Miten pääsen tuosta eroon? Skannaan AVG:llä, tässä raportti:
---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------
Created at: 15:14:26 19.12.2006
Scan result:
[1064] VM_00A80000 -> Trojan.DNSChanger.hg : Cleaned with backup (quarantined).
[1736] VM_009C0000 -> Trojan.DNSChanger.hg : Cleaned with backup (quarantined).
[1800] VM_009C0000 -> Trojan.DNSChanger.hg : Cleaned with backup (quarantined).
[1812] VM_00A60000 -> Trojan.DNSChanger.hg : Cleaned with backup (quarantined).
[1824] VM_008F0000 -> Trojan.DNSChanger.hg : Cleaned with backup (quarantined).
[1832] VM_009D0000 -> Trojan.DNSChanger.hg : Cleaned with backup (quarantined).
[1864] VM_00950000 -> Trojan.DNSChanger.hg : Cleaned with backup (quarantined).
[1896] VM_00930000 -> Trojan.DNSChanger.hg : Cleaned with backup (quarantined).
[1912] VM_00960000 -> Trojan.DNSChanger.hg : Cleaned with backup (quarantined).
[1984] VM_00920000 -> Trojan.DNSChanger.hg : Cleaned with backup (quarantined).
[1996] VM_00930000 -> Trojan.DNSChanger.hg : Cleaned with backup (quarantined).
[2016] VM_00970000 -> Trojan.DNSChanger.hg : Cleaned with backup (quarantined).
[2024] VM_00900000 -> Trojan.DNSChanger.hg : Cleaned with backup (quarantined).
[216] VM_00960000 -> Trojan.DNSChanger.hg : Cleaned with backup (quarantined).
[2200] VM_00950000 -> Trojan.DNSChanger.hg : Cleaned with backup (quarantined).
[3824] VM_01150000 -> Trojan.DNSChanger.hg : Cleaned with backup (quarantined).
[392] VM_00E30000 -> Trojan.DNSChanger.hg : Cleaned with backup (quarantined).
[416] VM_00DF0000 -> Trojan.DNSChanger.hg : Cleaned with backup (quarantined).
::Report end
Sitten uusi skannaus ja siellähän se taas on! Ei lähde ei sitten niin millään.
---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------
Created at: 15:14:26 19.12.2006
Scan result:
[1064] VM_00A80000 -> Trojan.DNSChanger.hg : Cleaned with backup (quarantined).
[1736] VM_009C0000 -> Trojan.DNSChanger.hg : Cleaned with backup (quarantined).
[1800] VM_009C0000 -> Trojan.DNSChanger.hg : Cleaned with backup (quarantined).
[1812] VM_00A60000 -> Trojan.DNSChanger.hg : Cleaned with backup (quarantined).
[1824] VM_008F0000 -> Trojan.DNSChanger.hg : Cleaned with backup (quarantined).
[1832] VM_009D0000 -> Trojan.DNSChanger.hg : Cleaned with backup (quarantined).
[1864] VM_00950000 -> Trojan.DNSChanger.hg : Cleaned with backup (quarantined).
[1896] VM_00930000 -> Trojan.DNSChanger.hg : Cleaned with backup (quarantined).
[1912] VM_00960000 -> Trojan.DNSChanger.hg : Cleaned with backup (quarantined).
[1984] VM_00920000 -> Trojan.DNSChanger.hg : Cleaned with backup (quarantined).
[1996] VM_00930000 -> Trojan.DNSChanger.hg : Cleaned with backup (quarantined).
[2016] VM_00970000 -> Trojan.DNSChanger.hg : Cleaned with backup (quarantined).
[2024] VM_00900000 -> Trojan.DNSChanger.hg : Cleaned with backup (quarantined).
[216] VM_00960000 -> Trojan.DNSChanger.hg : Cleaned with backup (quarantined).
[2200] VM_00950000 -> Trojan.DNSChanger.hg : Cleaned with backup (quarantined).
[3824] VM_01150000 -> Trojan.DNSChanger.hg : Cleaned with backup (quarantined).
[392] VM_00E30000 -> Trojan.DNSChanger.hg : Cleaned with backup (quarantined).
[416] VM_00DF0000 -> Trojan.DNSChanger.hg : Cleaned with backup (quarantined).
::Report end
Sitten uusi skannaus ja siellähän se taas on! Ei lähde ei sitten niin millään.
Vastaukset 7
Vanhimmat
Wareout infektio.
Lataa fixwareout.exe jommastakummasta osotteesta:
http://downloads.subratam.org/Fixwareout.exe
http://www.bleepingcomputer.com/files/lonny/Fixwareout.exe
-Tallenna se työpöydälle
-Tuplaklikkaa ohjelman kuvaketta ja seuraa ohjeita.
-Klikkaa Next.
-sitten Install ja varmistu, että "Run fixit" on valittu.
-Käynnistä kone uudelleen kun ohjelma niin pyytää.
Lähetä FixWareout raportti, löytyy yleensä sijainnista c:\fixwareout\report.txt
Fixwareout
Last edited 12/06/2006
Post this report in the forums please
...
Prerun check
[HKEY_LOCAL_MACHINE\\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"="kdnpq.exe"
...
...
Reg Entries that were deleted
...
Random Runs removed from HKLM
...
...
PLEASE NOTE, There WILL be LEGITIMATE FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
»»»»» Searching by size/names...
»»»»»
Search five digit cs, dm kd and jb files.
This WILL/CAN also list Legit Files, Submit them at Virustotal
C:\WINDOWS\SYSTEM32\KDNPQ.EXE 63 586 2005-04-07
Other suspects.
»»»»» Misc files.
»»»»» Checking for older varients covered by the Rem3 tool.
...
Postrun check
[HKEY_LOCAL_MACHINE\\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"system"=""
...
Aja sitten toiseen kertaan Fixwareout läpi samojen ohjeiden mukaan ja lähetä sit uusi Fixwareout raportti.
Fixwareout
Last edited 12/06/2006
Post this report in the forums please
...
Prerun check
[HKEY_LOCAL_MACHINE\\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"system"=""
...
...
Reg Entries that were deleted
...
Random Runs removed from HKLM
...
...
PLEASE NOTE, There WILL be LEGITIMATE FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
»»»»» Searching by size/names...
»»»»»
Search five digit cs, dm kd and jb files.
This WILL/CAN also list Legit Files, Submit them at Virustotal
Other suspects.
»»»»» Misc files.
»»»»» Checking for older varients covered by the Rem3 tool.
...
Postrun check
[HKEY_LOCAL_MACHINE\\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"system"=""
...
Nyt se pitäs olla poissa, skannaa vielä sillä AVG:llä konees läpi, voi olla että se sen vielä löytää mutta nyt sen pitäs poistua koneelta.
Tais lähteä. Jotain täällä vielä on, mutta jääköön toiseen kertaan...
Iso kiitos sulle!
Hyvä että läks, hyviä joulunjatkoja..=)