ei taida konevanhus olla ihan puhdas. Vähän ainakin hämää se että jos avaan kansion missä lukee virus (sisältäen yhdyssanat, mm antivirus :P) niin kaikki avatut kansiot sulkeutuu..
Logfile of HijackThis v1.99.1
Scan saved at 22:23:47, on 15.9.2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\MS32.exe
C:\WINNT\Explorer.exe
C:\WINNT\system32\secman.exe
C:\WINNT\sqldps.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\RUNDLL32.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINNT\system32\internat.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\cwshredder\WinZip\WZQKPICK.EXE
C:\hjt\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dnainternet.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dnainternet.fi
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\system32\shdocpe.dll/asst.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\shdocpe.dll/asst.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://C:\WINNT\system32\shdocpe.dll/asst.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\shdocpe.dll/asst.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://C:\WINNT\system32\shdocpe.dll/asst.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = dna Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://paivitys.dnainternet.fi/yhteys/proxy.pac
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
F2 - REG:system.ini: Shell=Explorer.exe MS32.exe
F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,MS32.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Microsoft (R) Windows Vista/NT Runtime Compatibility Service] C:\WINNT\NT\nrcs.exe
O4 - HKLM\..\Run: [syia3ba1] RUNDLL32.EXE w00610c7.dll,n 003a3b9e0000000a00610c7
O4 - HKLM\..\Run: [newname] C:\\nwnmff_14.exe
O4 - HKLM\..\Run: [Ms Java for Windows NT] MS32.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\RunServices: [MS Java Applets for Windows NT & XP] javaapplet.exe
O4 - HKLM\..\RunServices: [MS Java for Windows XP & NT] javanet.exe
O4 - HKLM\..\RunServices: [Sun Java Console for Windows NT & XP] jconsole.exe
O4 - HKLM\..\RunServices: [MS Java Service Wrapper for Windows NT & XP] wrapper.exe
O4 - HKLM\..\RunServices: [Windows Kernel System Service] wkssvr.exe
O4 - HKLM\..\RunServices: [ntdll.dll] wkssvr.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Ms Java for Windows NT] MS32.exe
O4 - HKCU\..\RunServices: [MS Java for Windows XP & NT] javanet.exe
O4 - HKCU\..\RunServices: [Sun Java Console for Windows NT & XP] jconsole.exe
O4 - HKCU\..\RunServices: [MS Java Service Wrapper for Windows NT & XP] wrapper.exe
O4 - HKCU\..\RunServices: [Windows Kernel System Service] wkssvr.exe
O4 - Global Startup: fxp.cmd
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\cwshredder\WinZip\WZQKPICK.EXE
O9 - Extra button: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - C:\Program Files\Net2Phone\Net2fone.exe
O9 - Extra 'Tools' menuitem: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - C:\Program Files\Net2Phone\Net2fone.exe
O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin4.dll
O12 - Plugin for .mpg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.dnainternet.fi
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab30149.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab30149.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab30149.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab30149.cab
O20 - Winlogon Notify: MCD - C:\WINNT\
O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\DOCUMENTS AND SETTINGS\JÄRJESTELMÄNVALVOJA\OMAT TIEDOSTOT\SONJA\Nvc\BIN\nipsvc.exe
O23 - Service: Windows Network Security Management Service (nsms) - Unknown owner - C:\WINNT\system32\8.tmp (file missing)
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\DOCUMENTS AND SETTINGS\JÄRJESTELMÄNVALVOJA\OMAT TIEDOSTOT\SONJA\nvc\BIN\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\DOCUMENTS AND SETTINGS\JÄRJESTELMÄNVALVOJA\OMAT TIEDOSTOT\SONJA\nvc\BIN\NVCSCHED.EXE
O23 - Service: Microsoft sdk core (sdk) - Unknown owner - C:\WINNT\lsass.exe
O23 - Service: sqldps - Unknown owner - C:\WINNT\sqldps.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe
O23 - Service: Windows Genuine Advantage Registration Service (wgareg) - Unknown owner - C:\WINNT\system32\wgareg.exe
Logfile of HijackThis v1.99.1
Scan saved at 22:23:47, on 15.9.2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\MS32.exe
C:\WINNT\Explorer.exe
C:\WINNT\system32\secman.exe
C:\WINNT\sqldps.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\RUNDLL32.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINNT\system32\internat.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\cwshredder\WinZip\WZQKPICK.EXE
C:\hjt\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dnainternet.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dnainternet.fi
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\system32\shdocpe.dll/asst.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\shdocpe.dll/asst.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://C:\WINNT\system32\shdocpe.dll/asst.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\shdocpe.dll/asst.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://C:\WINNT\system32\shdocpe.dll/asst.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = dna Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://paivitys.dnainternet.fi/yhteys/proxy.pac
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
F2 - REG:system.ini: Shell=Explorer.exe MS32.exe
F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,MS32.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Microsoft (R) Windows Vista/NT Runtime Compatibility Service] C:\WINNT\NT\nrcs.exe
O4 - HKLM\..\Run: [syia3ba1] RUNDLL32.EXE w00610c7.dll,n 003a3b9e0000000a00610c7
O4 - HKLM\..\Run: [newname] C:\\nwnmff_14.exe
O4 - HKLM\..\Run: [Ms Java for Windows NT] MS32.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\RunServices: [MS Java Applets for Windows NT & XP] javaapplet.exe
O4 - HKLM\..\RunServices: [MS Java for Windows XP & NT] javanet.exe
O4 - HKLM\..\RunServices: [Sun Java Console for Windows NT & XP] jconsole.exe
O4 - HKLM\..\RunServices: [MS Java Service Wrapper for Windows NT & XP] wrapper.exe
O4 - HKLM\..\RunServices: [Windows Kernel System Service] wkssvr.exe
O4 - HKLM\..\RunServices: [ntdll.dll] wkssvr.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Ms Java for Windows NT] MS32.exe
O4 - HKCU\..\RunServices: [MS Java for Windows XP & NT] javanet.exe
O4 - HKCU\..\RunServices: [Sun Java Console for Windows NT & XP] jconsole.exe
O4 - HKCU\..\RunServices: [MS Java Service Wrapper for Windows NT & XP] wrapper.exe
O4 - HKCU\..\RunServices: [Windows Kernel System Service] wkssvr.exe
O4 - Global Startup: fxp.cmd
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\cwshredder\WinZip\WZQKPICK.EXE
O9 - Extra button: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - C:\Program Files\Net2Phone\Net2fone.exe
O9 - Extra 'Tools' menuitem: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - C:\Program Files\Net2Phone\Net2fone.exe
O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin4.dll
O12 - Plugin for .mpg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.dnainternet.fi
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab30149.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab30149.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab30149.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab30149.cab
O20 - Winlogon Notify: MCD - C:\WINNT\
O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\DOCUMENTS AND SETTINGS\JÄRJESTELMÄNVALVOJA\OMAT TIEDOSTOT\SONJA\Nvc\BIN\nipsvc.exe
O23 - Service: Windows Network Security Management Service (nsms) - Unknown owner - C:\WINNT\system32\8.tmp (file missing)
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\DOCUMENTS AND SETTINGS\JÄRJESTELMÄNVALVOJA\OMAT TIEDOSTOT\SONJA\nvc\BIN\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\DOCUMENTS AND SETTINGS\JÄRJESTELMÄNVALVOJA\OMAT TIEDOSTOT\SONJA\nvc\BIN\NVCSCHED.EXE
O23 - Service: Microsoft sdk core (sdk) - Unknown owner - C:\WINNT\lsass.exe
O23 - Service: sqldps - Unknown owner - C:\WINNT\sqldps.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe
O23 - Service: Windows Genuine Advantage Registration Service (wgareg) - Unknown owner - C:\WINNT\system32\wgareg.exe
Vastaukset 21
Vanhimmat
Lataa tuolta
http://koti.mbnet.fi/pattaya1/escanmwav.htm
asenna, päivitä tapa2, laita täpit merkkauksien mukaan.
Scannaa
jos alaikkunaan virukset tulee jotain laita loki tänne.
kopioi se näin:
Käytä komentoa Ctrl A.
Kopioi rivit komennolla Ctrl C.
Liitä rivit komennolla Ctrl V.
laita sitten uusi hjt-loki myös.
Lataa http://siri.urz.free.fr/Fix/SmitfraudFix.zip
Pura sisältö (kansio nimeltä SmitfraudFix työpöydällesi:
Avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
Valitse optio #1 - Search kirjoittamalla 1 ja painamalla Enter; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa).
Postita tämän tekstitiedoston sisältö viestiketjuusi.
Huomaa: process.exe filun tunnistaa jotkut Anti-virus ohjelmat (AntiVir, Dr.Web, Kaspersky) "Haittakaluna"; se ei ole virus, vaan ohjelma joka pysäyttää prosesseja. A/V ohjelmat eivät pysty tunnistamaan hyvän ja pahan käytön tälläisten ohjelmian väliltä, silloin ne saattavat varoittaa käyttäjää.
http://www.beyondlogic.org/consulting/processutil/processutil.htm
En pystynyt suorittamaan escania, kävi samanlailla kuin aloitusviestissä sanoin. Ohjelma pysyi päällä noin kymmenesosasekunnin ja kaatui.
Tässä kuitenkin smitfraudin logi
SmitFraudFix v2.88
Scan done at 0:50:42,91, la 16.09.2006
Run from C:\Documents and Settings\J„rjestelm„nvalvoja\Ty”p”yt„\SmitfraudFix
OS: Microsoft Windows 2000 [Versio 5.00.2195] - Windows_NT
Fix ran in normal mode
»»»»»»»»»»»»»»»»»»»»»»»» C:\
C:\drsmartload?.exe FOUND !
C:\drsmartload??.exe FOUND !
C:\drsmartload???.exe FOUND !
C:\drsmartload????.exe FOUND !
C:\MTE3NDI6ODoxNg.exe FOUND !
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINNT
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINNT\system
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINNT\Web
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINNT\system32
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\J„rjestelm„nvalvoja\Application Data
»»»»»»»»»»»»»»»»»»»»»»»» Start Menu
»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\JRJEST~1\Suosikit
»»»»»»»»»»»»»»»»»»»»»»»» Desktop
»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys
»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection
»»»»»»»»»»»»»»»»»»»»»»»» End
Printtaa ohjeet ulos.
Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi.
Kun vikasietotilassa, avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
Valitse optio #2 - Clean kirjoittamalla 2 ja painamalla "Enter" poistaaksesi tarttuneet tiedostot.
Sinulta kysytään: "Registry cleaning - Do you want to clean the registry ?"; vastaa "Yes" kirjoittamalla Y ja paina "Enter" poistaaksesi työpöydän taustakuvan ja puhdistaaksesi tarttuneet rekisteriavaimet.
Työkalu tarkistaa jos wininet.dll on tarttunut. Sinua saatetaan pyytää korvaamaan tarttunut .dll (jos löytyy); vastaa "Yes" kirjoittamalla Y ja painamalla "Enter".
Työkalun saattaa tarvita käynnistää kone uudelleen; jos ei tee niin, käynnistä normaaliin Windowsiin.
Tekstitiedosto ilmestyy, puhdistusprosessin jäljiltä; kopioi & liitä tämän raportin tulokset vastaukseesi.
Raportti löytyy paikalliselta levyltäsi, useimmiten C:\rapport.txt.
ja hjt-loki
SmitFraudFix v2.88
Scan done at 2:06:59,90, la 16.09.2006
Run from C:\Documents and Settings\J„rjestelm„nvalvoja\Ty”p”yt„\SmitfraudFix
OS: Microsoft Windows 2000 [Versio 5.00.2195] - Windows_NT
Fix ran in normal mode
»»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» Killing process
»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix
GenericRenosFix by S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files
»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files
»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning
Registry Cleaning done.
»»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» End
Ja sitten hijackthis logi
Logfile of HijackThis v1.99.1
Scan saved at 2:19:59, on 16.9.2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\MS32.exe
C:\WINNT\system32\secman.exe
C:\WINNT\sqldps.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\RUNDLL32.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINNT\system32\internat.exe
C:\Program Files\cwshredder\WinZip\WZQKPICK.EXE
C:\WINNT\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\hjt\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://C:\WINNT\system32\shdocpe.dll/asst.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = dna Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://paivitys.dnainternet.fi/yhteys/proxy.pac
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
F2 - REG:system.ini: Shell=Explorer.exe MS32.exe
F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,MS32.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Microsoft (R) Windows Vista/NT Runtime Compatibility Service] C:\WINNT\NT\nrcs.exe
O4 - HKLM\..\Run: [syia3ba1] RUNDLL32.EXE w00610c7.dll,n 003a3b9e0000000a00610c7
O4 - HKLM\..\Run: [Ms Java for Windows NT] MS32.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\RunServices: [MS Java Applets for Windows NT & XP] javaapplet.exe
O4 - HKLM\..\RunServices: [MS Java for Windows XP & NT] javanet.exe
O4 - HKLM\..\RunServices: [Sun Java Console for Windows NT & XP] jconsole.exe
O4 - HKLM\..\RunServices: [MS Java Service Wrapper for Windows NT & XP] wrapper.exe
O4 - HKLM\..\RunServices: [Windows Kernel System Service] wkssvr.exe
O4 - HKLM\..\RunServices: [ntdll.dll] wkssvr.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Ms Java for Windows NT] MS32.exe
O4 - HKCU\..\RunServices: [MS Java for Windows XP & NT] javanet.exe
O4 - HKCU\..\RunServices: [Sun Java Console for Windows NT & XP] jconsole.exe
O4 - HKCU\..\RunServices: [MS Java Service Wrapper for Windows NT & XP] wrapper.exe
O4 - HKCU\..\RunServices: [Windows Kernel System Service] wkssvr.exe
O4 - Global Startup: fxp.cmd
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\cwshredder\WinZip\WZQKPICK.EXE
O9 - Extra button: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - C:\Program Files\Net2Phone\Net2fone.exe
O9 - Extra 'Tools' menuitem: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - C:\Program Files\Net2Phone\Net2fone.exe
O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin4.dll
O12 - Plugin for .mpg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.dnainternet.fi
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab30149.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab30149.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab30149.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab30149.cab
O20 - Winlogon Notify: MCD - C:\WINNT\
O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\DOCUMENTS AND SETTINGS\JÄRJESTELMÄNVALVOJA\OMAT TIEDOSTOT\SONJA\Nvc\BIN\nipsvc.exe
O23 - Service: Windows Network Security Management Service (nsms) - Unknown owner - C:\WINNT\system32\8.tmp (file missing)
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\DOCUMENTS AND SETTINGS\JÄRJESTELMÄNVALVOJA\OMAT TIEDOSTOT\SONJA\nvc\BIN\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\DOCUMENTS AND SETTINGS\JÄRJESTELMÄNVALVOJA\OMAT TIEDOSTOT\SONJA\nvc\BIN\NVCSCHED.EXE
O23 - Service: Microsoft sdk core (sdk) - Unknown owner - C:\WINNT\lsass.exe
O23 - Service: sqldps - Unknown owner - C:\WINNT\sqldps.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe
O23 - Service: Windows Genuine Advantage Registration Service (wgareg) - Unknown owner - C:\WINNT\system32\wgareg.exe
1. Lataa combofix.exe http://download.bleepingcomputer.com/sUBs/combofix.exe tiedosto työpöydällesi.
2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
merkaa ja paina fix checked
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://C:\WINNT\system32\shdocpe.dll/asst.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
F2 - REG:system.ini: Shell=Explorer.exe MS32.exe
F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,MS32.exe
O4 - HKLM\..\Run: [Microsoft (R) Windows Vista/NT Runtime Compatibility Service] C:\WINNT\NT\nrcs.exe
O4 - HKLM\..\RunServices: [MS Java Applets for Windows NT & XP] javaapplet.exe
O4 - HKLM\..\Run: [Microsoft (R) Windows Vista/NT Runtime Compatibility Service] C:\WINNT\NT\nrcs.exe
O4 - HKCU\..\Run: [Ms Java for Windows NT] MS32.exe
O4 - HKLM\..\RunServices: [MS Java for Windows XP & NT] javanet.exe
O4 - HKLM\..\RunServices: [Sun Java Console for Windows NT & XP] jconsole.exe
O4 - HKLM\..\RunServices: [MS Java Service Wrapper for Windows NT & XP] wrapper.exe
O4 - HKCU\..\RunServices: [Windows Kernel System Service] wkssvr.exe
O23 - Service: Microsoft sdk core (sdk) - Unknown owner - C:\WINNT\lsass.exe
O23 - Service: sqldps - Unknown owner - C:\WINNT\sqldps.exe
O23 - Service: Windows Genuine Advantage Registration Service (wgareg) - Unknown owner - C:\WINNT\system32\wgareg.exe
Kirjoita suorita kohtaan ja paina enter jokaisen rivin jälkeen
sc stop sdk
sc delete sdk
sc stop sqldps
sc delete sqldps
sc stop wgareg
sc delete wgareg
laita sitten uusi hjt-loki
fixsaukseen
O4 - HKLM\..\RunServices: [ntdll.dll] wkssvr.exe
O20 - Winlogon Notify: MCD - C:\WINNT\
fixsaukseen
O4 - HKLM\..\RunServices: [ntdll.dll] wkssvr.exe
O20 - Winlogon Notify: MCD - C:\WINNT\
lataa http://downloads.andymanchesta.com/RemovalTools/SDFix.zip
a tallenna se työpöydällesi.
Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi:
• Käynnistä tietokone
• Kun kuulet koneen piippaavan, paina F8, kuitenkin ennen Windowsin logon esiintuloa
• Seuraavaksi pitäisi ilmestyä valikko
• Valitse valikosta vikasietotila.
• Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
• Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
• Paina Y käynnistääksesi skriptin.
• Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
• Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
• Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
• Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
• Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
• Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis lokin kera.
tässä combofixin logi, suoritan tämän jälkeen nuo muut toimenpiteet
J„rjestelm„nvalvoja - la 16.09.2006 13:33:04,28 Service Pack 4
ComboFix 06.09.14 - Running from: C:\Documents and Settings\J„rjestelm„nvalvoja\Ty”p”yt„
((((((((((((((((((((((((((((((((((((((((((((( Look2Me's Log ))))))))))))))))))))))))))))))))))))))))))))))))))
REGISTRY ENTRIES REMOVED:
[HKEY_CLASSES_ROOT\CLSID\{92DBC871-58A4-4123-A3D1-11C4E27EB2A0}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{92DBC871-58A4-4123-A3D1-11C4E27EB2A0}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{92DBC871-58A4-4123-A3D1-11C4E27EB2A0}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{92DBC871-58A4-4123-A3D1-11C4E27EB2A0}\InprocServer32]
"ThreadingModel"="Apartment"
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
FILES REMOVED:
C:\WINNT\system32\d80mlid1180.dll
C:\WINNT\system32\en2ul1f91.dll
C:\WINNT\system32\enp2l17o1.dll
C:\WINNT\system32\ktnml7511.dll
C:\WINNT\system32\l4l6le3s1h.dll
C:\WINNT\system32\m664lgjq16oe.dll
C:\WINNT\system32\mvp6l97s1.dll
C:\WINNT\system32\n8r2li9o18.dll
C:\WINNT\system32\o2ro0c93ef.dll
C:\WINNT\system32\s4880eluehq80.dll
Granting sedebugprivilege to Järjestelmänvalvojat ... successful
(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\dfndrff_13.exe
C:\dfndrff_14.exe
C:\drsmartload45a45f.exe
C:\drsmartload46a46f.exe
C:\drsmartload849a849f.exe
C:\deskbar.exe
C:\kybrdff_13.exe
C:\kybrdff_14.exe
C:\MTE3NDI6ODoxNgnew.exe
C:\nwnmff_13.exe
C:\nwnmff_14.exe
C:\stub_113_4_0_4_0newer.exe
C:\warebundlenewer.exe
C:\WINNT\system32\tsuninst.exe
C:\ac3_0010.exe
C:\Installer3.exe
C:\WINNT\uninstall_nmon.vbs
C:\Documents and Settings\Default User\Application Data\NetMon
C:\Program Files\Deskbar
C:\WINNT\system32\w00610c7.dll
((((((((((((((((((((((((((((((( Files Created from 2006-08-16 to 2006-09-16 ))))))))))))))))))))))))))))))))))
2006-09-16 01:36 61,440 --a------ C:\WINNT\system32\Process.exe
2006-09-16 01:36 46,592 --a------ C:\WINNT\system32\swsc.exe
2006-09-16 01:36 288,417 --a------ C:\WINNT\system32\SrchSTS.exe
2006-09-16 01:36 140,800 --a------ C:\WINNT\system32\swreg.exe
2006-09-01 14:08 224,256 -r-hs---- C:\WINNT\sqldps.exe
2006-09-01 14:07 194,048 --a------ C:\WINNT\system32\33833_netapi.exe
2006-09-01 13:17 194,048 --a------ C:\WINNT\system32\71661_netapi.exe
2006-09-01 13:17 194,048 --a------ C:\MS32.exe
2006-09-01 13:12 194,048 --a------ C:\WINNT\system32\46428_netapi.exe
2006-08-29 20:23 194,048 --a------ C:\WINNT\system32\75365_netapi.exe
2006-08-29 19:25 178,688 --a------ C:\wkssvr.exe
2006-08-29 19:03 173,056 --a------ C:\WINNT\system32\81105_netapi.exe
2006-08-29 15:05 173,056 --a------ C:\WINNT\system32\53060_netapi.exe
2006-08-28 17:06 173,056 --a------ C:\WINNT\system32\80017_netapi.exe
2006-08-28 17:04 43,508 --a------ C:\WINNT\system32\i.exe
2006-08-28 05:23 61,952 --a------ C:\WINNT\system32\syia3ba1.dll
2006-08-28 05:23 1,233 --a------ C:\WINNT\system32\syia3ba1.sys
2006-08-28 05:17 28,672 --a------ C:\aol.exe
2006-08-27 22:08 178,688 --a------ C:\WINNT\system32\06167_netapi.exe
2006-08-27 21:41 0 --a------ C:\WINNT\system32\16853_netapi.exe
2006-08-27 20:03 187,904 --a------ C:\WINNT\system32\22814_netapi.exe
2006-08-27 19:15 187,904 --a------ C:\WINNT\system32\00653_netapi.exe
2006-08-27 18:24 187,904 --a------ C:\WINNT\system32\72142_netapi.exe
2006-08-27 17:23 187,904 --a------ C:\WINNT\system32\58437_netapi.exe
2006-08-27 17:04 187,904 --a------ C:\WINNT\system32\64377_netapi.exe
2006-08-27 16:37 187,904 --a------ C:\WINNT\system32\41235_netapi.exe
2006-08-27 16:37 187,904 --a------ C:\javaapplet.exe
2006-08-27 15:44 187,904 --a------ C:\WINNT\system32\37542_netapi.exe
2006-08-27 14:29 173,056 --a------ C:\WINNT\system32\48826_netapi.exe
2006-08-27 14:12 173,056 --a------ C:\WINNT\system32\17822_netapi.exe
2006-08-25 19:09 187,904 --a------ C:\WINNT\system32\58732_netapi.exe
2006-08-25 19:00 178,688 --a------ C:\WINNT\system32\04564_netapi.exe
2006-08-25 18:49 0 --a------ C:\WINNT\system32\34536_netapi.exe
2006-08-25 18:07 187,904 --a------ C:\WINNT\system32\52143_netapi.exe
2006-08-25 17:42 187,904 --a------ C:\WINNT\system32\36613_netapi.exe
2006-08-25 17:25 187,904 --a------ C:\WINNT\system32\84440_netapi.exe
2006-08-25 17:25 187,904 --a------ C:\WINNT\system32\57248_netapi.exe
2006-08-25 17:17 187,904 --a------ C:\WINNT\system32\32862_netapi.exe
2006-08-25 15:25 187,904 --a------ C:\WINNT\system32\42604_netapi.exe
2006-08-25 15:15 187,904 --a------ C:\WINNT\system32\68371_netapi.exe
2006-08-25 15:14 187,904 --a------ C:\WINNT\system32\51150_netapi.exe
2006-08-25 15:09 187,904 --a------ C:\WINNT\system32\54844_netapi.exe
2006-08-25 14:56 187,904 --a------ C:\WINNT\system32\07284_netapi.exe
2006-08-25 14:31 187,904 --a------ C:\wrapper.exe
2006-08-25 13:55 187,904 --a------ C:\WINNT\system32\10424_netapi.exe
2006-08-24 19:56 187,904 --a------ C:\WINNT\system32\31731_netapi.exe
2006-08-24 19:55 187,904 --a------ C:\WINNT\system32\67731_netapi.exe
2006-08-24 19:54 187,904 --a------ C:\WINNT\system32\84874_netapi.exe
2006-08-24 19:19 187,904 --a------ C:\WINNT\system32\74827_netapi.exe
2006-08-24 19:02 187,904 --a------ C:\WINNT\system32\81721_netapi.exe
2006-08-24 18:53 187,904 --a------ C:\WINNT\system32\78711_netapi.exe
2006-08-24 18:50 187,904 --a------ C:\WINNT\system32\47304_netapi.exe
2006-08-24 18:49 187,904 --a------ C:\WINNT\system32\16281_netapi.exe
2006-08-24 18:41 187,904 --a------ C:\WINNT\system32\75212_netapi.exe
2006-08-24 18:34 0 --a------ C:\WINNT\system32\58603_netapi.exe
2006-08-24 18:08 0 --a------ C:\WINNT\system32\66600_netapi.exe
2006-08-24 17:52 187,904 --a------ C:\WINNT\system32\62684_netapi.exe
2006-08-24 17:29 187,904 --a------ C:\WINNT\system32\65838_netapi.exe
2006-08-24 17:16 187,904 --a------ C:\WINNT\system32\88727_netapi.exe
2006-08-24 17:16 187,904 --a------ C:\WINNT\system32\10526_netapi.exe
2006-08-24 17:08 187,904 --a------ C:\WINNT\system32\74644_netapi.exe
2006-08-24 17:03 187,904 --a------ C:\WINNT\system32\38678_netapi.exe
2006-08-24 16:57 187,904 --a------ C:\WINNT\system32\58118_netapi.exe
2006-08-24 16:52 187,904 --a------ C:\WINNT\system32\22535_netapi.exe
2006-08-24 16:48 0 --a------ C:\WINNT\system32\40568_netapi.exe
2006-08-24 16:40 187,904 --a------ C:\WINNT\system32\15068_netapi.exe
2006-08-24 16:20 187,904 --a------ C:\WINNT\system32\34864_netapi.exe
2006-08-24 15:22 187,904 --a------ C:\WINNT\system32\53127_netapi.exe
2006-08-24 15:05 187,904 --a------ C:\WINNT\system32\64065_netapi.exe
2006-08-24 14:49 187,904 --a------ C:\WINNT\system32\05874_netapi.exe
2006-08-24 14:34 187,904 --a------ C:\WINNT\system32\11152_netapi.exe
2006-08-24 13:59 187,904 --a------ C:\WINNT\system32\16834_netapi.exe
2006-08-24 13:59 187,904 --a------ C:\jconsole.exe
2006-08-23 14:34 187,904 --a------ C:\WINNT\system32\05844_netapi.exe
2006-08-18 13:00 980,480 -r-hs---- C:\WINNT\lsass.exe
2006-08-18 12:59 50,176 --ahs---- C:\WINNT\system32\net32a.exe
2006-08-16 22:58 192,000 --ah----- C:\WINNT\system32\beza.exe
2006-08-16 13:55 36,864 -r-hs---- C:\WINNT\system32\sc.exe
2006-08-16 13:55 28,160 --a------ C:\WINNT\system32\tcp.dll
2006-08-16 13:55 27,648 --a------ C:\WINNT\system32\aproman.exe
2006-08-16 13:55 194,560 -rahs---- C:\WINNT\system32\pskill.exe
2006-08-16 13:55 193,536 -rahs---- C:\WINNT\system32\MSfw.exe
2006-08-16 13:55 1,177,600 -r-hs---- C:\WINNT\system32\secman.exe
(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
2006-09-16 13:39 41744 --a------ C:\WINNT\system32\FTP.EXE
2006-09-16 13:39 17680 --a------ C:\WINNT\system32\tftp.exe
2006-09-16 13:30 -------- d-------- C:\Program Files\Mozilla Firefox
2006-09-16 00:47 510194 --a------ C:\Program Files\SmitfraudFix.zip
2006-09-04 00:10 -------- d-------- C:\Program Files\Microsoft AntiSpyware
2006-09-04 00:07 -------- d-------- C:\Program Files\CCleaner
2006-09-04 00:05 -------- d-------- C:\Program Files\antiv
2006-09-03 22:03 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-09-03 21:35 -------- d-------- C:\Program Files\Zone Labs
2006-09-03 00:37 -------- d-------- C:\Program Files\Lavasoft
2006-09-01 15:18 15241 --ahs---- C:\WINNT\system32\.exe
2006-09-01 15:11 -------- d-------- C:\Program Files\Windows Media Player
2006-09-01 14:08 95536 --a------ C:\WINNT\system32\sfc.dll
2006-09-01 13:41 -------- d-------- C:\Program Files\Internet Explorer
2006-08-13 01:06 9609 --a------ C:\WINNT\system32\wgareg.exe
(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries are not shown
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"internat.exe"="internat.exe"
"msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
"Ms Java for Windows NT"="MS32.exe"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Runservices]
"MS Java for Windows XP & NT"="javanet.exe"
"Sun Java Console for Windows NT & XP"="jconsole.exe"
"MS Java Service Wrapper for Windows NT & XP"="wrapper.exe"
"Windows Kernel System Service"="wkssvr.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe /logon"
"Microsoft (R) Windows Vista/NT Runtime Compatibility Service"="C:\\WINNT\\NT\\nrcs.exe"
"syia3ba1"="RUNDLL32.EXE w00610c7.dll,n 003a3b9e0000000a00610c7"
"Ms Java for Windows NT"="MS32.exe"
"Zone Labs Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Runservices]
"MS Java Applets for Windows NT & XP"="javaapplet.exe"
"MS Java for Windows XP & NT"="javanet.exe"
"Sun Java Console for Windows NT & XP"="jconsole.exe"
"MS Java Service Wrapper for Windows NT & XP"="wrapper.exe"
"Windows Kernel System Service"="wkssvr.exe"
"ntdll.dll"="wkssvr.exe"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000003
"Settings"=dword:00000001
"GeneralFlags"=dword:00000000
[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Ms Java for Windows NT"="MS32.exe"
[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Runservices]
"MS Java Applets for Windows NT & XP"="javaapplet.exe"
"MS Java for Windows XP & NT"="javanet.exe"
"MS Java Service Wrapper for Windows NT & XP"="wrapper.exe"
"Windows Kernel System Service"="wkssvr.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{9EF34FF2-3396-4527-9D27-04C8C1C67806}"="Microsoft AntiSpyware Service Hook"
"{FA010552-4A27-4cb1-A1BB-3E2D697F1639}"="SpySubtract Shell Extension"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000095
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"DisableTaskMgr"=dword:00000001
"DisableRegistryTools"=dword:00000001
[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000095
[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"Network.ConnectionTray"="{7007ACCF-3202-11D1-AAD2-00805FC1270E}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run-]
"Norman ZANDA"="C:\\DOCUMENTS AND SETTINGS\\JÄRJESTELMÄNVALVOJA\\OMAT TIEDOSTOT\\SONJA\\Nvc\\BIN\\ZLH.EXE /LOAD /SPLASH"
"F-StopW"="C:\\Program Files\\FSI\\F-Prot\\F-StopW.EXE"
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders
securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll
~ ~ ~ ~ ~ ~ ~ ~ Hijackthis Backups ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
backup-20060903-225712-629
O23 - Service: Norman ZANDA - Unknown owner - C:\DOCUMENTS AND SETTINGS\JÄRJESTELMÄNVALVOJA\OMAT TIEDOSTOT\SONJA\nvc\BIN\ZANDA.EXE
backup-20060903-225712-429
O23 - Service: Norman Type-R - Unknown owner - C:\DOCUMENTS AND SETTINGS\JÄRJESTELMÄNVALVOJA\OMAT TIEDOSTOT\SONJA\nvc\BIN\NPFSVICE.EXE
backup-20060903-225712-699
O23 - Service: Norman NJeeves - Unknown owner - C:\DOCUMENTS AND SETTINGS\JÄRJESTELMÄNVALVOJA\OMAT TIEDOSTOT\SONJA\nvc\BIN\NJEEVES.EXE
backup-20060903-225712-901
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\DOCUMENTS AND SETTINGS\JÄRJESTELMÄNVALVOJA\OMAT TIEDOSTOT\SONJA\Nvc\BIN\nipsvc.exe
backup-20060903-225712-281
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)
backup-20060903-225712-408
O4 - HKLM\..\Run: [defender] C:\\dfndrff_14.exe
backup-20060903-225712-498
O4 - HKLM\..\Run: [keyboard] C:\\kybrdff_14.exe
backup-20060903-225712-784
O1 - Hosts: 64.24.234.120 swirve.com # Added by Utopia Angel
backup-20060903-225534-389
O23 - Service: Microsoft sdk core (sdk) - Unknown owner - C:\WINNT\lsass.exe
backup-20060903-225534-941
O4 - HKCU\..\Run: [muum] C:\PROGRA~1\COMMON~1\muum\muumm.exe
Completion time: Sat 2006-09-16 13:41:12.86
ComboFix.txt
sdfix logi:
SDFix: Version 1.22
-------------------------
Scan Time / Date: 14:23:00.22 / Sat 2006-09-16
Microsoft Windows 2000 [Versio 5.00.2195]
Running from: C:\Documents and Settings\J„rjestelm„nvalvoja\Ty”p”yt„\SDFix
Stage One...
Checking Services...
Service Name:
------------------
nsms
File Path:
------------
C:\WINNT\system32\8.tmp
Removing Services:
------------------------
nsms ... deleted
Repairing Registry...
Killing PID 368 'MS32.exe'
Restoring Default Hosts File...
Stage One Complete
Rebooting!
Stage Two...
Registry Cleaning Finished...
Checking For Malware Files:
----------------------------------
C:\AOL.EXE
C:\WINNT\system32\00653_netapi.exe
C:\WINNT\system32\04564_netapi.exe
C:\WINNT\system32\05844_netapi.exe
C:\WINNT\system32\05874_netapi.exe
C:\WINNT\system32\06167_netapi.exe
C:\WINNT\system32\07284_netapi.exe
C:\WINNT\system32\10424_netapi.exe
C:\WINNT\system32\10526_netapi.exe
C:\WINNT\system32\11152_netapi.exe
C:\WINNT\system32\15068_netapi.exe
C:\WINNT\system32\16281_netapi.exe
C:\WINNT\system32\16834_netapi.exe
C:\WINNT\system32\16853_netapi.exe
C:\WINNT\system32\17822_netapi.exe
C:\WINNT\system32\22535_netapi.exe
C:\WINNT\system32\22814_netapi.exe
C:\WINNT\system32\31731_netapi.exe
C:\WINNT\system32\32862_netapi.exe
C:\WINNT\system32\33833_netapi.exe
C:\WINNT\system32\34536_netapi.exe
C:\WINNT\system32\34864_netapi.exe
C:\WINNT\system32\36613_netapi.exe
C:\WINNT\system32\37542_netapi.exe
C:\WINNT\system32\38678_netapi.exe
C:\WINNT\system32\40568_netapi.exe
C:\WINNT\system32\41235_netapi.exe
C:\WINNT\system32\42604_netapi.exe
C:\WINNT\system32\46428_netapi.exe
C:\WINNT\system32\47304_netapi.exe
C:\WINNT\system32\48826_netapi.exe
C:\WINNT\system32\51150_netapi.exe
C:\WINNT\system32\52143_netapi.exe
C:\WINNT\system32\53060_netapi.exe
C:\WINNT\system32\53127_netapi.exe
C:\WINNT\system32\54844_netapi.exe
C:\WINNT\system32\57248_netapi.exe
C:\WINNT\system32\58118_netapi.exe
C:\WINNT\system32\58437_netapi.exe
C:\WINNT\system32\58603_netapi.exe
C:\WINNT\system32\58732_netapi.exe
C:\WINNT\system32\62684_netapi.exe
C:\WINNT\system32\64065_netapi.exe
C:\WINNT\system32\64377_netapi.exe
C:\WINNT\system32\65838_netapi.exe
C:\WINNT\system32\66600_netapi.exe
C:\WINNT\system32\67731_netapi.exe
C:\WINNT\system32\68371_netapi.exe
C:\WINNT\system32\71661_netapi.exe
C:\WINNT\system32\72142_netapi.exe
C:\WINNT\system32\74644_netapi.exe
C:\WINNT\system32\74827_netapi.exe
C:\WINNT\system32\75212_netapi.exe
C:\WINNT\system32\75365_netapi.exe
C:\WINNT\system32\78711_netapi.exe
C:\WINNT\system32\80017_netapi.exe
C:\WINNT\system32\81105_netapi.exe
C:\WINNT\system32\81721_netapi.exe
C:\WINNT\system32\84440_netapi.exe
C:\WINNT\system32\84874_netapi.exe
C:\WINNT\system32\88727_netapi.exe
C:\WINNT\lsass.exe
C:\WINNT\NT\nrcs.exe
C:\WINNT\sqldps.exe
C:\WINNT\system32\i
C:\WINNT\system32\javaapplet.exe
C:\WINNT\system32\javanet.exe
C:\WINNT\system32\jconsole.exe
C:\WINNT\system32\MS32.exe
C:\WINNT\system32\remote.exe
C:\WINNT\system32\wgareg.exe
C:\WINNT\system32\wkssvr.exe
C:\WINNT\system32\wrapper.exe
Backing Up and Removing any Files Found...
Final Check:
Remaining Services:
------------------------
Remaining Files:
-------------------
FINISHED
ja sitten hijackthis logi:
Logfile of HijackThis v1.99.1
Scan saved at 14:37, on 06-09-16
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\secman.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\notepad.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINNT\system32\internat.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\cwshredder\WinZip\WZQKPICK.EXE
C:\hjt\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://C:\WINNT\system32\shdocpe.dll/asst.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = dna Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://paivitys.dnainternet.fi/yhteys/proxy.pac
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [syia3ba1] RUNDLL32.EXE w00610c7.dll,n 003a3b9e0000000a00610c7
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: fxp.cmd
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\cwshredder\WinZip\WZQKPICK.EXE
O9 - Extra button: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - C:\Program Files\Net2Phone\Net2fone.exe
O9 - Extra 'Tools' menuitem: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - C:\Program Files\Net2Phone\Net2fone.exe
O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin4.dll
O12 - Plugin for .mpg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.dnainternet.fi
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab30149.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab30149.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab30149.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab30149.cab
O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\DOCUMENTS AND SETTINGS\JÄRJESTELMÄNVALVOJA\OMAT TIEDOSTOT\SONJA\Nvc\BIN\nipsvc.exe
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\DOCUMENTS AND SETTINGS\JÄRJESTELMÄNVALVOJA\OMAT TIEDOSTOT\SONJA\nvc\BIN\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\DOCUMENTS AND SETTINGS\JÄRJESTELMÄNVALVOJA\OMAT TIEDOSTOT\SONJA\nvc\BIN\NVCSCHED.EXE
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe
Tallenna nämä ohjeet tekstitiedostoon tai tulosta nämä, muuten et pääse niihin käsiksi vikasietotilasta
Lataa http://www.ewido.net/en/download/ ja tallenna ohjelma työpöydällesi.
• Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa.
• Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää.
• Käynnistä Ewido Anti-Spyware.
• Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta.
• Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa.
• Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti.
• Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine".
• Sitten "Reports" valikon alta:
• Laita täppi kohtaan "Automatically generate report after every scan"
• Ota täppi pois kohdasta"Only if threats were found"
• Sulje ohjelma, ÄLÄ skannaa vielä.
Käynnistä koneesi vikasietotilaan
sammuta ja käynnistä
käynnistyksenyhteydessä naputtele F8
valitse nuoli näppäimellä vikasietotila
paina Enter ja uudelleen Enter OK
HUOM! Älä käytä muita ohjelmia Ewidon skannauksen aikana, tämä saattaa häiritä skannausta.
• Kun vikasietotilassa, käynnistä Ewido Anti-Spyware.
• Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan".
• Ewido aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa.
Kun skannaus on valmis:
TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions"
• Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta.
• Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions"
• Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta.
• Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle.
• Sulje ohjelma, käynnistä kone normaalisti ja lähetä Ewidon raportti viestikejuusi.
sitten vielä escan lävitse
Lataa tuolta
http://koti.mbnet.fi/pattaya1/escanmwav.htm
asenna, päivitä tapa2, laita täpit merkkauksien mukaan.
Scannaa
jos alaikkunaan virukset tulee jotain laita loki tänne.
kopioi se näin:
Käytä komentoa Ctrl A.
Kopioi rivit komennolla Ctrl C.
Liitä rivit komennolla Ctrl V.
laita sitten uusi hjt-loki myös.
tuosta ei saa mitään tietoa
scannaa hjt:llä merkkaa ja paina fis checked
O4 - HKLM\..\Run: [syia3ba1] RUNDLL32.EXE w00610c7.dll,n 003a3b9e0000000a00610c7
jo näkyy combofix logissa C:\WINNT\system32\w00610c7.dll ja ehkä samassa logissa näkyy muitaki örkkejä.
okei, tässä on tämä uusin hijackthislogi :)
Logfile of HijackThis v1.99.1
Scan saved at 00:07, on 06-09-17
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\secman.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINNT\system32\internat.exe
C:\Program Files\cwshredder\WinZip\WZQKPICK.EXE
C:\hjt\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://C:\WINNT\system32\shdocpe.dll/asst.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = dna Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://paivitys.dnainternet.fi/yhteys/proxy.pac
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: fxp.cmd
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\cwshredder\WinZip\WZQKPICK.EXE
O9 - Extra button: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - C:\Program Files\Net2Phone\Net2fone.exe
O9 - Extra 'Tools' menuitem: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - C:\Program Files\Net2Phone\Net2fone.exe
O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin4.dll
O12 - Plugin for .mpg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.dnainternet.fi
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab30149.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab30149.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab30149.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab30149.cab
O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\DOCUMENTS AND SETTINGS\JÄRJESTELMÄNVALVOJA\OMAT TIEDOSTOT\SONJA\Nvc\BIN\nipsvc.exe
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\DOCUMENTS AND SETTINGS\JÄRJESTELMÄNVALVOJA\OMAT TIEDOSTOT\SONJA\nvc\BIN\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\DOCUMENTS AND SETTINGS\JÄRJESTELMÄNVALVOJA\OMAT TIEDOSTOT\SONJA\nvc\BIN\NVCSCHED.EXE
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://C:\WINNT\system32\shdocpe.dll/asst.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
ja laita loki tänne jos jotain tulee.
Scannasin eilen sillä escannilla ja puolisentuhatta infectedtiedostoa löytyi. Ajattelin ettei niin pitkää luetteloa kannata liittää tänne :P
Lähden muuten huomenna erikaupunkiin eli saa säätäminen jäädä ainakin viikoksi. Mutta kone toimii kuitenkin nyt jo aivan eritavalla kuin aluksi. Kiitokset siitä :)
tässä vielä uusin hijackthislogi
Logfile of HijackThis v1.99.1
Scan saved at 15:54, on 06-09-17
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\secman.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINNT\system32\internat.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\cwshredder\WinZip\WZQKPICK.EXE
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\hjt\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = dna Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://paivitys.dnainternet.fi/yhteys/proxy.pac
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: fxp.cmd
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\cwshredder\WinZip\WZQKPICK.EXE
O9 - Extra button: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - C:\Program Files\Net2Phone\Net2fone.exe
O9 - Extra 'Tools' menuitem: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - C:\Program Files\Net2Phone\Net2fone.exe
O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin4.dll
O12 - Plugin for .mpg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.dnainternet.fi
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab30149.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab30149.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab30149.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab30149.cab
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\DOCUMENTS AND SETTINGS\JÄRJESTELMÄNVALVOJA\OMAT TIEDOSTOT\SONJA\Nvc\BIN\nipsvc.exe
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\DOCUMENTS AND SETTINGS\JÄRJESTELMÄNVALVOJA\OMAT TIEDOSTOT\SONJA\nvc\BIN\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\DOCUMENTS AND SETTINGS\JÄRJESTELMÄNVALVOJA\OMAT TIEDOSTOT\SONJA\nvc\BIN\NVCSCHED.EXE
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe
kaksi virusohjelmaa
Norman ja AntiVir PersonalEdition Classic
käytät ilmeisesti tuota antiviriä
Niin kilautetaan tuo norman kumoon.
scannaa hjt:llä merkkaa ja paina Fix checked
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\DOCUMENTS AND SETTINGS\JÄRJESTELMÄNVALVOJA\OMAT TIEDOSTOT\SONJA\Nvc\BIN\nipsvc.exe
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\DOCUMENTS AND SETTINGS\JÄRJESTELMÄNVALVOJA\OMAT TIEDOSTOT\SONJA\nvc\BIN\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\DOCUMENTS AND SETTINGS\JÄRJESTELMÄNVALVOJA\OMAT TIEDOSTOT\SONJA\nvc\BIN\NVCSCHED.EXE
Kirjoita suorita luukkuun alla olevat ja paina ok jokaisen rivin jälkeen
sc stop NipSvc)
sc delete NipSvc)
sc stop nvcoas
sc delete nvcoas
sc stop NVCScheduler
sc delete NVCScheduler
laita uusi hjt-loki
sc stop NipSvc
sc delete NipSvc