Mitäs ny? Popupseja joka 3 sekuntti uunista ulos ja komin kerroin. Ja viel errorsafefree tulee kakkaamaa mun nenän etee. ÄÄÄÄKKKK! Ei keztä enää. Mitä ny?
Kai tartteette tota..?
Logfile of HijackThis v1.99.1
Scan saved at 23:48:38, on 30.4.2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Sonera Tietoturva\Common\FSM32.EXE
C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
C:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
C:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
C:\Program Files\Sonera Tietoturva\Anti-Virus\FSGK32.EXE
C:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sonera Tietoturva\Common\FSMB32.EXE
C:\Program Files\Sonera Tietoturva\Anti-Virus\fssm32.exe
C:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
C:\Program Files\Sonera Tietoturva\Common\FCH32.EXE
C:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Sonera Tietoturva\Common\FAMEH32.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Sonera Tietoturva\Anti-Virus\fsrw.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Warez P2P Client\warez.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Secretmaker\secretmaker.exe
C:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
C:\Program Files\Xfire\Xfire.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\Program Files\DAP\DAP.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Moi Jaakko tää\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.rover-host.com/infected.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Sonera Tietoturva\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Sonera Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\Sonera Tietoturva\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "C:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [keyboard] C:\windows\keyboard15.exe
O4 - HKLM\..\Run: [mousepad] C:\windows\mousepad15.exe
O4 - HKLM\..\Run: [newname] C:\windows\newname15.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [warez] "C:\Program Files\Warez P2P Client\warez.exe" -h
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: SECRETMAKER.lnk = C:\Program Files\Secretmaker\secretmaker.exe
O4 - Global Startup: Sonera Tietoturva.lnk = C:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\Sonera Tietoturva\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Sonera Tietoturva\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Sonera Tietoturva\Anti-Spyware\ieshield.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by20fd.bay20.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: Shell Extensions - C:\WINDOWS\system32\kodbu.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Sonera Tietoturva (BackWeb Plug-in - 4436233) - Sonera Tietoturva - C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\S2FyaSBIeXJra RuZW4\command.exe (file missing)
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - C:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
O23 - Service: Firewall service (FWSvc) - WinSoftware, Ltd. - C:\Program Files\WinAntiVirus Pro 2006\FWSvc.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
Ja tiedoks, tossa on muutaki paskaa, jotka kai voisitte sanova? :D En oo kattonu hijackthissii vuoteen.
Kai tartteette tota..?
Logfile of HijackThis v1.99.1
Scan saved at 23:48:38, on 30.4.2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Sonera Tietoturva\Common\FSM32.EXE
C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
C:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
C:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
C:\Program Files\Sonera Tietoturva\Anti-Virus\FSGK32.EXE
C:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sonera Tietoturva\Common\FSMB32.EXE
C:\Program Files\Sonera Tietoturva\Anti-Virus\fssm32.exe
C:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
C:\Program Files\Sonera Tietoturva\Common\FCH32.EXE
C:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Sonera Tietoturva\Common\FAMEH32.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Sonera Tietoturva\Anti-Virus\fsrw.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Warez P2P Client\warez.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Secretmaker\secretmaker.exe
C:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
C:\Program Files\Xfire\Xfire.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\Program Files\DAP\DAP.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Moi Jaakko tää\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.rover-host.com/infected.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Sonera Tietoturva\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Sonera Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\Sonera Tietoturva\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "C:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [keyboard] C:\windows\keyboard15.exe
O4 - HKLM\..\Run: [mousepad] C:\windows\mousepad15.exe
O4 - HKLM\..\Run: [newname] C:\windows\newname15.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [warez] "C:\Program Files\Warez P2P Client\warez.exe" -h
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: SECRETMAKER.lnk = C:\Program Files\Secretmaker\secretmaker.exe
O4 - Global Startup: Sonera Tietoturva.lnk = C:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\Sonera Tietoturva\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Sonera Tietoturva\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Sonera Tietoturva\Anti-Spyware\ieshield.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by20fd.bay20.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: Shell Extensions - C:\WINDOWS\system32\kodbu.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Sonera Tietoturva (BackWeb Plug-in - 4436233) - Sonera Tietoturva - C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\S2FyaSBIeXJra RuZW4\command.exe (file missing)
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - C:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
O23 - Service: Firewall service (FWSvc) - WinSoftware, Ltd. - C:\Program Files\WinAntiVirus Pro 2006\FWSvc.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
Ja tiedoks, tossa on muutaki paskaa, jotka kai voisitte sanova? :D En oo kattonu hijackthissii vuoteen.
Vastaukset 10
Vanhimmat
...siellä ylimääräistä tavaraa
Poista lisää tai poista sovelluksista.
warez
Download Accelerator Plus, DAP
WebHancer
Nimet saattavat vaihdella
Lataa tuosta Look2Me-Destroyer.exe työpöydällesi.
http://www.atribune.org/ccount/click.php?id=7
TÄRKEÄÄ: Ennen fixin jatkamista, sinun täytyy tehdä seuraavat:
* Tulosta tämä, tai tallenna tekstitiedostona sopivaan sijaintiin.
* Klikkaa käynnistä -> Suorita ja kirjoita: services.msc
* Klikkaa OK.
* Tarkista että tämä palvelu on käynnissä tai sen käynnistymistapa on automaattinen:
* Toissijainen kirjautuminen
* Seuraavaksi tietokoneesi on oltava offlinessa, vedä nettipiuha seinästä jos tarpeen.
* Virustorjuntasi, ja kaikkien muiden turvaohjelmistojen TÄYTYY olla suljettuja.
Jatka fixiä:
* Sulje ikkunat jatkaaksesi.
* Tupla-klikkaa Look2Me-Destroyer.exe filua ajaaksesi sen.
* Rastita Run this program as a task.
* Saat viestin joka sanoo "Look2Me-Destroyer will close and re-open in approximately 1 minute". Klikkaa OK
* Kun se avautuu uudestaan, klikkaa Scan for L2M valintaa, pikakuvakkeesi katoavat; tämä on normaalia.
* Kun skannaus on valmis, klikkaa Remove L2M.
* Saat Done Scanning viestin, klikkaa OK.
* Kun valmis, saat tämän viestin: Done removing infected files! Look2Me-Destroyer will now shutdown your computer, klikkaa OK.
* Koneesi sammuu.
* Käynnistä se uudelleen.
* Postita C:\Look2Me-Destroyer.txt lokin sisältö seuraavaan viestiisi.
Jos Look2Me-Destroyer ei aukea automaattisesi, käynnistä tietokoneesi uudestaan ja koita uudelleen.
Lataa tuosta Brute Force Uninstaller työpöydällesi.
http://www.merijn.org/files/bfu.zip
* Oikea-klikkaa BFU zippiä työpöydälläsi, ja valitse Pura kaikki.
* Klikkaa "Seuraava"
* Boksissa missä valita mihin haluat tiedostot purkaa,
* Klikkaa "Selaa"
* Klikkaa merkkiä oman tietokoneen vieressä
* Klikkaa "Paikallinen Levy ( C: )" tai mikä sinun tärkein levysi onkin
* Klikkaa "Tee uusi kansio"
* Kirjoita BFU
* Klikkaa "Seuraava", ja ÄLÄ rastita boksia "Näytä puretut tiedostot" ja klikkaa "Valmis".
OIKEA-KLIKKAA LINKISTÄ ja valitse "Save As"
http://metallica.geekstogo.com/alcanshorty.bfu
(Explorerissa "Save Target As") ladataksesi Alcra PLUS Poistajan.
Tallenna se samaan kansioon jonka teit aiemmin (c:\BFU).
Älä tee mitään tällä vielä!
Käynnistä koneesi vikasietotilaan naputtamalla F8 näppäintä käynnistyksen yhteydessä.
Klikkaa Käynnistä > Oma tietokone ja navigoi C:\BFU kansioon.
Käynnistä Brute Force Uninstaller tupla-klikkaamalla BFU.exe
Scriptline to execute kentässä kirjoita tai liitä c:\bfu\alcanshorty.bfu
Klikkaa Execute ja anna sen tehdä työnsä. (Sinun pitäisi nähdä edistyspalkki jos teit tämän oikein.)
Odota Complete script execution boksia ja klikkaa OK.
Klikkaa exit lopettaaksesi Brute Force Uninstallerin.
Käynnistä normaaliin tilaan.
Avaa HijackThis, klikkaa do a system scan only, merkkaa nämä, sulje selain ja klikkaa Fix checked.
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.rover-host.com/infected.html
O4 - HKLM\..\Run: [keyboard] C:\windows\keyboard15.exe
O4 - HKLM\..\Run: [mousepad] C:\windows\mousepad15.exe
O4 - HKLM\..\Run: [newname] C:\windows\newname15.exe
O4 - HKCU\..\Run: [warez] "C:\Program Files\Warez P2P Client\warez.exe" -h
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
Tämä myös fixiin, jos et ole lukinnut IE:n asetuksia tai jokin Anti-spyware tai F-secure.
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
Piilotetut tiedostot näkyviin.
Ohjauspaneeli -> Kansio asetukset -> Näytä -> Näytä piilotetut tiedostot.
Poista kansiot. Jos ei lähde, kokeile vikasietotilassa.
C:\Program Files\-->Warez P2P ClientDAPS2FyaSBIeXJra RuZW4
Scriptline to execute kentässä kirjoita tai liitä c:\bfu\alcanshorty.bfu
mikä muka on vialla?
Pääsitkös tuossa kohtaa eteenpäin?
Vikana on Alcan mato ja Look2me.
Väsyneenä unohtui Ewidolla scannaus.
http://keskustelu.afterdawn.com/thread_view.cfm/269186
Eli asenna, päivitä, scannaa vikasietotilassa ja tallenna raportti. Lähetä se sitten muiden mukana.
Mihi look2me:n logi katos?
Warezia ei ollu lisää tai poista listassa.
Sama ongelma webhanceris.
O4 - HKLM\..\Run: [keyboard] C:\windows\keyboard15.exe
O4 - HKLM\..\Run: [mousepad] C:\windows\mousepad15.exe
O4 - HKLM\..\Run: [newname] C:\windows\newname15.exe
O4 - HKCU\..\Run: [warez] "C:\Program Files\Warez P2P Client\warez.exe" -h
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
Hommat ei löytyny hijackthissil.
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.rover-host.com/infected.html
Ei millää suostu lähtemää.
C:\WINDOWS\-->S2FyaSBIeXJra RuZW4 Adware.InternetOptimizer : Cleaned with backup
HKLM\SOFTWARE\Avenue Media\Internet Optimizer -> Adware.InternetOptimizer : Cleaned with backup
HKLM\SOFTWARE\Avenue Media\Internet Optimizer\Browser Helper -> Adware.InternetOptimizer : Cleaned with backup
HKLM\SOFTWARE\Avenue Media\Internet Optimizer\Browser Helper\cf1 -> Adware.InternetOptimizer : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{2178F3FB-2560-458f-BDEE-631E2FE0DFE4} -> Adware.WinAntiVirus : Cleaned with backup
HKLM\SOFTWARE\Classes\ScreensaversInstaller.Installer -> Adware.Screensavers : Cleaned with backup
HKLM\SOFTWARE\Classes\ScreensaversInstaller.Installer\CLSID -> Adware.Screensavers : Cleaned with backup
HKLM\SOFTWARE\Classes\ScreensaversInstaller.Installer\CurVer -> Adware.Screensavers : Cleaned with backup
HKLM\SOFTWARE\Classes\ScreensaversInstaller.Installer.1 -> Adware.Screensavers : Cleaned with backup
HKLM\SOFTWARE\Classes\ScreensaversInstaller.Sinstaller -> Adware.Screensavers : Cleaned with backup
HKLM\SOFTWARE\Classes\ScreensaversInstaller.Sinstaller\CLSID -> Adware.Screensavers : Cleaned with backup
HKLM\SOFTWARE\Classes\ScreensaversInstaller.Sinstaller\CurVer -> Adware.Screensavers : Cleaned with backup
HKLM\SOFTWARE\Classes\ScreensaversInstaller.Sinstaller.1 -> Adware.Screensavers : Cleaned with backup
HKLM\SOFTWARE\Classes\WhIeHelperObj.WhIeHelperObj -> Adware.WebHancer : Cleaned with backup
HKLM\SOFTWARE\Classes\WhIeHelperObj.WhIeHelperObj\CurVer -> Adware.WebHancer : Cleaned with backup
HKLM\SOFTWARE\Classes\WhIeHelperObj.WhIeHelperObj.1 -> Adware.WebHancer : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ScreensaversInstaller -> Adware.Screensavers : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\webHancer Agent -> Adware.WebHancer : Cleaned with backup
HKLM\SOFTWARE\Policies\Avenue Media -> Adware.InternetOptimizer : Cleaned with backup
HKLM\SOFTWARE\webhancer -> Adware.WebHancer : Cleaned with backup
HKLM\SOFTWARE\webhancer\CC -> Adware.WebHancer : Cleaned with backup
HKLM\SOFTWARE\webhancer\ESO -> Adware.WebHancer : Cleaned with backup
HKU\S-1-5-21-220523388-2000478354-839522115-1004\Software\Avenue Media -> Adware.InternetOptimizer : Cleaned with backup
HKU\S-1-5-21-220523388-2000478354-839522115-1004\Software\Policies\Avenue Media -> Adware.InternetOptimizer : Cleaned with backup
[628] C:\Program Files\webHancer\Programs\webhdll.dll -> Adware.WebHancer : Error during cleaning
[820] C:\Program Files\webHancer\Programs\webhdll.dll -> Adware.WebHancer : Error during cleaning
[872] C:\Program Files\webHancer\Programs\webhdll.dll -> Adware.WebHancer : Error during cleaning
[1080] C:\Program Files\webHancer\Programs\webhdll.dll -> Adware.WebHancer : Error during cleaning
[1108] C:\Program Files\webHancer\Programs\webhdll.dll -> Adware.WebHancer : Error during cleaning
[1328] C:\Program Files\webHancer\Programs\webhdll.dll -> Adware.WebHancer : Error during cleaning
[1436] C:\Program Files\webHancer\Programs\webhdll.dll -> Adware.WebHancer : Error during cleaning
[1624] C:\Program Files\webHancer\Programs\webhdll.dll -> Adware.WebHancer : Error during cleaning
[2072] C:\Program Files\webHancer\Programs\webhdll.dll -> Adware.WebHancer : Error during cleaning
[3392] C:\Program Files\webHancer\Programs\webhdll.dll -> Adware.WebHancer : Error during cleaning
[3688] C:\Program Files\webHancer\Programs\webhdll.dll -> Adware.WebHancer : Error during cleaning
[3916] C:\Program Files\webHancer\Programs\webhdll.dll -> Adware.WebHancer : Error during cleaning
[2544] C:\Program Files\webHancer\Programs\webhdll.dll -> Adware.WebHancer : Error during cleaning
C:\Documents and Settings\Kirsi\Cookies\kirsi@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned with backup
C:\Documents and Settings\Kirsi\Cookies\kirsi@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Cleaned with backup
:mozilla.9:C:\Documents and Settings\SWAT\Application Data\Mozilla\Firefox\Profiles\ymeb84pc.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned with backup
:mozilla.26:C:\Documents and Settings\SWAT\Application Data\Mozilla\Firefox\Profiles\ymeb84pc.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned with backup
:mozilla.28:C:\Documents and Settings\SWAT\Application Data\Mozilla\Firefox\Profiles\ymeb84pc.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup
:mozilla.29:C:\Documents and Settings\SWAT\Application Data\Mozilla\Firefox\Profiles\ymeb84pc.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup
:mozilla.30:C:\Documents and Settings\SWAT\Application Data\Mozilla\Firefox\Profiles\ymeb84pc.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup
:mozilla.32:C:\Documents and Settings\SWAT\Application Data\Mozilla\Firefox\Profiles\ymeb84pc.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.33:C:\Documents and Settings\SWAT\Application Data\Mozilla\Firefox\Profiles\ymeb84pc.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.34:C:\Documents and Settings\SWAT\Application Data\Mozilla\Firefox\Profiles\ymeb84pc.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.49:C:\Documents and Settings\SWAT\Application Data\Mozilla\Firefox\Profiles\ymeb84pc.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.51:C:\Documents and Settings\SWAT\Application Data\Mozilla\Firefox\Profiles\ymeb84pc.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.52:C:\Documents and Settings\SWAT\Application Data\Mozilla\Firefox\Profiles\ymeb84pc.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.53:C:\Documents and Settings\SWAT\Application Data\Mozilla\Firefox\Profiles\ymeb84pc.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.65:C:\Documents and Settings\SWAT\Application Data\Mozilla\Firefox\Profiles\ymeb84pc.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.66:C:\Documents and Settings\SWAT\Application Data\Mozilla\Firefox\Profiles\ymeb84pc.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup
:mozilla.67:C:\Documents and Settings\SWAT\Application Data\Mozilla\Firefox\Profiles\ymeb84pc.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup
:mozilla.68:C:\Documents and Settings\SWAT\Application Data\Mozilla\Firefox\Profiles\ymeb84pc.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup
:mozilla.73:C:\Documents and Settings\SWAT\Application Data\Mozilla\Firefox\Profiles\ymeb84pc.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup
:mozilla.84:C:\Documents and Settings\SWAT\Application Data\Mozilla\Firefox\Profiles\ymeb84pc.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned with backup
:mozilla.93:C:\Documents and Settings\SWAT\Application Data\Mozilla\Firefox\Profiles\ymeb84pc.default\cookies.txt -> TrackingCookie.Yadro : Cleaned with backup
:mozilla.95:C:\Documents and Settings\SWAT\Application Data\Mozilla\Firefox\Profiles\ymeb84pc.default\cookies.txt -> TrackingCookie.Hotlog : Cleaned with backup
:mozilla.96:C:\Documents and Settings\SWAT\Application Data\Mozilla\Firefox\Profiles\ymeb84pc.default\cookies.txt -> TrackingCookie.Spylog : Cleaned with backup
:mozilla.97:C:\Documents and Settings\SWAT\Application Data\Mozilla\Firefox\Profiles\ymeb84pc.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup
:mozilla.98:C:\Documents and Settings\SWAT\Application Data\Mozilla\Firefox\Profiles\ymeb84pc.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup
:mozilla.102:C:\Documents and Settings\SWAT\Application Data\Mozilla\Firefox\Profiles\ymeb84pc.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.105:C:\Documents and Settings\SWAT\Application Data\Mozilla\Firefox\Profiles\ymeb84pc.default\cookies.txt -> TrackingCookie.Commission-junction : Cleaned with backup
:mozilla.106:C:\Documents and Settings\SWAT\Application Data\Mozilla\Firefox\Profiles\ymeb84pc.default\cookies.txt -> TrackingCookie.Commission-junction : Cleaned with backup
:mozilla.124:C:\Documents and Settings\SWAT\Application Data\Mozilla\Firefox\Profiles\ymeb84pc.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned with backup
:mozilla.138:C:\Documents and Settings\SWAT\Application Data\Mozilla\Firefox\Profiles\ymeb84pc.default\cookies.txt -> TrackingCookie.Clickbank : Cleaned with backup
:mozilla.147:C:\Documents and Settings\SWAT\Application Data\Mozilla\Firefox\Profiles\ymeb84pc.default\cookies.txt -> TrackingCookie.Overture : Cleaned with backup
:mozilla.155:C:\Documents and Settings\SWAT\Application Data\Mozilla\Firefox\Profiles\ymeb84pc.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup
:mozilla.156:C:\Documents and Settings\SWAT\Application Data\Mozilla\Firefox\Profiles\ymeb84pc.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned with backup
:mozilla.157:C:\Documents and Settings\SWAT\Application Data\Mozilla\Firefox\Profiles\ymeb84pc.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned with backup
C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\Cache\15B01B68d01 -> Not-A-Virus.Monitor.Win32.Ardamax.k : Cleaned with backup
C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\Cache\B1BF0F23d01 -> Not-A-Virus.Monitor.Win32.Ardamax.k : Cleaned with backup
C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\Cache\B9317C94d01 -> Not-A-Virus.Monitor.Win32.Ardamax.k : Cleaned with backup
C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\Cache\B93E9694d01 -> Not-A-Virus.Monitor.Win32.Ardamax.k : Cleaned with backup
:mozilla.10:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned with backup
:mozilla.11:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned with backup
:mozilla.16:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup
:mozilla.17:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup
:mozilla.18:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup
:mozilla.24:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup
:mozilla.25:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup
:mozilla.26:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup
:mozilla.27:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup
:mozilla.31:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned with backup
:mozilla.32:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned with backup
:mozilla.33:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.34:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.35:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.36:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.37:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.38:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.39:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.40:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.41:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.42:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.43:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Onestat : Cleaned with backup
:mozilla.44:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Onestat : Cleaned with backup
:mozilla.45:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Onestat : Cleaned with backup
:mozilla.46:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Onestat : Cleaned with backup
:mozilla.47:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Onestat : Cleaned with backup
:mozilla.48:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Onestat : Cleaned with backup
:mozilla.49:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Onestat : Cleaned with backup
:mozilla.50:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Onestat : Cleaned with backup
:mozilla.54:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup
:mozilla.67:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.68:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.69:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.70:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup
:mozilla.82:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.90:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.91:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.92:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.93:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.94:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.95:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.96:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.97:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.98:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.99:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.100:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.101:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.102:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.103:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.104:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.105:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.127:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup
:mozilla.128:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup
:mozilla.130:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup
:mozilla.131:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.132:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.133:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.137:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.144:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned with backup
:mozilla.145:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned with backup
:mozilla.146:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.147:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.148:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.149:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.155:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup
:mozilla.156:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup
:mozilla.157:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup
:mozilla.160:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup
:mozilla.161:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup
:mozilla.162:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup
:mozilla.176:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Spylog : Cleaned with backup
:mozilla.177:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Hotlog : Cleaned with backup
:mozilla.179:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
:mozilla.180:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
:mozilla.195:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned with backup
:mozilla.210:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned with backup
:mozilla.254:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned with backup
:mozilla.292:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.293:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.296:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.319:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.325:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Targetnet : Cleaned with backup
:mozilla.326:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Targetnet : Cleaned with backup
:mozilla.337:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Trafic : Cleaned with backup
:mozilla.342:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.347:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup
:mozilla.348:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup
:mozilla.349:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup
:mozilla.361:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned with backup
:mozilla.362:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned with backup
:mozilla.366:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned with backup
:mozilla.368:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned with backup
:mozilla.369:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned with backup
:mozilla.374:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.383:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup
:mozilla.384:C:\Documents and Settings\SWAT\Application Data\Netscape\NSB\Profiles\jmtpbhvl.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup
C:\Documents and Settings\SWAT\Omat tiedostot\My Completed Downloads\crack_584871.zip/loader.exe -> Downloader.IstBar : Cleaned with backup
C:\Moi Jaakko tää\backups\backup-20060430-192803-283.dll -> Adware.WebHancer : Cleaned with backup
C:\Program Files\Screensavers.com\Installer\bin\ScreensaversInst.dll -> Adware.Comet : Cleaned with backup
C:\Program Files\webHancer\Programs\whiehlpr.dll -> Adware.WebHancer : Cleaned with backup
C:\Program Files\webHancer\Programs\__delete_on_reboot__webhdll.dll -> Adware.WebHancer : Cleaned with backup
C:\Program Files\whInstall -> Adware.Webhancer : Cleaned with backup
C:\Program Files\whInstall\license.txt -> Adware.Webhancer : Cleaned with backup
C:\Program Files\whInstall\readme.txt -> Adware.Webhancer : Cleaned with backup
C:\Program Files\whInstall\whAgent.ini -> Adware.Webhancer : Cleaned with backup
C:\roskakori\banpanel1.exe -> Not-A-Virus.Monitor.Win32.Ardamax.k : Cleaned with backup
C:\roskakori\furnimaker1.exe -> Not-A-Virus.Monitor.Win32.Ardamax.k : Cleaned with backup
C:\roskakori\hcmaker1.exe -> Not-A-Virus.Monitor.Win32.Ardamax.k : Cleaned with backup
C:\roskakori\modpanel1.exe -> Not-A-Virus.Monitor.Win32.Ardamax.k : Cleaned with backup
C:\WINDOWS\NDNuninstall7_22.exe -> Adware.NewDotNet : Cleaned with backup
C:\WINDOWS\system32\hc_maker.007 -> Not-A-Virus.Monitor.Win32.Ardamax.k : Cleaned with backup
C:\WINDOWS\system32\hc_maker.exe -> Not-A-Virus.Monitor.Win32.Ardamax.24 : Cleaned with backup
::Report End
Paljo paskaa löyty ;)
Paljon näytti olevan tavaraa, Nuo rivit jota ei löytynyt hävisi ohjelman poistossa ja scriptien ajossa.
Koita fixata tämä vikasietotilassa.
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.rover-host.com/infected.html
Jos ei lähde, niin tämä rivi mukaan.
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
Ja F-securessa näytti olevan virustorjunta, joten poista Avast. Yksi viruksentorjunta ja palomuuri konella samaan aikaan.
Lähetä uusi HijackThis loki.
No äske ku mä poistin sen vikasietotilas nii joha lähti, mut ku käynnistin koneen uuvestaa, nii tuli joku windowsin esto homma et konees oli joku ongelma nii se jotai fyysijuttuja lataili ja sit käynnisty uuvellee. Kokoaja sama juttu siihe asti ku käynnistin koneen vikasietotilaan ja laitoin järjestelmänpalautuksella aiempaa, jolloin oli tää sama virus, eli alotetaanpas alusta. Oon eetu ja tässä mun moi jaakko tämä logi:
Logfile of HijackThis v1.99.1
Scan saved at 16:35:40, on 1.5.2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
C:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
C:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
C:\Program Files\Sonera Tietoturva\Anti-Virus\FSGK32.EXE
C:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
C:\Program Files\Sonera Tietoturva\Anti-Virus\fssm32.exe
C:\Program Files\Sonera Tietoturva\Common\FSMB32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
C:\Program Files\Sonera Tietoturva\Common\FCH32.EXE
C:\Program Files\Sonera Tietoturva\Common\FAMEH32.EXE
C:\Program Files\Sonera Tietoturva\Anti-Virus\fsrw.exe
C:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
C:\Program Files\Sonera Tietoturva\Common\FSM32.EXE
C:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Warez P2P Client\warez.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Xfire\Xfire.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Moi Jaakko tää\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.rover-host.com/infected.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.rover-host.com/infected.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Sonera Tietoturva\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Sonera Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\Sonera Tietoturva\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "C:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [hc_maker] C:\WINDOWS\System32\hc_maker.exe
O4 - HKLM\..\Run: [pnERNhaHa] C:\WINDOWS\jrfdljvw.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [warez] "C:\Program Files\Warez P2P Client\warez.exe" -h
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Bun] c:\windows\system32\crack.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Sonera Tietoturva.lnk = C:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\Sonera Tietoturva\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Sonera Tietoturva\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Sonera Tietoturva\Anti-Spyware\ieshield.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by20fd.bay20.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Sonera Tietoturva (BackWeb Plug-in - 4436233) - Sonera Tietoturva - C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - C:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
Poista lisää tai poista sovelluksista.
Warez P2P Client
Download Accelerator Plus, DAP
Merkkaa nämä, sulje selain ja klikkaa fix checked.
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.rover-host.com/infected.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.rover-host.com/infected.html
O4 - HKLM\..\Run: [hc_maker] C:\WINDOWS\System32\hc_maker.exe
O4 - HKLM\..\Run: [pnERNhaHa] C:\WINDOWS\jrfdljvw.exe
O4 - HKCU\..\Run: [warez] "C:\Program Files\Warez P2P Client\warez.exe" -h
O4 - HKCU\..\Run: [Bun] c:\windows\system32\crack.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
Piilotetut tiedostot näkyviin.
Ohjauspaneeli -> Kansio asetukset -> Näytä -> Näytä piilotetut tiedostot.
Käynnistä vikasietotilaan.
Poista
C:\WINDOWS\System32\-->hc_maker.exejrfdljvw.exerelated.htmcrack.exeDAPWarez P2P Client Oma tietokone ja navigoi C:\BFU kansioon.
Käynnistä Brute Force Uninstaller tupla-klikkaamalla BFU.exe
Scriptline to execute kentässä kirjoita tai liitä c:\bfu\alcanshorty.bfu
Klikkaa Execute ja anna sen tehdä työnsä. (Sinun pitäisi nähdä edistyspalkki jos teit tämän oikein.)
Odota Complete script execution boksia ja klikkaa OK.
Klikkaa exit lopettaaksesi Brute Force Uninstallerin.
Käynnistä normaaliin tilaan.
Lähetä uusi HijackThis loki ja Ewidon raportti
Logfile of HijackThis v1.99.1
Scan saved at 18:15:20, on 1.5.2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
C:\Program Files\Xfire\Xfire.exe
C:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
C:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
C:\Program Files\Sonera Tietoturva\Anti-Virus\FSGK32.EXE
C:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
C:\Program Files\Sonera Tietoturva\Anti-Virus\fssm32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sonera Tietoturva\Common\FSMB32.EXE
C:\Program Files\Sonera Tietoturva\Common\FCH32.EXE
C:\Program Files\Sonera Tietoturva\Common\FAMEH32.EXE
C:\Program Files\Sonera Tietoturva\Anti-Virus\fsrw.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\moi jaakko tää\hijackthis.exe
C:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwst.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Sonera Tietoturva\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Sonera Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\Sonera Tietoturva\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "C:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Sonera Tietoturva.lnk = C:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\Sonera Tietoturva\Anti-Spyware\blockpopups.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Sonera Tietoturva\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Sonera Tietoturva\Anti-Spyware\ieshield.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by20fd.bay20.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Sonera Tietoturva (BackWeb Plug-in - 4436233) - Sonera Tietoturva - C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - C:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------
Created on: 18:09:50, 1.5.2006
Report-Checksum: 6D340698
Scan result:
HKLM\SOFTWARE\Avenue Media -> Adware.InternetOptimizer : Cleaned with backup
HKLM\SOFTWARE\Avenue Media\Internet Optimizer -> Adware.InternetOptimizer : Cleaned with backup
HKLM\SOFTWARE\Avenue Media\Internet Optimizer\Browser Helper -> Adware.InternetOptimizer : Cleaned with backup
HKLM\SOFTWARE\Avenue Media\Internet Optimizer\Browser Helper\cf1 -> Adware.InternetOptimizer : Cleaned with backup
HKLM\SOFTWARE\Classes\DyFuCA_BH.BHObj -> Adware.MoneyTree : Cleaned with backup
HKLM\SOFTWARE\Classes\DyFuCA_BH.BHObj\CLSID -> Adware.MoneyTree : Cleaned with backup
HKLM\SOFTWARE\Classes\DyFuCA_BH.BHObj\CurVer -> Adware.MoneyTree : Cleaned with backup
HKLM\SOFTWARE\Classes\DyFuCA_BH.BHObj.1 -> Adware.MoneyTree : Cleaned with backup
HKLM\SOFTWARE\Classes\Ysb.YsbObj -> Adware.YourSiteBar : Cleaned with backup
HKLM\SOFTWARE\Classes\Ysb.YsbObj\CLSID -> Adware.YourSiteBar : Cleaned with backup
HKLM\SOFTWARE\Classes\Ysb.YsbObj\CurVer -> Adware.YourSiteBar : Cleaned with backup
HKLM\SOFTWARE\Classes\Ysb.YsbObj.1 -> Adware.YourSiteBar : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\AMeOpt -> Adware.InternetOptimizer : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DyFuCA -> Adware.MoneyTree : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Kapabout -> Adware.InternetOptimizer : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\YourSiteBar -> Adware.ISTBar : Cleaned with backup
HKLM\SOFTWARE\Policies\Avenue Media -> Adware.InternetOptimizer : Cleaned with backup
HKLM\SOFTWARE\YourSiteBar -> Adware.ISTBar : Cleaned with backup
HKLM\SOFTWARE\YourSiteBar\Historyfiles -> Adware.ISTBar : Cleaned with backup
HKLM\SOFTWARE\YourSiteBar\Historystring -> Adware.ISTBar : Cleaned with backup
HKU\S-1-5-21-220523388-2000478354-839522115-1004\Software\Avenue Media -> Adware.InternetOptimizer : Cleaned with backup
HKU\S-1-5-21-220523388-2000478354-839522115-1004\Software\IST -> Adware.ISTBar : Cleaned with backup
HKU\S-1-5-21-220523388-2000478354-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Policies\AMeOpt -> Adware.InternetOptimizer : Cleaned with backup
HKU\S-1-5-21-220523388-2000478354-839522115-1004\Software\Policies\Avenue Media -> Adware.InternetOptimizer : Cleaned with backup
:mozilla.26:C:\Documents and Settings\SWAT\Application Data\Mozilla\Firefox\Profiles\ymeb84pc.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned with backup
:mozilla.35:C:\Documents and Settings\SWAT\Application Data\Mozilla\Firefox\Profiles\ymeb84pc.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.36:C:\Documents and Settings\SWAT\Application Data\Mozilla\Firefox\Profiles\ymeb84pc.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.37:C:\Documents and Settings\SWAT\Application Data\Mozilla\Firefox\Profiles\ymeb84pc.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.47:C:\Documents and Settings\SWAT\Application Data\Mozilla\Firefox\Profiles\ymeb84pc.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup
C:\Documents and Settings\SWAT\Cookies\swat@atdmt[1].txt -> TrackingCookie.Atdmt : Cleaned with backup
C:\Documents and Settings\SWAT\Cookies\swat@com[1].txt -> TrackingCookie.Com : Cleaned with backup
C:\RECYCLER\S-1-5-21-220523388-2000478354-839522115-1004\Dc28.exe -> Not-A-Virus.Monitor.Win32.Ardamax.24 : Cleaned with backup
C:\roskakori\banpanel1.exe -> Not-A-Virus.Monitor.Win32.Ardamax.k : Cleaned with backup
C:\roskakori\furnimaker1.exe -> Not-A-Virus.Monitor.Win32.Ardamax.k : Cleaned with backup
C:\roskakori\hcmaker1.exe -> Not-A-Virus.Monitor.Win32.Ardamax.k : Cleaned with backup
C:\roskakori\modpanel1.exe -> Not-A-Virus.Monitor.Win32.Ardamax.k : Cleaned with backup
C:\WINDOWS\NDNuninstall7_22.exe -> Adware.NewDotNet : Cleaned with backup
C:\WINDOWS\nem220.dll -> Downloader.Dyfuca : Cleaned with backup
::Report End
Tämä vielä fixiin.
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
Windows päivityksiä lataamaan hopi hopi SP2 puuttuu.
Kiitos! :D Laatukone meil, ku asentaa päivitykset, kone ei toimi, ja pitää asentaa uuvellee recorevylt :D