Olen käyttänyt F-securen tuotetta (Elisa tietoturvapalvelu)ja viimeaikoina hälytyksiä ei ole juurikaan tullut joten rupesin epäilemään mahtaako olla jotain vikaa...
Tässä on Escan logia. Miltä näyttää?
File C:\WINDOWS\system32\70tovmto.ini tagged as not-a-virus:AdWare.Win32.Sahat.ao. No Action Taken.
File C:\WINDOWS\system32\gah95on6.ini tagged as not-a-virus:AdWare.Win32.Sahat.ao. No Action Taken.
File C:\Documents and Settings\xxxxx\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\BlackBox.class-7fb5dbb4-47ec7693.class infected by "Trojan.Java.ClassLoader.f" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\xxxxx\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\Dummy.class-645f4c2c-7137de09.class infected by "Trojan.Java.ClassLoader.Dummy.d" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\xxxxx\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\SecurityClassLoader.class-42aa640a-626b1724.class infected by "Trojan-Clicker.Win32.Spywad.b" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\xxxxx\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\VerifierBug.class-57601442-7497b769.class infected by "Exploit.Java.Bytverify" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\xxxxx\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive1213.jar-78fc7b1f-23267bd5.zip infected by "Trojan.Java.ClassLoader.ak" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\xxxxx\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-2fa9f21f-5240510d.zip infected by "Trojan.Java.ClassLoader.c" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\xxxxx\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-51ec025a-4df26b40.zip infected by "Trojan.Java.ClassLoader.c" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\xxxxx\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-5b0d960e-1ed91403.zip infected by "Trojan.Java.ClassLoader.c" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\xxxxx\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-d73f6a9-56e4a472.zip infected by "Trojan.Java.ClassLoader.c" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\xxxxx\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-1101e5-648dfc12.zip infected by "Exploit.Java.ByteVerify" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\xxxxx\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-1ec7e93-7c9e880e.zip infected by "Exploit.Java.ByteVerify" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\xxxxx\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-2992b227-446ababf.zip infected by "Exploit.Java.ByteVerify" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\xxxxx\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-3a954017-11882dfd.zip infected by "Exploit.Java.ByteVerify" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\xxxxx\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-5c6d80ec-4e9a9388.zip infected by "Exploit.Java.ByteVerify" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\xxxxx\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-8fcb128-103cffc1.zip infected by "Exploit.Java.ByteVerify" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\xxxxx\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-cb9148-4d3eac08.zip infected by "Exploit.Java.ByteVerify" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\xxxxx\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loader.jar-273595c6-2795d150.zip infected by "Trojan.Java.ClassLoader.h" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\xxxxx\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv418.jar-660f6c7c-250e0c72.zip infected by "Trojan-Downloader.Java.OpenStream.c" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\xxxxx\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv783.jar-106d9513-59e8f46b.zip infected by "Trojan-Downloader.Java.OpenStream.c" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\xxxxx\Local Settings\Temp\delwbi.tmp tagged as not-a-virus:Dialer.Win32.gen. No Action Taken.
File C:\Documents and Settings\xxxxx\Local Settings\Temp\temp.fr5918\MediaAccess.exe tagged as not-a-virus:AdWare.Win32.WinAD.at. No Action Taken.
File C:\Documents and Settings\xxxxx\Local Settings\Temporary Internet Files\Content.IE5\05034NOB\ASS[1].0TM infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\xxxxx\Local Settings\Temporary Internet Files\Content.IE5\05034NOB\MC-DUBS2[1].0TM infected by "Trojan.JS.NoClose.r" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\xxxxx\Local Settings\Temporary Internet Files\Content.IE5\7ZR1BLME\WOW[1].0TM infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\xxxxx\Local Settings\Temporary Internet Files\Content.IE5\9JF7HL8E\MC-DUBS2[1].0TM infected by "Trojan.JS.NoClose.r" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\xxxxx\Local Settings\Temporary Internet Files\Content.IE5\DN7Z1XOE\1[1].0TM infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\xxxxx\Local Settings\Temporary Internet Files\Content.IE5\G3RRM415\INDEX[1].0TM infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\xxxxx\Local Settings\Temporary Internet Files\Content.IE5\IBAJ6PYV\1[1].0TM infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\xxxxx\Local Settings\Temporary Internet Files\Content.IE5\MHHUFQ1O\1[1].0TM infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\xxxxx\Local Settings\Temporary Internet Files\Content.IE5\QDWJQDY5\WOW[1].0TM infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\xxxxx\Local Settings\Temporary Internet Files\Content.IE5\QRQVQHQZ\EXPLOIT[1].0TM infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\xxxxx\Local Settings\Temporary Internet Files\Content.IE5\S5IF8L23\ASS[1].0TM infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\xxxxx\Local Settings\Temporary Internet Files\Content.IE5\S5IF8L23\ASS[2].0TM infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\xxxxx\Local Settings\Temporary Internet Files\Content.IE5\TSFQ7F5Z\1[1].0TM infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\xxxx xxxxxxxxx\Local Settings\Temp\delwbi.tmp tagged as not-a-virus:Dialer.Win32.gen. No Action Taken.
File C:\System Volume Information\_restore{DE49B58A-4713-4D29-9C92-5FDA3FD4CAD0}\RP148\A0023103.exe tagged as not-a-virus:Dialer.Win32.gen. No Action Taken.
File C:\WINDOWS\system32\70tovmto.ini tagged as not-a-virus:AdWare.Win32.Sahat.ao. No Action Taken.
File C:\WINDOWS\system32\gah95on6.ini tagged as not-a-virus:AdWare.Win32.Sahat.ao. No Action Taken.
Tässä on Escan logia. Miltä näyttää?
File C:\WINDOWS\system32\70tovmto.ini tagged as not-a-virus:AdWare.Win32.Sahat.ao. No Action Taken.
File C:\WINDOWS\system32\gah95on6.ini tagged as not-a-virus:AdWare.Win32.Sahat.ao. No Action Taken.
File C:\Documents and Settings\xxxxx\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\BlackBox.class-7fb5dbb4-47ec7693.class infected by "Trojan.Java.ClassLoader.f" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\xxxxx\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\Dummy.class-645f4c2c-7137de09.class infected by "Trojan.Java.ClassLoader.Dummy.d" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\xxxxx\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\SecurityClassLoader.class-42aa640a-626b1724.class infected by "Trojan-Clicker.Win32.Spywad.b" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\xxxxx\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\VerifierBug.class-57601442-7497b769.class infected by "Exploit.Java.Bytverify" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\xxxxx\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive1213.jar-78fc7b1f-23267bd5.zip infected by "Trojan.Java.ClassLoader.ak" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\xxxxx\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-2fa9f21f-5240510d.zip infected by "Trojan.Java.ClassLoader.c" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\xxxxx\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-51ec025a-4df26b40.zip infected by "Trojan.Java.ClassLoader.c" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\xxxxx\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-5b0d960e-1ed91403.zip infected by "Trojan.Java.ClassLoader.c" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\xxxxx\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-d73f6a9-56e4a472.zip infected by "Trojan.Java.ClassLoader.c" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\xxxxx\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-1101e5-648dfc12.zip infected by "Exploit.Java.ByteVerify" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\xxxxx\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-1ec7e93-7c9e880e.zip infected by "Exploit.Java.ByteVerify" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\xxxxx\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-2992b227-446ababf.zip infected by "Exploit.Java.ByteVerify" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\xxxxx\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-3a954017-11882dfd.zip infected by "Exploit.Java.ByteVerify" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\xxxxx\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-5c6d80ec-4e9a9388.zip infected by "Exploit.Java.ByteVerify" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\xxxxx\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-8fcb128-103cffc1.zip infected by "Exploit.Java.ByteVerify" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\xxxxx\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-cb9148-4d3eac08.zip infected by "Exploit.Java.ByteVerify" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\xxxxx\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loader.jar-273595c6-2795d150.zip infected by "Trojan.Java.ClassLoader.h" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\xxxxx\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv418.jar-660f6c7c-250e0c72.zip infected by "Trojan-Downloader.Java.OpenStream.c" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\xxxxx\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv783.jar-106d9513-59e8f46b.zip infected by "Trojan-Downloader.Java.OpenStream.c" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\xxxxx\Local Settings\Temp\delwbi.tmp tagged as not-a-virus:Dialer.Win32.gen. No Action Taken.
File C:\Documents and Settings\xxxxx\Local Settings\Temp\temp.fr5918\MediaAccess.exe tagged as not-a-virus:AdWare.Win32.WinAD.at. No Action Taken.
File C:\Documents and Settings\xxxxx\Local Settings\Temporary Internet Files\Content.IE5\05034NOB\ASS[1].0TM infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\xxxxx\Local Settings\Temporary Internet Files\Content.IE5\05034NOB\MC-DUBS2[1].0TM infected by "Trojan.JS.NoClose.r" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\xxxxx\Local Settings\Temporary Internet Files\Content.IE5\7ZR1BLME\WOW[1].0TM infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\xxxxx\Local Settings\Temporary Internet Files\Content.IE5\9JF7HL8E\MC-DUBS2[1].0TM infected by "Trojan.JS.NoClose.r" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\xxxxx\Local Settings\Temporary Internet Files\Content.IE5\DN7Z1XOE\1[1].0TM infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\xxxxx\Local Settings\Temporary Internet Files\Content.IE5\G3RRM415\INDEX[1].0TM infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\xxxxx\Local Settings\Temporary Internet Files\Content.IE5\IBAJ6PYV\1[1].0TM infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\xxxxx\Local Settings\Temporary Internet Files\Content.IE5\MHHUFQ1O\1[1].0TM infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\xxxxx\Local Settings\Temporary Internet Files\Content.IE5\QDWJQDY5\WOW[1].0TM infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\xxxxx\Local Settings\Temporary Internet Files\Content.IE5\QRQVQHQZ\EXPLOIT[1].0TM infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\xxxxx\Local Settings\Temporary Internet Files\Content.IE5\S5IF8L23\ASS[1].0TM infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\xxxxx\Local Settings\Temporary Internet Files\Content.IE5\S5IF8L23\ASS[2].0TM infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\xxxxx\Local Settings\Temporary Internet Files\Content.IE5\TSFQ7F5Z\1[1].0TM infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\xxxx xxxxxxxxx\Local Settings\Temp\delwbi.tmp tagged as not-a-virus:Dialer.Win32.gen. No Action Taken.
File C:\System Volume Information\_restore{DE49B58A-4713-4D29-9C92-5FDA3FD4CAD0}\RP148\A0023103.exe tagged as not-a-virus:Dialer.Win32.gen. No Action Taken.
File C:\WINDOWS\system32\70tovmto.ini tagged as not-a-virus:AdWare.Win32.Sahat.ao. No Action Taken.
File C:\WINDOWS\system32\gah95on6.ini tagged as not-a-virus:AdWare.Win32.Sahat.ao. No Action Taken.
Vastaukset 8
Vanhimmat
Poista nämä:
C:\WINDOWS\system32\==>70tovmto.inigah95on6.inidelwbi.tmpMediaAccess.exe http://koti.mbnet.fi/pattaya1/HijackThis.exe . Tallenna hakemistoon c:\hjt, käynnistä, klikkaa do a system scan and save a logfile ja lähetä loki tänne.
Kiitos neuvoista.Nyt sain ohjeiden mukaan tehtynä tämän.Siitä aloituksesta,uudelleen nimetyt voinee poistaa jos löytää...
Logfile of HijackThis v1.99.1
Scan saved at 13:03:24, on 11/04/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ELISAT~1\backweb\4119343\Program\SERVIC~1.EXE
C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsgk32st.exe
C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\FSGK32.EXE
C:\Program Files\Elisa Tietoturvapalvelu\backweb\4119343\program\fsbwsys.exe
C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fssm32.exe
C:\Program Files\Elisa Tietoturvapalvelu\Common\FSMA32.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Elisa Tietoturvapalvelu\Common\FSMB32.EXE
C:\Program Files\Elisa Tietoturvapalvelu\Common\FCH32.EXE
C:\Program Files\Elisa Tietoturvapalvelu\Common\FAMEH32.EXE
C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsav32.exe
C:\Program Files\Elisa Tietoturvapalvelu\FWES\Program\fsdfwd.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ULI5289\ALi5289.exe
C:\Program Files\ULI5289\JMAP5289.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Elisa Tietoturvapalvelu\Common\FSM32.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Elisa Tietoturvapalvelu\FSGUI\fsguiexe.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe
C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe
C:\Program Files\Elisa Tietoturvapalvelu\backweb\4119343\Program\fspex.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\OpenOffice.org1.1.4\program\soffice.exe
C:\hjt\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.suomi24.fi/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ALi5289] C:\Program Files\ULI5289\ALi5289.exe
O4 - HKLM\..\Run: [JMAP5289] C:\Program Files\ULI5289\JMAP5289.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Elisa Tietoturvapalvelu\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Elisa Tietoturvapalvelu\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\Elisa Tietoturvapalvelu\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [InstantTray] C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe
O4 - HKCU\..\Run: [IW_Drop_Icon] C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe /DropDisc
O4 - Startup: OpenOffice.org 1.1.4.lnk = C:\Program Files\OpenOffice.org1.1.4\program\quickstart.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/CDT/ie/bridge-c18.cab
O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} (F-Secure Online Scanner) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Elisa Tietoturvapalvelu (BackWeb Plug-in - 4119343) - Unknown owner - C:\PROGRA~1\ELISAT~1\backweb\4119343\Program\SERVIC~1.EXE
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Elisa Tietoturvapalvelu\backweb\4119343\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Elisa Tietoturvapalvelu\FWES\Program\fsdfwd.exe
O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Elisa Tietoturvapalvelu\Common\FSMA32.EXE
O23 - Service: iPod-palvelu (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
Juu, voi poistaa.
Fixaa nämä(do a system scan only, merkkaa ja paina fix checked):
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file) O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} -http://static.windupdates.com/cab/CDT/ie/bridge-c18.cab
Tarkista nämä:
C:\Program Files\ULI5289\==>ALi5289.exeJMAP5289.exe http://virusscan.jotti.org ja lähetä tulokset tänne. Lähetä myös uusi HjT-loki.
Se http://virusscan.jotti.org Ei löytänyt mitään ja Tässä on uusi HJT. Escan löysi yhden viruksen.
Logfile of HijackThis v1.99.1
Scan saved at 17:00:59, on 11/04/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ULI5289\ALi5289.exe
C:\Program Files\ULI5289\JMAP5289.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Elisa Tietoturvapalvelu\Common\FSM32.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe
C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\OpenOffice.org1.1.4\program\soffice.exe
C:\PROGRA~1\ELISAT~1\backweb\4119343\Program\SERVIC~1.EXE
C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsgk32st.exe
C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\FSGK32.EXE
C:\Program Files\Elisa Tietoturvapalvelu\backweb\4119343\program\fsbwsys.exe
C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fssm32.exe
C:\Program Files\Elisa Tietoturvapalvelu\Common\FSMA32.EXE
C:\Program Files\Elisa Tietoturvapalvelu\backweb\4119343\Program\fspex.exe
C:\Program Files\Elisa Tietoturvapalvelu\Common\FSMB32.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Elisa Tietoturvapalvelu\Common\FCH32.EXE
C:\Program Files\Elisa Tietoturvapalvelu\Common\FAMEH32.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Elisa Tietoturvapalvelu\FWES\Program\fsdfwd.exe
C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsav32.exe
C:\Program Files\Elisa Tietoturvapalvelu\FSGUI\fsguiexe.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\hjt\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.suomi24.fi/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ALi5289] C:\Program Files\ULI5289\ALi5289.exe
O4 - HKLM\..\Run: [JMAP5289] C:\Program Files\ULI5289\JMAP5289.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Elisa Tietoturvapalvelu\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Elisa Tietoturvapalvelu\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\Elisa Tietoturvapalvelu\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [InstantTray] C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe
O4 - HKCU\..\Run: [IW_Drop_Icon] C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe /DropDisc
O4 - Startup: OpenOffice.org 1.1.4.lnk = C:\Program Files\OpenOffice.org1.1.4\program\quickstart.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} (F-Secure Online Scanner) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Elisa Tietoturvapalvelu (BackWeb Plug-in - 4119343) - Unknown owner - C:\PROGRA~1\ELISAT~1\backweb\4119343\Program\SERVIC~1.EXE
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\Elisa Tietoturvapalvelu\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Elisa Tietoturvapalvelu\backweb\4119343\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Elisa Tietoturvapalvelu\FWES\Program\fsdfwd.exe
O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Elisa Tietoturvapalvelu\Common\FSMA32.EXE
O23 - Service: iPod-palvelu (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
Loki on ok.
Ihan ok mun silmiin (tosin en kauheen tarkkaan lukenu). Näytti olevan kiitettävä määrä hyökkäyksiä tullu, ja fs blokannu kaikki. nuo ohjelmat ollaan tehty sellaisiksi ettei normaali käyttäjä huomaa mitään, jottei käyttäjä hermostuisi. no kannattaa kuitenkin scannata vielä esim Ad-aware ohjelmalla noita mainosohjelmia josko niitä löytyisi koneelta. todennäköisesti löytyy
..tuo loki F-securea nähnytkään. Se on eScanin loki ja muutama mainosohjelma löytyi. Ja eScan/ewido löytää mainosohjelmat kyllä, Ad-awaren löytökyky on aika vaatimatonta.
ei mitään hyökäyksiä nehän on koneella jo.
osa deletoitu osa nimetty uudestaan ja myös toimivia. Noin äkkiä vilastuna.