Backdoor.Win32Sdpot.act, BacdoorWin32.Rbot.xm, Im-worm.Win32.Kelvir.dt...
Yritin poistaa, nimetä uudelleen..yksi hukkui jonnekin..F-Securen ohjatulla poistolla.
Putsasin konetta ensin käsin.
Spybot ja AdAware löysi kaikenlaista, jotka poistin.
Otin nettipiuhan irti, kun virustorjunta häipyi alapalkista.
F-S löysi manuaalisessa putsauksessa 11 tartunnan saanutta. Yllämainitut ja
Trojan Downloader.Win32.dyfuca.ei:n.Uudelleennimesin muut, C:\Documents and settings\Maarit\33n.exeä ei voinut poistaa.
Logfile of HijackThis v1.99.1
Scan saved at 21:01:24, on 9.8.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\Kerio\Personal Firewall\persfw.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Common\FSGK32.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\WINDOWS\System32\ir2u705o.exe
C:\WINDOWS\etb\pokapoka62.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\HJT\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://elisa.net/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Microsoft Windows DLL Services Configuration] windir32.exe
O4 - HKLM\..\Run: [Microsoft Update 64 BIT] winman32.exe
O4 - HKLM\..\Run: [ir2u705o] C:\WINDOWS\System32\ir2u705o.exe
O4 - HKLM\..\Run: [System service62] C:\WINDOWS\etb\pokapoka62.exe
O4 - HKLM\..\RunServices: [Microsoft Windows DLL Services Configuration] windir32.exe
O4 - HKLM\..\RunServices: [Microsoft Update 64 BIT] winman32.exe
O4 - HKCU\..\Run: [EPSON Stylus C44 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C44 Series" /M "Stylus C44"
O4 - HKCU\..\Run: [Microsoft Windows DLL Services Configuration] windir32.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: F-Secure Authentication Agent (FSAA) - F-Secure Corporation. All Rights Reserved. - C:\Program Files\F-Secure\Common\FSAA.EXE
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall\persfw.exe
Yritin poistaa, nimetä uudelleen..yksi hukkui jonnekin..F-Securen ohjatulla poistolla.
Putsasin konetta ensin käsin.
Spybot ja AdAware löysi kaikenlaista, jotka poistin.
Otin nettipiuhan irti, kun virustorjunta häipyi alapalkista.
F-S löysi manuaalisessa putsauksessa 11 tartunnan saanutta. Yllämainitut ja
Trojan Downloader.Win32.dyfuca.ei:n.Uudelleennimesin muut, C:\Documents and settings\Maarit\33n.exeä ei voinut poistaa.
Logfile of HijackThis v1.99.1
Scan saved at 21:01:24, on 9.8.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\Kerio\Personal Firewall\persfw.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Common\FSGK32.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\WINDOWS\System32\ir2u705o.exe
C:\WINDOWS\etb\pokapoka62.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\HJT\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://elisa.net/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Microsoft Windows DLL Services Configuration] windir32.exe
O4 - HKLM\..\Run: [Microsoft Update 64 BIT] winman32.exe
O4 - HKLM\..\Run: [ir2u705o] C:\WINDOWS\System32\ir2u705o.exe
O4 - HKLM\..\Run: [System service62] C:\WINDOWS\etb\pokapoka62.exe
O4 - HKLM\..\RunServices: [Microsoft Windows DLL Services Configuration] windir32.exe
O4 - HKLM\..\RunServices: [Microsoft Update 64 BIT] winman32.exe
O4 - HKCU\..\Run: [EPSON Stylus C44 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C44 Series" /M "Stylus C44"
O4 - HKCU\..\Run: [Microsoft Windows DLL Services Configuration] windir32.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: F-Secure Authentication Agent (FSAA) - F-Secure Corporation. All Rights Reserved. - C:\Program Files\F-Secure\Common\FSAA.EXE
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall\persfw.exe
Vastaukset 24
Vanhimmat
Tiedostot
* Tarkistettu: 11545
* Tartunnan saanut: 11
* Mahdollisesti tartunnan saanut: 0
* Puhdistettu: 0
* Nimetty uudelleen: 0
* Poistettu: 0
* Eristetty: 0
Raportti
* C:\WINDOWS\system32\winman32.exe Virustartunta: Backdoor.Win32.Rbot.xm
* C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0107048.exe Virustartunta: IM-Worm.Win32.Kelvir.dt
* C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0107023.exe Virustartunta: Backdoor.Win32.SdBot.act
* C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0107015.exe Virustartunta: Backdoor.Win32.Rbot.xm
* C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0107009.exe Virustartunta: Trojan-Downloader.Win32.Dyfuca.ei
* C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0104962.exe Virustartunta: IM-Worm.Win32.Kelvir.dt
* C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0101905.com Virustartunta: Backdoor.Win32.SdBot.act
* C:\Program Files\Mozilla Firefox\zzz.exe Virustartunta: IM-Worm.Win32.Kelvir.dt
* C:\Documents and Settings\Maarit\zzzs.exe Virustartunta: IM-Worm.Win32.Kelvir.dt
* C:\Documents and Settings\Maarit\tispp.exe Virustartunta: IM-Worm.Win32.Kelvir.dt
* C:\Documents and Settings\Maarit\33n.exe Virustartunta: IM-Worm.Win32.Kelvir.dt
Scannaa tuo tuolla ja ilmoita tulos
C:\WINDOWS\System32\ir2u705o.exe
http://virusscan.jotti.org/
Service load:
0% 100%
File: ir2u705o.exe
Status:
INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database) (Note: only non-destructive malware has been found. Considering the non-destructive nature of samples like these - although they can be a pain -, results will not be stored in the database.)
MD5 07ee4d73ff5f9005fbe4fa0f1d386c97
Packers detected:
-
Scanner results
AntiVir Found nothing
ArcaVir Found Adware.Sahat.J06
Avast Found Win32:Adan-003
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found Adware.Shopathome
Dr.Web Found not a virus Adware.SAHAgent
F-Prot Antivirus Found nothing
Fortinet Found nothing
Kaspersky Anti-Virus Found not-a-virus:AdWare.Sahat.ai
NOD32 Found Win32/Adware.SAHAgent application
Norman Virus Control Found nothing
UNA Found nothing
VBA32 Found AdWare.Sahat.ai
Lisää-poista ohjelmissa on Select CashBack, ja IE availee jotain http:adsonwww.com sivua.
Merkkaa ja Fix:saa
O4 - HKLM\..\Run: [Microsoft Windows DLL Services Configuration] windir32.exe
O4 - HKLM\..\Run: [Microsoft Update 64 BIT] winman32.exe
O4 - HKLM\..\Run: [ir2u705o] C:\WINDOWS\System32\ir2u705o.exe
O4 - HKLM\..\Run: [System service62] C:\WINDOWS\etb\pokapoka62.exe
O4 - HKLM\..\RunServices: [Microsoft Windows DLL Services Configuration] windir32.exe
O4 - HKLM\..\RunServices: [Microsoft Update 64 BIT] winman32.exe
O4 - HKCU\..\Run: [Microsoft Windows DLL Services Configuration] windir32.exe
Sitte poista vikasietotilassa
C:\WINDOWS\System32\ir2u705o.exe
C:\WINDOWS\etb\pokapoka62.exe
Käynnistä sitte normaalisti ja uus logi.
Logfile of HijackThis v1.99.1
Scan saved at 22:35:18, on 9.8.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\Kerio\Personal Firewall\persfw.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Common\FSGK32.EXE
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\PROGRA~1\MOZILL~1\firefox.exe
C:\HJT\HijackThis.exe
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\ca1c9a5f6bfb5c940f7b592a816e164e\WindowsInstaller-KB893803-v2-x86.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://elisa.net/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [System service62] C:\WINDOWS\etb\pokapoka62.exe
O4 - HKCU\..\Run: [EPSON Stylus C44 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C44 Series" /M "Stylus C44"
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: F-Secure Authentication Agent (FSAA) - F-Secure Corporation. All Rights Reserved. - C:\Program Files\F-Secure\Common\FSAA.EXE
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall\persfw.exe
Unohdin :( aikaisemmin tuli pari kertaa ilmoitus F-S:ltä:
Vahingollinen koodi löytynyt tiedostosta
C:\WINDOWS\System32\winman32.exe, ei toimintoa.
Merkkaa ja Fix:saa
O4 - HKLM\..\Run: [System service62] C:\WINDOWS\etb\pokapoka62.exe
Tuo rivi
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
Jos ite tai joku muu on sen määritelly,niin anna olla muuten merkka se myös.
Sitte scannaa kone tolla
http://koti.mbnet.fi/pattaya1/escanmwav.htm
Jos jotain ilmestyy alaikkunaan,niin kopioi ne tänne.
ei suostu aukeamaan!
Teinkö väärin kun käynnistin uudelleen tuon 04-rivin fixin jälkeen?
06 on ok.
Jaa vai ei suostu toimiin.
Pistä vielä uus logi,niin nähään onko se puhas.
ei toiminut. Latasin sen tapa 1 zipin ja kokeilen sillä.
Entä se Select CashBack, se on poistettavien ohjelmien listalla. Kysyy poistossa koodia siihen laatikkoon?
Logfile of HijackThis v1.99.1
Scan saved at 23:15:37, on 9.8.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\Kerio\Personal Firewall\persfw.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Common\FSGK32.EXE
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\HJT\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://elisa.net/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [EPSON Stylus C44 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C44 Series" /M "Stylus C44"
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: F-Secure Authentication Agent (FSAA) - F-Secure Corporation. All Rights Reserved. - C:\Program Files\F-Secure\Common\FSAA.EXE
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall\persfw.exe
Logi on ok ja jos tuo löytyy niin poista se
C:\WINDOWS\System32\winman32.exe
> Entä se Select CashBack, se on poistettavien ohjelmien listalla. Kysyy poistossa koodia siihen laatikkoon? <
En tiiä mutta kokeile Hijackin Uninstall Managerilla poistaa se.
Config.. > Misc Tools > sieltä löytyy
aamulla?
Teen nuo kuitenkin vielä.
Escan pyörii ja löysi jo 41 satiaista.
Tuo virusimuri, yksi käyttäjistä, kärkkyy meselle..ja kyselee oletko hyvä tyyppi?
Sanoin, että olet niin hyvä ammattilainen, jotta tarjotaan koko porukalla iso, kylmä virtuaali-
huurteinen [_]o kiitokseksi tähänastisesta. Mutta säästä se viikonloppuun :)
Koneelta löytyi DCPlusPlus..
Kiitos ököstä joo nyt mennään nukkuun.
Dc pidosta tai poistosta saat päättää ite.
Huomenta!
File C:\WINDOWS\6ogcter6.exe tagged as not-a-virus:AdWare.Sahat.ah. No Action Taken.
File C:\WINDOWS\System32\1a.exe tagged as not-a-virus:AdWare.WinAD.bf. No Action Taken.
File C:\WINDOWS\System32\winman32.exe infected by "Backdoor.Win32.Rbot.xm" Virus. Action Taken: File to be renamed on reboot.
File C:\Documents and Settings\Jaana\1xa.exe tagged as not-a-virus:AdWare.WinAD.bf. No Action Taken.
File C:\Documents and Settings\Maarit\1.exe tagged as not-a-virus:AdWare.WinAD.bf. No Action Taken.
File C:\Documents and Settings\Maarit\1a.exe tagged as not-a-virus:AdWare.WinAD.bf. No Action Taken.
File C:\Documents and Settings\Maarit\1xa.exe tagged as not-a-virus:AdWare.WinAD.bf. No Action Taken.
File C:\Documents and Settings\Maarit\33n.exe infected by "IM-Worm.Win32.Kelvir.dt" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Maarit\mc-58-12-0000080.exe tagged as not-a-virus:AdWare.Maxifiles.f. No Action Taken.
File C:\Documents and Settings\Maarit\tispp.exe infected by "IM-Worm.Win32.Kelvir.dt" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Maarit\zzzs.exe infected by "IM-Worm.Win32.Kelvir.dt" Virus. Action Taken: File Deleted.
File C:\Program Files\Mozilla Firefox\zzz.exe infected by "IM-Worm.Win32.Kelvir.dt" Virus. Action Taken: File Deleted.
File C:\RECYCLER\S-1-5-21-1757981266-2111687655-1957994488-1001\Dc7.tmp1 tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0101905.com infected by "Backdoor.Win32.SdBot.act" Virus. Action Taken: File to be renamed on reboot.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0102896.dll tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0102898.dll tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0102909.dll tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0102910.dll tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0103917.dll tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0103918.dll tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0103920.exe tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0103933.dll tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0103934.dll tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0103946.dll tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0103947.dll tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0103948.exe tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0104947.dll tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0104948.dll tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0104957.exe tagged as not-a-virus:AdWare.WinAD.bf. No Action Taken.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0104959.dll tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0104960.dll tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0104961.exe tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0104962.exe infected by "IM-Worm.Win32.Kelvir.dt" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0104968.dll tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0104969.dll tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0104975.dll tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0104976.dll tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0105983.dll tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0105985.dll tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0105986.exe tagged as not-a-virus:AdWare.WinAD.bf. No Action Taken.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0105987.exe tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0106005.dll tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0106006.exe tagged as not-a-virus:AdWare.WinAD.bf. No Action Taken.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0106007.dll tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0106008.exe tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0107003.exe tagged as not-a-virus:AdWare.WinAD.bf. No Action Taken.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0107005.exe tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0107008.dll tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0107010.dll tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0107015.exe infected by "Backdoor.Win32.Rbot.xm" Virus. Action Taken: File to be renamed on reboot.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0107023.exe infected by "Backdoor.Win32.SdBot.act" Virus. Action Taken: File to be renamed on reboot.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0107048.exe infected by "IM-Worm.Win32.Kelvir.dt" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0107049.dll tagged as not-a-virus:AdWare.Sahat.ad. No Action Taken.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0107050.exe tagged as not-a-virus:AdWare.WinAD.bf. No Action Taken.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0107051.exe tagged as not-a-virus:AdWare.Sahat.f. No Action Taken.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0107072.dll tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP159\A0107073.dll tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP160\A0107198.exe tagged as not-a-virus:AdWare.Sahat.ai. No Action Taken.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP160\A0107199.exe tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP163\A0108272.exe infected by "Backdoor.Win32.Rbot.xm" Virus. Action Taken: File to be renamed on reboot.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP163\A0108273.exe infected by "IM-Worm.Win32.Kelvir.dt" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP163\A0108274.exe infected by "IM-Worm.Win32.Kelvir.dt" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP163\A0108275.exe infected by "IM-Worm.Win32.Kelvir.dt" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{F9982FA4-DEB2-4670-9EA4-A36613ADFFD2}\RP163\A0108279.exe infected by "IM-Worm.Win32.Kelvir.dt" Virus. Action Taken: File Deleted.
File C:\temp\180SAInstaller.exe tagged as not-a-virus:AdWare.180Solutions.g. No Action Taken.
File C:\WINDOWS\6ogcter6.exe tagged as not-a-virus:AdWare.Sahat.ah. No Action Taken.
File C:\WINDOWS\etb\nt_hide62.dll tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
File C:\WINDOWS\etb\xud_62.dll tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
File C:\WINDOWS\system32\1a.exe tagged as not-a-virus:AdWare.WinAD.bf. No Action Taken.
Winman32.exeä ei löytynyt, salaiset kansiot aukikaan. Cashback sai kyytiä.
Nyt avatessa F-S ilmoitti taas Backdoor.Win32.Rbot.xm:stä. Ei voinut tehdä mitään.
Winman32.exe: ei voitu käsitellä, joko jokin toinen sovellus tai tiedosto käyttää,
tai kirjoitussuojatussa asemassa.
F-S poisti Backdoor.Win32.Sdpot.act:n.
Kerio on minulle outo, mutta tilkkasin sen kysymään kaiken liikenteen. Ei kysellyt eilen mitään..nyt ulos yrittää jatkuvasti eri osoitteisiin tcpip kernel driver?
Logfile of HijackThis v1.99.1
Scan saved at 12:06:21, on 10.8.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\Kerio\Personal Firewall\persfw.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\F-Secure\Common\FSGK32.EXE
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Kaspersky\mwavscan.com
C:\Kaspersky\kavss.exe
C:\HJT\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://elisa.net/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [EPSON Stylus C44 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C44 Series" /M "Stylus C44"
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: F-Secure Authentication Agent (FSAA) - F-Secure Corporation. All Rights Reserved. - C:\Program Files\F-Secure\Common\FSAA.EXE
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall\persfw.exe
> Winman32.exe: ei voitu käsitellä <
> File C:\WINDOWS\System32\winman32.exe infected by "Backdoor.Win32.Rbot.xm" Virus. Action Taken: File to be renamed on reboot. <
Elikkäs sen nimi vaihtuu seuraavassa koneen startissa ja sitte se on pois pelistä.
Poista nuo
C:\WINDOWS\6ogcter6.exe
C:\WINDOWS\System32\1a.exe
C:\Documents and Settings\Jaana\1xa.exe
C:\Documents and Settings\Maarit\1.exe
C:\Documents and Settings\Maarit\mc-58-12-0000080.exe
C:\WINDOWS\etb\nt_hide62.dll
C:\WINDOWS\etb\xud_62.dll
Tyhjennä kaikki Tempit
Sitte sammuta järjestelmänpalautustoiminto, käynnistä kone uudestaan ja pistä se takas päälle ja tee uus palautuspiste.
Hyvä on.
Tein kaiken tuon, mutta tuolla C:\Documents and Settings\Maarit\ siellä on 1a.exe ja 1xa.exe?
Taidan hivauttaa tuon Kerion ja F-Securenkin jossain vaiheessa pois, ja laittaa tilalle ZoneAlarmin ja Antivirin. Ja opetan niiden käytön..kun kerran joudun ramppaamaan koneella jatkuvasti ;)
Poistan ne käsin? Ja ajan AdAwaren ja Spybotin.
1a.exe
Status:
INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database) (Note: only non-destructive malware has been found. Considering the non-destructive nature of samples like these - although they can be a pain -, results will not be stored in the database.)
MD5 37c87888e1ff84c0a63f639dfdf20fe3
Packers detected:
UPX Scanner results
AntiVir Found TR/Dldr.180Instal.2
ArcaVir Found Adware.Mediagtw.A3
Avast Found Win32:Adan-121
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
Dr.Web Found not a virus Adware.WinUpd
F-Prot Antivirus Found nothing
Fortinet Found nothing
Kaspersky Anti-Virus Found not-a-virus:AdWare.WinAD.bf
NOD32 Found probably a variant of Win32/Adware.WUpd application (probable variant)
Norman Virus Control Found nothing
UNA Found nothing
VBA32 Found AdWare.WinAD.bf
1xa.exe
Status:
INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database) (Note: only non-destructive malware has been found. Considering the non-destructive nature of samples like these - although they can be a pain -, results will not be stored in the database.)
MD5 37c87888e1ff84c0a63f639dfdf20fe3
Packers detected:
UPX Scanner results
AntiVir Found TR/Dldr.180Instal.2
ArcaVir Found Adware.Mediagtw.A3
Avast Found Win32:Adan-121
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
Dr.Web Found not a virus Adware.WinUpd
F-Prot Antivirus Found nothing
Fortinet Found nothing
Kaspersky Anti-Virus Found not-a-virus:AdWare.WinAD.bf
NOD32 Found probably a variant of Win32/Adware.WUpd application (probable variant)
Norman Virus Control Found nothing
UNA Found nothing
VBA32 Found AdWare.WinAD.bf
Tipsz.exe
The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file
Löysin tästä googlella jotain.
> Tein kaiken tuon, mutta tuolla C:\Documents and Settings\Maarit\ siellä on 1a.exe ja 1xa.exe? <
Pois vaan molemmat.
1xa.exe, yhteiskäyttövirhe.
AdAware löysi kaksi kriittistä objektia, WindUpdates, punainen pallukka.
Jos heitetään format c..niin tehtiin kuulemma monta kertaa ennen selaimenvaihtoakin :D
Ja pistetään puhtaalle levylle uudet systeemit?
Mikä riesa..
Tarvi ainakaan vielä mitään formaattia.
Koitikko poistoo vikasietotilassa.
Siellä lähti. Huh! Täytyy pistää tuo korvan taakse.
Kokeilen vielä jotain putsareita, säätelen konetta ja palailen astialle..
Ja sinulle monta isoa eilisenkaltaista virtuaalijuomaa, mutta ei työaikana..
Kiitämme ja niiaamme syvään jo tässä vaiheessa!
Kiitos viimeisestä!
Kone toimii kuulemma nyt, ei jää jumiin, ei sammuile, ja netti aukeaa hyvin.
Lueskelin tuota Chocon logia.
Tähänhän jäi se etb-kansio, jossa Tipsz.exe
(The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file)
Tarkistin jotilla kun oli outo. Luulin löytäneeni Googlella tietoja mutta teinkin kirjoitusvirheen..
En muista oliko siellä muuta. Eivät osaa itse poistaa joten..
Riittääkö jos ajaa ennen/päälle tavalliset putsingit, ja Regseekeerin vai pitäisikö käydä regeditillä..se kansio oli C:\WINDOWS:ssa?
Voiko se sellaisenaan muhia sieltä jotain? Tämä porukka tuntuu saavan parissa kolmessa viikossa koneen aina samaan kuntoon..
Joo poista se kansio
C:\WINDOWS\etb\
vikasietotilassa