Tässä Antivirusohjelman logi tarkistuksen jälkeen, miten saan poistettua viruksen koneelta???
"Creation date of the report file: 04.06.2004 11:13
AntiVir®/9x Personal Edition v6.25.00.03 of 11.05.2004
VDF file v6.25.0.83 (0) of 03.06.2004
This program is for PERSONAL USE only.
Any other use is PROHIBITED.
Informations regarding commercial versions of AntiVir may be obtained from:
www.hbedv.com.
Scanning for 86575 virus strains and unwanted programs.
Licensed for: AntiVir Personal Edition
Serial number: 0000149996-WURGE-0001
FUSE: Basic license
Please enter the workstation and
contact name with phone number in this form:
Name ___________________________________________
Street ___________________________________________
Town ___________________________________________
Phone/Fax ___________________________________________
EMail ___________________________________________
Platform: Windows 98
Windows version: 4.90.3000
Computername: I9T1Q2
Processor: Pentium
Working memory: 129460 KB free
Version information:
AVEWIN32.DLL : v6.25.0.61 520704 03.06.2004 16:19:22
SYS_RW16.DLL : v6.19.0 12800 20.05.2003 14:41:06
SYS_RW32.DLL : v6.19.0 16384 20.05.2003 14:41:06
AVGCTRL.EXE : v6.24.01.01 81920 26.04.2004 08:54:34
AVGUARD.VXD : v6.25.0.61 365487 03.06.2004 16:19:24
AVPACK32.DLL : v6.22.00.16 421928 16.03.2004 14:28:00
AVGETVER.DLL : v6.22.00.00 24576 20.01.2004 14:14:00
AVWIN.DLL : v6.25.00.03 557096 11.05.2004 12:17:30
AVSHLEXT.DLL : v6.22.00.00 57344 20.01.2004 14:14:00
AVSched32.EXE : v6.23.00.00 110632 20.01.2004 14:14:00
AVSched32.DLL : v6.23.00.00 122880 20.01.2004 14:14:00
AVREG.DLL : v6.22.00.00 41000 20.01.2004 14:14:00
AVRep.DLL : v6.25.00.10 434216 03.06.2004 16:19:28
INETUPD.EXE : v6.25.00.01 196608 27.04.2004 16:30:18
INETUPD.DLL : v6.25.00.01 143360 27.04.2004 16:30:18
MFC42.DLL : v6.00.8665.0 995383 08.06.2000 17:00:00
MSVCRT.DLL : v6.10.8637.0 290869 08.06.2000 17:00:00
CTL3D32.DLL : v2.31.000 45056 08.06.2000 17:00:00
CTL3DV2.DLL : v2.31.001 27632 08.06.2000 17:00:00
Configuration file:
Name of configuration file: C:\OHJELMATIEDOSTOT\AVPERSONAL\AVWIN.INI
Name of report file: C:\OHJELMATIEDOSTOT\AVPERSONAL\LOGFILES\AVWIN.LOG
Start path: C:\OHJELMATIEDOSTOT\AVPERSONAL
Command line:
Start mode: unknown
Mode of report file:
[ ] Do not create report
[X] Overwrite report
[ ] Append new report
Data in report file:
[X] Infected files
[ ] Infected files with paths
[ ] All scanned files
[ ] Full information
Abridge report file:
[ ] Abridge report file
Warnings in report:
[X] Access denied/file locked
[X] Wrong file size in directory
[X] Wrong creation time in directory
[ ] COM file is too large
[X] Invalid start address
[X] Invalid EXE header
[X] Possibly damaged
Summary report:
[X] Create summary report
Output file: AVWIN.ACT
Maximum number of entries: 100
Where to search:
[X] Memory
[X] Boot record of selected drives
[ ] Report unknown boot sectors
[ ] All files
[X] Program files
Extensions: .386 .ACM .ADE .ADP .APP .ASD .ASF .ASP .ASX .AWX .AX .BAS .BAT .BIN .BOO .CDF .CHM .CLASS .CMD .CNV .COM .CPL .CRT .CSH .DLL .DLO .DO? .DRV .EML .EXE* .FLT .FOT .HLP .HT* .INF .INI .INS .ISP .JS* .JSE .LNK .MD? .MDB .MOD .MS? .NWS .OBJ .OCX .OLB .OSD .OV? .PCD .PDR .PGM .PIF .PKG .POT .PPS .PPT .PRG .RAR .REG .RPL .RTF .SBF .SCR .SCRIPT .SCT .SH .SHA .SHB .SHS .SHTM* .SPL .SWF .SYS .TLB .TMP .TSP .TTF .URL .VB? .VCS .VLM .VXD .VXO .WIZ .WLL .WMD .WMS .WMZ .WPC .WSC .WSF .WSH .WWK .XL? .XML .ZIP
Response in case of a detection:
[X] Repair with prompt
[ ] Repair without prompt
[ ] Delete with prompt
[ ] Delete without prompt
[ ] Write in report file only
[X] Acoustic alarm
Response in case of destroyed files:
[X] Delete with prompt
[ ] Delete without prompt
[ ] Ignore
Response in case of destroyed files:
[X] No change
[ ] Current system time
[ ] Correct date
Drag&drop settings:
[X] Scan subdirectories
Profile settings:
[X] Scan subdirectories
Archive options
[X] Search archive
[X] All archive types
Miscellaneous options:
Temporary path: %TEMP% -> C:\WINDOWS\TEMP
[X] Overwrite infected files
[ ] Detect idle time
[X] Allow interruptions of scan
[X] Load AVWin®/9x Guard on System start
General settings:
[X] Save options on exiting AntiVir
Priority: medium
Drives:
A: Floppy drive
C: Hard disk
D: Hard disk
E: Hard disk
F: CD-ROM
Start of scan: 04.06.2004 11:13
Memory test OK
Master boot record of hard disk HD0 OK
Master boot record of hard disk HD1 OK
Boot record of drive C: OK
C:\WINDOWS\Temporary Internet Files\Content.IE5\MFURY1EF
demo[1].jar
ArchiveType: ZIP
--> VerifierBug.class
[DETECTION] The Trojan horse TR/Java.ByteVerify
--> Dummy.class
[DETECTION] The Trojan horse TR/Classloader.D
C:\WINDOWS\Temporary Internet Files\Content.IE5\INSFAL4N
demo[1].jar
ArchiveType: ZIP
--> VerifierBug.class
[DETECTION] The Trojan horse TR/Java.ByteVerify
--> Dummy.class
[DETECTION] The Trojan horse TR/Classloader.D
End of scan: 04.06.2004 11:37
Time taken: 23:12 min
949 directories were scanned
20536 files were scanned
0 warning messages were issued
0 files were deleted
0 files were repaired
4 detections"
"Creation date of the report file: 04.06.2004 11:13
AntiVir®/9x Personal Edition v6.25.00.03 of 11.05.2004
VDF file v6.25.0.83 (0) of 03.06.2004
This program is for PERSONAL USE only.
Any other use is PROHIBITED.
Informations regarding commercial versions of AntiVir may be obtained from:
www.hbedv.com.
Scanning for 86575 virus strains and unwanted programs.
Licensed for: AntiVir Personal Edition
Serial number: 0000149996-WURGE-0001
FUSE: Basic license
Please enter the workstation and
contact name with phone number in this form:
Name ___________________________________________
Street ___________________________________________
Town ___________________________________________
Phone/Fax ___________________________________________
EMail ___________________________________________
Platform: Windows 98
Windows version: 4.90.3000
Computername: I9T1Q2
Processor: Pentium
Working memory: 129460 KB free
Version information:
AVEWIN32.DLL : v6.25.0.61 520704 03.06.2004 16:19:22
SYS_RW16.DLL : v6.19.0 12800 20.05.2003 14:41:06
SYS_RW32.DLL : v6.19.0 16384 20.05.2003 14:41:06
AVGCTRL.EXE : v6.24.01.01 81920 26.04.2004 08:54:34
AVGUARD.VXD : v6.25.0.61 365487 03.06.2004 16:19:24
AVPACK32.DLL : v6.22.00.16 421928 16.03.2004 14:28:00
AVGETVER.DLL : v6.22.00.00 24576 20.01.2004 14:14:00
AVWIN.DLL : v6.25.00.03 557096 11.05.2004 12:17:30
AVSHLEXT.DLL : v6.22.00.00 57344 20.01.2004 14:14:00
AVSched32.EXE : v6.23.00.00 110632 20.01.2004 14:14:00
AVSched32.DLL : v6.23.00.00 122880 20.01.2004 14:14:00
AVREG.DLL : v6.22.00.00 41000 20.01.2004 14:14:00
AVRep.DLL : v6.25.00.10 434216 03.06.2004 16:19:28
INETUPD.EXE : v6.25.00.01 196608 27.04.2004 16:30:18
INETUPD.DLL : v6.25.00.01 143360 27.04.2004 16:30:18
MFC42.DLL : v6.00.8665.0 995383 08.06.2000 17:00:00
MSVCRT.DLL : v6.10.8637.0 290869 08.06.2000 17:00:00
CTL3D32.DLL : v2.31.000 45056 08.06.2000 17:00:00
CTL3DV2.DLL : v2.31.001 27632 08.06.2000 17:00:00
Configuration file:
Name of configuration file: C:\OHJELMATIEDOSTOT\AVPERSONAL\AVWIN.INI
Name of report file: C:\OHJELMATIEDOSTOT\AVPERSONAL\LOGFILES\AVWIN.LOG
Start path: C:\OHJELMATIEDOSTOT\AVPERSONAL
Command line:
Start mode: unknown
Mode of report file:
[ ] Do not create report
[X] Overwrite report
[ ] Append new report
Data in report file:
[X] Infected files
[ ] Infected files with paths
[ ] All scanned files
[ ] Full information
Abridge report file:
[ ] Abridge report file
Warnings in report:
[X] Access denied/file locked
[X] Wrong file size in directory
[X] Wrong creation time in directory
[ ] COM file is too large
[X] Invalid start address
[X] Invalid EXE header
[X] Possibly damaged
Summary report:
[X] Create summary report
Output file: AVWIN.ACT
Maximum number of entries: 100
Where to search:
[X] Memory
[X] Boot record of selected drives
[ ] Report unknown boot sectors
[ ] All files
[X] Program files
Extensions: .386 .ACM .ADE .ADP .APP .ASD .ASF .ASP .ASX .AWX .AX .BAS .BAT .BIN .BOO .CDF .CHM .CLASS .CMD .CNV .COM .CPL .CRT .CSH .DLL .DLO .DO? .DRV .EML .EXE* .FLT .FOT .HLP .HT* .INF .INI .INS .ISP .JS* .JSE .LNK .MD? .MDB .MOD .MS? .NWS .OBJ .OCX .OLB .OSD .OV? .PCD .PDR .PGM .PIF .PKG .POT .PPS .PPT .PRG .RAR .REG .RPL .RTF .SBF .SCR .SCRIPT .SCT .SH .SHA .SHB .SHS .SHTM* .SPL .SWF .SYS .TLB .TMP .TSP .TTF .URL .VB? .VCS .VLM .VXD .VXO .WIZ .WLL .WMD .WMS .WMZ .WPC .WSC .WSF .WSH .WWK .XL? .XML .ZIP
Response in case of a detection:
[X] Repair with prompt
[ ] Repair without prompt
[ ] Delete with prompt
[ ] Delete without prompt
[ ] Write in report file only
[X] Acoustic alarm
Response in case of destroyed files:
[X] Delete with prompt
[ ] Delete without prompt
[ ] Ignore
Response in case of destroyed files:
[X] No change
[ ] Current system time
[ ] Correct date
Drag&drop settings:
[X] Scan subdirectories
Profile settings:
[X] Scan subdirectories
Archive options
[X] Search archive
[X] All archive types
Miscellaneous options:
Temporary path: %TEMP% -> C:\WINDOWS\TEMP
[X] Overwrite infected files
[ ] Detect idle time
[X] Allow interruptions of scan
[X] Load AVWin®/9x Guard on System start
General settings:
[X] Save options on exiting AntiVir
Priority: medium
Drives:
A: Floppy drive
C: Hard disk
D: Hard disk
E: Hard disk
F: CD-ROM
Start of scan: 04.06.2004 11:13
Memory test OK
Master boot record of hard disk HD0 OK
Master boot record of hard disk HD1 OK
Boot record of drive C: OK
C:\WINDOWS\Temporary Internet Files\Content.IE5\MFURY1EF
demo[1].jar
ArchiveType: ZIP
--> VerifierBug.class
[DETECTION] The Trojan horse TR/Java.ByteVerify
--> Dummy.class
[DETECTION] The Trojan horse TR/Classloader.D
C:\WINDOWS\Temporary Internet Files\Content.IE5\INSFAL4N
demo[1].jar
ArchiveType: ZIP
--> VerifierBug.class
[DETECTION] The Trojan horse TR/Java.ByteVerify
--> Dummy.class
[DETECTION] The Trojan horse TR/Classloader.D
End of scan: 04.06.2004 11:37
Time taken: 23:12 min
949 directories were scanned
20536 files were scanned
0 warning messages were issued
0 files were deleted
0 files were repaired
4 detections"
Vastaukset 4
Vanhimmat
Väliaikaiset internet-tiedostot. Siellähän kyseinen näyttäisi majailevan.
Työkalut -> internet asetukset -> poista tiedostot -> raksi ruutuun "kaikki offline sisältö" -> Ok
Tämä kannattaa tehdä joka kerran aina ennen selaimen sulkemista, koska monetkin virukset ja örkit majoittuu yleensä väliaikaisiin internet tiedostoihin:
>Työkalut
>Internet-asetukset
>Poista Evästeet
>Ok (pikku-ikkunaan)
>Poista tiedostot, laita myös ruksi, Poista kaikki off-line sisältö, kohdan eteen
>Ok (pikku-ikkunaan)
>Ok
F-Secure ilmoittaa että virus on arkistossa, ei voi poistaa. Virus ei poistu, vaikka tyhjentää kaikki temporary internet tiedostot. Temporary internet tiedostoissa ei ole muuta kuin index.dat. mut se ei lähde pois. Sielläkö se virus on, ja miten sen poistaminen onnistuu?
Tässä poisto ohje:
http://support.f-secure.fi/fin/home/virusproblem/howtoclean/cleansystemrestore.shtml