|
Hjt log tarkastettavaksi kone jumii, viruksia?
|
|
|
jokke66
Junior Member
|
7. kesäkuuta 2008 @ 01:53 |
Linkki tähän viestiin
|
|
Nykäsenkö sen compofixin vielä?
|
|
Hujo
Suspended permanently
|
7. kesäkuuta 2008 @ 01:55 |
Linkki tähän viestiin
|
|
otas tuo uusi combofix loki
ja uusi hjt:n loki
Voiko tietsikka koskaan toimia?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 7. kesäkuuta 2008 @ 01:56
|
|
jokke66
Junior Member
|
7. kesäkuuta 2008 @ 02:04 |
Linkki tähän viestiin
|
ComboFix 08-06-06.4 - J 2008-06-07 2:00:03.2 - NTFSx86
Running from: C:\Documents and Settings\J\Työpöytä\VIRUS HOMMELIT\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\J\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\f.exe
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-06 to 2008-06-06 )))))))))))))))))
.
2008-06-06 22:01 . 2008-06-06 22:03 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-06 22:01 . 2008-06-06 22:01 <KANSIO> d-------- C:\Documents and Settings\J\Application Data\Malwarebytes
2008-06-06 22:01 . 2008-06-06 22:01 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-06 22:01 . 2008-06-05 16:04 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-06 22:01 . 2008-06-05 16:04 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-06 20:15 . 2008-06-06 20:15 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-06-06 20:14 . 2008-06-06 20:14 <KANSIO> d-------- C:\Program Files\SUPERAntiSpyware
2008-06-06 20:14 . 2008-06-06 20:14 <KANSIO> d-------- C:\Documents and Settings\J\Application Data\SUPERAntiSpyware.com
2008-06-06 17:21 . 2008-06-06 20:41 49,156 --a------ C:\shz.exe
2008-06-06 14:58 . 2008-06-06 14:58 49,156 --a------ C:\sz.exe
2008-06-06 14:51 . 2008-06-06 14:51 3,072 --a------ C:\WINDOWS\system32\bruxavne.dll
2008-06-06 14:42 . 2008-06-06 23:00 116,736 --------- C:\WINDOWS\system32\gqukyugx.dll
2008-06-06 14:38 . 2008-06-06 14:38 2,232 --a------ C:\sexx22.exe
2008-06-06 00:42 . 2008-06-06 00:56 49,156 --a------ C:\sf.exe
2008-06-05 14:20 . 2008-06-05 14:20 3,072 --a------ C:\WINDOWS\system32\irsrtkre.dll
2008-06-04 01:00 . 2008-06-04 13:44 3,423 --a------ C:\setz.exe
2008-06-03 23:39 . 2008-06-03 23:40 202,210 --a------ C:\sxy.exe
2008-06-03 21:57 . 2008-06-03 21:57 52,331 --a------ C:\f.bat
2008-06-03 18:53 . 2008-06-03 21:57 86,548 --a------ C:\ssetup.exe
2008-06-03 18:48 . 2008-06-04 14:14 3,423 --a------ C:\WINDOWS\is154890.exe
2008-06-02 22:27 . 2008-06-06 20:13 <KANSIO> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-05-29 00:10 . 2008-05-31 15:01 <KANSIO> d-------- C:\Documents and Settings\J\Application Data\Microgaming
2008-05-25 23:30 . 2008-05-25 23:30 <KANSIO> d-------- C:\Documents and Settings\J\Application Data\Apple Computer
2008-05-25 23:29 . 2008-06-06 23:04 <KANSIO> d-------- C:\Program Files\Bonjour
2008-05-25 23:28 . 2008-05-25 23:28 <KANSIO> d-------- C:\Program Files\Common Files\Apple
2008-05-25 23:28 . 2008-05-25 23:28 <KANSIO> d-------- C:\Program Files\Apple Software Update
2008-05-25 23:28 . 2008-06-06 21:52 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-05-25 23:28 . 2008-05-25 23:28 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-05-23 20:22 . 2008-06-07 01:30 <KANSIO> d-------- C:\Program Files\mIRC
2008-05-23 20:22 . 2008-06-07 01:55 <KANSIO> d-------- C:\Documents and Settings\J\Application Data\mIRC
2008-05-14 14:41 . 2008-05-14 14:41 <KANSIO> d-------- C:\Documents and Settings\J\Application Data\vghd
2008-05-09 21:39 . 2008-05-09 21:39 <KANSIO> d-------- C:\Program Files\Trend Micro
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-06 22:57 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-06-06 22:56 --------- d-----w C:\Program Files\Norton Internet Security
2008-06-06 18:50 --------- d-----w C:\Program Files\Winamp
2008-06-06 17:17 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-06 15:49 --------- d-----w C:\Documents and Settings\J\Application Data\Skype
2008-06-06 15:25 --------- d-----w C:\Documents and Settings\J\Application Data\skypePM
2008-06-05 22:01 --------- d-----w C:\Program Files\Norton AntiVirus
2008-06-03 16:19 --------- d-----w C:\Program Files\NetAnttila
2008-05-31 12:05 --------- d-----w C:\Program Files\PAFPoker
2008-05-23 13:09 --------- d-----w C:\Program Files\Windows Live Safety Center
2008-05-22 14:49 --------- d-----w C:\Program Files\Winamp Remote
2008-05-22 14:32 --------- d-----w C:\Program Files\Java
2008-04-30 16:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\Installations
2008-04-25 18:10 --------- d-----w C:\Program Files\MSN Messenger
2008-04-25 18:10 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-04-25 18:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\army burn poke ooze
2008-04-25 18:09 --------- d-----w C:\Documents and Settings\J\Application Data\slowlongdata
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 166,688 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2007-11-30 14:49 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-14 16:12 15360]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-04-11 17:52 1409024]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-27 15:53 68856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTTimer"="VTTimer.exe" [2005-03-07 22:33 53248 C:\WINDOWS\system32\VTTimer.exe]
"VTTrayp"="VTtrayp.exe" [2006-03-23 11:02 176128 C:\WINDOWS\system32\VTTrayp.exe]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"NAV Agent"="C:\PROGRA~1\NORTON~1\navapw32.exe" [2001-08-16 17:52 74832]
"iamapp"="C:\Program Files\Norton Internet Security\IAMAPP.EXE" [2001-08-30 01:32 373888]
"Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2007-05-15 19:03 95960]
"VX3000"="C:\WINDOWS\vVX3000.exe" [2006-10-13 17:04 707376]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-01-11 17:40 185896]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-14 16:12 15360]
C:\Documents and Settings\All Users\K?ynnist?-valikko\Ohjelmat\K?ynnistys\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 12:01:04 83360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
[HKLM\~\startupfolder\C:^Documents and Settings^J^Käynnistä-valikko^Ohjelmat^Käynnistys^VirtuaGirl HD.LNK]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LifeCam]
--a------ 2006-06-30 02:54 269104 C:\Program Files\Microsoft LifeCam\LifeExp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
-r------- 2006-08-03 00:12 577536 C:\WINDOWS\soundman.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
--a------ 2008-05-28 10:33 1506544 C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2007-07-27 15:53 68856 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\DC++\\DCPlusPlus.exe"=
"C:\\DC++\\DCPlusPlus.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"C:\\Program Files\\Internet Explorer\\iexplore.exe"=
"C:\\Program Files\\TVUPlayer\\TVUPlayer.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"C:\\WINDOWS\\system32\\java.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
R2 MSCamSvc;MSCamSvc;"C:\Program Files\Microsoft LifeCam\MSCamSvc.exe" [2006-06-30 02:54]
R2 NISSERV;Norton Internet Security Service;"C:\Program Files\Norton Internet Security\NISSERV.EXE" [2001-08-30 01:32]
S3 SetupNTGLM7X;SetupNTGLM7X;D:\NTGLM7X.sys []
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{572a729f-02fb-11dc-bdab-0019db21efdf}]
\Shell\AutoRun\command - H:\USBNB.exe
.
'Ajoitetut tehtävät'-kansion sisältö
"2008-06-06 23:00:00 C:\WINDOWS\Tasks\A4E0BC57918735D7.job"
- c:\docume~1\j\applic~1\slowlo~1\mediasecttrust.exe
"2008-06-06 19:28:18 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-06-06 17:01:59 C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer.job"
- C:\PROGRA~1\NORTON~1\NAVW32.exeG/task:C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec\NORTON~1\Tasks\mycomp.sca
"2008-06-06 22:57:13 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
"2008-06-06 22:35:00 C:\WINDOWS\Tasks\Tarkistetaan Windows Live -työkalurivin päivitykset.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-07 02:01:24
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-06-07 2:02:33
ComboFix-quarantined-files.txt 2008-06-06 23:02:28
Pre-Run: 18,489,786,368 tavua vapaana
Post-Run: 18,484,219,904 tavua vapaana
158 --- E O F --- 2008-05-17 01:02:05
|
|
jokke66
Junior Member
|
7. kesäkuuta 2008 @ 02:11 |
Linkki tähän viestiin
|
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:05:06, on 7.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Microsoft LifeCam\MSCamSvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton Internet Security\NISUM.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Norton Internet Security\SymProxySvc.exe
C:\Program Files\Norton Internet Security\NISSERV.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\Norton Internet Security\IAMAPP.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\Norton Internet Security\ATRACK.EXE
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.iltalehti.fi/etusivu/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [iamapp] C:\Program Files\Norton Internet Security\IAMAPP.EXE
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Unibet Guest Poker - {830BB968-4445-4a18-946B-D8582D09D678} - C:\Microgaming\Poker\UnibetguestpokerMPP\MPPoker.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {49E71DB9-E803-43BA-AF81-1CAF61A6C4CB} (F-Secure Online Scanner 3.2) - http://support.f-secure.com/ols/beta/fscax.cab
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://livekuva.suomi.net/activex/AMC.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F9664626-A63A-44D5-9DE4-44AAB757C3DA}: NameServer = 212.50.131.153 213.139.190.3
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Internet Security Service (NISSERV) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISSERV.EXE
O23 - Service: Norton Internet Security Accounts Manager (NISUM) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISUM.EXE
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Norton Internet Security Proxy Service (SymProxySvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\SymProxySvc.exe
--
End of file - 7470 bytes
|
|
Hujo
Suspended permanently
|
7. kesäkuuta 2008 @ 02:11 |
Linkki tähän viestiin
|
Avaa Muistio ja kopioi/liitä lainauksen sisältö sinne:
Lainaus:
File::
C:\shz.exe
C:\sz.exe
C:\sexx22.exe
C:\sf.exe
C:\setz.exe
C:\sxy.exe
C:\f.bat
C:\ssetup.exe
C:\WINDOWS\is154890.exe
Tallenna se nimellä CFScript.txt
Sitten raahaa CFScript ComboFix.exeen kuten alla.
Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
Voiko tietsikka koskaan toimia?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 7. heinäkuuta 2008 @ 01:49
|
|
jokke66
Junior Member
|
7. kesäkuuta 2008 @ 02:16 |
Linkki tähän viestiin
|
|
ÄÄH, en vissiin tajunnu tuota edellistä!
|
|
Hujo
Suspended permanently
|
7. kesäkuuta 2008 @ 02:25 |
Linkki tähän viestiin
|
niin tuo tyhjään muistioon
File::
C:\shz.exe
C:\sz.exe
C:\sexx22.exe
C:\sf.exe
C:\setz.exe
C:\sxy.exe
C:\f.bat
C:\ssetup.exe
C:\WINDOWS\is154890.exe
sitten tallenna nimellä CFScript.txt
työpöydälle missä sulla on tuo combofix sitten raahaat sen niinkuin kuva osoittaa.
Voiko tietsikka koskaan toimia?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 7. kesäkuuta 2008 @ 02:33
|
|
jokke66
Junior Member
|
7. kesäkuuta 2008 @ 02:33 |
Linkki tähän viestiin
|
Ei ole käynnistetty uudelleen
ComboFix 08-06-06.4 - J 2008-06-07 2:28:39.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.568 [GMT 3:00]
Running from: C:\Documents and Settings\J\Työpöytä\VIRUS HOMMELIT\ComboFix.exe
Command switches used :: C:\Documents and Settings\J\Työpöytä\CFScript.txt
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
C:\f.bat
C:\setz.exe
C:\sexx22.exe
C:\sf.exe
C:\shz.exe
C:\ssetup.exe
C:\sxy.exe
C:\sz.exe
C:\WINDOWS\is154890.exe
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\f.bat
C:\setz.exe
C:\sexx22.exe
C:\sf.exe
C:\shz.exe
C:\ssetup.exe
C:\sxy.exe
C:\sz.exe
C:\WINDOWS\is154890.exe
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-06 to 2008-06-06 )))))))))))))))))
.
2008-06-06 22:01 . 2008-06-06 22:03 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-06 22:01 . 2008-06-06 22:01 <KANSIO> d-------- C:\Documents and Settings\J\Application Data\Malwarebytes
2008-06-06 22:01 . 2008-06-06 22:01 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-06 22:01 . 2008-06-05 16:04 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-06 22:01 . 2008-06-05 16:04 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-06 20:15 . 2008-06-06 20:15 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-06-06 20:14 . 2008-06-06 20:14 <KANSIO> d-------- C:\Program Files\SUPERAntiSpyware
2008-06-06 20:14 . 2008-06-06 20:14 <KANSIO> d-------- C:\Documents and Settings\J\Application Data\SUPERAntiSpyware.com
2008-06-06 14:51 . 2008-06-06 14:51 3,072 --a------ C:\WINDOWS\system32\bruxavne.dll
2008-06-06 14:42 . 2008-06-06 23:00 116,736 --------- C:\WINDOWS\system32\gqukyugx.dll
2008-06-05 14:20 . 2008-06-05 14:20 3,072 --a------ C:\WINDOWS\system32\irsrtkre.dll
2008-06-02 22:27 . 2008-06-06 20:13 <KANSIO> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-05-29 00:10 . 2008-05-31 15:01 <KANSIO> d-------- C:\Documents and Settings\J\Application Data\Microgaming
2008-05-25 23:30 . 2008-05-25 23:30 <KANSIO> d-------- C:\Documents and Settings\J\Application Data\Apple Computer
2008-05-25 23:29 . 2008-06-06 23:04 <KANSIO> d-------- C:\Program Files\Bonjour
2008-05-25 23:28 . 2008-05-25 23:28 <KANSIO> d-------- C:\Program Files\Common Files\Apple
2008-05-25 23:28 . 2008-05-25 23:28 <KANSIO> d-------- C:\Program Files\Apple Software Update
2008-05-25 23:28 . 2008-06-06 21:52 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-05-25 23:28 . 2008-05-25 23:28 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-05-23 20:22 . 2008-06-07 02:25 <KANSIO> d-------- C:\Program Files\mIRC
2008-05-23 20:22 . 2008-06-07 02:29 <KANSIO> d-------- C:\Documents and Settings\J\Application Data\mIRC
2008-05-14 14:41 . 2008-05-14 14:41 <KANSIO> d-------- C:\Documents and Settings\J\Application Data\vghd
2008-05-09 21:39 . 2008-05-09 21:39 <KANSIO> d-------- C:\Program Files\Trend Micro
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-06 22:57 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-06-06 22:56 --------- d-----w C:\Program Files\Norton Internet Security
2008-06-06 18:50 --------- d-----w C:\Program Files\Winamp
2008-06-06 17:17 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-06 15:49 --------- d-----w C:\Documents and Settings\J\Application Data\Skype
2008-06-06 15:25 --------- d-----w C:\Documents and Settings\J\Application Data\skypePM
2008-06-05 22:01 --------- d-----w C:\Program Files\Norton AntiVirus
2008-06-03 16:19 --------- d-----w C:\Program Files\NetAnttila
2008-05-31 12:05 --------- d-----w C:\Program Files\PAFPoker
2008-05-23 13:09 --------- d-----w C:\Program Files\Windows Live Safety Center
2008-05-22 14:49 --------- d-----w C:\Program Files\Winamp Remote
2008-05-22 14:32 --------- d-----w C:\Program Files\Java
2008-04-30 16:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\Installations
2008-04-25 18:10 --------- d-----w C:\Program Files\MSN Messenger
2008-04-25 18:10 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-04-25 18:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\army burn poke ooze
2008-04-25 18:09 --------- d-----w C:\Documents and Settings\J\Application Data\slowlongdata
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 166,688 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2007-11-30 14:49 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-14 16:12 15360]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-04-11 17:52 1409024]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-27 15:53 68856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTTimer"="VTTimer.exe" [2005-03-07 22:33 53248 C:\WINDOWS\system32\VTTimer.exe]
"VTTrayp"="VTtrayp.exe" [2006-03-23 11:02 176128 C:\WINDOWS\system32\VTTrayp.exe]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"NAV Agent"="C:\PROGRA~1\NORTON~1\navapw32.exe" [2001-08-16 17:52 74832]
"iamapp"="C:\Program Files\Norton Internet Security\IAMAPP.EXE" [2001-08-30 01:32 373888]
"Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2007-05-15 19:03 95960]
"VX3000"="C:\WINDOWS\vVX3000.exe" [2006-10-13 17:04 707376]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-01-11 17:40 185896]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-14 16:12 15360]
C:\Documents and Settings\All Users\K?ynnist?-valikko\Ohjelmat\K?ynnistys\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 12:01:04 83360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
[HKLM\~\startupfolder\C:^Documents and Settings^J^Käynnistä-valikko^Ohjelmat^Käynnistys^VirtuaGirl HD.LNK]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LifeCam]
--a------ 2006-06-30 02:54 269104 C:\Program Files\Microsoft LifeCam\LifeExp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
-r------- 2006-08-03 00:12 577536 C:\WINDOWS\soundman.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
--a------ 2008-05-28 10:33 1506544 C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2007-07-27 15:53 68856 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\DC++\\DCPlusPlus.exe"=
"C:\\DC++\\DCPlusPlus.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"C:\\Program Files\\Internet Explorer\\iexplore.exe"=
"C:\\Program Files\\TVUPlayer\\TVUPlayer.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"C:\\WINDOWS\\system32\\java.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
R2 MSCamSvc;MSCamSvc;"C:\Program Files\Microsoft LifeCam\MSCamSvc.exe" [2006-06-30 02:54]
R2 NISSERV;Norton Internet Security Service;"C:\Program Files\Norton Internet Security\NISSERV.EXE" [2001-08-30 01:32]
S3 SetupNTGLM7X;SetupNTGLM7X;D:\NTGLM7X.sys []
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{572a729f-02fb-11dc-bdab-0019db21efdf}]
\Shell\AutoRun\command - H:\USBNB.exe
.
'Ajoitetut tehtävät'-kansion sisältö
"2008-06-06 23:00:00 C:\WINDOWS\Tasks\A4E0BC57918735D7.job"
- c:\docume~1\j\applic~1\slowlo~1\mediasecttrust.exe
"2008-06-06 19:28:18 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-06-06 17:01:59 C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer.job"
- C:\PROGRA~1\NORTON~1\NAVW32.exeG/task:C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec\NORTON~1\Tasks\mycomp.sca
"2008-06-06 22:57:13 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
"2008-06-06 22:35:00 C:\WINDOWS\Tasks\Tarkistetaan Windows Live -työkalurivin päivitykset.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-07 02:29:39
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-06-07 2:30:26
ComboFix-quarantined-files.txt 2008-06-06 23:30:06
ComboFix2.txt 2008-06-06 23:02:34
Pre-Run: 18,455,842,816 tavua vapaana
Post-Run: 18,457,325,568 tavua vapaana
170 --- E O F --- 2008-05-17 01:02:05
|
|
Hujo
Suspended permanently
|
7. kesäkuuta 2008 @ 02:35 |
Linkki tähän viestiin
|
Lataa NoLop työpöydällesi yhdestä seuraavista linkeistä...
Linkki1
Linkki2
Linkki3
1.Sulje kaikki ohjelmat, koska tämä vaihe vaatii uudelleenkäynnistyksen
2.Tuplaklikkaa NoLop.exe ajaaksesi sen
3.Klikkaa nappulaa "Search and Destroy"
<<Tietokoneesi skannataan saastuneiden tiedostojen osalta>>
4, Kun skannaus on valmis, sinua pyydetään käynnistämään kone uudestaan, jos infektio löytyy. Klikkaa OK
5. Klikkaa "REBOOT"-painiketta.
6. NoLopin pitäisi antaa viesti. Jos ei, tuplaklikkaa ohjelmaa ja se valmistuu. Lähetä C:\NoLop.log-tiedoston sisältö uuden HijackThis-lokin kera.
-- Jos saat seuraavan virheen, "mscomctl.ocx or one of its dependencies are not correctly registered," lataa mscomctl.ocx ja tallenna se system32-hakemistoosi (yleensä c:\Windows\system32). Tämän jälkeen aja ohjelma uudestaan.
Voiko tietsikka koskaan toimia?
|
|
jokke66
Junior Member
|
7. kesäkuuta 2008 @ 02:44 |
Linkki tähän viestiin
|
NoLop! Log by Skate_Punk_21
Fix running from: C:\Documents and Settings\J\Työpöytä
[7.6.2008]
[2:39:00]
---Infection Files Found/Removed---
C:\WINDOWS\tasks\A4E0BC57918735D7.job
Beginning Removal...
Rebooting...
Removing Lop's Leftover Files/Folders...
Editing Registry...
**Fix Complete!**
---Listing AppData sub directories---
C:\Documents and Settings\All Users\Application Data\Adobe
C:\Documents and Settings\All Users\Application Data\Apple
C:\Documents and Settings\All Users\Application Data\Apple Computer
C:\Documents and Settings\All Users\Application Data\Army Burn Poke Ooze
C:\Documents and Settings\All Users\Application Data\Cyberlink
C:\Documents and Settings\All Users\Application Data\Downloaded Installations
C:\Documents and Settings\All Users\Application Data\Google
C:\Documents and Settings\All Users\Application Data\Installations
C:\Documents and Settings\All Users\Application Data\Malwarebytes
C:\Documents and Settings\All Users\Application Data\Messenger Plus!
C:\Documents and Settings\All Users\Application Data\Microsoft
C:\Documents and Settings\All Users\Application Data\Msn6
C:\Documents and Settings\All Users\Application Data\Pc Suite
C:\Documents and Settings\All Users\Application Data\Skype
C:\Documents and Settings\All Users\Application Data\Superantispyware.com
C:\Documents and Settings\All Users\Application Data\Symantec
C:\Documents and Settings\All Users\Application Data\Tvu Networks
C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
C:\Documents and Settings\All Users\Application Data\Windows Live Toolbar
C:\Documents and Settings\All Users\Application Data\Wlinstaller
C:\Documents and Settings\Default User\Application Data\Microsoft
C:\Documents and Settings\J\Application Data\Adobe
C:\Documents and Settings\J\Application Data\Adobeaum
C:\Documents and Settings\J\Application Data\Adobeum -- EMPTY Directory
C:\Documents and Settings\J\Application Data\Apple Computer
C:\Documents and Settings\J\Application Data\Bsplayer
C:\Documents and Settings\J\Application Data\Datalayer
C:\Documents and Settings\J\Application Data\Google
C:\Documents and Settings\J\Application Data\Help -- EMPTY Directory
C:\Documents and Settings\J\Application Data\Identities
C:\Documents and Settings\J\Application Data\Imgburn
C:\Documents and Settings\J\Application Data\Intertrust
C:\Documents and Settings\J\Application Data\Leadertech
C:\Documents and Settings\J\Application Data\Macromedia
C:\Documents and Settings\J\Application Data\Malwarebytes
C:\Documents and Settings\J\Application Data\Microgaming
C:\Documents and Settings\J\Application Data\Microsoft
C:\Documents and Settings\J\Application Data\Mirc
C:\Documents and Settings\J\Application Data\Mozilla
C:\Documents and Settings\J\Application Data\Msn6
C:\Documents and Settings\J\Application Data\Nokia
C:\Documents and Settings\J\Application Data\Nokia Multimedia Player
C:\Documents and Settings\J\Application Data\Pc Suite
C:\Documents and Settings\J\Application Data\Real
C:\Documents and Settings\J\Application Data\Skype
C:\Documents and Settings\J\Application Data\Skypepm
C:\Documents and Settings\J\Application Data\Slowlongdata
C:\Documents and Settings\J\Application Data\Sun
C:\Documents and Settings\J\Application Data\Superantispyware.com
C:\Documents and Settings\J\Application Data\Symantec
C:\Documents and Settings\J\Application Data\Tvu Networks
C:\Documents and Settings\J\Application Data\Vghd
C:\Documents and Settings\J\Application Data\Winrar -- EMPTY Directory
C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Microsoft
C:\Documents and Settings\Localservice\Application Data\Microsoft
C:\Documents and Settings\Networkservice\Application Data\Microsoft
|
|
Hujo
Suspended permanently
|
7. kesäkuuta 2008 @ 02:47 |
Linkki tähän viestiin
|
Voiko tietsikka koskaan toimia?
|
|
jokke66
Junior Member
|
7. kesäkuuta 2008 @ 02:47 |
Linkki tähän viestiin
|
|
43 prosseia käynnissä. Miten copy psten heitän tuosta osaatko sano keinot?
|
|
jokke66
Junior Member
|
7. kesäkuuta 2008 @ 02:53 |
Linkki tähän viestiin
|
|
Ajan kapen ja heitän login!
|
|
Hujo
Suspended permanently
|
7. kesäkuuta 2008 @ 02:54 |
Linkki tähän viestiin
|
kyllä niitä tuo verran pitää käynnissä olla.
mutta vähennetään tuosta muutama
fixsaa nuo
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
==============
ajas tuosta
Lataa TÄSTÄ VundoFix.exe työpöydällesi.
Tupla-klikkaa VundoFix.exe ajaaksesi sen.
Klikkaa Scan for Vundo valintaa.
Kun skannaus on valmis, klikkaa Fix Vundo valintaa.
Sinulta kysytään haluatko poistaa filut - klikkaa YES.
Kun olet klikannut yes, työpöytäsi tyhjenee kun se alkaa poistamaan Vundoa.
Kun se on valmis, fiksi ilmoittaa käynnistäväsi koneesi uudelleen, klikkaa OK.
Postita C:\vundofix.txt lokin sekä tuoreen HijackThis lokin sisältö.
Huomaa: Se on mahdollista että VundoFix löysi tiedoston jota se ei pystynyt poistamaan.
Tässä tilanteessa, VundoFix ajaa itsensä rebootissa, seuraa vain yläpuolelle olevia ohjeita alkaen kohdasta "Klikkaa Scan for Vundo valintaa." kun VundoFix ilmaantuu uudelleenkäynnistyksen yhteydessä.
Voiko tietsikka koskaan toimia?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 7. kesäkuuta 2008 @ 02:56
|
|
jokke66
Junior Member
|
7. kesäkuuta 2008 @ 03:10 |
Linkki tähän viestiin
|
|
Escan ajaa, ja sen jälkeen heitän ton Vundon!!
|
|
Hujo
Suspended permanently
|
7. kesäkuuta 2008 @ 03:13 |
Linkki tähän viestiin
|
|
ok..
Voiko tietsikka koskaan toimia?
|
|
jokke66
Junior Member
|
7. kesäkuuta 2008 @ 21:29 |
Linkki tähän viestiin
|
|
Sat Jun 07 05:10:34 2008 => ***** Checking for specific ITW Viruses *****
Sat Jun 07 05:10:34 2008 => Checking for Welchia Virus...
Sat Jun 07 05:10:34 2008 => Checking for LovGate Virus...
Sat Jun 07 05:10:34 2008 => Checking for CodeRed Virus...
Sat Jun 07 05:10:34 2008 => Checking for OpaServ Virus...
Sat Jun 07 05:10:34 2008 => Checking for Sobig.e Virus...
Sat Jun 07 05:10:34 2008 => Checking for Winupie Virus...
Sat Jun 07 05:10:34 2008 => Checking for Swen Virus...
Sat Jun 07 05:10:34 2008 => Checking for JS.Fortnight Virus...
Sat Jun 07 05:10:34 2008 => Checking for Novarg Virus...
Sat Jun 07 05:10:34 2008 => Checking for Pagabot Virus...
Sat Jun 07 05:10:34 2008 => Checking for Parite.b Virus...
Sat Jun 07 05:10:34 2008 => Checking for Parite.a Virus...
Sat Jun 07 05:10:34 2008 => ***** Scanning complete. *****
Sat Jun 07 05:10:34 2008 => Total Number of Files Scanned: 65733
Sat Jun 07 05:10:34 2008 => Total Number of Virus(es) Found: 29
Sat Jun 07 05:10:34 2008 => Total Number of Disinfected Files: 0
Sat Jun 07 05:10:34 2008 => Total Number of Files Renamed: 6
Sat Jun 07 05:10:34 2008 => Total Number of Deleted Files: 23
Sat Jun 07 05:10:34 2008 => Total Number of Errors: 21
Sat Jun 07 05:10:34 2008 => Time Elapsed: 02:12:38
Sat Jun 07 05:10:35 2008 => Virus Database Date: 2008/06/06
Sat Jun 07 05:10:35 2008 => Virus Database Count: 835030
|
|
jokke66
Junior Member
|
7. kesäkuuta 2008 @ 21:30 |
Linkki tähän viestiin
|
|
Siis e-scanilta tuommosta
|
|
Mainos
|
|
|
|
Hujo
Suspended permanently
|
7. kesäkuuta 2008 @ 21:54 |
Linkki tähän viestiin
|
|
joo olis ollut hyvä saada se siintä alaluukusta tänne
mutta paljon se deletoi pois ja muutaman nimesi uudelleen
Voiko tietsikka koskaan toimia?
|
