Eli heittelee jotain sivuja auki itsekseen.. Oon koittanu ajaa ad-awaree, spy-bottii, doctorii, e-scannii, mutta ei tottele. Näkeekö joku fiksu logista mikä mättää? Thanks, jos jaksaa jelppaa..
Logfile of HijackThis v1.99.1
Scan saved at 11:54:42, on 20.4.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\system32\abasa5jrp.exe
C:\Program Files\AVPersonal\AVGNT.EXE
c:\windows\system32\nbddlu.exe
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\Program Files\AVPersonal\AVGUARD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Hjt\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://elisa.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://elisa.net/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://elisa.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja Elisa Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;;*.*.fi;*.*.*.fi;;
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: BolgerObj Class - {302A3240-4805-4a34-97D7-1645A0B08410} - C:\WINDOWS\Bolger.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: ohb - {999A06FF-10EF-4A29-8640-69E99882C26B} - C:\WINDOWS\system32\nst107F.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [ieoqmax] c:\windows\system32\ieoqmax.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [abasa5jrp] C:\WINDOWS\system32\abasa5jrp.exe
O4 - HKLM\..\Run: [oiochh] c:\windows\system32\nbddlu.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\Program Files\AVPersonal\AVGNT.EXE /min
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: SMS-viesti - {581C5253-F3FB-4585-AAF0-44ED91B7C9CF} - http://sms.kolumbus.fi/ (file missing) (HKCU)
O9 - Extra button: Tuki - {8B834A9A-61A0-47E0-ADCB-5B4A1D98A383} - http://tuki.elisa.net/ (file missing) (HKCU)
O9 - Extra button: Palvelut - {A081D7A0-C372-48DF-A4F6-050A7493FE0D} - http://service.kolumbus.fi/ (file missing) (HKCU)
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AntiVir Service (AntiVirService) - H BEDV Datentechnik GmbH - C:\Program Files\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\NORMAN\Nvc\BIN\nipsvc.exe (file missing)
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
Logfile of HijackThis v1.99.1
Scan saved at 11:54:42, on 20.4.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\system32\abasa5jrp.exe
C:\Program Files\AVPersonal\AVGNT.EXE
c:\windows\system32\nbddlu.exe
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\Program Files\AVPersonal\AVGUARD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Hjt\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://elisa.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://elisa.net/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://elisa.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja Elisa Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;;*.*.fi;*.*.*.fi;;
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: BolgerObj Class - {302A3240-4805-4a34-97D7-1645A0B08410} - C:\WINDOWS\Bolger.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: ohb - {999A06FF-10EF-4A29-8640-69E99882C26B} - C:\WINDOWS\system32\nst107F.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [ieoqmax] c:\windows\system32\ieoqmax.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [abasa5jrp] C:\WINDOWS\system32\abasa5jrp.exe
O4 - HKLM\..\Run: [oiochh] c:\windows\system32\nbddlu.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\Program Files\AVPersonal\AVGNT.EXE /min
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: SMS-viesti - {581C5253-F3FB-4585-AAF0-44ED91B7C9CF} - http://sms.kolumbus.fi/ (file missing) (HKCU)
O9 - Extra button: Tuki - {8B834A9A-61A0-47E0-ADCB-5B4A1D98A383} - http://tuki.elisa.net/ (file missing) (HKCU)
O9 - Extra button: Palvelut - {A081D7A0-C372-48DF-A4F6-050A7493FE0D} - http://service.kolumbus.fi/ (file missing) (HKCU)
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AntiVir Service (AntiVirService) - H BEDV Datentechnik GmbH - C:\Program Files\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\NORMAN\Nvc\BIN\nipsvc.exe (file missing)
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
Vastaukset 31
Vanhimmat
tiedostot
C:\WINDOWS\Nail.exe
c:\windows\system32\nbddlu.exe
C:\WINDOWS\system32\abasa5jrp.exe
c:\windows\system32\ieoqmax.exe
tuolla
http://virusscan.jotti.org/
ja ilmoita niiden tulos tänne.
tämä
C:\WINDOWS\svcproc.exe
siellä
Tällasta kertoi..
File: Nail.exe
Status: INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database) (Note: only non-destructive malware has been found. Considering the non-destructive nature of samples like these - although they can be a pain -, results will not be stored in the database.)
Packers detected: PE_PATCH, UPX
Scanner results
AntiVir Found nothing
Avast Found Win32:Trojano-1212
AVG Antivirus Found nothing
BitDefender Found Trojan.Dloader.LI
ClamAV Found nothing
Dr.Web Found Trojan.Nail
F-Prot Antivirus Found nothing
Fortinet Found W32/Dloader.LI-tr
Kaspersky Anti-Virus Found not-a-virus:AdWare.BetterInternet
mks_vir Found Win32.4 (probable variant)
NOD32 Found nothing
Norman Virus Control Found nothing
VBA32 Found AdWare.BetterInternet
File: nbddlu.exe
Status: INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)
Packers detected: PE_PATCH, UPX
Scanner results
AntiVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
Fortinet Found W32/Agent.CP-tr
Kaspersky Anti-Virus Found Trojan.Win32.Agent.cp
mks_vir Found Trojan.Agent.Cp
NOD32 Found nothing
Norman Virus Control Found nothing
VBA32 Found Trojan.Win32.Agent.cp
File: abasa5jrp.exe
Status: INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database) (Note: only non-destructive malware has been found. Considering the non-destructive nature of samples like these - although they can be a pain -, results will not be stored in the database.)
Packers detected: -
Scanner results
AntiVir Found nothing
Avast Found Win32:Adan-003
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found Adware.Shopathome
Dr.Web Found not a virus Adware.SAHAgent
F-Prot Antivirus Found W32/Agent.MQ
Fortinet Found Adware/SahaAgent.A
Kaspersky Anti-Virus Found not-a-virus:AdWare.Sahat.o
mks_vir Found .Sahat.O
NOD32 Found nothing
Norman Virus Control Found nothing
VBA32 Found AdWare.Sahat.o
c:\windows\system32\ieoqmax.exe
The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file
File: svcproc.exe
Status: INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)
Packers detected: PE_PATCH, UPX
Scanner results
AntiVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
Dr.Web Found Trojan.DnsChange
F-Prot Antivirus Found nothing
Fortinet Found W32/Stervis.B-tr
Kaspersky Anti-Virus Found Trojan.Win32.Stervis.b
mks_vir Found Trojan.Stervis.B
NOD32 Found nothing
Norman Virus Control Found nothing
VBA32 Found Trojan.Win32.Stervis.b
Tämän variantin kans oon just tapellu yhellä toisella foorumilla ja se oli aika kinkkinen poistaa.
Ota tosta Findit.zip
http://forums.net-integration.net/index.php?act=Attach&type=post&id=142443
Pura se omaan kansioon C:\lle
Sitte aukase se kansio ja tuplaklikkaa find.bat
Anna sen rauhassa scannata ja kopioi tänne se logi joka tulee ulos.
Pistä myös uus Hijack logi ja sen jälkeen ku oot lähettänny ne logit niin älä sammuta tai käynnistä konetta uudestaan enneku tulee lisää ohjeita.
PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
»»»»»»»»»»»»»»»»»»»»»»»» Todo Files found »»»»»»»»»»»»»»»»»»»»»»»»»»»»»
* Todo C:\WINDOWS\System32\YZHZCGV.EXE
»»»»»»»»»»»»»»»»»»»»»»»» aurora Files found »»»»»»»»»»»»»»»»»»»»»»»»»»»
* 1 aurora C:\WINDOWS\YOWZDD.EXE
»»»»»»»»»»»»»»»»»»»»»»»» Suspect's »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Dont delete file's in the section without guidence
Even then back them up first
* UPX! C:\WINDOWS\System32\YZHZCGV.EXE
* UPX! C:\WINDOWS\GTVZQH~1.EXE
* UPX! C:\WINDOWS\NAIL.EXE
* UPX! C:\WINDOWS\SVCPROC.EXE
* Sniffed C:\WINDOWS\System32\DRPMON.DLL
»»»»»»»»»»»»»»»»»»»»»»»» Possible SAHAgent Files found »»»»»»»»»»»»»»»»
* SAHAgent C:\WINDOWS\System32\ABASA5~1.EXE
* SAHAgent C:\WINDOWS\System32\HOCHKA~1.EXE
* SAHAgent C:\WINDOWS\System32\Q17I9A4J.EXE
* SAHAgent C:\WINDOWS\U6F6UF~1.EXE
* SAHAgent C:\WINDOWS\System32\70TOVMTO.INI
* SAHAgent C:\WINDOWS\System32\A95KFRHE.INI
* SAHAgent C:\WINDOWS\System32\ABASA5~1.INI
* SAHAgent C:\WINDOWS\System32\AP9H4QMO.INI
* SAHAgent C:\WINDOWS\System32\BLN02NQV.INI
* SAHAgent C:\WINDOWS\System32\GAH95ON6.INI
* SAHAgent C:\WINDOWS\System32\HOCHKA~1.INI
* SAHAgent C:\WINDOWS\System32\Q17I9A4J.INI
* SAHAgent C:\WINDOWS\System32\U6F6UF~1.INI
»»»»»»»»»»»»»»»»»»»»»»»» Misc checks »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
* _rtneg3 C:\WINDOWS\System32\NST107F.DLL
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
* buddy C:\WINDOWS\GTVZQH~1.EXE
Aseman C nimi on 51_38_08
Aseman sarjanumero on 580A-16E4
Kansio C:\WINDOWS\system32
22.03.2005 20:26 2ÿ998 bball.ico
20.04.2005 14:01 3ÿ262 bingo_big2.ico
17.03.2005 11:29 3ÿ262 conver radio 32x32-21.ico
19.10.2004 13:15 3ÿ262 creditcard21.ico
20.04.2005 14:01 3ÿ262 dice21.ico
27.03.2005 18:05 3ÿ262 eye41.ico
15.05.2001 17:14 2ÿ238 FSCICON.ICO
20.04.2005 14:01 4ÿ286 greenmovie2313asaadsasfad.ico
12.04.2005 11:47 4ÿ286 greenmovie2313asaadsasfad112341231adsfa.ico
15.03.2005 20:17 2ÿ526 ibm laptop3.ico
01.04.2005 11:31 2ÿ526 ibm laptop31.ico
24.03.2005 20:18 3ÿ262 kas pink1233a1.ico
20.04.2005 14:02 3ÿ262 kas pink1233aadsfa1.ico
20.04.2005 09:56 3ÿ262 kas pink1233aadsfa12.ico
16.03.2005 19:31 3ÿ262 kas4c1.ico
18.03.2005 23:59 4ÿ286 kill all spywareadsfadsf1.ico
27.03.2005 18:05 4ÿ286 moviescirc2.ico
27.03.2005 18:05 4ÿ286 mp3 players4salea.ico
20.04.2005 09:56 4ÿ286 mp3red51aads.ico
20.04.2005 14:01 4ÿ286 mp3red51aads1.ico
13.03.2005 19:53 4ÿ286 pop up blaster.ico
03.04.2005 21:28 4ÿ286 pop up blaster1232131.ico
20.04.2005 14:01 3ÿ262 popupkiller2asdf1.ico
03.04.2005 21:28 2ÿ238 red_kas1.ico
20.04.2005 14:01 3ÿ262 vh e2331.ico
26.03.2005 22:23 19ÿ942 virus hunter yeah1.ico
26 tiedosto(a) 106ÿ924 tavua
0 kansio(ta) 10ÿ667ÿ556ÿ864 tavua vapaana
svcproc.exe
Nail.exe
DrPMon.dll
Aseman C nimi on 51_38_08
Aseman sarjanumero on 580A-16E4
Kansio C:\WINDOWS\SYSTEM32
20.04.2005 09:56 cache32_rtneg2
20.04.2005 13:02 cache32_rtneg3
0 tiedosto(a) 0 tavua
2 kansio(ta) 10ÿ667ÿ556ÿ864 tavua vapaana
Aseman C nimi on 51_38_08
Aseman sarjanumero on 580A-16E4
Kansio C:\WINDOWS\SYSTEM
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\ZepMon\Driver SZ DrPMon.dll
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\ZepMon\Driver SZ DrPMon.dll
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Print\Monitors\ZepMon\Driver SZ DrPMon.dll
Logfile of HijackThis v1.99.1
Scan saved at 14:26:59, on 20.4.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVPersonal\AVGUARD.EXE
C:\Program Files\AVPersonal\AVWUPSRV.EXE
c:\windows\system32\yzhzcgv.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\AVPersonal\AVGNT.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\ntvdm.exe
C:\WINDOWS\system32\notepad.exe
C:\Hjt\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://elisa.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://elisa.net/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://elisa.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja Elisa Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;;*.*.fi;*.*.*.fi;;
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: BolgerObj Class - {302A3240-4805-4a34-97D7-1645A0B08410} - C:\WINDOWS\Bolger.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: ohb - {999A06FF-10EF-4A29-8640-69E99882C26B} - C:\WINDOWS\system32\nst107F.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [ieoqmax] c:\windows\system32\ieoqmax.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\Program Files\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [hbybnb] c:\windows\system32\yzhzcgv.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: SMS-viesti - {581C5253-F3FB-4585-AAF0-44ED91B7C9CF} - http://sms.kolumbus.fi/ (file missing) (HKCU)
O9 - Extra button: Tuki - {8B834A9A-61A0-47E0-ADCB-5B4A1D98A383} - http://tuki.elisa.net/ (file missing) (HKCU)
O9 - Extra button: Palvelut - {A081D7A0-C372-48DF-A4F6-050A7493FE0D} - http://service.kolumbus.fi/ (file missing) (HKCU)
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AntiVir Service (AntiVirService) - H BEDV Datentechnik GmbH - C:\Program Files\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\NORMAN\Nvc\BIN\nipsvc.exe (file missing)
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
Lue ensin kaikki läpi ja jos jotain et tajuu niin kysy enneku alotat.
Tee kaikki ihan rauhassa äläkä hätäile.
Piilotiedostot näkyviin ohje tuolla
http://www.xtra.co.nz/help/0,,4155-1916458,00.html
Ota tosta KillBoxi
http://www.bleepingcomputer.com/files/spyware/KillBox.zip
Pura se työpöydälle
Avaa se ja ylhäältä Tools > Delete Temp files ja ok
Sitte täppi kohtaan Delete on Reboot
Sitte kopioi ja liitä kaikki nuo rivit sinne KillBoxiin yksitellen
Eli ensin ensimmäinen rivi ja sitte Delete nappia (punanen jossa on valakonen X)
Ensimmäiseen kysymykseen vastaa myöntävästi ja toiseen Reboot now vastaa No tai Ei
Sitte seuraava rivi ja sama homma jne..
C:\WINDOWS\System32\YZHZCGV.EXE
C:\WINDOWS\YOWZDD.EXE
C:\WINDOWS\GTVZQH~1.EXE
C:\WINDOWS\NAIL.EXE
C:\WINDOWS\SVCPROC.EXE
C:\WINDOWS\System32\DRPMON.DLL
C:\WINDOWS\System32\ABASA5~1.EXE
C:\WINDOWS\System32\HOCHKA~1.EXE
C:\WINDOWS\System32\Q17I9A4J.EXE
C:\WINDOWS\U6F6UF~1.EXE
C:\WINDOWS\System32\70TOVMTO.INI
C:\WINDOWS\System32\A95KFRHE.INI
C:\WINDOWS\System32\ABASA5~1.INI
C:\WINDOWS\System32\AP9H4QMO.INI
C:\WINDOWS\System32\BLN02NQV.INI
C:\WINDOWS\System32\GAH95ON6.INI
C:\WINDOWS\System32\HOCHKA~1.INI
C:\WINDOWS\System32\Q17I9A4J.INI
C:\WINDOWS\System32\U6F6UF~1.INI
C:\WINDOWS\System32\NST107F.DLL
C:\WINDOWS\Bolger.dll
c:\windows\system32\ieoqmax.exe
c:\windows\system32\yzhzcgv.exe
Eli sitte kun oot pistänny ton viimesen rivin KillBoxiin,niin vastaa myöntävästi molempiin kysymyksiin ja jos kone ei itestään käynnisty uudestaan,niin käynnistä se ite uudestaan ja mee samalla suoraan VIKASIETOTILAAN
Sitte scannaa Hijackillä ja merkkaa nuo rivit jos näkyy.
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: BolgerObj Class - {302A3240-4805-4a34-97D7-1645A0B08410} - C:\WINDOWS\Bolger.dll
O2 - BHO: ohb - {999A06FF-10EF-4A29-8640-69E99882C26B} - C:\WINDOWS\system32\nst107F.dll
O4 - HKLM\..\Run: [ieoqmax] c:\windows\system32\ieoqmax.exe
O4 - HKLM\..\Run: [hbybnb] c:\windows\system32\yzhzcgv.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
Sitte voi olla että nämä kaks 04 riviä
O4 - HKLM\..\Run: [ieoqmax] c:\windows\system32\ieoqmax.exe
O4 - HKLM\..\Run: [hbybnb] c:\windows\system32\yzhzcgv.exe
on vaihtannu nimee,eli ne on eri nimisiä ku tossa logissa,mutta merkkaa ne ja sitte poista ne exe tiedostot.
Kirjoita sitte Suorita kohtaan services.msc ja ok
Etsi sieltä tuo service
System Startup Service (SvcProc)
Pysäytä se ja pistä käynistysmuotoon ei käytössä Käytä ja ok.
Käynnistä sitte normaalisti ja uus Hijack ja se Findit logi.
Tässä uudet hijack ja findit logit. Ainoo minkä mielestäni kämmäsin, oli etten päässy suoraan vikasietoon KillBoxin jälkeen. Eli jouduin ottaa uuden restartin ja sitten onnistui..
Logfile of HijackThis v1.99.1
Scan saved at 16:05:00, on 20.4.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVPersonal\AVGUARD.EXE
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\AVPersonal\AVGNT.EXE
c:\windows\system32\kyrura.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Hjt\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://elisa.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://elisa.net/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://elisa.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja Elisa Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;;*.*.fi;*.*.*.fi;;
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\Program Files\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [zonqgvj] c:\windows\system32\kyrura.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: SMS-viesti - {581C5253-F3FB-4585-AAF0-44ED91B7C9CF} - http://sms.kolumbus.fi/ (file missing) (HKCU)
O9 - Extra button: Tuki - {8B834A9A-61A0-47E0-ADCB-5B4A1D98A383} - http://tuki.elisa.net/ (file missing) (HKCU)
O9 - Extra button: Palvelut - {A081D7A0-C372-48DF-A4F6-050A7493FE0D} - http://service.kolumbus.fi/ (file missing) (HKCU)
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AntiVir Service (AntiVirService) - H BEDV Datentechnik GmbH - C:\Program Files\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\NORMAN\Nvc\BIN\nipsvc.exe (file missing)
PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
»»»»»»»»»»»»»»»»»»»»»»»» Todo Files found »»»»»»»»»»»»»»»»»»»»»»»»»»»»»
* Todo C:\WINDOWS\System32\KYRURA.EXE
»»»»»»»»»»»»»»»»»»»»»»»» aurora Files found »»»»»»»»»»»»»»»»»»»»»»»»»»»
* 1 aurora C:\WINDOWS\YOWZDD.EXE
»»»»»»»»»»»»»»»»»»»»»»»» Suspect's »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Dont delete file's in the section without guidence
Even then back them up first
* UPX! C:\WINDOWS\System32\KYRURA.EXE
* UPX! C:\WINDOWS\NAIL.EXE
* UPX! C:\WINDOWS\SVCPROC.EXE
* Sniffed C:\WINDOWS\System32\DRPMON.DLL
»»»»»»»»»»»»»»»»»»»»»»»» Possible SAHAgent Files found »»»»»»»»»»»»»»»»
»»»»»»»»»»»»»»»»»»»»»»»» Misc checks »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Aseman C nimi on 51_38_08
Aseman sarjanumero on 580A-16E4
Kansio C:\WINDOWS\system32
22.03.2005 20:26 2ÿ998 bball.ico
20.04.2005 15:21 3ÿ262 bingo_big2.ico
17.03.2005 11:29 3ÿ262 conver radio 32x32-21.ico
19.10.2004 13:15 3ÿ262 creditcard21.ico
20.04.2005 15:21 3ÿ262 dice21.ico
27.03.2005 18:05 3ÿ262 eye41.ico
15.05.2001 17:14 2ÿ238 FSCICON.ICO
20.04.2005 15:21 4ÿ286 greenmovie2313asaadsasfad.ico
12.04.2005 11:47 4ÿ286 greenmovie2313asaadsasfad112341231adsfa.ico
15.03.2005 20:17 2ÿ526 ibm laptop3.ico
01.04.2005 11:31 2ÿ526 ibm laptop31.ico
24.03.2005 20:18 3ÿ262 kas pink1233a1.ico
20.04.2005 15:21 3ÿ262 kas pink1233aadsfa1.ico
20.04.2005 09:56 3ÿ262 kas pink1233aadsfa12.ico
16.03.2005 19:31 3ÿ262 kas4c1.ico
18.03.2005 23:59 4ÿ286 kill all spywareadsfadsf1.ico
27.03.2005 18:05 4ÿ286 moviescirc2.ico
27.03.2005 18:05 4ÿ286 mp3 players4salea.ico
20.04.2005 09:56 4ÿ286 mp3red51aads.ico
20.04.2005 15:21 4ÿ286 mp3red51aads1.ico
13.03.2005 19:53 4ÿ286 pop up blaster.ico
03.04.2005 21:28 4ÿ286 pop up blaster1232131.ico
20.04.2005 15:21 3ÿ262 popupkiller2asdf1.ico
03.04.2005 21:28 2ÿ238 red_kas1.ico
20.04.2005 15:21 3ÿ262 vh e2331.ico
26.03.2005 22:23 19ÿ942 virus hunter yeah1.ico
26 tiedosto(a) 106ÿ924 tavua
0 kansio(ta) 11ÿ108ÿ691ÿ968 tavua vapaana
svcproc.exe
Nail.exe
DrPMon.dll
Aseman C nimi on 51_38_08
Aseman sarjanumero on 580A-16E4
Kansio C:\WINDOWS\SYSTEM32
20.04.2005 09:56 cache32_rtneg2
20.04.2005 14:47 cache32_rtneg3
0 tiedosto(a) 0 tavua
2 kansio(ta) 11ÿ108ÿ745ÿ216 tavua vapaana
Aseman C nimi on 51_38_08
Aseman sarjanumero on 580A-16E4
Kansio C:\WINDOWS\SYSTEM
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\ZepMon\Driver SZ DrPMon.dll
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\ZepMon\Driver SZ DrPMon.dll
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Print\Monitors\ZepMon\Driver SZ DrPMon.dll
Sun pitää mennä suoraan vikasietoon ku kone käynistyy uudestaan.
Uudestaan KillBoxsilla sama homma ku aikasemmin.
Tossa rivit
C:\WINDOWS\System32\KYRURA.EXE
C:\WINDOWS\YOWZDD.EXE
C:\WINDOWS\NAIL.EXE
C:\WINDOWS\SVCPROC.EXE
Sitte suoraan vikasietotilaan ja merkkaa ja Fix:saa nuo
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O4 - HKLM\..\Run: [zonqgvj] c:\windows\system32\kyrura.exe
ja jos tuo 04 rivi on vaihtannu nimee,niin poista se exe tiedosto.
Käynnistä sitte normaalisti ja uudet logit
Rupee heti paukuttaan sitä F8:sia
Logfile of HijackThis v1.99.1
Scan saved at 17:15:51, on 19.4.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVPersonal\AVGUARD.EXE
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\AVPersonal\AVGNT.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Hjt\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://elisa.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://elisa.net/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://elisa.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja Elisa Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;;*.*.fi;*.*.*.fi;;
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\Program Files\AVPersonal\AVGNT.EXE /min
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: SMS-viesti - {581C5253-F3FB-4585-AAF0-44ED91B7C9CF} - http://sms.kolumbus.fi/ (file missing) (HKCU)
O9 - Extra button: Tuki - {8B834A9A-61A0-47E0-ADCB-5B4A1D98A383} - http://tuki.elisa.net/ (file missing) (HKCU)
O9 - Extra button: Palvelut - {A081D7A0-C372-48DF-A4F6-050A7493FE0D} - http://service.kolumbus.fi/ (file missing) (HKCU)
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AntiVir Service (AntiVirService) - H BEDV Datentechnik GmbH - C:\Program Files\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\NORMAN\Nvc\BIN\nipsvc.exe (file missing)
PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
»»»»»»»»»»»»»»»»»»»»»»»» Todo Files found »»»»»»»»»»»»»»»»»»»»»»»»»»»»»
* Todo C:\WINDOWS\System32\QCEEMA.EXE
»»»»»»»»»»»»»»»»»»»»»»»» aurora Files found »»»»»»»»»»»»»»»»»»»»»»»»»»»
»»»»»»»»»»»»»»»»»»»»»»»» Suspect's »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Dont delete file's in the section without guidence
Even then back them up first
* UPX! C:\WINDOWS\System32\QCEEMA.EXE
* Sniffed C:\WINDOWS\System32\DRPMON.DLL
»»»»»»»»»»»»»»»»»»»»»»»» Possible SAHAgent Files found »»»»»»»»»»»»»»»»
»»»»»»»»»»»»»»»»»»»»»»»» Misc checks »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Aseman C nimi on 51_38_08
Aseman sarjanumero on 580A-16E4
Kansio C:\WINDOWS\system32
22.03.2005 20:26 2ÿ998 bball.ico
20.04.2005 15:21 3ÿ262 bingo_big2.ico
17.03.2005 11:29 3ÿ262 conver radio 32x32-21.ico
19.10.2004 13:15 3ÿ262 creditcard21.ico
20.04.2005 15:21 3ÿ262 dice21.ico
27.03.2005 18:05 3ÿ262 eye41.ico
15.05.2001 17:14 2ÿ238 FSCICON.ICO
20.04.2005 15:21 4ÿ286 greenmovie2313asaadsasfad.ico
12.04.2005 11:47 4ÿ286 greenmovie2313asaadsasfad112341231adsfa.ico
15.03.2005 20:17 2ÿ526 ibm laptop3.ico
01.04.2005 11:31 2ÿ526 ibm laptop31.ico
24.03.2005 20:18 3ÿ262 kas pink1233a1.ico
20.04.2005 15:21 3ÿ262 kas pink1233aadsfa1.ico
20.04.2005 09:56 3ÿ262 kas pink1233aadsfa12.ico
16.03.2005 19:31 3ÿ262 kas4c1.ico
18.03.2005 23:59 4ÿ286 kill all spywareadsfadsf1.ico
27.03.2005 18:05 4ÿ286 moviescirc2.ico
27.03.2005 18:05 4ÿ286 mp3 players4salea.ico
20.04.2005 09:56 4ÿ286 mp3red51aads.ico
20.04.2005 15:21 4ÿ286 mp3red51aads1.ico
13.03.2005 19:53 4ÿ286 pop up blaster.ico
03.04.2005 21:28 4ÿ286 pop up blaster1232131.ico
20.04.2005 15:21 3ÿ262 popupkiller2asdf1.ico
03.04.2005 21:28 2ÿ238 red_kas1.ico
20.04.2005 15:21 3ÿ262 vh e2331.ico
26.03.2005 22:23 19ÿ942 virus hunter yeah1.ico
26 tiedosto(a) 106ÿ924 tavua
0 kansio(ta) 11ÿ094ÿ556ÿ672 tavua vapaana
DrPMon.dll
Aseman C nimi on 51_38_08
Aseman sarjanumero on 580A-16E4
Kansio C:\WINDOWS\SYSTEM32
20.04.2005 09:56 cache32_rtneg2
20.04.2005 14:47 cache32_rtneg3
0 tiedosto(a) 0 tavua
2 kansio(ta) 11ÿ094ÿ556ÿ672 tavua vapaana
Aseman C nimi on 51_38_08
Aseman sarjanumero on 580A-16E4
Kansio C:\WINDOWS\SYSTEM
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\ZepMon\Driver SZ DrPMon.dll
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\ZepMon\Driver SZ DrPMon.dll
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Print\Monitors\ZepMon\Driver SZ DrPMon.dll
Scannaa tuo tuolla ja ilmoita tulos
C:\WINDOWS\System32\DRPMON.DLL
http://virusscan.jotti.org/
Älä käynnistä konetta uudestaan nyt tässä välillä
File: DRPMON.DLL
Status: INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)
Packers detected: -
Scanner results
AntiVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
Fortinet Found nothing
Kaspersky Anti-Virus Found Trojan.Win32.Agent.db
mks_vir Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
VBA32 Found nothing
Taas KillBoxilla sama homma
Nuo
C:\WINDOWS\System32\QCEEMA.EXE
C:\WINDOWS\System32\DRPMON.DLL
Uudet logit ku kone on käynistynny uudestaan.
Logfile of HijackThis v1.99.1
Scan saved at 17:52:11, on 19.4.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVPersonal\AVGUARD.EXE
C:\Program Files\AVPersonal\AVWUPSRV.EXE
c:\windows\system32\dxfakr.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\AVPersonal\AVGNT.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Hjt\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://elisa.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://elisa.net/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://elisa.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja Elisa Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;;*.*.fi;*.*.*.fi;;
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\Program Files\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [jurdxm] c:\windows\system32\dxfakr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: SMS-viesti - {581C5253-F3FB-4585-AAF0-44ED91B7C9CF} - http://sms.kolumbus.fi/ (file missing) (HKCU)
O9 - Extra button: Tuki - {8B834A9A-61A0-47E0-ADCB-5B4A1D98A383} - http://tuki.elisa.net/ (file missing) (HKCU)
O9 - Extra button: Palvelut - {A081D7A0-C372-48DF-A4F6-050A7493FE0D} - http://service.kolumbus.fi/ (file missing) (HKCU)
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AntiVir Service (AntiVirService) - H BEDV Datentechnik GmbH - C:\Program Files\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\NORMAN\Nvc\BIN\nipsvc.exe (file missing)
O23 - Service: System Startup Service (SvcProc) - Unknown owner - c:\windows\SvcProc.exe
PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
»»»»»»»»»»»»»»»»»»»»»»»» Todo Files found »»»»»»»»»»»»»»»»»»»»»»»»»»»»»
* Todo C:\WINDOWS\System32\DXFAKR.EXE
»»»»»»»»»»»»»»»»»»»»»»»» aurora Files found »»»»»»»»»»»»»»»»»»»»»»»»»»»
* 1 aurora C:\WINDOWS\YOWZDD.EXE
»»»»»»»»»»»»»»»»»»»»»»»» Suspect's »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Dont delete file's in the section without guidence
Even then back them up first
* UPX! C:\WINDOWS\System32\DXFAKR.EXE
* UPX! C:\WINDOWS\NAIL.EXE
* UPX! C:\WINDOWS\SVCPROC.EXE
»»»»»»»»»»»»»»»»»»»»»»»» Possible SAHAgent Files found »»»»»»»»»»»»»»»»
»»»»»»»»»»»»»»»»»»»»»»»» Misc checks »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Aseman C nimi on 51_38_08
Aseman sarjanumero on 580A-16E4
Kansio C:\WINDOWS\system32
22.03.2005 20:26 2ÿ998 bball.ico
20.04.2005 15:21 3ÿ262 bingo_big2.ico
17.03.2005 11:29 3ÿ262 conver radio 32x32-21.ico
19.10.2004 13:15 3ÿ262 creditcard21.ico
20.04.2005 15:21 3ÿ262 dice21.ico
27.03.2005 18:05 3ÿ262 eye41.ico
15.05.2001 17:14 2ÿ238 FSCICON.ICO
20.04.2005 15:21 4ÿ286 greenmovie2313asaadsasfad.ico
12.04.2005 11:47 4ÿ286 greenmovie2313asaadsasfad112341231adsfa.ico
15.03.2005 20:17 2ÿ526 ibm laptop3.ico
01.04.2005 11:31 2ÿ526 ibm laptop31.ico
24.03.2005 20:18 3ÿ262 kas pink1233a1.ico
20.04.2005 15:21 3ÿ262 kas pink1233aadsfa1.ico
20.04.2005 09:56 3ÿ262 kas pink1233aadsfa12.ico
16.03.2005 19:31 3ÿ262 kas4c1.ico
18.03.2005 23:59 4ÿ286 kill all spywareadsfadsf1.ico
27.03.2005 18:05 4ÿ286 moviescirc2.ico
27.03.2005 18:05 4ÿ286 mp3 players4salea.ico
20.04.2005 09:56 4ÿ286 mp3red51aads.ico
20.04.2005 15:21 4ÿ286 mp3red51aads1.ico
13.03.2005 19:53 4ÿ286 pop up blaster.ico
03.04.2005 21:28 4ÿ286 pop up blaster1232131.ico
20.04.2005 15:21 3ÿ262 popupkiller2asdf1.ico
03.04.2005 21:28 2ÿ238 red_kas1.ico
20.04.2005 15:21 3ÿ262 vh e2331.ico
26.03.2005 22:23 19ÿ942 virus hunter yeah1.ico
26 tiedosto(a) 106ÿ924 tavua
0 kansio(ta) 11ÿ093ÿ778ÿ432 tavua vapaana
svcproc.exe
Nail.exe
Aseman C nimi on 51_38_08
Aseman sarjanumero on 580A-16E4
Kansio C:\WINDOWS\SYSTEM32
20.04.2005 09:56 cache32_rtneg2
20.04.2005 14:47 cache32_rtneg3
0 tiedosto(a) 0 tavua
2 kansio(ta) 11ÿ093ÿ778ÿ432 tavua vapaana
Aseman C nimi on 51_38_08
Aseman sarjanumero on 580A-16E4
Kansio C:\WINDOWS\SYSTEM
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\ZepMon\Driver SZ DrPMon.dll
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\ZepMon\Driver SZ DrPMon.dll
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Print\Monitors\ZepMon\Driver SZ DrPMon.dll
Tuli takas.
Koitetaan vielä näin.
Piilotiedostot taas näkyviin
Sama taas KillBoxilla > Delete on Reboot
Nuo
C:\WINDOWS\System32\DXFAKR.EXE
C:\WINDOWS\YOWZDD.EXE
C:\WINDOWS\NAIL.EXE
C:\WINDOWS\SVCPROC.EXE
c:\windows\system32\dxfakr.exe
Sitte taas suoraan vikasietotilaan scannaa ,merkkaa ja Fix checked
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O4 - HKLM\..\Run: [jurdxm] c:\windows\system32\dxfakr.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - c:\windows\SvcProc.exe
Kirjoita sitte Suorita kohtaan services.msc ja ok
Etsi sieltä tuo service
System Startup Service (SvcProc)
Pysäytä se ja pistä käynistysmuotoon ei käytössä Käytä ja ok.
Sitte etsi ja poista jos löytyy
C:\WINDOWS\System32\DXFAKR.EXE
C:\WINDOWS\YOWZDD.EXE
C:\WINDOWS\NAIL.EXE
C:\WINDOWS\SVCPROC.EXE
c:\windows\system32\dxfakr.exe
ja jos se 04 rivi on eri nimellä niin poista myös se exe tiedosto.
Kirjoita sitte Suorita kohtaan cleanmgr ja Ok
Merkkaa sieltä nuo ja putsaa pois ne
Temporary Files
Temporary Internet Files
Recycle Bin
Käynnistä sitte normaalisti ja uus Hijack ja se Findit logi.
Logfile of HijackThis v1.99.1
Scan saved at 18:43:51, on 19.4.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVPersonal\AVGUARD.EXE
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\AVPersonal\AVGNT.EXE
C:\Hjt\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://elisa.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://elisa.net/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://elisa.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja Elisa Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;;*.*.fi;*.*.*.fi;;
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\Program Files\AVPersonal\AVGNT.EXE /min
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: SMS-viesti - {581C5253-F3FB-4585-AAF0-44ED91B7C9CF} - http://sms.kolumbus.fi/ (file missing) (HKCU)
O9 - Extra button: Tuki - {8B834A9A-61A0-47E0-ADCB-5B4A1D98A383} - http://tuki.elisa.net/ (file missing) (HKCU)
O9 - Extra button: Palvelut - {A081D7A0-C372-48DF-A4F6-050A7493FE0D} - http://service.kolumbus.fi/ (file missing) (HKCU)
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AntiVir Service (AntiVirService) - H BEDV Datentechnik GmbH - C:\Program Files\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\NORMAN\Nvc\BIN\nipsvc.exe (file missing)
PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
»»»»»»»»»»»»»»»»»»»»»»»» Todo Files found »»»»»»»»»»»»»»»»»»»»»»»»»»»»»
»»»»»»»»»»»»»»»»»»»»»»»» aurora Files found »»»»»»»»»»»»»»»»»»»»»»»»»»»
»»»»»»»»»»»»»»»»»»»»»»»» Suspect's »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Dont delete file's in the section without guidence
Even then back them up first
* Sniffed C:\WINDOWS\System32\DRPMON.DLL
»»»»»»»»»»»»»»»»»»»»»»»» Possible SAHAgent Files found »»»»»»»»»»»»»»»»
»»»»»»»»»»»»»»»»»»»»»»»» Misc checks »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Aseman C nimi on 51_38_08
Aseman sarjanumero on 580A-16E4
Kansio C:\WINDOWS\system32
22.03.2005 20:26 2ÿ998 bball.ico
20.04.2005 15:21 3ÿ262 bingo_big2.ico
17.03.2005 11:29 3ÿ262 conver radio 32x32-21.ico
19.10.2004 13:15 3ÿ262 creditcard21.ico
20.04.2005 15:21 3ÿ262 dice21.ico
27.03.2005 18:05 3ÿ262 eye41.ico
15.05.2001 17:14 2ÿ238 FSCICON.ICO
20.04.2005 15:21 4ÿ286 greenmovie2313asaadsasfad.ico
12.04.2005 11:47 4ÿ286 greenmovie2313asaadsasfad112341231adsfa.ico
15.03.2005 20:17 2ÿ526 ibm laptop3.ico
01.04.2005 11:31 2ÿ526 ibm laptop31.ico
24.03.2005 20:18 3ÿ262 kas pink1233a1.ico
20.04.2005 15:21 3ÿ262 kas pink1233aadsfa1.ico
20.04.2005 09:56 3ÿ262 kas pink1233aadsfa12.ico
16.03.2005 19:31 3ÿ262 kas4c1.ico
18.03.2005 23:59 4ÿ286 kill all spywareadsfadsf1.ico
27.03.2005 18:05 4ÿ286 moviescirc2.ico
27.03.2005 18:05 4ÿ286 mp3 players4salea.ico
20.04.2005 09:56 4ÿ286 mp3red51aads.ico
20.04.2005 15:21 4ÿ286 mp3red51aads1.ico
13.03.2005 19:53 4ÿ286 pop up blaster.ico
03.04.2005 21:28 4ÿ286 pop up blaster1232131.ico
20.04.2005 15:21 3ÿ262 popupkiller2asdf1.ico
03.04.2005 21:28 2ÿ238 red_kas1.ico
20.04.2005 15:21 3ÿ262 vh e2331.ico
26.03.2005 22:23 19ÿ942 virus hunter yeah1.ico
26 tiedosto(a) 106ÿ924 tavua
0 kansio(ta) 11ÿ089ÿ838ÿ080 tavua vapaana
DrPMon.dll
Aseman C nimi on 51_38_08
Aseman sarjanumero on 580A-16E4
Kansio C:\WINDOWS\SYSTEM32
20.04.2005 09:56 cache32_rtneg2
20.04.2005 14:47 cache32_rtneg3
0 tiedosto(a) 0 tavua
2 kansio(ta) 11ÿ089ÿ838ÿ080 tavua vapaana
Aseman C nimi on 51_38_08
Aseman sarjanumero on 580A-16E4
Kansio C:\WINDOWS\SYSTEM
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\ZepMon\Driver SZ DrPMon.dll
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\ZepMon\Driver SZ DrPMon.dll
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Print\Monitors\ZepMon\Driver SZ DrPMon.dll
Ehkä joo.
Koitas Ad-Awarella jos tuo C:\WINDOWS\System32\DRPMON.DLL lähtis sillä
Hae tuolta Plug-In for Ad-Aware (VX2 Cleaner)
(add-ons kohasta löytyy)
http://www.lavasoft.de/
Löysin valmiit ohjeet englanniks
Close Ad-Aware SE build 1.05 and Ad-Watch (if running)
Install the VX2 Cleaner by double-clicking on the downloaded .exe.
That wil install it to the Lavasoft>Plugins folder.
Start Ad-Aware SE build 1.05
Go to "Add-Ons"
Select the VX2 Cleaner plug-in and click "Run Plugin"
If your computer isn't infected, click "Close".
If your computer is infected:
Select "Clean System"
Reboot your computer
Scan your computer with Ad-Aware
Remove any VX2 objects detected
Reboot your computer again
Run a second scan to make sure the files have been removed from your computer
koitas noin jos se löytää sen.
Ilmota sitte miten kävi.
Täytyy lähtee auttaan kaveria siirtään muutama huonekalu ku lupasin eilen.
Palaan asiaan ku tuun takas jos kukaan muu ei oo kerenny auttaan.
Eipä löytänyt Ad-Aware kyseistä mörköä. Jotain muuta shittii kylläkin..
Kiitti sulle kuitenkin ihan rutosti jelpistä. Jos sulla tai jollain muulla tulee mieleen vielä jotain jekkuja, niin otan mielellään vastaan.
Kone tuntuu kuitenkin jo nyt toimivan huomattavasti paremmin...
Tuohan lähti pois sillä Killboxilla aikasemmin
C:\WINDOWS\System32\DRPMON.DLL
Mutta nuo jäi
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\ZepMon\Driver SZ DrPMon.dll
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\ZepMon\Driver SZ DrPMon.dll
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Print\Monitors\ZepMon\Driver SZ DrPMon.dll
En sitte tiedä että mitä tapahtuu jos seuraa noita polkuja ja poistaa nuo DrPMon.dll:ät
Koita vielä scannata sillä e-scannilla ja pistä ne örkkilöydöt tänne jos jotain löytyy.
vertasin omaa rekisteriä vastaavasta kohdasta ja siellä Monitors-kansiossa lojuu asennetut printterit tai niitä vastaavat.
Jos tuommoista ZepMon "printteriä" ei ole olemassa, ei se tarvitse DrPMon.dll:ääkään.
Tai siis viittausta siihen , jos itse .dll on jo poistettu.
Kiinnitti huomiota, ettei järjestelmän palautusta otettu pois päältä missään vaiheessa, tiedä sitten oliko sillä mitään vaikutusta hyvään lopputulokseen.
Oli sitkeä taistelu ja taas jäi örkit alakynteen!
Tuohan lähti jo kerran KillBoxila pois
C:\WINDOWS\System32\DRPMON.DLL
Mutta nuo jäi
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\ZepMon\Driver SZ DrPMon.dll
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\ZepMon\Driver SZ DrPMon.dll
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Print\Monitors\ZepMon\Driver SZ DrPMon.dll
ja sitte tuo tuli taas takas
C:\WINDOWS\System32\DRPMON.DLL
En sitte tiiä,ehkä tää kuuluu jotenki tähän varianttiin
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O4 - HKLM\..\Run: [ieoqmax] c:\windows\system32\ieoqmax.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
Mutta miten sen saa pois niin en tiedä.
Tonne rekisteriin jäi vaan jotain rippeitä.
Tuolta löytyi saksalainen versio tosta nail.exe:stä:
http://board.protecus.de/showtopic.php?threadid=15063
Uhri nimeltä "rotschman" aloittaa uuden ketjun ekan sotkun selvittyä.
Siellä toi pahis nail.exe lötyy IE:n cachesta ainakin jossain vaiheessa.
F2 Reg:System.ini rivillä on vähän huono kaiku, se kun löytyy niin tietää sinnikästä tappelua?
Joutu pistään tänne ku oli menny liian syvälle
> Lähtihän se...Tonne rekisteriin jäi vaan jotain rippeitä <
Tossa se oli poissa
http://keskustelu.suomi24.fi/show.fcgi?category=108&conference=4500000000000628&posting=22000000007950598
mutta se tuli takas
http://keskustelu.suomi24.fi/show.fcgi?category=108&conference=4500000000000628&posting=22000000007951725
F2 riviä ei ilmestynyt, vain tuo sniffed :
* Sniffed C:\WINDOWS\System32\DRPMON.DLL
Nail.exeä en ainakaan huomannu (silmät alkaa olla jo aika ristissä).
Eikä Jack tuon jälkeen enää laittanut logia.Kertoi vaan ettei Ad-Aware löytänyt :
"Eipä löytänyt Ad-Aware kyseistä mörköä. Jotain muuta shittii kylläkin.."
Jack varmaan palaa huomenna uudestaan , jos nail.exe ilmestyy vielä.
Sänky kutsuu.....
Eli E-scan löysi enää tollasen (thin_bundlelite[1].exe), josta Jotti kerto seuraavaa.. Alla myös aamun tuoreet hijack ja findit logit.
File: thin_bundlelite[1].exe
Status: INFECTED/MALWARE (Note: only non-destructive malware has been found. Considering the non-destructive nature of samples like these - although they can be a pain -, results will not be stored in the database.)
Packers detected: ASPACK, PE_PATCH, UPX
Scanner results
AntiVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
Fortinet Found nothing
Kaspersky Anti-Virus Found not-a-virus:AdWare.Sahat.m, not-a-virus:AdWare.BetterInternet
mks_vir Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
VBA32 Found nothing
Logfile of HijackThis v1.99.1
Scan saved at 10:07:45, on 20.4.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\AVPersonal\AVGNT.EXE
C:\Program Files\AVPersonal\AVGUARD.EXE
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Kaspersky\mwavscan.com
C:\Kaspersky\kavss.exe
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Hjt\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://elisa.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://elisa.net/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://elisa.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja Elisa Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;;*.*.fi;*.*.*.fi;;
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\Program Files\AVPersonal\AVGNT.EXE /min
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: SMS-viesti - {581C5253-F3FB-4585-AAF0-44ED91B7C9CF} - http://sms.kolumbus.fi/ (file missing) (HKCU)
O9 - Extra button: Tuki - {8B834A9A-61A0-47E0-ADCB-5B4A1D98A383} - http://tuki.elisa.net/ (file missing) (HKCU)
O9 - Extra button: Palvelut - {A081D7A0-C372-48DF-A4F6-050A7493FE0D} - http://service.kolumbus.fi/ (file missing) (HKCU)
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AntiVir Service (AntiVirService) - H BEDV Datentechnik GmbH - C:\Program Files\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\NORMAN\Nvc\BIN\nipsvc.exe (file missing)
PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
»»»»»»»»»»»»»»»»»»»»»»»» Todo Files found »»»»»»»»»»»»»»»»»»»»»»»»»»»»»
»»»»»»»»»»»»»»»»»»»»»»»» aurora Files found »»»»»»»»»»»»»»»»»»»»»»»»»»»
»»»»»»»»»»»»»»»»»»»»»»»» Suspect's »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Dont delete file's in the section without guidence
Even then back them up first
* Sniffed C:\WINDOWS\System32\DRPMON.DLL
»»»»»»»»»»»»»»»»»»»»»»»» Possible SAHAgent Files found »»»»»»»»»»»»»»»»
»»»»»»»»»»»»»»»»»»»»»»»» Misc checks »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Aseman C nimi on 51_38_08
Aseman sarjanumero on 580A-16E4
Kansio C:\WINDOWS\system32
22.03.2005 20:26 2ÿ998 bball.ico
20.04.2005 15:21 3ÿ262 bingo_big2.ico
17.03.2005 11:29 3ÿ262 conver radio 32x32-21.ico
19.10.2004 13:15 3ÿ262 creditcard21.ico
27.03.2005 18:05 3ÿ262 eye41.ico
15.05.2001 17:14 2ÿ238 FSCICON.ICO
20.04.2005 15:21 4ÿ286 greenmovie2313asaadsasfad.ico
12.04.2005 11:47 4ÿ286 greenmovie2313asaadsasfad112341231adsfa.ico
15.03.2005 20:17 2ÿ526 ibm laptop3.ico
01.04.2005 11:31 2ÿ526 ibm laptop31.ico
24.03.2005 20:18 3ÿ262 kas pink1233a1.ico
20.04.2005 15:21 3ÿ262 kas pink1233aadsfa1.ico
20.04.2005 09:56 3ÿ262 kas pink1233aadsfa12.ico
16.03.2005 19:31 3ÿ262 kas4c1.ico
18.03.2005 23:59 4ÿ286 kill all spywareadsfadsf1.ico
27.03.2005 18:05 4ÿ286 moviescirc2.ico
27.03.2005 18:05 4ÿ286 mp3 players4salea.ico
20.04.2005 09:56 4ÿ286 mp3red51aads.ico
20.04.2005 15:21 4ÿ286 mp3red51aads1.ico
13.03.2005 19:53 4ÿ286 pop up blaster.ico
03.04.2005 21:28 4ÿ286 pop up blaster1232131.ico
20.04.2005 15:21 3ÿ262 popupkiller2asdf1.ico
03.04.2005 21:28 2ÿ238 red_kas1.ico
26.03.2005 22:23 19ÿ942 virus hunter yeah1.ico
24 tiedosto(a) 100ÿ400 tavua
0 kansio(ta) 11ÿ056ÿ312ÿ320 tavua vapaana
DrPMon.dll
Aseman C nimi on 51_38_08
Aseman sarjanumero on 580A-16E4
Kansio C:\WINDOWS\SYSTEM32
20.04.2005 09:56 cache32_rtneg2
20.04.2005 14:47 cache32_rtneg3
0 tiedosto(a) 0 tavua
2 kansio(ta) 11ÿ056ÿ312ÿ320 tavua vapaana
Aseman C nimi on 51_38_08
Aseman sarjanumero on 580A-16E4
Kansio C:\WINDOWS\SYSTEM
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\ZepMon\Driver SZ DrPMon.dll
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\ZepMon\Driver SZ DrPMon.dll
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Print\Monitors\ZepMon\Driver SZ DrPMon.dll
> Eli E-scan löysi enää tollasen <
Poista se
Taas KillBox ja Delete on Reboot
tuo
C:\WINDOWS\System32\DRPMON.DLL
Sitte kopioi alla oleva texti notepadiin
REGEDIT4
[-HKEY_CURRENT_USER\Software\_rtneg3]
[-HKEY_CURRENT_USER\Software\aurora]
[-HKEY_CLASSES_ROOT\CLSID\{0962DA67-DB64-465C-8CD7-CBB357CAF825}]
[-HKEY_CLASSES_ROOT\CLSID\{356B2BD0-D206-4E21-8C85-C6F49409C6A9}]
[-HKEY_CLASSES_ROOT\CLSID\{52ADD86D-9561-4C40-B561-4204DBC139D1}]
[-HKEY_CLASSES_ROOT\CLSID\{999A06FF-10EF-4A29-8640-69E99882C26B}]
[-HKEY_CLASSES_ROOT\Interface\{018C5406-AEE6-4A68-980F-2CEB1E9416FB}]
[-HKEY_CLASSES_ROOT\Interface\{0A7FC040-F84A-4AD7-9439-798B6C0F861E}]
[-HKEY_CLASSES_ROOT\Interface\{32A9D21F-F510-44DC-9EA6-0456EDA04668}]
[-HKEY_CLASSES_ROOT\Interface\{4562B6F3-DAF8-464E-87B7-5464575F0D6A}]
[-HKEY_CLASSES_ROOT\Interface\{C93CC79D-02D5-45B0-BE39-7F5B0E5DDA31}]
[-HKEY_CLASSES_ROOT\Interface\{DA4B919F-B757-4E32-8D79-DEC5C2704C4B}]
[-HKEY_CLASSES_ROOT\trfdsk.amo]
[-HKEY_CLASSES_ROOT\trfdsk.iiittt]
[-HKEY_CLASSES_ROOT\trfdsk.momo]
[-HKEY_CLASSES_ROOT\trfdsk.ohb]
[-HKEY_CLASSES_ROOT\TypeLib\{DA15C9A2-C30A-4761-922A-5DFE7C9A1F67}]
[-HKEY_CURRENT_USER\Software\Bolger]
[-HKEY_CLASSES_ROOT\BolgerDll.BolgerDllObj]
[-HKEY_CLASSES_ROOT\CLSID\{302A3240-4805-4a34-97D7-1645A0B08410}]
[-HKEY_CLASSES_ROOT\Interface\{BB0D5ADC-028D-4185-9288-722DDCE2C757}]
[-HKEY_CLASSES_ROOT\TypeLib\{92DAF5C1-2135-4E0C-B7A0-259ABFCD3904}]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\ZepMon]
Säästa se työpöydälle nimellä cleanup.reg ja tallennusmuotoon kaikki tiedostot.
Sitte tuplaklikkaa sitä työpöydällä ja vastaa myöntävästi.
Käynnistä taas kone uudestan ja sitte uudet logit.
Thanks, mutta pitää lähtee käymään koulussa. Koitan kun pääsen taas koneelle.
tein työtä neuvottua ja tolta näyttää.. Nättii kö?
Logfile of HijackThis v1.99.1
Scan saved at 14:25:29, on 20.4.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVPersonal\AVGUARD.EXE
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\AVPersonal\AVGNT.EXE
C:\Hjt\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://elisa.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://elisa.net/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://elisa.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja Elisa Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;;*.*.fi;*.*.*.fi;;
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\Program Files\AVPersonal\AVGNT.EXE /min
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: SMS-viesti - {581C5253-F3FB-4585-AAF0-44ED91B7C9CF} - http://sms.kolumbus.fi/ (file missing) (HKCU)
O9 - Extra button: Tuki - {8B834A9A-61A0-47E0-ADCB-5B4A1D98A383} - http://tuki.elisa.net/ (file missing) (HKCU)
O9 - Extra button: Palvelut - {A081D7A0-C372-48DF-A4F6-050A7493FE0D} - http://service.kolumbus.fi/ (file missing) (HKCU)
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AntiVir Service (AntiVirService) - H BEDV Datentechnik GmbH - C:\Program Files\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\NORMAN\Nvc\BIN\nipsvc.exe (file missing)
PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
»»»»»»»»»»»»»»»»»»»»»»»» Todo Files found »»»»»»»»»»»»»»»»»»»»»»»»»»»»»
»»»»»»»»»»»»»»»»»»»»»»»» aurora Files found »»»»»»»»»»»»»»»»»»»»»»»»»»»
»»»»»»»»»»»»»»»»»»»»»»»» Suspect's »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Dont delete file's in the section without guidence
Even then back them up first
»»»»»»»»»»»»»»»»»»»»»»»» Possible SAHAgent Files found »»»»»»»»»»»»»»»»
»»»»»»»»»»»»»»»»»»»»»»»» Misc checks »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Aseman C nimi on 51_38_08
Aseman sarjanumero on 580A-16E4
Kansio C:\WINDOWS\system32
22.03.2005 20:26 2ÿ998 bball.ico
20.04.2005 15:21 3ÿ262 bingo_big2.ico
17.03.2005 11:29 3ÿ262 conver radio 32x32-21.ico
19.10.2004 13:15 3ÿ262 creditcard21.ico
27.03.2005 18:05 3ÿ262 eye41.ico
15.05.2001 17:14 2ÿ238 FSCICON.ICO
20.04.2005 15:21 4ÿ286 greenmovie2313asaadsasfad.ico
12.04.2005 11:47 4ÿ286 greenmovie2313asaadsasfad112341231adsfa.ico
15.03.2005 20:17 2ÿ526 ibm laptop3.ico
01.04.2005 11:31 2ÿ526 ibm laptop31.ico
24.03.2005 20:18 3ÿ262 kas pink1233a1.ico
20.04.2005 15:21 3ÿ262 kas pink1233aadsfa1.ico
20.04.2005 09:56 3ÿ262 kas pink1233aadsfa12.ico
16.03.2005 19:31 3ÿ262 kas4c1.ico
18.03.2005 23:59 4ÿ286 kill all spywareadsfadsf1.ico
27.03.2005 18:05 4ÿ286 moviescirc2.ico
27.03.2005 18:05 4ÿ286 mp3 players4salea.ico
20.04.2005 09:56 4ÿ286 mp3red51aads.ico
20.04.2005 15:21 4ÿ286 mp3red51aads1.ico
13.03.2005 19:53 4ÿ286 pop up blaster.ico
03.04.2005 21:28 4ÿ286 pop up blaster1232131.ico
20.04.2005 15:21 3ÿ262 popupkiller2asdf1.ico
03.04.2005 21:28 2ÿ238 red_kas1.ico
26.03.2005 22:23 19ÿ942 virus hunter yeah1.ico
24 tiedosto(a) 100ÿ400 tavua
0 kansio(ta) 11ÿ054ÿ993ÿ408 tavua vapaana
Aseman C nimi on 51_38_08
Aseman sarjanumero on 580A-16E4
Kansio C:\WINDOWS\SYSTEM32
20.04.2005 09:56 cache32_rtneg2
20.04.2005 14:47 cache32_rtneg3
0 tiedosto(a) 0 tavua
2 kansio(ta) 11ÿ055ÿ247ÿ360 tavua vapaana
Aseman C nimi on 51_38_08
Aseman sarjanumero on 580A-16E4
Kansio C:\WINDOWS\SYSTEM
Hyvältä näyttää.
Jos Normanni on poistettu koneelta,niin merkkaa ja Fix:saa
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\NORMAN\Nvc\BIN\nipsvc.exe (file missing)
Ei voi kyllin kiittää, mutta kiitti kuitenkin ihan vtusti!! Ehkä jopa opinkin jotain...