Saamani ystävällisen ohjeen mukaan asensin eScanin, päivitin sen ja scannasin. Kylläpä se kesti ja mietin että miksiköhän tarkastettujen tiedostojen määrä oli 'vain' 39 000 kun olen huomannut että esim. Ad-Aware seuloo vajaat 100 000 tiedostoa. No, saalista kertyi näistäkin. Mitä uskaltaa poistaa ja onnistuuko se vain tyyliin maalaus ja delete?
File C:\WINDOWS\System32\uikir.dll tagged as not-a-virus:AdWare.Win32.SBSoft.h. No Action Taken.
File C:\WINDOWS\desktop.html infected by "not-virus:Hoax.Win32.Aflac.a" Virus. Action Taken: File Renamed.
File C:\WINDOWS\System32\idownload.exe infected by "Trojan-Downloader.Win32.Small.buy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\System32\uikir.dll tagged as not-a-virus:AdWare.Win32.SBSoft.h. No Action Taken.
File C:\Documents and Settings\Jani Lappi\Local Settings\Temp\yu5vp57h.exe infected by "Trojan.Win32.Dialer.ht" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Jani Lappi\Local Settings\Temporary Internet Files\Content.IE5\1RJZHPOE\177[1].jpg infected by "Trojan-Downloader.Win32.Small.ccn" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\03E864AC.exe tagged as not-a-virus:AdWare.Win32.Raze.a. No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\13124163.0xe infected by "Trojan.Win32.StartPage.rw" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\1BE21962.0xe infected by "Trojan.Win32.WebSearch.d" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\2FD43576.exe infected by "Backdoor.Win32.Agent.rw" Virus. Action Taken: File Renamed.
File C:\Program Files\Norton AntiVirus\Quarantine\2FE40764.exe tagged as not-a-virus:AdWare.Win32.Raze.a. No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\40FA298D.php infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Program Files\Norton AntiVirus\Quarantine\40FD538A.0tm infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Program Files\Norton AntiVirus\Quarantine\41007D86.0tm infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Program Files\Norton AntiVirus\Quarantine\41032782.0tm infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Program Files\Norton AntiVirus\Quarantine\410A7B7B.php infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Program Files\Norton AntiVirus\Quarantine\410D2578.0xe infected by "Trojan.Win32.Regger.j" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\42F94F5A.0xe infected by "Trojan.Win32.Regger.j" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\42FF2353.0xe infected by "Trojan.Win32.Regger.j" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{6D447FF4-821A-49D1-A403-3173C3560718}\RP290\A0023867.exe tagged as not-a-virus:AdWare.Win32.Raze.a. No Action Taken.
File C:\System Volume Information\_restore{6D447FF4-821A-49D1-A403-3173C3560718}\RP290\A0023899.exe infected by "Trojan.Win32.DNSChanger.bj" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{6D447FF4-821A-49D1-A403-3173C3560718}\RP291\A0023907.exe tagged as not-a-virus:AdWare.Win32.Raze.a. No Action Taken.
File C:\System Volume Information\_restore{6D447FF4-821A-49D1-A403-3173C3560718}\RP291\A0023942.exe tagged as not-a-virus:AdWare.Win32.Raze.a. No Action Taken.
File C:\System Volume Information\_restore{6D447FF4-821A-49D1-A403-3173C3560718}\RP292\A0023947.exe tagged as not-a-virus:AdWare.Win32.Raze.a. No Action Taken.
File C:\System Volume Information\_restore{6D447FF4-821A-49D1-A403-3173C3560718}\RP292\A0023994.exe tagged as not-a-virus:AdWare.Win32.Raze.a. No Action Taken.
File C:\System Volume Information\_restore{6D447FF4-821A-49D1-A403-3173C3560718}\RP293\A0023998.exe tagged as not-a-virus:AdWare.Win32.Raze.a. No Action Taken.
File C:\System Volume Information\_restore{6D447FF4-821A-49D1-A403-3173C3560718}\RP295\A0024086.exe infected by "Trojan-Downloader.Win32.Small.buy" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{6D447FF4-821A-49D1-A403-3173C3560718}\RP296\A0024128.exe tagged as not-a-virus:AdWare.Win32.Raze.a. No Action Taken.
File C:\System Volume Information\_restore{6D447FF4-821A-49D1-A403-3173C3560718}\RP296\A0024172.exe tagged as not-a-virus:AdWare.Win32.Raze.a. No Action Taken.
File C:\System Volume Information\_restore{6D447FF4-821A-49D1-A403-3173C3560718}\RP297\A0024190.exe infected by "Backdoor.Win32.Agent.rw" Virus. Action Taken: File to be renamed on reboot.
File C:\System Volume Information\_restore{6D447FF4-821A-49D1-A403-3173C3560718}\RP297\A0024191.exe tagged as not-a-virus:AdWare.Win32.Raze.a. No Action Taken.
File C:\System Volume Information\_restore{6D447FF4-821A-49D1-A403-3173C3560718}\RP297\A0024192.exe infected by "Trojan-Downloader.Win32.Small.buy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\uikir.dll tagged as not-a-virus:AdWare.Win32.SBSoft.h. No Action Taken.
File C:\WINDOWS\System32\uikir.dll tagged as not-a-virus:AdWare.Win32.SBSoft.h. No Action Taken.
File C:\WINDOWS\desktop.html infected by "not-virus:Hoax.Win32.Aflac.a" Virus. Action Taken: File Renamed.
File C:\WINDOWS\System32\idownload.exe infected by "Trojan-Downloader.Win32.Small.buy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\System32\uikir.dll tagged as not-a-virus:AdWare.Win32.SBSoft.h. No Action Taken.
File C:\Documents and Settings\Jani Lappi\Local Settings\Temp\yu5vp57h.exe infected by "Trojan.Win32.Dialer.ht" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\Jani Lappi\Local Settings\Temporary Internet Files\Content.IE5\1RJZHPOE\177[1].jpg infected by "Trojan-Downloader.Win32.Small.ccn" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\03E864AC.exe tagged as not-a-virus:AdWare.Win32.Raze.a. No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\13124163.0xe infected by "Trojan.Win32.StartPage.rw" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\1BE21962.0xe infected by "Trojan.Win32.WebSearch.d" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\2FD43576.exe infected by "Backdoor.Win32.Agent.rw" Virus. Action Taken: File Renamed.
File C:\Program Files\Norton AntiVirus\Quarantine\2FE40764.exe tagged as not-a-virus:AdWare.Win32.Raze.a. No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\40FA298D.php infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Program Files\Norton AntiVirus\Quarantine\40FD538A.0tm infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Program Files\Norton AntiVirus\Quarantine\41007D86.0tm infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Program Files\Norton AntiVirus\Quarantine\41032782.0tm infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Program Files\Norton AntiVirus\Quarantine\410A7B7B.php infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Program Files\Norton AntiVirus\Quarantine\410D2578.0xe infected by "Trojan.Win32.Regger.j" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\42F94F5A.0xe infected by "Trojan.Win32.Regger.j" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\42FF2353.0xe infected by "Trojan.Win32.Regger.j" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{6D447FF4-821A-49D1-A403-3173C3560718}\RP290\A0023867.exe tagged as not-a-virus:AdWare.Win32.Raze.a. No Action Taken.
File C:\System Volume Information\_restore{6D447FF4-821A-49D1-A403-3173C3560718}\RP290\A0023899.exe infected by "Trojan.Win32.DNSChanger.bj" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{6D447FF4-821A-49D1-A403-3173C3560718}\RP291\A0023907.exe tagged as not-a-virus:AdWare.Win32.Raze.a. No Action Taken.
File C:\System Volume Information\_restore{6D447FF4-821A-49D1-A403-3173C3560718}\RP291\A0023942.exe tagged as not-a-virus:AdWare.Win32.Raze.a. No Action Taken.
File C:\System Volume Information\_restore{6D447FF4-821A-49D1-A403-3173C3560718}\RP292\A0023947.exe tagged as not-a-virus:AdWare.Win32.Raze.a. No Action Taken.
File C:\System Volume Information\_restore{6D447FF4-821A-49D1-A403-3173C3560718}\RP292\A0023994.exe tagged as not-a-virus:AdWare.Win32.Raze.a. No Action Taken.
File C:\System Volume Information\_restore{6D447FF4-821A-49D1-A403-3173C3560718}\RP293\A0023998.exe tagged as not-a-virus:AdWare.Win32.Raze.a. No Action Taken.
File C:\System Volume Information\_restore{6D447FF4-821A-49D1-A403-3173C3560718}\RP295\A0024086.exe infected by "Trojan-Downloader.Win32.Small.buy" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{6D447FF4-821A-49D1-A403-3173C3560718}\RP296\A0024128.exe tagged as not-a-virus:AdWare.Win32.Raze.a. No Action Taken.
File C:\System Volume Information\_restore{6D447FF4-821A-49D1-A403-3173C3560718}\RP296\A0024172.exe tagged as not-a-virus:AdWare.Win32.Raze.a. No Action Taken.
File C:\System Volume Information\_restore{6D447FF4-821A-49D1-A403-3173C3560718}\RP297\A0024190.exe infected by "Backdoor.Win32.Agent.rw" Virus. Action Taken: File to be renamed on reboot.
File C:\System Volume Information\_restore{6D447FF4-821A-49D1-A403-3173C3560718}\RP297\A0024191.exe tagged as not-a-virus:AdWare.Win32.Raze.a. No Action Taken.
File C:\System Volume Information\_restore{6D447FF4-821A-49D1-A403-3173C3560718}\RP297\A0024192.exe infected by "Trojan-Downloader.Win32.Small.buy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\uikir.dll tagged as not-a-virus:AdWare.Win32.SBSoft.h. No Action Taken.
Vastaukset 31
Vanhimmat
Poista tämä:
C:\WINDOWS\System32\==>uikir.dll
Tuolla on kyllä tommonen kuin hoax se kylläkin nimetty uudestaan.
Se on työpöytäkaappari, liittyy smitfraudiin. Senkin voi kyllä poistaa.
Tällainen piti poistaa:
C:\WINDOWS\System32\==>uikir.dll
Mene tuonne C:\WINDOWS\System32-kansioon, ja etsi sieltä tämä, ==>uikir.dll
Löysin uikir.dll:n luo mutta sen 'käyttö estetty' täytyy muka varmistaa ettei levy ole täynnä / kirjoitussuojattu tai ettei tiedosto ole käytössä. Muita ohjelmia ei ole käynnissä kuin selain ja resurssienhallinta. ???
Nortonin karanteenin kanssa oli enemmän menestystä; tyhjensin Quarantinen alakansiot Incoming ja Portal.
se vikasietotilassa.
Miten sinne vikasietotilaan mentiinkään?
Odotellessa jätin uikir.dll -häirikön poiston huomiotta ja kokeilin ohjeen seuraavaa kohtaa; 'Poista järjestelmän palauttaminen käytöstä'. Annas olla kun käynnistin koneen uudelleen, oli odottamassa joku hassu UnSpyPc ohjelma, joka aloitti saman tien oman skannauksensa ja mikään muu ei toiminutkaan. Monen monta uutta käynnistystä, lopulta Windows ehdotti toimia Desktopin suhteen mutta valikko ei toiminut. Uusia käynnistyksiä ja pääsinpä vielä nettiin.
Onko jollain vielä järeämpiä keinoja?
http://koti.mbnet.fi/pattaya1/bad_spyware_removal_programs1.htm
UnSpyPc katso löytyykö se lisää / poista sovellutuksesta. Jos löytyy niin poista.
sen saat ladattua tuolta.
http://koti.mbnet.fi/pattaya1/hijackthis.htm
Katso ohjeet
sytyts. :))
Scannasin yön aikana eScanilla, tätä näytti. Kun suljen eScania, se muistaakseni pyytää käynnistämään koneen uudelleen (tai tekemään jotain vastaavaa) että eScanin asennuksesta tulisi täydellinen. Mitä olette mieltä?
File C:\WINDOWS\System32\uikir.dll tagged as not-a-virus:AdWare.Win32.SBSoft.h. No Action Taken.
File C:\WINDOWS\System32\uikir.dll tagged as not-a-virus:AdWare.Win32.SBSoft.h. No Action Taken.
File C:\RECYCLER\S-1-5-21-1123561945-706699826-1202660629-1004\Dc124.exe tagged as not-a-virus:AdWare.Win32.Raze.a. No Action Taken.
File C:\RECYCLER\S-1-5-21-1123561945-706699826-1202660629-1004\Dc126.exe tagged as not-a-virus:AdWare.Win32.Raze.a. No Action Taken.
File C:\WINDOWS\system32\uikir.dll tagged as not-a-virus:AdWare.Win32.SBSoft.h. No Action Taken.
File C:\WINDOWS\System32\uikir.dll tagged as not-a-virus:AdWare.Win32.SBSoft.h. No Action Taken.
edeleen toiminnassa.
Tämä taas
C:\RECYCLER\S-1-5-21-1123561945-706699826-1202660629-1004\Dc124.exe tagged as not-a-virus:AdWare.Win32.Raze.a. No Action Taken.
File
Virus ohjelman roskissa.
Tuolla haluttiin tuota hjt lokia laitas se tänne.
Hae KillBox
http://www.bleepingcomputer.com/files/spyware/KillBox.zip
Pura,avaa ja täppi kohtaan Delete on Reboot
Sitten kopioi rivitosta alapuolelta
C:\WINDOWS\System32\uikir.dll
Sitten KillBoxissa ylhäältä File > Paste from Clipboard
Sen jälkeen paina Delete (punainen, jossa on valkonen X)
Vastaa myöntävästi kysymyksiin ja jos kone ei itestään käynnisty uudestaan,niin käynnistä se.
Lähetä sen jälkeen Hijack-logi.
Jossain sanottiin että putsaa ensin Ad Awarella, näin tein ja ainakin se löysi sekä tuon sitkeän uikir.dll -tiedoston että UnSpyPc:n. Tiedä sitten pitäsikö ne poistaa vielä jostain karanteenista. Tässä Hijack-logi:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\KMDEVMONSRV.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\KMdevmonx.exe
C:\Program Files\Norton Internet Security\NISUM.EXE
C:\WINDOWS\System32\wdfmgr.exe
C:\Program Files\Norton Internet Security\NISSERV.EXE
C:\Program Files\Norton Internet Security\SymProxySvc.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\Norton Internet Security\IAMAPP.EXE
C:\WINDOWS\System32\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Panasonic\Multi-Function Station\StatusMon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\DOCUMENTS AND SETTINGS\JANI LAPPI\TYÖPÖYTÄ\HijackThis-1.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://69.50.191.53/search.cgi?b12484
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://69.50.191.53/search.cgi?a12484
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://69.50.191.53/search.cgi?a12484
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://69.50.191.53/search.cgi?a12484
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://69.50.191.53/search.cgi?b12484
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: (no name) - {B477850E-0B33-F54A-737E-2C03C60E12E0} - JAguAr.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [iamapp] C:\Program Files\Norton Internet Security\IAMAPP.EXE
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [MMTray] MMTray.exe
O4 - HKLM\..\Run: [MMTray2K] MMTray2k.exe
O4 - HKLM\..\Run: [MMTrayLSI] MMTrayLSI.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\System32\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [___] sbin.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [StatusCheck] keybdll.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Panasonic Multi-Function StatusMonitor.lnk = C:\Program Files\Panasonic\Multi-Function Station\StatusMon.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O15 - Trusted Zone: *.bestsearch.cc
O15 - Trusted Zone: *.dapsol.com
O15 - Trusted Zone: *.bestsearch.cc (HKLM)
O15 - Trusted Zone: *.dapsol.com (HKLM)
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{97F8BFFB-07E2-499F-81A8-F8E19A4590E4}: NameServer = 85.255.114.196,85.255.112.197
O17 - HKLM\System\CS1\Services\Tcpip\..\{97F8BFFB-07E2-499F-81A8-F8E19A4590E4}: NameServer = 85.255.114.196,85.255.112.197
O23 - Service: Multi-Function Station Device Monitor (KMDevmonSrv) - Unknown owner - C:\WINDOWS\system32\KMDEVMONSRV.exe
O23 - Service: Norton AntiVirus -ohjelman automaattinen suojaus (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Internet Security Service (NISSERV) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISSERV.EXE
O23 - Service: Norton Internet Security Accounts Manager (NISUM) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISUM.EXE
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Norton Internet Security Proxy Service (SymProxySvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\SymProxySvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O4 - HKLM\..\Run: [___] sbin.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{97F8BFFB-07E2-499F-81A8-F8E19A4590E4}: NameServer = 85.255.114.196,85.255.112.197
O17 - HKLM\System\CS1\Services\Tcpip\..\{97F8BFFB-07E2-499F-81A8-F8E19A4590E4}: NameServer = 85.255.114.196,85.255.112.197
Nuo näyttäis menevän ukrainaan.
Sulla on wareout-rootkit koneella.
Hae fixwareout -> http://downloads.subratam.org/Fixwareout.exe
Tallenna johonkin hakemistoon ja käynnistä se. Seuraa ohjeita, käynnistä kone uudestaan kun fixi pyytää sitä. Fixi avaa HjT:n
Fixaa silloin nämä (do a system scan only, merkkaa ja paina fix checked):
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://69.50.191.53/search.cgi?b12484
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://69.50.191.53/search.cgi?a12484 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://69.50.191.53/search.cgi?a12484
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://69.50.191.53/search.cgi?a12484
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://69.50.191.53/search.cgi?b12484
R3 - URLSearchHook: (no name) - {B477850E-0B33-F54A-737E-2C03C60E12E0} - JAguAr.dll (file missing)
O4 - HKLM\..\Run: [___] sbin.exe
O4 - HKCU\..\Run: [StatusCheck] keybdll.exe
O15 - Trusted Zone: *.bestsearch.cc
O15 - Trusted Zone: *.dapsol.com
O15 - Trusted Zone: *.bestsearch.cc (HKLM)
O15 - Trusted Zone: *.dapsol.com (HKLM) O17 - HKLM\System\CCS\Services\Tcpip\..\{97F8BFFB-07E2-499F-81A8-F8E19A4590E4}: NameServer = 85.255.114.196,85.255.112.197
O17 - HKLM\System\CS1\Services\Tcpip\..\{97F8BFFB-07E2-499F-81A8-F8E19A4590E4}: NameServer = 85.255.114.196,85.255.112.197
Lähetä uusi HjT-loki ja C:\fixwareout\report.txt-tiedoston sisältö tänne.
Tässä nyt toistona sen dll:n poisto-ohjeet, jos et niitä ymmärtänyt :)
Mikään ad-aware ei sitä osaa poistaa. Voit tehdä sen vaikka tuon fixwareoutin perään.
Hae KillBox
http://www.bleepingcomputer.com/files/spyware/KillBox.zip
Pura,avaa ja täppi kohtaan Delete on Reboot
Sitten kopioi rivi tosta alapuolelta
C:\WINDOWS\System32\uikir.dll
Sitten KillBoxissa ylhäältä File > Paste from Clipboard
Sen jälkeen paina Delete (punainen, jossa on valkonen X)
Vastaa myöntävästi kysymyksiin ja jos kone ei itestään käynnisty uudestaan,niin käynnistä se.
Lähetä sen jälkeen Hijack-logi.
Tein neuvotut jutut järjestyksessä KillBox ja sitten FixWareOut. Jälkimmäisen lista aukesi Muistiossa ja lisäksi saatoin avata selaimen mutta HiJackia en saa avattua koska alt-tabulaattorilla pääsen liikkumaan vain näiden kahden ohjelman välillä (Käynnistä-haitariakaan ei saa auki). Näin FixWareOut:
Reg Entries that were deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\repiwoh
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\xedocne
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\23plhps
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\mgcppp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\tesvaf
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\32refaselif
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\pggmd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\repiwoh
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\ypszr
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\daolnwodi
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\putesprpgd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\lavinraCputeS
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\xedocne
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\gib_ogol
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\llun
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\golmedi
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\23plhps
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\mgcppp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\tesvaf
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\32refaselif
Tuo Fixwareoutin loki ei ole kokonainen, lähetä se uudestaan.
Fixaa ne HjT:n rivit, mitkä pyysin ja lähetä sen loki.
Käynnistyihän se HiJack kun käynnistin koneen uudelleen. FixWareOutin kanssa täytyy ottaa uusiksi ja yrittää olla sähläämättä.
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [iamapp] C:\Program Files\Norton Internet Security\IAMAPP.EXE
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [MMTray] MMTray.exe
O4 - HKLM\..\Run: [MMTray2K] MMTray2k.exe
O4 - HKLM\..\Run: [MMTrayLSI] MMTrayLSI.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\System32\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Panasonic Multi-Function StatusMonitor.lnk = C:\Program Files\Panasonic\Multi-Function Station\StatusMon.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O23 - Service: Multi-Function Station Device Monitor (KMDevmonSrv) - Unknown owner - C:\WINDOWS\system32\KMDEVMONSRV.exe
O23 - Service: Norton AntiVirus -ohjelman automaattinen suojaus (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Internet Security Service (NISSERV) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISSERV.EXE
O23 - Service: Norton Internet Security Accounts Manager (NISUM) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISUM.EXE
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Norton Internet Security Proxy Service (SymProxySvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\SymProxySvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
Uusi käynnistys ja tällainen tulos:
Fixwareout ver 1.003
Last edited 1/12/2006
Post this report in the forums please
Reg Entries that were deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\aspmd
PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
»»»»» Search by size and names...
C:\WINDOWS\SYSTEM32\CSJIJ.EXE
»»»»» Misc files
»»»»» Checking for older varients covered by the Rem3 tool
Tarkista tämä -> C:\WINDOWS\SYSTEM32\CSJIJ.EXE
täällä -> http://virusscan.jotti.org ja lähetä tulokset tänne. Ja lähetä se HjT-loki kokonaan myös :)
No, jo on vehkeet. Se surautti scannauksensa läpi:
File: CSJIJ.EXE
Status:
INFECTED/MALWARE
MD5 d803c9c81bcc00754ef30fa495769073
Packers detected:
PE-CRYPT.DOWN
Scanner results
AntiVir
Found nothing
ArcaVir
Found nothing
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found Trojan.Downloader.FFZ
ClamAV
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found nothing
Fortinet
Found nothing
Kaspersky Anti-Virus
Found nothing
NOD32
Found a variant of Win32/Small.FB
Norman Virus Control
Found nothing
UNA
Found nothing
VBA32
Found Trojan.DownLoader.4316
HjT on viestissä, tuossa vähän ylempänä, niin täydellisenä kun se viimeisellä kerralla tuli.
Tämä lienee aivan sama kuin se vähän aiemmin lähettämäni.
Logfile of HijackThis v1.99.1
Scan saved at 19:19:22, on 14.1.2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\KMDEVMONSRV.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\KMdevmonx.exe
C:\Program Files\Norton Internet Security\NISUM.EXE
C:\WINDOWS\System32\wdfmgr.exe
C:\Program Files\Norton Internet Security\NISSERV.EXE
C:\Program Files\Norton Internet Security\SymProxySvc.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\Norton Internet Security\IAMAPP.EXE
C:\WINDOWS\System32\MMTray.exe
C:\WINDOWS\System32\MMTray2k.exe
C:\WINDOWS\System32\MMTrayLSI.exe
C:\WINDOWS\System32\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Panasonic\Multi-Function Station\StatusMon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Jani Lappi\Työpöytä\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [iamapp] C:\Program Files\Norton Internet Security\IAMAPP.EXE
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [MMTray] MMTray.exe
O4 - HKLM\..\Run: [MMTray2K] MMTray2k.exe
O4 - HKLM\..\Run: [MMTrayLSI] MMTrayLSI.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\System32\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [dmree.exe] C:\WINDOWS\System32\dmree.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Panasonic Multi-Function StatusMonitor.lnk = C:\Program Files\Panasonic\Multi-Function Station\StatusMon.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O23 - Service: Multi-Function Station Device Monitor (KMDevmonSrv) - Unknown owner - C:\WINDOWS\system32\KMDEVMONSRV.exe
O23 - Service: Norton AntiVirus -ohjelman automaattinen suojaus (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Internet Security Service (NISSERV) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISSERV.EXE
O23 - Service: Norton Internet Security Accounts Manager (NISUM) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISUM.EXE
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Norton Internet Security Proxy Service (SymProxySvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\SymProxySvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
Fixaa:
O4 - HKLM\..\Run: [dmree.exe] C:\WINDOWS\System32\dmree.exe
Pura,avaa ja täppi kohtaan Delete on Reboot
Sitten kopioi rivit tosta alapuolelta
C:\WINDOWS\SYSTEM32\CSJIJ.EXE
C:\WINDOWS\System32\dmree.exe
Sitten KillBoxissa ylhäältä File > Paste from Clipboard. Valitse "all files"
Sen jälkeen paina Delete (punainen, jossa on valkonen X)
Vastaa myöntävästi kysymyksiin ja jos kone ei itestään käynnisty uudestaan,niin käynnistä se.
Lähetä sen jälkeen uusi Hijack-logi.
Aivan tällaista ei löydy, O4 - HKLM\..\Run: [dmree.exe] C:\WINDOWS\System32\dmree.exe, sen sijaan \dmpgg.exe löytyy...
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [iamapp] C:\Program Files\Norton Internet Security\IAMAPP.EXE
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [MMTray] MMTray.exe
O4 - HKLM\..\Run: [MMTray2K] MMTray2k.exe
O4 - HKLM\..\Run: [MMTrayLSI] MMTrayLSI.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\System32\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [dmpgg.exe] C:\WINDOWS\System32\dmpgg.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Panasonic Multi-Function StatusMonitor.lnk = C:\Program Files\Panasonic\Multi-Function Station\StatusMon.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O23 - Service: Multi-Function Station Device Monitor (KMDevmonSrv) - Unknown owner - C:\WINDOWS\system32\KMDEVMONSRV.exe
O23 - Service: Norton AntiVirus -ohjelman automaattinen suojaus (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Internet Security Service (NISSERV) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISSERV.EXE
O23 - Service: Norton Internet Security Accounts Manager (NISUM) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISUM.EXE
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Norton Internet Security Proxy Service (SymProxySvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\SymProxySvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
Tuo näyttää vaihtavan nimeä joka buutilla.
Yritetään näin:
Fixaa:
O4 - HKLM\..\Run: [dmpgg.exe] C:\WINDOWS\System32\dmpgg.exe
Avaa Killbox ja täppi kohtaan Replace on reboot. Valitse myös "use dummy".
Sitten kopioi rivi tosta alapuolelta
C:\WINDOWS\System32\dmpgg.exe
Sitten KillBoxissa ylhäältä File > Paste from Clipboard.
Sen jälkeen paina Delete (punainen, jossa on valkonen X)
Vastaa myöntävästi kysymyksiin ja jos kone ei itestään käynnisty uudestaan,niin käynnistä se.
Lähetä sen jälkeen uusi Hijack-logi.
En pystynyt merkkaamaan 'use dummy' -kohtaa koska se pysyi harmaana. Kone kyllä käynnistyi itsekseen. Desktop, joka oli se alkuperäinen syy putsaukseen, välkyttelee taustaväriään, on milloin valkoinen, milloin harmaa. Onkohan siellä vielä joku alien?
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [iamapp] C:\Program Files\Norton Internet Security\IAMAPP.EXE
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [MMTray] MMTray.exe
O4 - HKLM\..\Run: [MMTray2K] MMTray2k.exe
O4 - HKLM\..\Run: [MMTrayLSI] MMTrayLSI.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\System32\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Panasonic Multi-Function StatusMonitor.lnk = C:\Program Files\Panasonic\Multi-Function Station\StatusMon.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O23 - Service: Multi-Function Station Device Monitor (KMDevmonSrv) - Unknown owner - C:\WINDOWS\system32\KMDEVMONSRV.exe
O23 - Service: Norton AntiVirus -ohjelman automaattinen suojaus (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Internet Security Service (NISSERV) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISSERV.EXE
O23 - Service: Norton Internet Security Accounts Manager (NISUM) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISUM.EXE
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Norton Internet Security Proxy Service (SymProxySvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\SymProxySvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
No sitä et kyllä kertonut aiemmin :)
Hae täältä -> http://www.billsway.com/vbspage/ registry search tool ja tee haku "desktop.html":llä. Jos antivirus herjaa, anna ajaa. Jos ei löydy, kokeile "warnhp.html"-hakusanaa.
Lähetä registry searchin tulokset.
Joo, sori Juu, minut neuvottiin Virukset forumilta tänne HjT-logini kanssa enkä enää kirjoittanut viestiini alkuperäisen kivistyksen syytä. Mutta ohjeittesi mukaan rivejä poistellessani on joka tapauksessa lähtenyt jo varmasti monta tuholaista. Tässä registry search:
REGEDIT4
; RegSrch.vbs © Bill James
; Registry search results for string "desktop.html" 15.1.2006 22:50:32
; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)
[HKEY_USERS\S-1-5-21-1123561945-706699826-1202660629-1004\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="C:\\WINDOWS\\desktop.html"
[HKEY_USERS\S-1-5-21-1123561945-706699826-1202660629-1004\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"SubscribedURL"="C:\\WINDOWS\\desktop.html"