Elikkäs scannasin koneen pandan online scannerilla ja se löysi tuollaisen.

Hacktool:Hacktool/HideItX

Kaspersky ei löydä tuota eikä spywaren poisto ohjelmani. Mikäs neuvoksi?

moi
voi olla väärä hälytys
mikä tiedosto ja mikä on polku

Hacktool:Hacktool/HideItX Not disinfected M:\System Volume Information\_restore{D542C3A4-090C-4E20-BC5C-09D4AC7566DE}\RP199\A0023129.MSI

ok se on järjestelmä palautuksessa,ei kannata vielä putsata sitä,vasta sitten kun kone on puhas

Tarkista koneesi F-Securen online skannerilla

Huom, skanneri toimii vain Internet Explorer selaimella

* Lue sivun ohjeet huolella läpi
* Klikkaa Start scanning
* Mikäli saat Internet Explorer -suojausvaroituksen, klikkaa Asenna
* Klikkaa Accept
* Klikkaa Custom Scan
* Säädä asetukset seuraavasti

o "Virus Scan Option" kohdasta valitse Scan whole system
o "Other Scan Option" kohdasta valitse Scan All Files
o Valitse Scan whole system for rootkits
o Valitse Scan whole system for spyware
o Laita ruksi kohtaan Scan inside archives
o Varmista että Use advanced heuristics on valittuna

* Klikkaa Start
* Skannaus käynnistyy kun tarvittavat tiedostot/päivitykset on ladattu
* Odota kärsivällisesti
* Kun sakannaus on suoritettu, klikkaa Automatic cleaning
* Klikkaa Show Report
* Raportti aukeaa selaimessa, kopioi teksti kokonaan
* Liitä kopioitu teksti esim. muistioon tai Wordiin ja tallenna työpöydälle
* Voit sulkea skannerin
* Lähetä raportti viestiketjuusi

Scanning Report
Wednesday, October 24, 2007 19:52:26 - 23:14:01

Computer name: ANNEN-N90GXNI2T
Scanning type: Scan system for viruses, rootkits, spyware
Target: C:\ H:\ J:\ M:\
Result: 7 malware found
Harnig.gen1 (virus)

* J:\CEELT�\VST\PROGRESS AUDIO SHAPESHIFTER V1.0\KEYGEN.EXE (Submitted)
* J:\POLTTO\VST\PROGRESS.AUDIO.SHAPESHIFTER.VST.V1.0.INC.KEY-DAZ 11.22.05 ORIGINAL\PROGRESS AUDIO SHAPESHIFTER V1.0\KEYGEN.EXE (Submitted)
* J:\SYSTEM VOLUME INFORMATION\_RESTORE{C30F9B8B-4746-40AA-B601-7CFD7750E4B5}\RP193\A0019798.EXE (Submitted)

SDBot.gen8 (virus)

* J:\SYSTEM VOLUME INFORMATION\_RESTORE{D542C3A4-090C-4E20-BC5C-09D4AC7566DE}\RP222\A0028133.EXE (Submitted)

Tracking Cookie (spyware)

* System (Disinfected)
* System
* System

Statistics
Scanned:

* Files: 49494
* System: 4736
* Not scanned: 3

Actions:

* Disinfected: 1
* Renamed: 0
* Deleted: 0
* None: 6
* Submitted: 4

Files not scanned:

* C:\PAGEFILE.SYS
* C:\WINDOWS\SYSTEM32\DRIVERS\SPTD.SYS
* C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT

Options
Scanning engines:

* F-Secure Libra: 2.4.2, 2007-10-24
* F-Secure AVP: 7.0.171, 2007-10-24
* F-Secure Orion: 1.2.37, 2007-10-24
* F-Secure Blacklight: 1.0.64
* F-Secure Draco: 1.0.35, 2007-09-17
* F-Secure Pegasus: 1.19.0, 2007-09-18

Scanning options:

* Scan defined files: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB BAT LNK ANI AVB CEO CMD LSP MAP MHT MIF PDF PHP POT WMF NWS TAR TGZ WSF ZL? {* ZIP JAR ARJ LZH TAR TGZ GZ CAB RAR BZ2 HQX
* Use Advanced heuristics

Copyright © 1998-2006 Product support |Send virus sample to F-Secure
F-Secure assumes no responsibility for material created or published by third parties that F-Secure World Wide Web pages have a link to. Unless you have clearly stated otherwise, by submitting material to any of our servers, for example by E-mail or via our F-Secure's CGI E-mail, you agree that the material you make available may be published in the F-Secure World Wide Pages or hard-copy publications. You will reach F-Secure public web site by clicking on underlined links. While doing this, your access will be logged to our private access statistics with your domain name.This information will not be given to any third party. You agree not to take action against us in relation to material that you submit. Unless you have clearly stated otherwise, by submitting material you warrant that F-Secure may incorporate any concepts described in it in the F-Secure products/publications without liability.

Edelleen Pandan online scan löytää tuon saman Hacktoll/HideItX

Incident Status Location

Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Mozilla\Firefox\Profiles\ylt6hke4.default\cookies.txt[ad.yieldmanager.com/]
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Mozilla\Firefox\Profiles\ylt6hke4.default\cookies.txt[.fastclick.net/]
Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Mozilla\Firefox\Profiles\ylt6hke4.default\cookies.txt[.zedo.com/]
Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Mozilla\Firefox\Profiles\ylt6hke4.default\cookies.txt[.apmebf.com/]
Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Mozilla\Firefox\Profiles\ylt6hke4.default\cookies.txt[.zedo.com/]
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Mozilla\Firefox\Profiles\ylt6hke4.default\cookies.txt[.fastclick.net/]
Spyware:Cookie/Adserver Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Mozilla\Firefox\Profiles\ylt6hke4.default\cookies.txt[.adserver.easyad.info/]
Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Mozilla\Firefox\Profiles\ylt6hke4.default\cookies.txt[.adtech.de/]
Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Mozilla\Firefox\Profiles\ylt6hke4.default\cookies.txt[.adrevolver.com/]
Spyware:Cookie/Toplist Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Mozilla\Firefox\Profiles\ylt6hke4.default\cookies.txt[.toplist.cz/]
Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Mozilla\Firefox\Profiles\ylt6hke4.default\cookies.txt[.tradedoubler.com/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Mozilla\Firefox\Profiles\ylt6hke4.default\cookies.txt[.advertising.com/]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Mozilla\Firefox\Profiles\ylt6hke4.default\cookies.txt[.doubleclick.net/]
Spyware:Cookie/adultfriendfinder Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Mozilla\Firefox\Profiles\ylt6hke4.default\cookies.txt[.adultfriendfinder.com/]
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Mozilla\Firefox\Profiles\ylt6hke4.default\cookies.txt[.xiti.com/]
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Mozilla\Firefox\Profiles\ylt6hke4.default\cookies.txt[.serving-sys.com/]
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Mozilla\Firefox\Profiles\ylt6hke4.default\cookies.txt[.bs.serving-sys.com/]
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Mozilla\Firefox\Profiles\ylt6hke4.default\cookies.txt[.atwola.com/]
Hacktool:Hacktool/HideItX Not disinfected M:\System Volume Information\_restore{D542C3A4-090C-4E20-BC5C-09D4AC7566DE}\RP199\A0023129.MSI

moi
jep se on järjestelmä palautuksessa
poista tiedosto:

J:\CEELT?\VST\PROGRESS AUDIO SHAPESHIFTER V1.0

tyhjennä roskakori

Putsaa järjestelmän palautus:
1. Klikkaa oikealla käynnistävalikon My Computer- tai oma tietokone-kuvaketta
2. Valitse Properties/ominaisuudet
3. Valitse System Restore/järjestelmän palauttaminen välilehti
4. Valitse "Turn off System Restore"/poista järjestelmän palauttaminen kaikissa asemissa
5. Paina Apply/käytä
6. Paina OK
7. Käynnistä kone uudelleen
8. Palauta asetukset takaisin

vielä ongelmia

moi

Miten asetusten palauttaminen tapahtuu?

öööö mitkä asetukset :D

8. Palauta asetukset takaisin ?

Skannasin Pandalla vielä varmuudenvuoksi ja edelleen se löytää tuon Hacktool/HideItX

Tässä Scan report

Incident Status Location

Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Mozilla\Firefox\Profiles\ylt6hke4.default\cookies.txt[.2o7.net/]
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Mozilla\Firefox\Profiles\ylt6hke4.default\cookies.txt[.atwola.com/]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Mozilla\Firefox\Profiles\ylt6hke4.default\cookies.txt[.doubleclick.net/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Mozilla\Firefox\Profiles\ylt6hke4.default\cookies.txt[.advertising.com/]
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Mozilla\Firefox\Profiles\ylt6hke4.default\cookies.txt[.tribalfusion.com/]
Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Mozilla\Firefox\Profiles\ylt6hke4.default\cookies.txt[.tradedoubler.com/]
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Mozilla\Firefox\Profiles\ylt6hke4.default\cookies.txt[ad.yieldmanager.com/]
Spyware:Cookie/Toplist Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Mozilla\Firefox\Profiles\ylt6hke4.default\cookies.txt[.toplist.cz/]
Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Mozilla\Firefox\Profiles\ylt6hke4.default\cookies.txt[.adrevolver.com/]
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Mozilla\Firefox\Profiles\ylt6hke4.default\cookies.txt[.fastclick.net/]
Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Mozilla\Firefox\Profiles\ylt6hke4.default\cookies.txt[.apmebf.com/]
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Mozilla\Firefox\Profiles\ylt6hke4.default\cookies.txt[.fastclick.net/]
Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Mozilla\Firefox\Profiles\ylt6hke4.default\cookies.txt[.adtech.de/]
Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Mozilla\Firefox\Profiles\ylt6hke4.default\cookies.txt[.zedo.com/]
Spyware:Cookie/Adserver Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Mozilla\Firefox\Profiles\ylt6hke4.default\cookies.txt[.adserver.easyad.info/]
Spyware:Cookie/adultfriendfinder Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Mozilla\Firefox\Profiles\ylt6hke4.default\cookies.txt[.adultfriendfinder.com/]
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Mozilla\Firefox\Profiles\ylt6hke4.default\cookies.txt[.xiti.com/]
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Mozilla\Firefox\Profiles\ylt6hke4.default\cookies.txt[.serving-sys.com/]
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Mozilla\Firefox\Profiles\ylt6hke4.default\cookies.txt[.bs.serving-sys.com/]
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Cookies\järjestelmänvalvoja@2o7[2].txt
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Järjestelmänvalvoja\Cookies\järjestelmänvalvoja@advertising[2].txt
Hacktool:Hacktool/HideItX Not disinfected M:\System Volume Information\_restore{D542C3A4-090C-4E20-BC5C-09D4AC7566DE}\RP199\A0023129.MSI

pykä tällä selvällä tomaton ohjeella palautat koneesi:

Putsaa järjestelmän palautus:
1. Klikkaa oikealla käynnistävalikon My Computer- tai oma tietokone-kuvaketta
2. Valitse Properties/ominaisuudet
3. Valitse System Restore/järjestelmän palauttaminen välilehti
4. Valitse "Turn off System Restore"/poista järjestelmän palauttaminen kaikissa asemissa
5. Paina Apply/käytä
6. Paina OK
7. Käynnistä kone uudelleen
8. Palauta asetukset takaisin

Voisiko joku nyt vielä kertoa miten tuo kohta 8. tehdään? Muutoin noudatin noita ohjeita.

Sori pykä kommukaatio virhe joo eli tee tämä päin vastoin:

4 Valitse "Turn off System Restore"/poista järjestelmän palauttaminen kaikissa asemissa eli otat ruksin pois ja klikkaat ok tai käytä.

Jeps noin olin sen ymmärtänytkin jo tehdä. Mutta eipä pandan mukaan ole virus koneesta vielä poistunut mikähän seuraavana neuvoksi?

Muistitko käynnistää koneen uudelleen ennen kuin palautit asetukset?

jep

olisko tässä selkeempi ohje

http://www.virustorjunta.net/modules.php...n+ratkaisuun#34

kokeilaan tää

Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi:
*Käynnistä tietokone
*Kun kuulet koneen piippaavan, paina F8, kuitenkin ennen Windowsin logon esiintuloa
*Seuraavaksi pitäisi ilmestyä valikko
*Valitse valikosta vikasietotila.

* Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio). Työpöydälle ilmestyy sdfix.exe. Tuplakilikkaa sitä, niin tiedosto purkaantuu ja asentaa itsensä siihen levyasemaan, minne on käyttöjärjestelmä on asennettu ja juureen ilmestyy kansio SDFix, ESIM c:\SDFix
* Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
* Paina Y käynnistääksesi skriptin.
* Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
* Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
* Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
* Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
* Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
* Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis lokin kera.

SDFix: Version 1.114

Run by J?rjestelm?nvalvoja on ti 13.11.2007 at 22:26

Microsoft Windows XP [versio 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files:

No Trojan Files Found




Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-13 22:48:44
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:d6,39,7d,6c,82,5e,2f,fb,88,54,ac,d1,c2,b3,95,3c,1f,c4,27,e9,8b,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"khjeh"=hex:5f,68,fa,f2,7e,7a,64,b8,d1,60,ab,e7,83,04,36,99,0e,95,37,d5,ef,..
"d0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:a3,89,46,ea,41,3c,4d,87,22,d7,29,55,ce,4c,a9,de,27,bb,8c,0e,5b,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:67,69,e7,ac,d3,79,d2,59,c6,2e,00,eb,21,69,37,ae,3d,6f,1a,48,e2,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,30,15,37,91,e1,8d,5f,8d,e8,4b,67,a2,a4,22,5b,a6,a6,..
"khjeh"=hex:5f,68,fa,f2,7e,7a,64,b8,d1,60,ab,e7,83,04,36,99,0e,95,37,d5,ef,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:50,5e,22,bb,7a,09,5d,32,58,c1,c8,84,28,1b,51,c4,96,09,f7,58,a9,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:d6,39,7d,6c,82,5e,2f,fb,88,54,ac,d1,c2,b3,95,3c,1f,c4,27,e9,8b,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"khjeh"=hex:5f,68,fa,f2,7e,7a,64,b8,d1,60,ab,e7,83,04,36,99,0e,95,37,d5,ef,..
"d0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:a3,89,46,ea,41,3c,4d,87,22,d7,29,55,ce,4c,a9,de,27,bb,8c,0e,5b,..

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\\x00ffc\xd3w\2]
"b049C053C7D38EE4AB9A00CB3B5D2472"="C?\Program Files\Common Files\Microsoft Shared\Web Folders\PUBPLACE.HTT"

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\Last.fm\\LastFM.exe"="C:\\Program Files\\Last.fm\\LastFM.exe:*:Enabled:Last.fm"
"C:\\Program Files\\BitComet\\BitComet.exe"="C:\\Program Files\\BitComet\\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client"
"C:\\Program Files\\Soulseek\\slsk.exe"="C:\\Program Files\\Soulseek\\slsk.exe:*:Enabled:SoulSeek"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

Remaining Files:
---------------


Files with Hidden Attributes:

Wed 11 Jul 2007 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Wed 11 Jul 2007 401 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv14.bak"
Fri 27 Feb 2004 233,472 A..H. --- "C:\Program Files\Image-Line\FL Studio 7\REX Shared Library.dll"

Finished!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:58:05, on 13.11.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\CTHELPER.EXE
C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Last.fm\LastFMHelper.exe
C:\Program Files\MagicDisc\MagicDisc.exe
C:\Program Files\Creative Professional\Digital Audio System\E-MU PatchMix DSP\EmuPatchMixDSP.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Last.fm\LastFM.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Mam2Pan] Mam2Pan.Exe
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [H2O] C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe
O4 - Global Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner...can_unicode.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A4069847-C342-48E2-9257-01A24E5C78EA} (F-Secure Online Scanner 3.2) - http://support.f-secure.com/ols3beta/fscax.cab
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE

--
End of file - 6603 bytes

jep se oli ok,joko sait järjestelmä palautuksen tyhjennetty

Joo sain palautuksen tyhjennettyä. Suuret kiitokset ja kumarrukset Tomatolle jelpistä. Skannasin kuitenkin varmuuden vuoksi uudelleen ja edelleen f-secure löytää samoja viruksia. Lisäsin koneeseen aseman D: jolta löytyi jotain, mutta myös edelleen samoja vanhoja? Laitan seuraavaan viestiin skannaus raportin.

Scanning Report
Thursday, November 15, 2007 03:36:01 - 11:49:34

Computer name: ANNEN-N90GXNI2T
Scanning type: Scan system for viruses, rootkits, spyware
Target: C:\ D:\ H:\ L:\ M:\
Result: 17 malware found
Ehijda.A (virus)

* C:\Documents and Settings\J�rjestelm�nvalvoja\Ty�p�yt�\vst\KX_Modulad.zip\KX_Modulad\KX-MODULAD-setup.exe

Harnig.gen1 (virus)

* D:\ceelt�\ohjelmat2\BSplayer.Pro.v1.20.815.Incl.Keygen-TSZ\tszbsp12.zip\keygen.exe
* D:\ceelt�\ohjelmat2\BSplayer.Pro.v1.20.815.Incl.Keygen-TSZ\tszbsp12\keygen.exe (Submitted)
* L:\ceelt�\vst\Progress Audio ShapeShifter v1.0\Keygen.exe (Submitted)
* L:\poltto\vst\Progress.Audio.ShapeShifter.VST.v1.0.inc.Key-dAz 11.22.05 original\Progress Audio ShapeShifter v1.0.rar\Progress Audio ShapeShifter v1.0\Keygen.exe
* L:\poltto\vst\Progress.Audio.ShapeShifter.VST.v1.0.inc.Key-dAz 11.22.05 original\Progress Audio ShapeShifter v1.0\Keygen.exe (Submitted)

SDBot.gen8 (virus)

* L:\System Volume Information\_restore{D542C3A4-090C-4E20-BC5C-09D4AC7566DE}\RP222\A0028133.exe (Submitted)

Tracking Cookie (spyware)

* System (Disinfected)
* System (Disinfected)
* System
* System
* System
* System
* System
* System
* System

W32/Malware.XZZ (virus)

* L:\torrent downloads\Replay Media Catcher 2.10 + Crack\crack\foff_patch.exe (Submitted)

Statistics
Scanned:

* Files: 500230
* System: 4236
* Not scanned: 679

Actions:

* Disinfected: 2
* Renamed: 0
* Deleted: 0
* None: 15
* Submitted: 5

Files not scanned:

* 8d
x
�AGEFILE.SYS C:\WINDOWS\SYSTEM32\BIOS1.ROM
* C:\WINDOWS\SYSTEM32\DRIVERS\FIDBOX.DAT
* C:\WINDOWS\SYSTEM32\DRIVERS\SPTD.SYS
* C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT
* C:\WINDOWS\SYSTEM32\CONFIG\SAM
* C:\WINDOWS\SYSTEM32\CONFIG\SECURITY
* C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM
* C:\WINDOWS\SYSTEM32\CATROOT2\EDB.LOG
* C:\WINDOWS\SYSTEM32\CATROOT2\TMP.EDB
* C:\WINDOWS\SOFTWAREDISTRIBUTION\EVENTCACHE\{03341252-8F5B-42F0-92B6-F57DFAAA3148}.BIN
* C:\PROGRAM FILES\VST\INSTRUT\BASS SYNTHS & 303 CLONES\TRI2KTABLESM.DAT
* C:\PROGRAM FILES\IMAGE-LINE\FL STUDIO 7\PLUGINS\FRUITY\GENERATORS\DIRECTWAVE\DIRECTWAVE.CFG
* C:\PROGRAM FILES\CYCLING '74\PLUGGO\DEVELOPMENT MATERIALS\P2.PICT
* C:\PROGRAM FILES\COMMON FILES\CYCLING '74\PLUGGO SUPPORT\PLUGGO SUPPORTING FILES\MATRIXDEFAULTBKGND.PCT
* C:\PROGRAM FILES\COMMON FILES\CYCLING '74\PLUGGO SUPPORT\PLUGGO SUPPORTING FILES\MATRIXDEFAULTCELL.PCT
* C:\PROGRAM FILES\COMMON FILES\CYCLING '74\PLUGGO SUPPORT\PLUGGO SUPPORTING FILES\SLIDERDEFAULTBKGND.PCT
* C:\PROGRAM FILES\COMMON FILES\CYCLING '74\PLUGGO SUPPORT\PLUGGO SUPPORTING FILES\SLIDERDEFAULTKNOB.PCT
* C:\PROGRAM FILES\COMMON FILES\CYCLING '74\PLUGGO SUPPORT\PLUGGO SUPPORTING FILES\JHNO-SUPPORT\ARROWS.PICT
* C:\PROGRAM FILES\COMMON FILES\CYCLING '74\PLUGGO SUPPORT\PLUGGO SUPPORTING FILES\JHNO-SUPPORT\BANDPASS.PICT
* C:\PROGRAM FILES\COMMON FILES\CYCLING '74\PLUGGO SUPPORT\PLUGGO SUPPORTING FILES\JHNO-SUPPORT\BLACK2X2.PICT
* C:\PROGRAM FILES\COMMON FILES\CYCLING '74\PLUGGO SUPPORT\PLUGGO SUPPORTING FILES\JHNO-SUPPORT\BLACKSQUARE.PICT
* C:\PROGRAM FILES\COMMON FILES\CYCLING '74\PLUGGO SUPPORT\PLUGGO SUPPORTING FILES\JHNO-SUPPORT\DRAW.PICT
* C:\PROGRAM FILES\COMMON FILES\CYCLING '74\PLUGGO SUPPORT\PLUGGO SUPPORTING FILES\JHNO-SUPPORT\GRAY SQUARE 2X2.PICT
* C:\PROGRAM FILES\COMMON FILES\CYCLING '74\PLUGGO SUPPORT\PLUGGO SUPPORTING FILES\JHNO-SUPPORT\HIPASS.PICT
* C:\PROGRAM FILES\COMMON FILES\CYCLING '74\PLUGGO SUPPORT\PLUGGO SUPPORTING FILES\JHNO-SUPPORT\HISHELF.PICT
* C:\PROGRAM FILES\COMMON FILES\CYCLING '74\PLUGGO SUPPORT\PLUGGO SUPPORTING FILES\JHNO-SUPPORT\KNOB.BLACK2.PICT
* C:\PROGRAM FILES\COMMON FILES\CYCLING '74\PLUGGO SUPPORT\PLUGGO SUPPORTING FILES\JHNO-SUPPORT\LFO.PICT
* C:\PROGRAM FILES\COMMON FILES\CYCLING '74\PLUGGO SUPPORT\PLUGGO SUPPORTING FILES\JHNO-SUPPORT\LFO2.PICT
* C:\PROGRAM FILES\COMMON FILES\CYCLING '74\PLUGGO SUPPORT\PLUGGO SUPPORTING FILES\JHNO-SUPPORT\LOPASS.PICT
* C:\PROGRAM FILES\COMMON FILES\CYCLING '74\PLUGGO SUPPORT\PLUGGO SUPPORTING FILES\JHNO-SUPPORT\LOSHELF.PICT
* C:\PROGRAM FILES\COMMON FILES\CYCLING '74\PLUGGO SUPPORT\PLUGGO SUPPORTING FILES\JHNO-SUPPORT\NOTCH.PICT
* C:\PROGRAM FILES\COMMON FILES\CYCLING '74\PLUGGO SUPPORT\PLUGGO SUPPORTING FILES\JHNO-SUPPORT\SAWDOWN.PICT
* C:\PROGRAM FILES\COMMON FILES\CYCLING '74\PLUGGO SUPPORT\PLUGGO SUPPORTING FILES\JHNO-SUPPORT\SAWUP.PICT
* C:\PROGRAM FILES\COMMON FILES\CYCLING '74\PLUGGO SUPPORT\PLUGGO SUPPORTING FILES\JHNO-SUPPORT\SINE.PICT
* C:\PROGRAM FILES\COMMON FILES\CYCLING '74\PLUGGO SUPPORT\PLUGGO SUPPORTING FILES\JHNO-SUPPORT\SQUARE.PICT
* C:\PROGRAM FILES\COMMON FILES\CYCLING '74\PLUGGO SUPPORT\PLUGGO SUPPORTING FILES\JHNO-SUPPORT\SWIRL.PICT
* C:\DOWNLOADS\WAVES.MERCURY.BUNDLE.VST.DX.RTAS.V5.0-AIR\A-WMB50.R00
* C:\DOWNLOADS\WAVES.MERCURY.BUNDLE.VST.DX.RTAS.V5.0-AIR\A-WMB50.R01
* C:\DOWNLOADS\WAVES.MERCURY.BUNDLE.VST.DX.RTAS.V5.0-AIR\A-WMB50.R02
* C:\DOWNLOADS\WAVES.MERCURY.BUNDLE.VST.DX.RTAS.V5.0-AIR\A-WMB50.R03
* C:\DOWNLOADS\WAVES.MERCURY.BUNDLE.VST.DX.RTAS.V5.0-AIR\A-WMB50.R04
* C:\DOWNLOADS\WAVES.MERCURY.BUNDLE.VST.DX.RTAS.V5.0-AIR\A-WMB50.R05
* C:\DOWNLOADS\WAVES.MERCURY.BUNDLE.VST.DX.RTAS.V5.0-AIR\A-WMB50.R06
* C:\DOWNLOADS\WAVES.MERCURY.BUNDLE.VST.DX.RTAS.V5.0-AIR\A-WMB50.R07
* C:\DOWNLOADS\WAVES.MERCURY.BUNDLE.VST.DX.RTAS.V5.0-AIR\A-WMB50.R08
* C:\DOWNLOA(
�
OS

Options
Scanning engines:

* F-Secure Libra: 2.4.2, 2007-11-14
* F-Secure AVP: 7.0.171, 2007-11-15
* F-Secure Orion: 1.2.37, 2007-11-14
* F-Secure Blacklight: 1.0.64
* F-Secure Draco: 1.0.35, 0602-150-72
* F-Secure Pegasus: 1.19.0, 2007-10-12

Scanning options:

* Scan all files
* Scan inside archives
* Use Advanced heuristics

Copyright © 1998-2006 Product support |Send virus sample to F-Secure
F-Secure assumes no responsibility for material created or published by third parties that F-Secure World Wide Web pages have a link to. Unless you have clearly stated otherwise, by submitting material to any of our servers, for example by E-mail or via our F-Secure's CGI E-mail, you agree that the material you make available may be published in the F-Secure World Wide Pages or hard-copy publications. You will reach F-Secure public web site by clicking on underlined links. While doing this, your access will be logged to our private access statistics with your domain name.This information will not be given to any third party. You agree not to take action against us in relation to material that you submit. Unless you have clearly stated otherwise, by submitting material you warrant that F-Secure may incorporate any concepts described in it in the F-Secure products/publications without liability.

:O
en näe tässä mitään järkeä,sen mukaan mitä saa poistettua viruksia niin
sinä lataat niitä lisää koneelle
Eli aika turhaa tää......