Rekisteröidy

Ilmoitukset

Ladataan…

    Näytä kaikki

    hjt-tiedosto

    mulla on alkanut ilmaantuu noita troijalaisia ym,pöpöjä vaikka en paljoa ole käynyt nyt netissä. mistähän tuo nyt johtuu? ja mitä kannattais tehdä?
    Adwarekin menee jumiin, ei pääse loppuunasti..
    ohessa hjt-tiedosto:

    Logfile of HijackThis v1.99.1
    Scan saved at 19:11:05, on 11.5.2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Norman\bin\ZLH.EXE
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\Norman\NPF\NPFMSG.EXE
    C:\Program Files\Microsoft Office\Office\OSA.EXE
    C:\Program Files\Norman\NPF\NPFSVICE.EXE
    C:\Norman\Bin\Zanda.exe
    C:\WINDOWS\system32\slserv.exe
    C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Norman\bin\NJEEVES.EXE
    C:\Norman\Nvc\bin\nvcoas.exe
    C:\Norman\Nvc\BIN\NIP.EXE
    C:\Norman\Nvc\BIN\NVCSCHED.EXE
    C:\Norman\Nvc\BIN\nipsvc.exe
    C:\Norman\Nvc\bin\cclaw.exe
    C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\hjt\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://elisa.net/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://elisa.net/
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://elisa.net/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - Toimittaja Elisa Internet
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: (no name) - {ED0EBA5C-E548-448D-956F-A9E47390DF8C} - C:\Program Files\Common Files\mehoweq.dll (file missing)
    O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_5_0.dll
    O3 - Toolbar: BitComet Toolbar - {2E608F70-C430-4bc5-96F6-608E02EBA5B2} - C:\Program Files\BitComet Toolbar\v2.0.0.5\BitComet_Toolbar.dll
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [keyboard] c:\\keyboard18.exe
    O4 - HKLM\..\Run: [newname] c:\\newname18.exe
    O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
    O4 - HKLM\..\Run: [defender] c:\\defender1.exe
    O4 - HKLM\..\Run: [webHancer Survey Companion] C:\Program Files\webHancer\Programs\whsurvey.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [rzqu] C:\PROGRA~1\COMMON~1\rzqu\rzqum.exe
    O4 - Startup: Microsoft Office Pikahaku.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
    O4 - Startup: Officen käynnistys.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: NPF Messenger.lnk = ?
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: Tuki - {16B09332-6936-4D38-AC3C-D5D67B151B90} - http://tuki.elisa.net/ (file missing) (HKCU)
    O9 - Extra button: SMS-viesti - {ED94EFF4-AFA4-4DD0-BFED-EEC285A38A4E} - http://sms.kolumbus.fi/ (file missing) (HKCU)
    O9 - Extra button: Palvelut - {F70EB8E1-8AC0-4075-B36B-9B2ABCD03FDC} - http://service.kolumbus.fi/ (file missing) (HKCU)
    O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O20 - Winlogon Notify: ShellCompatibility - C:\WINDOWS\system32\pzdgen.dll (file missing)
    O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN\nipsvc.exe
    O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE
    O23 - Service: Norman Type-R - Unknown owner - C:\Program Files\Norman\NPF\NPFSVICE.EXE
    O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\Bin\Zanda.exe
    O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe
    O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\Norman\Nvc\BIN\NVCSCHED.EXE
    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
    O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
    9680
    Äänestä

    Muut lukivat myös

    Vastaukset 9

    Vanhimmat

    * Lataa tuosta Look2Me-Destroyer.exe työpöydällesi.

    http://www.atribune.org/ccount/click.php?id=7

    *** TÄRKEÄÄ: Ennen fixin jatkamista, sinun täytyy tehdä seuraavat: ***



    * Tulosta tämä, tai tallenna tekstitiedostona sopivaan sijaintiin.
    * Klikkaa käynnistä -> Suorita ja kirjoita: services.msc
    * Klikkaa OK.
    * Tarkista että tämä palvelu on käynnissä tai sen käynnistymistapa on automaattinen:
    * Toissijainen kirjautuminen
    * Seuraavaksi tietokoneesi on oltava offlinessa, vedä nettipiuha seinästä jos tarpeen.
    * Virustorjuntasi, ja kaikkien muiden turvaohjelmistojen TÄYTYY olla suljettuja.

    Jatka fixiä:


    * Sulje ikkunat jatkaaksesi.
    * Tupla-klikkaa Look2Me-Destroyer.exe filua ajaaksesi sen.
    * Rastita Run this program as a task.
    * Saat viestin joka sanoo "Look2Me-Destroyer will close and re-open in approximately 1 minute". Klikkaa OK
    * Kun se avautuu uudestaan, klikkaa Scan for L2M valintaa, pikakuvakkeesi katoavat; tämä on normaalia.
    * Kun skannaus on valmis, klikkaa Remove L2M.
    * Saat Done Scanning viestin, klikkaa OK.
    * Kun valmis, saat tämän viestin: Done removing infected files! Look2Me-Destroyer will now shutdown your computer, klikkaa OK.
    * Koneesi sammuu.
    * Käynnistä se uudelleen.
    * Postita C:\Look2Me-Destroyer.txt lokin sisältö seuraavaan viestiisi.

    Jos Look2Me-Destroyer ei aukea automaattisesi, käynnistä tietokoneesi uudestaan ja koita uudelleen.

    boottaa kone. Lähetä uusi hijackthis loki ja C:\Look2Me-Destroyer.txt

    Äänestä

    • jep, tosin ajon aikana norman poisti jonkun troijalaisen mutta muuten meni ihan hyvin

      Logfile of HijackThis v1.99.1
      Scan saved at 21:05:48, on 11.5.2006
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\csrss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\Norman\NPF\NPFSVICE.EXE
      C:\Norman\Bin\Zanda.exe
      C:\WINDOWS\system32\slserv.exe
      C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\wdfmgr.exe
      C:\Norman\Nvc\BIN\NVCSCHED.EXE
      C:\Norman\bin\NJEEVES.EXE
      C:\Norman\Nvc\bin\nvcoas.exe
      C:\Norman\Nvc\BIN\nipsvc.exe
      C:\WINDOWS\System32\alg.exe
      C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
      C:\Program Files\DAEMON Tools\daemon.exe
      C:\Program Files\iTunes\iTunesHelper.exe
      C:\Norman\bin\ZLH.EXE
      C:\Program Files\Messenger\msmsgs.exe
      C:\Program Files\iPod\bin\iPodService.exe
      C:\Norman\Nvc\BIN\NIP.EXE
      C:\Norman\Nvc\bin\cclaw.exe
      C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      C:\Program Files\Norman\NPF\NPFMSG.EXE
      C:\Program Files\Microsoft Office\Office\OSA.EXE
      C:\WINDOWS\system32\wuauclt.exe
      C:\hjt\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://elisa.net/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://elisa.net/
      R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://elisa.net/
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - Toimittaja Elisa Internet
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      O2 - BHO: (no name) - {ED0EBA5C-E548-448D-956F-A9E47390DF8C} - C:\Program Files\Common Files\mehoweq.dll (file missing)
      O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_5_0.dll
      O3 - Toolbar: BitComet Toolbar - {2E608F70-C430-4bc5-96F6-608E02EBA5B2} - C:\Program Files\BitComet Toolbar\v2.0.0.5\BitComet_Toolbar.dll
      O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
      O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
      O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
      O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
      O4 - HKLM\..\Run: [keyboard] c:\\keyboard18.exe
      O4 - HKLM\..\Run: [newname] c:\\newname18.exe
      O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
      O4 - HKLM\..\Run: [defender] c:\\defender1.exe
      O4 - HKLM\..\Run: [webHancer Survey Companion] C:\Program Files\webHancer\Programs\whsurvey.exe
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O4 - HKCU\..\Run: [rzqu] C:\PROGRA~1\COMMON~1\rzqu\rzqum.exe
      O4 - Startup: Microsoft Office Pikahaku.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
      O4 - Startup: Officen käynnistys.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
      O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
      O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      O4 - Global Startup: NPF Messenger.lnk = ?
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra button: Tuki - {16B09332-6936-4D38-AC3C-D5D67B151B90} - http://tuki.elisa.net/ (file missing) (HKCU)
      O9 - Extra button: SMS-viesti - {ED94EFF4-AFA4-4DD0-BFED-EEC285A38A4E} - http://sms.kolumbus.fi/ (file missing) (HKCU)
      O9 - Extra button: Palvelut - {F70EB8E1-8AC0-4075-B36B-9B2ABCD03FDC} - http://service.kolumbus.fi/ (file missing) (HKCU)
      O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
      O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
      O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
      O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
      O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN\nipsvc.exe
      O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE
      O23 - Service: Norman Type-R - Unknown owner - C:\Program Files\Norman\NPF\NPFSVICE.EXE
      O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\Bin\Zanda.exe
      O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe
      O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\Norman\Nvc\BIN\NVCSCHED.EXE
      O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
      O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe






      Look2Me-Destroyer V1.0.12

      Scanning for infected files.....
      Scan started at 11.5.2006 20:44:05

      Infected! C:\WINDOWS\system32\pzdgen.dll

      Attempting to delete infected files...

      Making registry repairs.

      Removing: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ShellCompatibility

      Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{0A740FC3-D47E-4CC0-B399-3C45D3038C7F}"
      HKCR\Clsid\{0A740FC3-D47E-4CC0-B399-3C45D3038C7F}

      Restoring Windows certificates.

      Replaced hosts file with default windows hosts file


      Restoring SeDebugPrivilege for Järjestelmänvalvojat - Succeeded

      Äänestä

    • ... kirjoitti:

      jep, tosin ajon aikana norman poisti jonkun troijalaisen mutta muuten meni ihan hyvin

      Logfile of HijackThis v1.99.1
      Scan saved at 21:05:48, on 11.5.2006
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\csrss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\Norman\NPF\NPFSVICE.EXE
      C:\Norman\Bin\Zanda.exe
      C:\WINDOWS\system32\slserv.exe
      C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\wdfmgr.exe
      C:\Norman\Nvc\BIN\NVCSCHED.EXE
      C:\Norman\bin\NJEEVES.EXE
      C:\Norman\Nvc\bin\nvcoas.exe
      C:\Norman\Nvc\BIN\nipsvc.exe
      C:\WINDOWS\System32\alg.exe
      C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
      C:\Program Files\DAEMON Tools\daemon.exe
      C:\Program Files\iTunes\iTunesHelper.exe
      C:\Norman\bin\ZLH.EXE
      C:\Program Files\Messenger\msmsgs.exe
      C:\Program Files\iPod\bin\iPodService.exe
      C:\Norman\Nvc\BIN\NIP.EXE
      C:\Norman\Nvc\bin\cclaw.exe
      C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      C:\Program Files\Norman\NPF\NPFMSG.EXE
      C:\Program Files\Microsoft Office\Office\OSA.EXE
      C:\WINDOWS\system32\wuauclt.exe
      C:\hjt\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://elisa.net/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://elisa.net/
      R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://elisa.net/
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - Toimittaja Elisa Internet
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      O2 - BHO: (no name) - {ED0EBA5C-E548-448D-956F-A9E47390DF8C} - C:\Program Files\Common Files\mehoweq.dll (file missing)
      O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_5_0.dll
      O3 - Toolbar: BitComet Toolbar - {2E608F70-C430-4bc5-96F6-608E02EBA5B2} - C:\Program Files\BitComet Toolbar\v2.0.0.5\BitComet_Toolbar.dll
      O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
      O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
      O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
      O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
      O4 - HKLM\..\Run: [keyboard] c:\\keyboard18.exe
      O4 - HKLM\..\Run: [newname] c:\\newname18.exe
      O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
      O4 - HKLM\..\Run: [defender] c:\\defender1.exe
      O4 - HKLM\..\Run: [webHancer Survey Companion] C:\Program Files\webHancer\Programs\whsurvey.exe
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O4 - HKCU\..\Run: [rzqu] C:\PROGRA~1\COMMON~1\rzqu\rzqum.exe
      O4 - Startup: Microsoft Office Pikahaku.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
      O4 - Startup: Officen käynnistys.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
      O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
      O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      O4 - Global Startup: NPF Messenger.lnk = ?
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra button: Tuki - {16B09332-6936-4D38-AC3C-D5D67B151B90} - http://tuki.elisa.net/ (file missing) (HKCU)
      O9 - Extra button: SMS-viesti - {ED94EFF4-AFA4-4DD0-BFED-EEC285A38A4E} - http://sms.kolumbus.fi/ (file missing) (HKCU)
      O9 - Extra button: Palvelut - {F70EB8E1-8AC0-4075-B36B-9B2ABCD03FDC} - http://service.kolumbus.fi/ (file missing) (HKCU)
      O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
      O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
      O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
      O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
      O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN\nipsvc.exe
      O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE
      O23 - Service: Norman Type-R - Unknown owner - C:\Program Files\Norman\NPF\NPFSVICE.EXE
      O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\Bin\Zanda.exe
      O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe
      O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\Norman\Nvc\BIN\NVCSCHED.EXE
      O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
      O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe






      Look2Me-Destroyer V1.0.12

      Scanning for infected files.....
      Scan started at 11.5.2006 20:44:05

      Infected! C:\WINDOWS\system32\pzdgen.dll

      Attempting to delete infected files...

      Making registry repairs.

      Removing: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ShellCompatibility

      Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{0A740FC3-D47E-4CC0-B399-3C45D3038C7F}"
      HKCR\Clsid\{0A740FC3-D47E-4CC0-B399-3C45D3038C7F}

      Restoring Windows certificates.

      Replaced hosts file with default windows hosts file


      Restoring SeDebugPrivilege for Järjestelmänvalvojat - Succeeded

      Lataa tuosta Brute Force Uninstaller työpöydällesi.
      http://www.merijn.org/files/bfu.zip


      * Oikea-klikkaa BFU zippiä työpöydälläsi, ja valitse Pura kaikki.
      * Klikkaa "Seuraava"
      * Boksissa missä valita mihin haluat tiedostot purkaa,
      * Klikkaa "Selaa"
      * Klikkaa merkkiä oman tietokoneen vieressä
      * Klikkaa "Paikallinen Levy ( C: )" tai mikä sinun tärkein levysi onkin
      * Klikkaa "Tee uusi kansio"
      * Kirjoita BFU
      * Klikkaa "Seuraava", ja ÄLÄ rastita boksia "Näytä puretut tiedostot" ja klikkaa "Valmis".

      OIKEA-KLIKKAA TÄSTÄ ja valitse "Save As"
      http://metallica.geekstogo.com/alcanshorty.bfu

      (Explorerissa "Save Target As") ladataksesi Alcra PLUS Poistajan.
      Tallenna se samaan kansioon jonka teit aiemmin (c:\BFU).

      Älä tee mitään tällä vielä!

      Käynnistä koneesi vikasietotilaan naputtamalla F8 näppäintä käynnistyksen yhteydessä.

      Klikkaa Käynnistä > Oma tietokone ja navigoi C:\BFU kansioon.


      * Käynnistä Brute Force Uninstaller tupla-klikkaamalla BFU.exe
      * Scriptline to execute kentässä kirjoita tai liitä c:\bfu\alcanshorty.bfu
      * Klikkaa Execute ja anna sen tehdä työnsä. (Sinun pitäisi nähdä edistyspalkki jos teit tämän oikein.)
      * Odota Complete script execution boksia ja klikkaa OK.
      * Klikkaa exit lopettaaksesi Brute Force Uninstallerin.

      Käynnistä normaalisti uudelleen ja postita tuore HijackThis logi.

      Äänestä

    • Juu kirjoitti:

      Lataa tuosta Brute Force Uninstaller työpöydällesi.
      http://www.merijn.org/files/bfu.zip


      * Oikea-klikkaa BFU zippiä työpöydälläsi, ja valitse Pura kaikki.
      * Klikkaa "Seuraava"
      * Boksissa missä valita mihin haluat tiedostot purkaa,
      * Klikkaa "Selaa"
      * Klikkaa merkkiä oman tietokoneen vieressä
      * Klikkaa "Paikallinen Levy ( C: )" tai mikä sinun tärkein levysi onkin
      * Klikkaa "Tee uusi kansio"
      * Kirjoita BFU
      * Klikkaa "Seuraava", ja ÄLÄ rastita boksia "Näytä puretut tiedostot" ja klikkaa "Valmis".

      OIKEA-KLIKKAA TÄSTÄ ja valitse "Save As"
      http://metallica.geekstogo.com/alcanshorty.bfu

      (Explorerissa "Save Target As") ladataksesi Alcra PLUS Poistajan.
      Tallenna se samaan kansioon jonka teit aiemmin (c:\BFU).

      Älä tee mitään tällä vielä!

      Käynnistä koneesi vikasietotilaan naputtamalla F8 näppäintä käynnistyksen yhteydessä.

      Klikkaa Käynnistä > Oma tietokone ja navigoi C:\BFU kansioon.


      * Käynnistä Brute Force Uninstaller tupla-klikkaamalla BFU.exe
      * Scriptline to execute kentässä kirjoita tai liitä c:\bfu\alcanshorty.bfu
      * Klikkaa Execute ja anna sen tehdä työnsä. (Sinun pitäisi nähdä edistyspalkki jos teit tämän oikein.)
      * Odota Complete script execution boksia ja klikkaa OK.
      * Klikkaa exit lopettaaksesi Brute Force Uninstallerin.

      Käynnistä normaalisti uudelleen ja postita tuore HijackThis logi.

      ok tässä tiedosto:

      Logfile of HijackThis v1.99.1
      Scan saved at 9:13:20, on 12.5.2006
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\csrss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
      C:\Program Files\DAEMON Tools\daemon.exe
      C:\Program Files\iTunes\iTunesHelper.exe
      C:\Norman\bin\ZLH.EXE
      C:\Program Files\Messenger\msmsgs.exe
      C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      C:\Program Files\Norman\NPF\NPFMSG.EXE
      C:\Program Files\Microsoft Office\Office\OSA.EXE
      C:\Program Files\Norman\NPF\NPFSVICE.EXE
      C:\Norman\Bin\Zanda.exe
      C:\WINDOWS\system32\slserv.exe
      C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\wdfmgr.exe
      C:\Norman\Nvc\BIN\NIP.EXE
      C:\Program Files\iPod\bin\iPodService.exe
      C:\Norman\Nvc\BIN\NVCSCHED.EXE
      C:\Norman\Nvc\bin\nvcoas.exe
      C:\Norman\bin\NJEEVES.EXE
      C:\Norman\Nvc\BIN\nipsvc.exe
      C:\WINDOWS\System32\alg.exe
      C:\Norman\Nvc\bin\cclaw.exe
      C:\WINDOWS\System32\wbem\wmiprvse.exe
      C:\WINDOWS\system32\wuauclt.exe
      C:\hjt\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://elisa.net/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://elisa.net/
      R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://elisa.net/
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - Toimittaja Elisa Internet
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      O2 - BHO: (no name) - {ED0EBA5C-E548-448D-956F-A9E47390DF8C} - C:\Program Files\Common Files\mehoweq.dll (file missing)
      O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_5_0.dll
      O3 - Toolbar: BitComet Toolbar - {2E608F70-C430-4bc5-96F6-608E02EBA5B2} - C:\Program Files\BitComet Toolbar\v2.0.0.5\BitComet_Toolbar.dll
      O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
      O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
      O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
      O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
      O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
      O4 - HKLM\..\Run: [defender] c:\\defender1.exe
      O4 - HKLM\..\Run: [webHancer Survey Companion] C:\Program Files\webHancer\Programs\whsurvey.exe
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O4 - HKCU\..\Run: [rzqu] C:\PROGRA~1\COMMON~1\rzqu\rzqum.exe
      O4 - Startup: Microsoft Office Pikahaku.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
      O4 - Startup: Officen käynnistys.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
      O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
      O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      O4 - Global Startup: NPF Messenger.lnk = ?
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra button: Tuki - {16B09332-6936-4D38-AC3C-D5D67B151B90} - http://tuki.elisa.net/ (file missing) (HKCU)
      O9 - Extra button: SMS-viesti - {ED94EFF4-AFA4-4DD0-BFED-EEC285A38A4E} - http://sms.kolumbus.fi/ (file missing) (HKCU)
      O9 - Extra button: Palvelut - {F70EB8E1-8AC0-4075-B36B-9B2ABCD03FDC} - http://service.kolumbus.fi/ (file missing) (HKCU)
      O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
      O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
      O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
      O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
      O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN\nipsvc.exe
      O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE
      O23 - Service: Norman Type-R - Unknown owner - C:\Program Files\Norman\NPF\NPFSVICE.EXE
      O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\Bin\Zanda.exe
      O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe
      O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\Norman\Nvc\BIN\NVCSCHED.EXE
      O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
      O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

      Äänestä

    • ... kirjoitti:

      ok tässä tiedosto:

      Logfile of HijackThis v1.99.1
      Scan saved at 9:13:20, on 12.5.2006
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\csrss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
      C:\Program Files\DAEMON Tools\daemon.exe
      C:\Program Files\iTunes\iTunesHelper.exe
      C:\Norman\bin\ZLH.EXE
      C:\Program Files\Messenger\msmsgs.exe
      C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      C:\Program Files\Norman\NPF\NPFMSG.EXE
      C:\Program Files\Microsoft Office\Office\OSA.EXE
      C:\Program Files\Norman\NPF\NPFSVICE.EXE
      C:\Norman\Bin\Zanda.exe
      C:\WINDOWS\system32\slserv.exe
      C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\wdfmgr.exe
      C:\Norman\Nvc\BIN\NIP.EXE
      C:\Program Files\iPod\bin\iPodService.exe
      C:\Norman\Nvc\BIN\NVCSCHED.EXE
      C:\Norman\Nvc\bin\nvcoas.exe
      C:\Norman\bin\NJEEVES.EXE
      C:\Norman\Nvc\BIN\nipsvc.exe
      C:\WINDOWS\System32\alg.exe
      C:\Norman\Nvc\bin\cclaw.exe
      C:\WINDOWS\System32\wbem\wmiprvse.exe
      C:\WINDOWS\system32\wuauclt.exe
      C:\hjt\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://elisa.net/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://elisa.net/
      R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://elisa.net/
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - Toimittaja Elisa Internet
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      O2 - BHO: (no name) - {ED0EBA5C-E548-448D-956F-A9E47390DF8C} - C:\Program Files\Common Files\mehoweq.dll (file missing)
      O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_5_0.dll
      O3 - Toolbar: BitComet Toolbar - {2E608F70-C430-4bc5-96F6-608E02EBA5B2} - C:\Program Files\BitComet Toolbar\v2.0.0.5\BitComet_Toolbar.dll
      O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
      O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
      O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
      O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
      O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
      O4 - HKLM\..\Run: [defender] c:\\defender1.exe
      O4 - HKLM\..\Run: [webHancer Survey Companion] C:\Program Files\webHancer\Programs\whsurvey.exe
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O4 - HKCU\..\Run: [rzqu] C:\PROGRA~1\COMMON~1\rzqu\rzqum.exe
      O4 - Startup: Microsoft Office Pikahaku.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
      O4 - Startup: Officen käynnistys.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
      O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
      O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      O4 - Global Startup: NPF Messenger.lnk = ?
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra button: Tuki - {16B09332-6936-4D38-AC3C-D5D67B151B90} - http://tuki.elisa.net/ (file missing) (HKCU)
      O9 - Extra button: SMS-viesti - {ED94EFF4-AFA4-4DD0-BFED-EEC285A38A4E} - http://sms.kolumbus.fi/ (file missing) (HKCU)
      O9 - Extra button: Palvelut - {F70EB8E1-8AC0-4075-B36B-9B2ABCD03FDC} - http://service.kolumbus.fi/ (file missing) (HKCU)
      O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
      O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
      O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
      O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
      O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN\nipsvc.exe
      O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE
      O23 - Service: Norman Type-R - Unknown owner - C:\Program Files\Norman\NPF\NPFSVICE.EXE
      O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\Bin\Zanda.exe
      O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe
      O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\Norman\Nvc\BIN\NVCSCHED.EXE
      O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
      O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

      Hae Ewido

      http://www.ewido.net/en/download/

      asenna ja päivitä se.
      Poista ohjauspaneelista jos näkyy

      webHancer

      Merkkaa nuo sulje selain ja paina Fix checked

      O2 - BHO: (no name) - {ED0EBA5C-E548-448D-956F-A9E47390DF8C} - C:\Program Files\Common Files\mehoweq.dll (file missing)
      O4 - HKLM\..\Run: [defender] c:\\defender1.exe
      O4 - HKLM\..\Run: [webHancer Survey Companion] C:\Program Files\webHancer\Programs\whsurvey.exe
      O4 - HKCU\..\Run: [rzqu] C:\PROGRA~1\COMMON~1\rzqu\rzqum.exe

      Käynnistä sitte vikasietotilassa ja piilotiedostot näkyvillä poista jos löytyy

      c:\defender1.exe
      C:\Program Files\webHancer\ < kansio
      C:\PROGRA~1\COMMON~1\rzqu\ < kansio

      Sitte scannaa ja putsaa Ewidolla säästä sen logi.
      Käynnistä sitte normaalisti ja uus Hijack logi ja Ewidon logi.

      Äänestä

    • Juu kirjoitti:

      Hae Ewido

      http://www.ewido.net/en/download/

      asenna ja päivitä se.
      Poista ohjauspaneelista jos näkyy

      webHancer

      Merkkaa nuo sulje selain ja paina Fix checked

      O2 - BHO: (no name) - {ED0EBA5C-E548-448D-956F-A9E47390DF8C} - C:\Program Files\Common Files\mehoweq.dll (file missing)
      O4 - HKLM\..\Run: [defender] c:\\defender1.exe
      O4 - HKLM\..\Run: [webHancer Survey Companion] C:\Program Files\webHancer\Programs\whsurvey.exe
      O4 - HKCU\..\Run: [rzqu] C:\PROGRA~1\COMMON~1\rzqu\rzqum.exe

      Käynnistä sitte vikasietotilassa ja piilotiedostot näkyvillä poista jos löytyy

      c:\defender1.exe
      C:\Program Files\webHancer\ < kansio
      C:\PROGRA~1\COMMON~1\rzqu\ < kansio

      Sitte scannaa ja putsaa Ewidolla säästä sen logi.
      Käynnistä sitte normaalisti ja uus Hijack logi ja Ewidon logi.

      jep, tässä olisi nämä tiedostot

      Logfile of HijackThis v1.99.1
      Scan saved at 18:42:34, on 15.5.2006
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\csrss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
      C:\Program Files\DAEMON Tools\daemon.exe
      C:\Program Files\iTunes\iTunesHelper.exe
      C:\Norman\bin\ZLH.EXE
      C:\Program Files\Messenger\msmsgs.exe
      C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      C:\Program Files\Norman\NPF\NPFMSG.EXE
      C:\Program Files\Microsoft Office\Office\OSA.EXE
      C:\Program Files\ewido anti-malware\ewidoctrl.exe
      C:\Program Files\ewido anti-malware\ewidoguard.exe
      C:\Program Files\Norman\NPF\NPFSVICE.EXE
      C:\Norman\Bin\Zanda.exe
      C:\WINDOWS\system32\slserv.exe
      C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\wdfmgr.exe
      C:\Norman\Nvc\BIN\NIP.EXE
      C:\Program Files\iPod\bin\iPodService.exe
      C:\Norman\Nvc\bin\nvcoas.exe
      C:\Norman\bin\NJEEVES.EXE
      C:\Norman\Nvc\BIN\nipsvc.exe
      C:\Norman\Nvc\BIN\NVCSCHED.EXE
      C:\Norman\Nvc\bin\cclaw.exe
      C:\WINDOWS\System32\alg.exe
      C:\hjt\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://elisa.net/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://elisa.net/
      R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://elisa.net/
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - Toimittaja Elisa Internet
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_5_0.dll
      O3 - Toolbar: BitComet Toolbar - {2E608F70-C430-4bc5-96F6-608E02EBA5B2} - C:\Program Files\BitComet Toolbar\v2.0.0.5\BitComet_Toolbar.dll
      O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
      O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
      O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
      O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
      O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O4 - Startup: Microsoft Office Pikahaku.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
      O4 - Startup: Officen käynnistys.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
      O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
      O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      O4 - Global Startup: NPF Messenger.lnk = ?
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra button: Tuki - {16B09332-6936-4D38-AC3C-D5D67B151B90} - http://tuki.elisa.net/ (file missing) (HKCU)
      O9 - Extra button: SMS-viesti - {ED94EFF4-AFA4-4DD0-BFED-EEC285A38A4E} - http://sms.kolumbus.fi/ (file missing) (HKCU)
      O9 - Extra button: Palvelut - {F70EB8E1-8AC0-4075-B36B-9B2ABCD03FDC} - http://service.kolumbus.fi/ (file missing) (HKCU)
      O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
      O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
      O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
      O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
      O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
      O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
      O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN\nipsvc.exe
      O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE
      O23 - Service: Norman Type-R - Unknown owner - C:\Program Files\Norman\NPF\NPFSVICE.EXE
      O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\Bin\Zanda.exe
      O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe
      O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\Norman\Nvc\BIN\NVCSCHED.EXE
      O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
      O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe


      ja sitten tämä...

      ---------------------------------------------------------
      ewido anti-malware - Scan report
      ---------------------------------------------------------

      Created on: 19:47:33, 15.5.2006
      Report-Checksum: B1DB93B6

      Scan result:

      :mozilla.11:C:\Documents and Settings\seppo kasurinen\Application Data\Mozilla\Firefox\Profiles\tq3bq1qu.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup


      ::Report End


      tämän jälkimmäisen ajoin parikertaa mutta tätä samaa infektiota se herjaa
      Muutoin kone toimii nopeemmin, mutta pöpöt muutti tuon työpöydän kuvake tekstin (väri laatikkoon",en löytänyt muokkaus asetusta tähän, tiedätkö mistä saan värin pois?)

      Äänestä

    • ... kirjoitti:

      jep, tässä olisi nämä tiedostot

      Logfile of HijackThis v1.99.1
      Scan saved at 18:42:34, on 15.5.2006
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\csrss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
      C:\Program Files\DAEMON Tools\daemon.exe
      C:\Program Files\iTunes\iTunesHelper.exe
      C:\Norman\bin\ZLH.EXE
      C:\Program Files\Messenger\msmsgs.exe
      C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      C:\Program Files\Norman\NPF\NPFMSG.EXE
      C:\Program Files\Microsoft Office\Office\OSA.EXE
      C:\Program Files\ewido anti-malware\ewidoctrl.exe
      C:\Program Files\ewido anti-malware\ewidoguard.exe
      C:\Program Files\Norman\NPF\NPFSVICE.EXE
      C:\Norman\Bin\Zanda.exe
      C:\WINDOWS\system32\slserv.exe
      C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\wdfmgr.exe
      C:\Norman\Nvc\BIN\NIP.EXE
      C:\Program Files\iPod\bin\iPodService.exe
      C:\Norman\Nvc\bin\nvcoas.exe
      C:\Norman\bin\NJEEVES.EXE
      C:\Norman\Nvc\BIN\nipsvc.exe
      C:\Norman\Nvc\BIN\NVCSCHED.EXE
      C:\Norman\Nvc\bin\cclaw.exe
      C:\WINDOWS\System32\alg.exe
      C:\hjt\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://elisa.net/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://elisa.net/
      R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://elisa.net/
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - Toimittaja Elisa Internet
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_5_0.dll
      O3 - Toolbar: BitComet Toolbar - {2E608F70-C430-4bc5-96F6-608E02EBA5B2} - C:\Program Files\BitComet Toolbar\v2.0.0.5\BitComet_Toolbar.dll
      O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
      O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
      O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
      O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
      O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O4 - Startup: Microsoft Office Pikahaku.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
      O4 - Startup: Officen käynnistys.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
      O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
      O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      O4 - Global Startup: NPF Messenger.lnk = ?
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra button: Tuki - {16B09332-6936-4D38-AC3C-D5D67B151B90} - http://tuki.elisa.net/ (file missing) (HKCU)
      O9 - Extra button: SMS-viesti - {ED94EFF4-AFA4-4DD0-BFED-EEC285A38A4E} - http://sms.kolumbus.fi/ (file missing) (HKCU)
      O9 - Extra button: Palvelut - {F70EB8E1-8AC0-4075-B36B-9B2ABCD03FDC} - http://service.kolumbus.fi/ (file missing) (HKCU)
      O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
      O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
      O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
      O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
      O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
      O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
      O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN\nipsvc.exe
      O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE
      O23 - Service: Norman Type-R - Unknown owner - C:\Program Files\Norman\NPF\NPFSVICE.EXE
      O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\Bin\Zanda.exe
      O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe
      O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\Norman\Nvc\BIN\NVCSCHED.EXE
      O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
      O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe


      ja sitten tämä...

      ---------------------------------------------------------
      ewido anti-malware - Scan report
      ---------------------------------------------------------

      Created on: 19:47:33, 15.5.2006
      Report-Checksum: B1DB93B6

      Scan result:

      :mozilla.11:C:\Documents and Settings\seppo kasurinen\Application Data\Mozilla\Firefox\Profiles\tq3bq1qu.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup


      ::Report End


      tämän jälkimmäisen ajoin parikertaa mutta tätä samaa infektiota se herjaa
      Muutoin kone toimii nopeemmin, mutta pöpöt muutti tuon työpöydän kuvake tekstin (väri laatikkoon",en löytänyt muokkaus asetusta tähän, tiedätkö mistä saan värin pois?)

      Logi on ok ja tuo Ewidon löytö on pelkkä Cookie joka on normaalia ja siittä ei tarvi välittää.

      > mutta pöpöt muutti tuon työpöydän kuvake tekstin <

      Siis työpöydällä olevien kuvakkeiden alapuolella olevan textin tausta on vaihtannu väriä vai?
      En tiedä mistä se muutetaan .

      Äänestä

    • ... kirjoitti:

      jep, tässä olisi nämä tiedostot

      Logfile of HijackThis v1.99.1
      Scan saved at 18:42:34, on 15.5.2006
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\csrss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
      C:\Program Files\DAEMON Tools\daemon.exe
      C:\Program Files\iTunes\iTunesHelper.exe
      C:\Norman\bin\ZLH.EXE
      C:\Program Files\Messenger\msmsgs.exe
      C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      C:\Program Files\Norman\NPF\NPFMSG.EXE
      C:\Program Files\Microsoft Office\Office\OSA.EXE
      C:\Program Files\ewido anti-malware\ewidoctrl.exe
      C:\Program Files\ewido anti-malware\ewidoguard.exe
      C:\Program Files\Norman\NPF\NPFSVICE.EXE
      C:\Norman\Bin\Zanda.exe
      C:\WINDOWS\system32\slserv.exe
      C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\wdfmgr.exe
      C:\Norman\Nvc\BIN\NIP.EXE
      C:\Program Files\iPod\bin\iPodService.exe
      C:\Norman\Nvc\bin\nvcoas.exe
      C:\Norman\bin\NJEEVES.EXE
      C:\Norman\Nvc\BIN\nipsvc.exe
      C:\Norman\Nvc\BIN\NVCSCHED.EXE
      C:\Norman\Nvc\bin\cclaw.exe
      C:\WINDOWS\System32\alg.exe
      C:\hjt\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://elisa.net/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://elisa.net/
      R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://elisa.net/
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - Toimittaja Elisa Internet
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_5_0.dll
      O3 - Toolbar: BitComet Toolbar - {2E608F70-C430-4bc5-96F6-608E02EBA5B2} - C:\Program Files\BitComet Toolbar\v2.0.0.5\BitComet_Toolbar.dll
      O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
      O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
      O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
      O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
      O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O4 - Startup: Microsoft Office Pikahaku.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
      O4 - Startup: Officen käynnistys.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
      O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
      O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      O4 - Global Startup: NPF Messenger.lnk = ?
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra button: Tuki - {16B09332-6936-4D38-AC3C-D5D67B151B90} - http://tuki.elisa.net/ (file missing) (HKCU)
      O9 - Extra button: SMS-viesti - {ED94EFF4-AFA4-4DD0-BFED-EEC285A38A4E} - http://sms.kolumbus.fi/ (file missing) (HKCU)
      O9 - Extra button: Palvelut - {F70EB8E1-8AC0-4075-B36B-9B2ABCD03FDC} - http://service.kolumbus.fi/ (file missing) (HKCU)
      O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
      O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
      O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
      O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
      O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
      O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
      O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN\nipsvc.exe
      O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE
      O23 - Service: Norman Type-R - Unknown owner - C:\Program Files\Norman\NPF\NPFSVICE.EXE
      O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\Bin\Zanda.exe
      O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe
      O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\Norman\Nvc\BIN\NVCSCHED.EXE
      O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
      O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe


      ja sitten tämä...

      ---------------------------------------------------------
      ewido anti-malware - Scan report
      ---------------------------------------------------------

      Created on: 19:47:33, 15.5.2006
      Report-Checksum: B1DB93B6

      Scan result:

      :mozilla.11:C:\Documents and Settings\seppo kasurinen\Application Data\Mozilla\Firefox\Profiles\tq3bq1qu.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup


      ::Report End


      tämän jälkimmäisen ajoin parikertaa mutta tätä samaa infektiota se herjaa
      Muutoin kone toimii nopeemmin, mutta pöpöt muutti tuon työpöydän kuvake tekstin (väri laatikkoon",en löytänyt muokkaus asetusta tähän, tiedätkö mistä saan värin pois?)

      Työpöydällä olevien kuvakkeiniden teksti on värilaatikossa.

      Ne saat pois näin:

      Klikkaa tyhjällä työpöydällä hiiren oikealla korvalla > ominaisuudet > välilehti työpöytä > mukauta työpöytä > Web välilehti > Ota ruksi pois kohdasta *Lukitse työpöydän kohteet*

      Äänestä

    • FixFix kirjoitti:

      Työpöydällä olevien kuvakkeiniden teksti on värilaatikossa.

      Ne saat pois näin:

      Klikkaa tyhjällä työpöydällä hiiren oikealla korvalla > ominaisuudet > välilehti työpöytä > mukauta työpöytä > Web välilehti > Ota ruksi pois kohdasta *Lukitse työpöydän kohteet*

      Kiitos avusta

      Äänestä

    Odottaa vastausta

    Näihin keskusteluihin ei ole vielä vastattu. Ole ensimmäinen.

    Luetuimmat keskustelut

    Kommentoi aloitusta

    Nimetön kirjoitti:

    mulla on alkanut ilmaantuu noita troijalaisia ym,pöpöjä vaikka en paljoa ole käynyt nyt netissä. mistähän tuo nyt johtuu? ja mitä kannattais tehdä?
    Adwarekin menee jumiin, ei pääse loppuunasti..
    ohessa hjt-tiedosto:

    Logfile of HijackThis v1.99.1
    Scan saved at 19:11:05, on 11.5.2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Norman\bin\ZLH.EXE
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\Norman\NPF\NPFMSG.EXE
    C:\Program Files\Microsoft Office\Office\OSA.EXE
    C:\Program Files\Norman\NPF\NPFSVICE.EXE
    C:\Norman\Bin\Zanda.exe
    C:\WINDOWS\system32\slserv.exe
    C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Norman\bin\NJEEVES.EXE
    C:\Norman\Nvc\bin\nvcoas.exe
    C:\Norman\Nvc\BIN\NIP.EXE
    C:\Norman\Nvc\BIN\NVCSCHED.EXE
    C:\Norman\Nvc\BIN\nipsvc.exe
    C:\Norman\Nvc\bin\cclaw.exe
    C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\hjt\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://elisa.net/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://elisa.net/
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://elisa.net/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - Toimittaja Elisa Internet
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: (no name) - {ED0EBA5C-E548-448D-956F-A9E47390DF8C} - C:\Program Files\Common Files\mehoweq.dll (file missing)
    O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_5_0.dll
    O3 - Toolbar: BitComet Toolbar - {2E608F70-C430-4bc5-96F6-608E02EBA5B2} - C:\Program Files\BitComet Toolbar\v2.0.0.5\BitComet_Toolbar.dll
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [keyboard] c:\\keyboard18.exe
    O4 - HKLM\..\Run: [newname] c:\\newname18.exe
    O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
    O4 - HKLM\..\Run: [defender] c:\\defender1.exe
    O4 - HKLM\..\Run: [webHancer Survey Companion] C:\Program Files\webHancer\Programs\whsurvey.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [rzqu] C:\PROGRA~1\COMMON~1\rzqu\rzqum.exe
    O4 - Startup: Microsoft Office Pikahaku.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
    O4 - Startup: Officen käynnistys.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: NPF Messenger.lnk = ?
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: Tuki - {16B09332-6936-4D38-AC3C-D5D67B151B90} - http://tuki.elisa.net/ (file missing) (HKCU)
    O9 - Extra button: SMS-viesti - {ED94EFF4-AFA4-4DD0-BFED-EEC285A38A4E} - http://sms.kolumbus.fi/ (file missing) (HKCU)
    O9 - Extra button: Palvelut - {F70EB8E1-8AC0-4075-B36B-9B2ABCD03FDC} - http://service.kolumbus.fi/ (file missing) (HKCU)
    O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O20 - Winlogon Notify: ShellCompatibility - C:\WINDOWS\system32\pzdgen.dll (file missing)
    O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN\nipsvc.exe
    O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE
    O23 - Service: Norman Type-R - Unknown owner - C:\Program Files\Norman\NPF\NPFSVICE.EXE
    O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\Bin\Zanda.exe
    O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe
    O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\Norman\Nvc\BIN\NVCSCHED.EXE
    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
    O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

    Anonyymi
    5000

    Ilmoita asiaton sisältö

    • Sisältää materiaalia, joka on loukkaavaa, herjaavaa, rasistista, uhkailevaa tai ahdistelevaa.

    • Materiaali sisältää nimiä, yhteystietoja tai muita henkilökohtaisia tietoja. Julkisuuden henkilöistä, julkisissa viroissa toimivista ihmisistä sekä yritysten vastuuhenkilöistä saa keskustella työhön liittyen. Myös yksityiselämään liittyvistä asioista voi keskustella siltä osin, kuin niistä on julkisesti kerrottu.

    • Sisältää lapsille haitallista tai heiltä kiellettyä materiaalia. Seksuaalinen sisältö on sallittua aiheeseen tarkoitetuilla palstoilla, joiden ikäraja on 18 vuotta.

    • Lainvastaista sisältöä voi olla mm. yksityiselämää loukkaavan tiedon levitys, kiihottaminen kansanryhmää vastaan, laiton uhkaaminen, alaikäisiin liittyvä seksuaalinen sisältö/grooming, petokset, identiteettivarkaudet, kunnianloukkaukset ja tekijänoikeusrikkomukset.

    • Sisältö ei liity palstan tai keskusteluketjun aiheeseen.

    • Viesti ei ole suomea tai ruotsia (pl. International Forums), se sisältää mainontaa, se sisältää tekijänoikeuksin suojattua materiaalia, se on massapostitus tai jokin muu syy.

    Jaa keskustelu