älykortti - Unknown - D:\WINNT\System32\SCardSvr.exe
O23 - Service: Tehtävien ajoitus - Unknown - D:\WINNT\system32\MSTask.exe
O23 - Service: RunAs-palvelu - Unknown - D:\WINNT\system32\services.exe
O23 - Service: Resurssilokit ja -hälytykset - Unknown - D:\WINNT\system32\smlogsvc.exe
O23 - Service: Telnet - Unknown - D:\WINNT\system32\tlntsvr.exe
O23 - Service: Tiedostolinkkijäljityksen asiakas - Unknown - D:\WINNT\system32\services.exe
O23 - Service: Toimintojen hallinta - Unknown - D:\WINNT\System32\UtilMan.exe
O23 - Service: Windows Time - Unknown - D:\WINNT\System32\services.exe
O23 - Service: WMI-palvelu (Windows Management Instrumentation) - Unknown - D:\WINNT\System32\WBEM\WinMgmt.exe
O23 - Service: WM -instrumenttien ohjainlaajennukset - Unknown - D:\WINNT\system32\Services.exe
Vastaukset 8
Vanhimmat
Siirrä se Hijackki omaan kansioon tonne
C:\HjT\HijackThis.exe
Merkkaa ja Fix:saa
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.uuaskmewzcjyzcotizzsw.com/wCV60han03Co7nT/kFHUAjlzsNOp/4kBFDGq9CNrORZHkOlKGwO
Käynnistä sitte kone uudestaan ja uus logi tolla versiolla
http://koti.mbnet.fi/pattaya1/HijackThis.exe
Tässäpä uusi logi, toivottavasti sain tehtyä oikein noi hommat
Logfile of HijackThis v1.99.1
Scan saved at 12:20:46, on 24.3.2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
D:\WINNT\System32\smss.exe
D:\WINNT\system32\winlogon.exe
D:\WINNT\system32\services.exe
D:\WINNT\system32\lsass.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\system32\spoolsv.exe
D:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
D:\WINNT\System32\svchost.exe
D:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
D:\Program Files\Sonera Tietoturva\Anti-Virus\FSGK32.EXE
D:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
D:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
D:\Program Files\Sonera Tietoturva\Anti-Virus\fssm32.exe
D:\Program Files\Sonera Tietoturva\Common\FSMB32.EXE
D:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe
D:\Program Files\Sonera Tietoturva\Common\FCH32.EXE
D:\WINNT\system32\regsvc.exe
D:\WINNT\System32\WBEM\WinMgmt.exe
D:\WINNT\system32\svchost.exe
D:\Program Files\Sonera Tietoturva\Common\FAMEH32.EXE
D:\WINNT\Explorer.EXE
D:\Program Files\Sonera Tietoturva\Anti-Virus\fsav32.exe
D:\Program Files\Sonera Tietoturva\Common\FSM32.EXE
D:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe
D:\Program Files\Microsoft AntiSpyware\gcasServ.exe
D:\WINNT\system32\internat.exe
D:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
D:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
D:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
D:\Program Files\Sonera Tietoturva\FSGUI\fsguiexe.exe
D:\PROGRA~1\EFFICI~1\ENTERN~1\app\EnterNet.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\hjt\HijackThis-4.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.suomi24.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.soneraplaza.fi
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - D:\Program Files\ICQToolbar\toolbaru.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - D:\Program Files\ICQToolbar\toolbaru.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [F-Secure Manager] "D:\Program Files\Sonera Tietoturva\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "D:\Program Files\Sonera Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [News Service] "D:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [gcasServ] "D:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKCU\..\Run: [internat.exe] internat.exe
O8 - Extra context menu item: &ICQ Toolbar Search - res://D:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Program Files\ICQLite\ICQLite.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O23 - Service: Sonera Tietoturva (BackWeb Plug-in - 4436233) - Unknown owner - D:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - VERITAS Software Corp. - D:\WINNT\System32\dmadmin.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - D:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - D:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - D:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - D:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
O23 - Service: PPPoE Service (PPPoEService) - Unknown owner - D:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe
Juoksutin äsken virusohjelman koneesta löytyi neljä troijalaista, ei lähe pois ja juoksutin hijackin niin taas samat örkit kummittelee siellä,vaikka poistaa ne palaa näköjään takas, mitä voin tehdä?
Logfile of HijackThis v1.99.1
Scan saved at 14:01:33, on 24.3.2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
D:\WINNT\System32\smss.exe
D:\WINNT\system32\winlogon.exe
D:\WINNT\system32\services.exe
D:\WINNT\system32\lsass.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\system32\spoolsv.exe
D:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
D:\WINNT\System32\svchost.exe
D:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
D:\Program Files\Sonera Tietoturva\Anti-Virus\FSGK32.EXE
D:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
D:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
D:\Program Files\Sonera Tietoturva\Anti-Virus\fssm32.exe
D:\Program Files\Sonera Tietoturva\Common\FSMB32.EXE
D:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe
D:\Program Files\Sonera Tietoturva\Common\FCH32.EXE
D:\WINNT\system32\regsvc.exe
D:\WINNT\System32\WBEM\WinMgmt.exe
D:\WINNT\system32\svchost.exe
D:\Program Files\Sonera Tietoturva\Common\FAMEH32.EXE
D:\WINNT\Explorer.EXE
D:\Program Files\Sonera Tietoturva\Anti-Virus\fsav32.exe
D:\Program Files\Sonera Tietoturva\Common\FSM32.EXE
D:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe
D:\Program Files\Microsoft AntiSpyware\gcasServ.exe
D:\WINNT\system32\internat.exe
D:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
D:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
D:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
D:\Program Files\Sonera Tietoturva\FSGUI\fsguiexe.exe
D:\PROGRA~1\EFFICI~1\ENTERN~1\app\EnterNet.exe
D:\hjt\HijackThis-4.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.lrgqqquvaslavkfmohqzh.com/wCV60han03Co7nT/kFHUAjlzsNOp/4kBFDGq9CNrORakUVpO1unfxgVO_sr3Fzq3.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mquivvrjfrr.com/wCV60han03C4OA_nV07EBTLQ5xbSbghPHXDFO4D94DU.jsp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.soneraplaza.fi
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.lrgqqquvaslavkfmohqzh.com/wCV60han03Co7nT/kFHUAjlzsNOp/4kBFDGq9CNrORakUVpO1unfxgVO_sr3Fzq3.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mquivvrjfrr.com/wCV60han03C4OA_nV07EBTLQ5xbSbghPHXDFO4D94DU.jsp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - D:\Program Files\ICQToolbar\toolbaru.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - D:\Program Files\ICQToolbar\toolbaru.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [F-Secure Manager] "D:\Program Files\Sonera Tietoturva\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "D:\Program Files\Sonera Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [News Service] "D:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [gcasServ] "D:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKCU\..\Run: [internat.exe] internat.exe
O8 - Extra context menu item: &ICQ Toolbar Search - res://D:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Program Files\ICQLite\ICQLite.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O23 - Service: Sonera Tietoturva (BackWeb Plug-in - 4436233) - Unknown owner - D:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - VERITAS Software Corp. - D:\WINNT\System32\dmadmin.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - D:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - D:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - D:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - D:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
O23 - Service: PPPoE Service (PPPoEService) - Unknown owner - D:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe
> löytyi neljä troijalaista <
Jaa minkä nimisiä ja missä ne on
Merkkaa nuo sulje selain ja muut avoimet ikkunat ja paina Fix checked
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.lrgqqquvaslavkfmohqzh.com/wCV60han03Co7nT/kFHUAjlzsNOp/4kBFDGq9CNrORakUVpO1unfxgVO_sr3Fzq3.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mquivvrjfrr.com/wCV60han03C4OA_nV07EBTLQ5xbSbghPHXDFO4D94DU.jsp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.lrgqqquvaslavkfmohqzh.com/wCV60han03Co7nT/kFHUAjlzsNOp/4kBFDGq9CNrORakUVpO1unfxgVO_sr3Fzq3.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mquivvrjfrr.com/wCV60han03C4OA_nV07EBTLQ5xbSbghPHXDFO4D94DU.jsp
Käynnistä sitte kone uudestaan ja uus logi.
No ei löydy enään täältä vissiin mitään ihmeellistä,explorer ei käynnisty jostain syystä mutta en sitä juuri käytäkkään, aikaisemmin explorerin käytön jälkeen löytyi hijackista niitä ihme juttuja
Logfile of HijackThis v1.99.1
Scan saved at 15:41:12, on 24.3.2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
D:\WINNT\System32\smss.exe
D:\WINNT\system32\winlogon.exe
D:\WINNT\system32\services.exe
D:\WINNT\system32\lsass.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\system32\spoolsv.exe
D:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
D:\WINNT\System32\svchost.exe
D:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
D:\Program Files\Sonera Tietoturva\Anti-Virus\FSGK32.EXE
D:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
D:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
D:\Program Files\Sonera Tietoturva\Anti-Virus\fssm32.exe
D:\Program Files\Sonera Tietoturva\Common\FSMB32.EXE
D:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe
D:\Program Files\Sonera Tietoturva\Common\FCH32.EXE
D:\WINNT\system32\regsvc.exe
D:\WINNT\System32\WBEM\WinMgmt.exe
D:\Program Files\Sonera Tietoturva\Common\FAMEH32.EXE
D:\WINNT\system32\svchost.exe
D:\WINNT\Explorer.EXE
D:\Program Files\Sonera Tietoturva\Anti-Virus\fsav32.exe
D:\Program Files\Sonera Tietoturva\Common\FSM32.EXE
D:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe
D:\Program Files\Microsoft AntiSpyware\gcasServ.exe
D:\WINNT\system32\internat.exe
D:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
D:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
D:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
D:\PROGRA~1\EFFICI~1\ENTERN~1\app\EnterNet.exe
D:\Program Files\Sonera Tietoturva\FSGUI\fsguiexe.exe
D:\hjt\HijackThis-4.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.soneraplaza.fi
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - D:\Program Files\ICQToolbar\toolbaru.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - D:\Program Files\ICQToolbar\toolbaru.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [F-Secure Manager] "D:\Program Files\Sonera Tietoturva\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "D:\Program Files\Sonera Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [News Service] "D:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [gcasServ] "D:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKCU\..\Run: [internat.exe] internat.exe
O8 - Extra context menu item: &ICQ Toolbar Search - res://D:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Program Files\ICQLite\ICQLite.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O23 - Service: Sonera Tietoturva (BackWeb Plug-in - 4436233) - Unknown owner - D:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - VERITAS Software Corp. - D:\WINNT\System32\dmadmin.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - D:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - D:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - D:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - D:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
O23 - Service: PPPoE Service (PPPoEService) - Unknown owner - D:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe
Ny on ok.
kiitoksia paljon, nyt kun vielä saan selvitettyä miksi explorer ei aukea :)
niin saat lukittua kotisivun, poistettua cookiet surffailun jälkeen ja valittua mitä ohjelmia käynnistyksessä lähtee mukaan...
http://www.winpatrol.com