Logfile of HijackThis v1.99.1
Scan saved at 11:55:04, on 17.11.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\pavsrv51.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\AVENGINE.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\TPSrv.exe
C:\WINDOWS\SYSTEM32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
c:\program files\panda software\panda internet security 2007\firewall\PNMSRV.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Panda Software\Panda Internet Security 2007\PavFnSvr.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\AntiSpam\pskmssvc.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\PsImSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\apvxdwin.exe
C:\Program Files\Java\jre1.5.0\bin\jusched.exe
C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\SEC\MagicTune3.6\GammaTray.exe
C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
C:\Program Files\ZyXEL\G360\Gcc.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\SEC\MagicTune3.6\MagicTune.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\ZyXEL\G360\OdHost.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\SRVLOAD.EXE
c:\program files\panda software\panda internet security 2007\WebProxy.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\psimreal.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\avciman.exe
C:\Documents and Settings\Janne\Työpöytä\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yle.fi/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yle.fi/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.ati.com/online/cccwelcome/drivers.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [gsosznd.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\gsosznd.dll,toaevje
O4 - HKLM\..\Run: [ndjbfgf.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\ndjbfgf.dll,ptvkdsd
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Internet Security 2007\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Software\Panda Internet Security 2007\Inicio.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Color Calibration.lnk = ?
O4 - Global Startup: MagicTune 3.6.lnk = ?
O4 - Global Startup: NaturalColorLoad.lnk = ?
O4 - Global Startup: ZyXEL G-360 Wireless Adapter Utility.lnk = C:\Program Files\ZyXEL\G360\Gcc.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - Unknown owner - C:\Program Files\F-Secure\FSAUA\program\fsaua.exe (file missing)
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - Unknown owner - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN\nipsvc.exe (file missing)
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Software\Panda Internet Security 2007\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Software\Panda Internet Security 2007\pavsrv51.exe
O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - C:\Program Files\Pinnacle\Shared Files\Programs\MediaServer\PMSHost.exe
O23 - Service: Panda Antispam Engine (pmshellsrv) - Panda Software International - C:\Program Files\Panda Software\Panda Internet Security 2007\AntiSpam\pskmssvc.exe
O23 - Service: Panda Network Manager (PNMSRV) - Panda Software International - c:\program files\panda software\panda internet security 2007\firewall\PNMSRV.EXE
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software - C:\Program Files\Panda Software\Panda Internet Security 2007\PsImSvc.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Software - C:\Program Files\Panda Software\Panda Internet Security 2007\TPSrv.exe
**************************************************
Koneella oli alunperin Norman mutta viruksia tuli läpi ja kone jumiin. Tilalle F-Securen trial mutta se meni solmuun troijalaisen kanssa (?) ja nyt on Panda. Mutta mitä loki kertoo ja miten tästä eteenpäin?
Scan saved at 11:55:04, on 17.11.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\pavsrv51.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\AVENGINE.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\TPSrv.exe
C:\WINDOWS\SYSTEM32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
c:\program files\panda software\panda internet security 2007\firewall\PNMSRV.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Panda Software\Panda Internet Security 2007\PavFnSvr.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\AntiSpam\pskmssvc.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\PsImSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\apvxdwin.exe
C:\Program Files\Java\jre1.5.0\bin\jusched.exe
C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\SEC\MagicTune3.6\GammaTray.exe
C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
C:\Program Files\ZyXEL\G360\Gcc.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\SEC\MagicTune3.6\MagicTune.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\ZyXEL\G360\OdHost.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\SRVLOAD.EXE
c:\program files\panda software\panda internet security 2007\WebProxy.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\psimreal.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\avciman.exe
C:\Documents and Settings\Janne\Työpöytä\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yle.fi/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yle.fi/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.ati.com/online/cccwelcome/drivers.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [gsosznd.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\gsosznd.dll,toaevje
O4 - HKLM\..\Run: [ndjbfgf.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\ndjbfgf.dll,ptvkdsd
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Internet Security 2007\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Software\Panda Internet Security 2007\Inicio.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Color Calibration.lnk = ?
O4 - Global Startup: MagicTune 3.6.lnk = ?
O4 - Global Startup: NaturalColorLoad.lnk = ?
O4 - Global Startup: ZyXEL G-360 Wireless Adapter Utility.lnk = C:\Program Files\ZyXEL\G360\Gcc.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - Unknown owner - C:\Program Files\F-Secure\FSAUA\program\fsaua.exe (file missing)
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - Unknown owner - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN\nipsvc.exe (file missing)
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Software\Panda Internet Security 2007\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Software\Panda Internet Security 2007\pavsrv51.exe
O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - C:\Program Files\Pinnacle\Shared Files\Programs\MediaServer\PMSHost.exe
O23 - Service: Panda Antispam Engine (pmshellsrv) - Panda Software International - C:\Program Files\Panda Software\Panda Internet Security 2007\AntiSpam\pskmssvc.exe
O23 - Service: Panda Network Manager (PNMSRV) - Panda Software International - c:\program files\panda software\panda internet security 2007\firewall\PNMSRV.EXE
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software - C:\Program Files\Panda Software\Panda Internet Security 2007\PsImSvc.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Software - C:\Program Files\Panda Software\Panda Internet Security 2007\TPSrv.exe
**************************************************
Koneella oli alunperin Norman mutta viruksia tuli läpi ja kone jumiin. Tilalle F-Securen trial mutta se meni solmuun troijalaisen kanssa (?) ja nyt on Panda. Mutta mitä loki kertoo ja miten tästä eteenpäin?
Vastaukset 6
Vanhimmat
jäänteistä norman f-secure
scannaa hjt:llä merkkaa paina Fix checked
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - Unknown owner - C:\Program Files\F-Secure\FSAUA\program\fsaua.exe (file FSDmissing)
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - Unknown owner - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe (file missing
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN\nipsvc.exe (file missing)
Käynnistä > suorita > kirjoita alla olevat jokaisen rivin jälkeen paina ok
sc stop FSAUA
sc delete FSAUA
sc stop FSDFWD
sc delete FSDFWD
sc stop NipSvc
sc delete NipSvc
mene vikasietotilaan
poista kansiot
C:\Program Files\--> F-Secure Norman
Ohjeet tuolla sivulla.
http://koti.mbnet.fi/pattaya1/escanmwav.htm
lataa tuosta
http://www.spywareinfo.dk/download/mwav.exe
päivitä tuosta
http://koti.mbnet.fi/pattaya1/lataus/Mwav.bat
laita täpit merkkauksien mukaan
http://koti.mbnet.fi/pattaya1/eScan6.jpg
scannaa
jos ala luukkuun tulee jotain niin kopioi se näin:
Käytä komentoa Ctrl A.
Kopioi rivit komennolla Ctrl C.
Liitä rivit komennolla Ctrl V.
--------------------------------------------------
-------------------- INFECTED --------------------
--------------------------------------------------
1: Fri Nov 17 22:35:11 2006 => File C:\WINDOWS\system32\ismini.exe infected by "Trojan-Downloader.Win32.Zlob.avb" Virus. Action Taken: File Deleted.
2: Fri Nov 17 23:25:40 2006 => File C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP144\A0012109.exe infected by "Trojan-Downloader.Win32.Zlob.auw" Virus. Action Taken: File Deleted.
3: Fri Nov 17 23:25:41 2006 => File C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP144\A0012127.dll infected by "Trojan-Downloader.Win32.Zlob.akg" Virus. Action Taken: File Deleted.
4: Fri Nov 17 23:25:57 2006 => File C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP146\A0013110.exe infected by "Trojan-Downloader.Win32.Zlob.auw" Virus. Action Taken: File Deleted.
5: Fri Nov 17 23:25:57 2006 => File C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP146\A0014110.exe infected by "Trojan-Downloader.Win32.Zlob.auw" Virus. Action Taken: File Deleted.
6: Fri Nov 17 23:25:57 2006 => File C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP146\A0015110.exe infected by "Trojan-Downloader.Win32.Zlob.auw" Virus. Action Taken: File Deleted.
7: Fri Nov 17 23:26:04 2006 => File C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP146\A0016110.exe infected by "Trojan-Downloader.Win32.Zlob.auw" Virus. Action Taken: File Deleted.
8: Fri Nov 17 23:26:07 2006 => File C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP146\A0017110.exe infected by "Trojan-Downloader.Win32.Zlob.auw" Virus. Action Taken: File Deleted.
9: Fri Nov 17 23:26:34 2006 => File C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP147\A0017511.exe infected by "Trojan-Downloader.Win32.Zlob.auw" Virus. Action Taken: File Deleted.
10: Fri Nov 17 23:26:34 2006 => File C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP147\A0018504.exe infected by "Trojan-Downloader.Win32.Zlob.auw" Virus. Action Taken: File Deleted.
11: Fri Nov 17 23:26:34 2006 => File C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP147\A0019504.exe infected by "Trojan-Downloader.Win32.Zlob.auw" Virus. Action Taken: File Deleted.
12: Fri Nov 17 23:26:34 2006 => File C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP147\A0020504.exe infected by "Trojan-Downloader.Win32.Zlob.auw" Virus. Action Taken: File Deleted.
13: Fri Nov 17 23:26:35 2006 => File C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP147\A0021504.exe infected by "Trojan-Downloader.Win32.Zlob.auw" Virus. Action Taken: File Deleted.
14: Fri Nov 17 23:26:35 2006 => File C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP147\A0022504.exe infected by "Trojan-Downloader.Win32.Zlob.auw" Virus. Action Taken: File Deleted.
15: Fri Nov 17 23:26:35 2006 => File C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP147\A0023504.exe infected by "Trojan-Downloader.Win32.Zlob.auw" Virus. Action Taken: File Deleted.
16: Fri Nov 17 23:26:36 2006 => File C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP147\A0024504.exe infected by "Trojan-Downloader.Win32.Zlob.auw" Virus. Action Taken: File Deleted.
17: Fri Nov 17 23:26:36 2006 => File C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP147\A0025504.exe infected by "Trojan-Downloader.Win32.Zlob.auw" Virus. Action Taken: File Deleted.
18: Fri Nov 17 23:26:36 2006 => File C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP147\A0026504.exe infected by "Trojan-Downloader.Win32.Zlob.auw" Virus. Action Taken: File Deleted.
19: Fri Nov 17 23:26:36 2006 => File C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP147\A0027504.exe infected by "Trojan-Downloader.Win32.Zlob.auw" Virus. Action Taken: File Deleted.
20: Fri Nov 17 23:26:39 2006 => File C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP147\A0028508.exe infected by "Trojan-Downloader.Win32.Zlob.auw" Virus. Action Taken: File Deleted.
21: Fri Nov 17 23:26:40 2006 => File C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP147\A0029504.exe infected by "Trojan-Downloader.Win32.Zlob.auw" Virus. Action Taken: File Deleted.
22: Fri Nov 17 23:26:40 2006 => File C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP147\A0029505.exe infected by "Trojan-Downloader.Win32.Zlob.auw" Virus. Action Taken: File Deleted.
23: Fri Nov 17 23:26:40 2006 => File C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP147\A0029506.exe infected by "Trojan-Downloader.Win32.Zlob.aes" Virus. Action Taken: File Deleted.
24: Fri Nov 17 23:28:40 2006 => File C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP152\A0065143.dll infected by "not-virus:Hoax.Win32.Renos.ge" Virus. Action Taken: File Deleted.
25: Fri Nov 17 23:28:41 2006 => File C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP152\A0065157.dll infected by "Trojan.Win32.BHO.g" Virus. Action Taken: File Deleted.
26: Fri Nov 17 23:28:41 2006 => File C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP152\A0065161.dll infected by "Trojan.Win32.Agent.vg" Virus. Action Taken: File Deleted.
27: Fri Nov 17 23:31:50 2006 => File C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP182\A0078652.exe infected by "Trojan-Downloader.Win32.Zlob.avb" Virus. Action Taken: File Deleted.
28: Fri Nov 17 23:59:35 2006 => Total Number of Disinfected Files: 0
--------------------------------------------------
--------------------- TAGGED ---------------------
--------------------------------------------------
1: Fri Nov 17 22:54:24 2006 => File C:\Program Files\DAEMON Tools\SetupDTSB.exe tagged as not-a-virus:AdTool.Win32.WhenU.a. No Action Taken.
2: Fri Nov 17 23:26:04 2006 => File C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP146\A0015243.exe tagged as not-a-virus:AdWare.Win32.Maxifiles.aa. No Action Taken.
3: Fri Nov 17 23:26:40 2006 => File C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP147\A0029520.exe tagged as not-a-virus:RiskTool.Win32.Reboot.f. No Action Taken.
4: Fri Nov 17 23:27:22 2006 => File C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP147\A0042192.exe tagged as not-a-virus:FraudTool.Win32.VirusBurst.b. No Action Taken.
5: Fri Nov 17 23:27:30 2006 => File C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP148\A0052224.exe tagged as not-a-virus:RiskTool.Win32.Reboot.f. No Action Taken.
6: Fri Nov 17 23:28:29 2006 => File C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP152\A0059987.exe tagged as not-a-virus:RiskTool.Win32.Reboot.f. No Action Taken.
7: Fri Nov 17 23:28:34 2006 => File C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP152\A0062051.exe tagged as not-a-virus:RiskTool.Win32.Reboot.f. No Action Taken.
8: Fri Nov 17 23:28:41 2006 => File C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP152\A0065156.dll tagged as not-a-virus:AdWare.Win32.Agent.at. No Action Taken.
9: Fri Nov 17 23:28:41 2006 => File C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP152\A0065158.exe tagged as not-a-virus:AdWare.Win32.Agent.at. No Action Taken.
--------------------------------------------------
--------------------- ERRORS ---------------------
--------------------------------------------------
1: Fri Nov 17 22:34:20 2006 => ERROR!!! Invalid Entry = blank. Removing it.
2: Fri Nov 17 22:34:20 2006 => ERROR!!! Invalid Entry = blank. Removing it.
3: Fri Nov 17 22:34:20 2006 => ERROR!!! Invalid Entry = blank. Removing it.
4: Fri Nov 17 22:34:22 2006 => ERROR!!! Invalid Entry \??\C:\Program Files\Anti Trojan Elite\ATEPMon.sys in SYSTEM\CurrentControlSet\Services\ATE_PROCMON...
5: Fri Nov 17 22:34:23 2006 => ERROR!!! Invalid Entry \SystemRoot\system32\drivers\av5flt.sys in SYSTEM\CurrentControlSet\Services\AvFlt...
6: Fri Nov 17 22:34:23 2006 => ERROR!!! Invalid Entry \??\C:\WINDOWS\system32\DRIVERS\COMFiltr.sys in SYSTEM\CurrentControlSet\Services\ComFiltr...
7: Fri Nov 17 22:34:24 2006 => ERROR!!! Invalid Entry "C:\Program Files\F-Secure\Common\FSMA32.EXE" in SYSTEM\CurrentControlSet\Services\FSMA...
8: Fri Nov 17 22:34:27 2006 => ERROR!!! Invalid Entry \??\C:\WINDOWS\system32\PavSRK.sys in SYSTEM\CurrentControlSet\Services\PavSRK.sys...
9: Fri Nov 17 22:34:27 2006 => ERROR!!! Invalid Entry \??\C:\WINDOWS\system32\PavTPK.sys in SYSTEM\CurrentControlSet\Services\PavTPK.sys...
10: Fri Nov 17 22:34:29 2006 => ERROR!!! ScanFile Fails...
11: Fri Nov 17 22:34:33 2006 => ERROR!!! ScanFile fails for C:\WINDOWS\SchedLgU.Txt
12: Fri Nov 17 22:34:35 2006 => ERROR!!! ScanFile fails for C:\WINDOWS\wiadebug.log
13: Fri Nov 17 22:34:35 2006 => ERROR!!! ScanFile fails for C:\WINDOWS\wiaservc.log
14: Fri Nov 17 22:34:35 2006 => ERROR!!! ScanFile fails for C:\WINDOWS\WindowsUpdate.log
15: Fri Nov 17 22:36:57 2006 => ERROR!!! ScanFile fails for C:\DOCUME~1\Janne\APPLIC~1\Mozilla\Firefox\Profiles\LLLSKR~1.DEF\cert8.db
16: Fri Nov 17 22:36:58 2006 => ERROR!!! ScanFile fails for C:\DOCUME~1\Janne\APPLIC~1\Mozilla\Firefox\Profiles\LLLSKR~1.DEF\history.dat
17: Fri Nov 17 22:36:58 2006 => ERROR!!! ScanFile fails for C:\DOCUME~1\Janne\APPLIC~1\Mozilla\Firefox\Profiles\LLLSKR~1.DEF\key3.db
18: Fri Nov 17 22:36:58 2006 => ERROR!!! ScanFile fails for C:\DOCUME~1\Janne\APPLIC~1\Mozilla\Firefox\Profiles\LLLSKR~1.DEF\SEARCH~1.SQL
19: Fri Nov 17 22:37:08 2006 => ERROR!!! ScanFile fails for C:\DOCUME~1\Janne\Cookies\index.dat
20: Fri Nov 17 22:37:13 2006 => ERROR!!! ScanFile fails for C:\DOCUME~1\Janne\LOCALS~1\APPLIC~1\MICROS~1\Windows\UsrClass.dat
21: Fri Nov 17 22:37:13 2006 => ERROR!!! ScanFile fails for C:\DOCUME~1\Janne\LOCALS~1\APPLIC~1\MICROS~1\Windows\USRCLA~1.LOG
22: Fri Nov 17 22:37:34 2006 => ERROR!!! ScanFile fails for C:\DOCUME~1\Janne\LOCALS~1\APPLIC~1\Mozilla\Firefox\Profiles\LLLSKR~1.DEF\Cache\_CACHE~2
23: Fri Nov 17 22:37:34 2006 => ERROR!!! ScanFile fails for C:\DOCUME~1\Janne\LOCALS~1\APPLIC~1\Mozilla\Firefox\Profiles\LLLSKR~1.DEF\Cache\_CACHE~3
24: Fri Nov 17 22:37:34 2006 => ERROR!!! ScanFile fails for C:\DOCUME~1\Janne\LOCALS~1\APPLIC~1\Mozilla\Firefox\Profiles\LLLSKR~1.DEF\Cache\_CACHE~1
25: Fri Nov 17 22:37:35 2006 => ERROR!!! ScanFile fails for C:\DOCUME~1\Janne\LOCALS~1\SIVUHI~1\History.IE5\index.dat
26: Fri Nov 17 22:37:36 2006 => ERROR!!! ScanFile fails for C:\DOCUME~1\Janne\LOCALS~1\Temp\PERFLI~2.DAT
27: Fri Nov 17 22:37:36 2006 => ERROR!!! ScanFile fails for C:\DOCUME~1\Janne\LOCALS~1\Temp\PERFLI~3.DAT
28: Fri Nov 17 22:37:36 2006 => ERROR!!! ScanFile fails for C:\DOCUME~1\Janne\LOCALS~1\Temp\PERFLI~1.DAT
29: Fri Nov 17 22:37:40 2006 => ERROR!!! ScanFile fails for C:\DOCUME~1\Janne\LOCALS~1\TEMPOR~1\Content.IE5\index.dat
30: Fri Nov 17 22:37:44 2006 => ERROR!!! ScanFile fails for C:\DOCUME~1\Janne\NTUSER.DAT
31: Fri Nov 17 22:37:44 2006 => ERROR!!! ScanFile fails for C:\DOCUME~1\Janne\NTUSER~1.LOG
32: Fri Nov 17 22:39:26 2006 => ERROR!!! ScanFile fails for C:\DOCUME~1\LOCALS~1\Cookies\index.dat
33: Fri Nov 17 22:39:26 2006 => ERROR!!! ScanFile fails for C:\DOCUME~1\LOCALS~1\LOCALS~1\APPLIC~1\MICROS~1\Windows\UsrClass.dat
34: Fri Nov 17 22:39:26 2006 => ERROR!!! ScanFile fails for C:\DOCUME~1\LOCALS~1\LOCALS~1\APPLIC~1\MICROS~1\Windows\USRCLA~1.LOG
35: Fri Nov 17 22:39:26 2006 => ERROR!!! ScanFile fails for C:\DOCUME~1\LOCALS~1\LOCALS~1\SIVUHI~1\History.IE5\index.dat
36: Fri Nov 17 22:39:26 2006 => ERROR!!! ScanFile fails for C:\DOCUME~1\LOCALS~1\LOCALS~1\TEMPOR~1\Content.IE5\index.dat
37: Fri Nov 17 22:39:26 2006 => ERROR!!! ScanFile fails for C:\DOCUME~1\LOCALS~1\NTUSER.DAT
38: Fri Nov 17 22:39:27 2006 => ERROR!!! ScanFile fails for C:\DOCUME~1\LOCALS~1\NTUSER~1.LOG
39: Fri Nov 17 22:39:27 2006 => ERROR!!! ScanFile fails for C:\DOCUME~1\NETWOR~1\LOCALS~1\APPLIC~1\MICROS~1\Windows\UsrClass.dat
40: Fri Nov 17 22:39:27 2006 => ERROR!!! ScanFile fails for C:\DOCUME~1\NETWOR~1\LOCALS~1\APPLIC~1\MICROS~1\Windows\USRCLA~1.LOG
41: Fri Nov 17 22:39:27 2006 => ERROR!!! ScanFile fails for C:\DOCUME~1\NETWOR~1\NTUSER.DAT
42: Fri Nov 17 22:39:27 2006 => ERROR!!! ScanFile fails for C:\DOCUME~1\NETWOR~1\NTUSER~1.LOG
43: Fri Nov 17 23:12:25 2006 => ERROR!!! ScanFile fails for C:\PROGRA~1\PANDAS~1\PANDAI~1\PSK_NA~2
44: Fri Nov 17 23:31:50 2006 => ERROR!!! ScanFile fails for C:\SYSTEM~1\_RESTO~1\RP182\change.log
45: Fri Nov 17 23:54:46 2006 => ERROR!!! ScanFile fails for C:\WINDOWS\SchedLgU.Txt
46: Fri Nov 17 23:54:52 2006 => ERROR!!! ScanFile fails for C:\WINDOWS\SoftwareDistribution\EventCache\{302C19D0-5860-4731-9FD7-A45DF05F38BA}.bin
47: Fri Nov 17 23:54:53 2006 => ERROR!!! ScanFile fails for C:\WINDOWS\SoftwareDistribution\ReportingEvents.log
48: Fri Nov 17 23:55:05 2006 => ERROR!!! ScanFile fails for C:\WINDOWS\system32\CatRoot2\edb.log
49: Fri Nov 17 23:55:06 2006 => ERROR!!! ScanFile fails for C:\WINDOWS\system32\CatRoot2\tmp.edb
50: Fri Nov 17 23:55:10 2006 => ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\ACEEvent.evt
51: Fri Nov 17 23:55:10 2006 => ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\AppEvent.Evt
52: Fri Nov 17 23:55:10 2006 => ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\default
53: Fri Nov 17 23:55:10 2006 => ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\default.LOG
54: Fri Nov 17 23:55:10 2006 => ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\Internet.evt
55: Fri Nov 17 23:55:10 2006 => ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\ODiag.evt
56: Fri Nov 17 23:55:10 2006 => ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\OSession.evt
57: Fri Nov 17 23:55:10 2006 => ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\SAM
58: Fri Nov 17 23:55:10 2006 => ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\SAM.LOG
59: Fri Nov 17 23:55:10 2006 => ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\SecEvent.Evt
60: Fri Nov 17 23:55:10 2006 => ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\SECURITY
61: Fri Nov 17 23:55:10 2006 => ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\SECURITY.LOG
62: Fri Nov 17 23:55:10 2006 => ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\software.LOG
63: Fri Nov 17 23:55:10 2006 => ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\SysEvent.Evt
64: Fri Nov 17 23:55:10 2006 => ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\system
65: Fri Nov 17 23:55:11 2006 => ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\system.LOG
66: Fri Nov 17 23:55:11 2006 => ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
67: Fri Nov 17 23:55:12 2006 => ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\SYSTEM~1\LOCALS~1\SIVUHI~1\History.IE5\index.dat
68: Fri Nov 17 23:55:12 2006 => ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\SYSTEM~1\LOCALS~1\TEMPOR~1\Content.IE5\index.dat
69: Fri Nov 17 23:56:38 2006 => ERROR!!! ScanFile fails for C:\WINDOWS\system32\drivers\sptd.sys
70: Fri Nov 17 23:58:30 2006 => ERROR!!! ScanFile fails for C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR
71: Fri Nov 17 23:58:30 2006 => ERROR!!! ScanFile fails for C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP
72: Fri Nov 17 23:58:30 2006 => ERROR!!! ScanFile fails for C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER
73: Fri Nov 17 23:58:30 2006 => ERROR!!! ScanFile fails for C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP
74: Fri Nov 17 23:58:30 2006 => ERROR!!! ScanFile fails for C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP
75: Fri Nov 17 23:58:30 2006 => ERROR!!! ScanFile fails for C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP
76: Fri Nov 17 23:58:47 2006 => ERROR!!! ScanFile fails for C:\WINDOWS\wiadebug.log
77: Fri Nov 17 23:58:47 2006 => ERROR!!! ScanFile fails for C:\WINDOWS\wiaservc.log
78: Fri Nov 17 23:58:47 2006 => ERROR!!! ScanFile fails for C:\WINDOWS\WindowsUpdate.log
--------------------------------------------------
------------- FILES ADDED TO DELETE --------------
--------------------------------------------------
1: C:\WINDOWS\system32\ismini.exe => Trojan-Downloader.Win32.Zlob.avb
2: C:\Program Files\DAEMON Tools\SetupDTSB.exe => tagged:AdTool.Win32.WhenU.a.
3: C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP144\A0012109.exe => Trojan-Downloader.Win32.Zlob.auw
4: C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP144\A0012127.dll => Trojan-Downloader.Win32.Zlob.akg
5: C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP146\A0013110.exe => Trojan-Downloader.Win32.Zlob.auw
6: C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP146\A0014110.exe => Trojan-Downloader.Win32.Zlob.auw
7: C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP146\A0015110.exe => Trojan-Downloader.Win32.Zlob.auw
8: C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP146\A0015243.exe => tagged:AdWare.Win32.Maxifiles.aa.
9: C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP146\A0016110.exe => Trojan-Downloader.Win32.Zlob.auw
10: C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP146\A0017110.exe => Trojan-Downloader.Win32.Zlob.auw
11: C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP147\A0017511.exe => Trojan-Downloader.Win32.Zlob.auw
12: C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP147\A0018504.exe => Trojan-Downloader.Win32.Zlob.auw
13: C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP147\A0019504.exe => Trojan-Downloader.Win32.Zlob.auw
14: C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP147\A0020504.exe => Trojan-Downloader.Win32.Zlob.auw
15: C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP147\A0021504.exe => Trojan-Downloader.Win32.Zlob.auw
16: C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP147\A0022504.exe => Trojan-Downloader.Win32.Zlob.auw
17: C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP147\A0023504.exe => Trojan-Downloader.Win32.Zlob.auw
18: C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP147\A0024504.exe => Trojan-Downloader.Win32.Zlob.auw
19: C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP147\A0025504.exe => Trojan-Downloader.Win32.Zlob.auw
20: C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP147\A0026504.exe => Trojan-Downloader.Win32.Zlob.auw
21: C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP147\A0027504.exe => Trojan-Downloader.Win32.Zlob.auw
22: C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP147\A0028508.exe => Trojan-Downloader.Win32.Zlob.auw
23: C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP147\A0029504.exe => Trojan-Downloader.Win32.Zlob.auw
24: C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP147\A0029505.exe => Trojan-Downloader.Win32.Zlob.auw
25: C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP147\A0029506.exe => Trojan-Downloader.Win32.Zlob.aes
26: C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP147\A0029520.exe => tagged:RiskTool.Win32.Reboot.f.
27: C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP147\A0042192.exe => tagged:FraudTool.Win32.VirusBurst.b.
28: C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP148\A0052224.exe => tagged:RiskTool.Win32.Reboot.f.
29: C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP152\A0059987.exe => tagged:RiskTool.Win32.Reboot.f.
30: C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP152\A0062051.exe => tagged:RiskTool.Win32.Reboot.f.
31: C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP152\A0065143.dll => not-virus:Hoax.Win32.Renos.ge
32: C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP152\A0065156.dll => tagged:AdWare.Win32.Agent.at.
33: C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP152\A0065157.dll => Trojan.Win32.BHO.g
34: C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP152\A0065158.exe => tagged:AdWare.Win32.Agent.at.
35: C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP152\A0065161.dll => Trojan.Win32.Agent.vg
36: C:\System Volume Information\_restore{859FB621-B409-495E-BA58-0F3CB63DBE6E}\RP182\A0078652.exe => Trojan-Downloader.Win32.Zlob.avb
--------------------------------------------------
-------------------- Statistik -------------------
--------------------------------------------------
Daemonin saa ainakin säästää mutta entäpä muo muut?
Kiittää jo etukäteen.
• 1. Klikkaa oikealla käynnistävalikon My Computer- tai oma tietokone-kuvaketta
• 2. Valitse Properties/ominaisuudet
• 3. Valitse System Restore/järjestelmän palauttaminen välilehti
• 4. Valitse "Turn off System Restore"/poista järjestelmän palauttaminen kaikissa asemissa
• 5. Paina Apply/käytä
• 6. Paina OK
• 7. Käynnistä kone uudelleen
• 8. Tarkista kone (mielellään kahdella) online scannereilla ja omalla virustorjuntaohjelmalla
• 9. Poista kaikki saastuneet tiedostot
• 10. Palauta asetukset takaisin
Kun olet skannannut ja puhdistanut levyt, laita System Restore taas päälle toistaen ohjeet käänteisesti.
Linkki: http://www.pandasoftware.com/products/activescan.htm
• Kun olet Pandan sivulla, klikkaa Scan your PC-painiketta
• Uusi ikkuna aukeaa, klikkaa Check Now-painiketta
• Valitse maa, Country
• Syötä kaupunki, State/Province
• Syötä sähköpostiosoitteesi, e-mail address ja klikkaa send-painiketta
• Valitse joko kotikäyttäjä Home User tai yritys Company
• Klikkaa suurta Scan Now-painiketta
• Jos ActiveX-komponentin asentamista kysytään, salli se.
• Tarvittavien tiedostojen lataaminen alkaa (Huom: Tämä vaihe voi viedä muutamia minuutteja)
• Kun lataukset ovat valmiit, klikkaa Local Disks aloittaaksesi skannauksen
• Kun skannaus on valmis, klikkaa See Report-painiketta jos infektioita löytyi. Klikkaa sitten Save Report ja tallenna raportti johonkin sopivaan sijaintiin (esim työpöydälle).
uusi hjt-loki