aukeilevat sivut

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by make1972, Apr 2, 2007.

  1. make1972

    make1972 Member

    Joined:
    Dec 16, 2006
    Messages:
    82
    Likes Received:
    0
    Trophy Points:
    16
    joo kirjottelin tänne jo tossa eilen ,vielläkin on ongelmana itsestään aukeilevat linkit,olen kokeillut ajaa lähes kaikki spyware ohjelmat ja jotkun on jotain löytänytkin ja poistanut mutta ongelma ei häviä mihinkään,tässä olis hijacklogi jos joku viisaampi näkis siinä jotain.

    Logfile of Trend Micro HijackThis v2.0.0 (BETA)
    Scan saved at 16:41:01, on 2.4.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
    C:\Program Files\Sonera Tietoturva\Common\FSM32.EXE
    C:\Program Files\Styler\Styler.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\LClock\LClock.exe
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    C:\Program Files\VisualTooltip\VisualToolTip.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Thoosje Vista Sidebar v1.7.8\thoosje's sidebar.exe
    C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
    C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
    C:\PROGRA~1\INCRED~1\bin\IMApp.exe
    C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
    C:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
    C:\Program Files\Sonera Tietoturva\Anti-Virus\FSGK32.EXE
    C:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
    C:\Program Files\Sonera Tietoturva\Anti-Virus\fssm32.exe
    C:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
    C:\Program Files\Sonera Tietoturva\Common\FSMB32.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Sonera Tietoturva\Common\FCH32.EXE
    C:\Program Files\Sonera Tietoturva\Common\FAMEH32.EXE
    C:\Program Files\Sonera Tietoturva\Anti-Virus\fsrw.exe
    C:\WINDOWS\system32\svchost.exe
    C:\DOCUME~1\Marko\LOCALS~1\Temp\{D9481D72-2845-473A-914F-8E4CB03A5351}\Blaero Start Orb.exe
    C:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
    C:\Program Files\Sonera Tietoturva\Anti-Virus\fsav32.exe
    C:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
    C:\PROGRA~1\SONERA~1\ANTI-S~1\fsaw.exe
    C:\Program Files\Sonera Tietoturva\FSGUI\fsguidll.exe
    C:\Documents and Settings\Marko\Omat tiedostot\HiJackThis_v2.0.0.0.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
    O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
    O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
    O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Sonera Tietoturva\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Sonera Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\Sonera Tietoturva\FSGUI\FSSW.EXE" /reboot
    O4 - HKLM\..\Run: [News Service] "C:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe"
    O4 - HKLM\..\Run: [services.exe] C:\WINDOWS\Fonts\services.exe
    O4 - HKLM\..\Run: [Styler] C:\Program Files\Styler\Styler.exe
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
    O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
    O4 - HKLM\..\Run: [Blaero Start Orb] C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe
    O4 - HKLM\..\Run: [VisualTooltip] C:\Program Files\VisualTooltip\VisualToolTip.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [thoosje's sidebar] C:\Program Files\Thoosje Vista Sidebar v1.7.8\thoosje's sidebar.exe
    O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
    O4 - Global Startup: Sonera Tietoturva.lnk = C:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
    O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\Sonera Tietoturva\Anti-Spyware\blockpopups.htm
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
    O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
    O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
    O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
    O8 - Extra context menu item: Muutavalikkoa - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
    O8 - Extra context menu item: RF Työkalupalkki - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
    O8 - Extra context menu item: Tallenna lomakkeet - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
    O8 - Extra context menu item: Täytä lomakkeet - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
    O8 - Extra context menu item: V&ie Microsoft Exceliin - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
    O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
    O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Sonera Tietoturva (BackWeb Plug-in - 4436233) - Sonera Tietoturva - C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
    O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
    O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
    O23 - Service: Tapahtumaloki (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - Unknown owner - C:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
    O23 - Service: fsbwsys - Unknown owner - C:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
    O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: CD-levyjen kirjoittamisen IMAPI COM -palvelu (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
    O23 - Service: NetMeeting etätyöpöydän jakaminen (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Plug and Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
    O23 - Service: Etätyöpöydän ohjeen istunnonhallinta (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
    O23 - Service: Älykortti (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
    O23 - Service: Resurssilokit ja -hälytykset (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
    O23 - Service: Aseman tilannevedos (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
    O23 - Service: WMI resurssisovitin (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe

    --
    End of file - 11661 bytes
     
    make1972, Apr 2, 2007
    #1
  2. Auttaja

    Auttaja Guest

    http://koti.mbnet.fi/pattaya1/HijackThis.exe

    Lataa tuolta viimeisin vakaa versio ja laita sen loki

    *********

    Nettisivu http://www.trendmicro.com/download/dcs.asp
    Ohjeet Enkuksi Täällä http://www.trendmicro.com/ftp/products/tsc/readme.txt

    V. How to Use

    1. Tee oma hakemisto minne asennat (purat) ladatut tiedostot.

    2. Lataa sysclean http://www.trendmicro.com/ftp/products/tsc/sysclean.com TÄÄLTÄ tekemääsi kansioon.

    3. Lataa päivitykset http://www.trendmicro.com/download/pattern.asp TÄÄLTÄ tekemääsi kansioon.

    4. Pura sysclean ja päivitykset samaan kansioon.

    5. Irrota nettipiuha

    6. Sammuta antivirusohjelmasi ja palomuurisi

    7. Tuplaklikkaa SYSCLEAN.COM tiedostoa.

    8. Kun sysclean on valmis, Käynnistä palomuuri ja antiviruksesi ja scannaa koko koneesi antivirusohjelmallasi.

    9. Kun kaikki noi toimenpiteet on tehty, niin yhdistä koneesi nettiin ja lähetä SYSCLEAN.LOG ja pyydetyt lokit

    HUOM. Työkalu tekee lokin SYSCLEAN.LOG samaan kansioon missä scanneri on.
     
    Auttaja, Apr 2, 2007
    #2
  3. make1972

    make1972 Member

    Joined:
    Dec 16, 2006
    Messages:
    82
    Likes Received:
    0
    Trophy Points:
    16
    tein niinkuin neuvoit tuossa,ajoin spybotin,f-securen,AVG anti spywaren sekä super anti spyware pro:n mutta mikään ei löytänyt mitään ja kun laitoin netti piuhan kiinni ja avasin netin,göögle aukes normaalisti ja siinä vaiheessa kun painoin afterdawin linkkiä niin aukesi samalla se erreo safe se sininen sivu,klikkasin sen saman tein pois,ne logit.jos niistä selviäis jotain.

    Logfile of HijackThis v1.99.1
    Scan saved at 6:37:36, on 3.4.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16414)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
    C:\Program Files\Styler\Styler.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\LClock\LClock.exe
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    C:\Program Files\VisualTooltip\VisualToolTip.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Thoosje Vista Sidebar v1.7.8\thoosje's sidebar.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
    C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
    C:\DOCUME~1\Marko\LOCALS~1\Temp\{2F31A5F9-C925-4E53-9AD3-C71C3AE15C8F}\Blaero Start Orb.exe
    C:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
    C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
    C:\Program Files\Sonera Tietoturva\Anti-Virus\FSGK32.EXE
    C:\PROGRA~1\INCRED~1\bin\IMApp.exe
    C:\Program Files\Sonera Tietoturva\Anti-Virus\fssm32.exe
    C:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Sonera Tietoturva\Common\FSM32.EXE
    C:\Program Files\Sonera Tietoturva\Common\FSMB32.EXE
    C:\Program Files\Sonera Tietoturva\Common\FCH32.EXE
    C:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
    C:\Program Files\Sonera Tietoturva\Common\FAMEH32.EXE
    C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
    C:\Program Files\Sonera Tietoturva\Anti-Virus\fsrw.exe
    C:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
    C:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
    C:\Program Files\Sonera Tietoturva\Anti-Virus\fsav32.exe
    C:\Program Files\Sonera Tietoturva\FSGUI\fsguidll.exe
    C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\HJT\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
    O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
    O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
    O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Sonera Tietoturva\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Sonera Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\Sonera Tietoturva\FSGUI\FSSW.EXE" /reboot
    O4 - HKLM\..\Run: [News Service] "C:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe"
    O4 - HKLM\..\Run: [services.exe] C:\WINDOWS\Fonts\services.exe
    O4 - HKLM\..\Run: [Styler] C:\Program Files\Styler\Styler.exe
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
    O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
    O4 - HKLM\..\Run: [Blaero Start Orb] C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe
    O4 - HKLM\..\Run: [VisualTooltip] C:\Program Files\VisualTooltip\VisualToolTip.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [thoosje's sidebar] C:\Program Files\Thoosje Vista Sidebar v1.7.8\thoosje's sidebar.exe
    O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
    O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
    O4 - Global Startup: Sonera Tietoturva.lnk = C:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
    O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\Sonera Tietoturva\Anti-Spyware\blockpopups.htm
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
    O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
    O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
    O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
    O8 - Extra context menu item: Muutavalikkoa - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
    O8 - Extra context menu item: RF Työkalupalkki - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
    O8 - Extra context menu item: Tallenna lomakkeet - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
    O8 - Extra context menu item: Täytä lomakkeet - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
    O8 - Extra context menu item: V&ie Microsoft Exceliin - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Sonera Tietoturva (BackWeb Plug-in - 4436233) - Sonera Tietoturva - C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
    O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - C:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
    O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
    O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

     
    make1972, Apr 2, 2007
    #3
  4. make1972

    make1972 Member

    Joined:
    Dec 16, 2006
    Messages:
    82
    Likes Received:
    0
    Trophy Points:
    16


    /--------------------------------------------------------------\
    | Trend Micro System Cleaner |
    | Copyright 2006, Trend Micro, Inc. |
    | http://www.antivirus.com |
    \--------------------------------------------------------------/


    2007-04-02, 20:17:56, Auto-clean mode specified.
    2007-04-02, 20:17:56, Running scanner "C:\Uusi kansio (3)\TSC.BIN"...
    2007-04-02, 20:18:19, Scanner "C:\Uusi kansio (3)\TSC.BIN" has finished running.
    2007-04-02, 20:18:19, TSC Log:

    Damage Cleanup Engine (DCE) 5.0(Build 1107)
    Windows XP(Build 2600: Service Pack 2)

    Start time : ma huhti 02 2007 20:17:57

    Load Damage Cleanup Template (DCT) "C:\Uusi kansio (3)\tsc.ptn" (version 850) [success]

    Complete time : ma huhti 02 2007 20:18:19
    Execute pattern count(3073), Virus found count(0), Virus clean count(0), Clean failed count(0)

    2007-04-02, 20:18:33, An error was detected on "C:\System Volume Information\*.*": Käyttö estetty.
    2007-04-02, 20:18:52, An error was detected on "D:\SOVELLUKSIA 2\Namo WebEditor 2006 suite + Namo FreeMotion 2006\Namo FreeMotion 2006???????\*.*": Tiedostonimen, hakemistonimen tai levynimen syntaksi ei kelpaa.
    2007-04-02, 20:18:52, An error was detected on "D:\SOVELLUKSIA 2\Namo WebEditor 2006 suite + Namo FreeMotion 2006\Namo WebEditor 2006 Suite???????\*.*": Tiedostonimen, hakemistonimen tai levynimen syntaksi ei kelpaa.
    2007-04-02, 20:18:58, An error was detected on "D:\System Volume Information\*.*": Käyttö estetty.
    2007-04-02, 20:19:18, An error was detected on "F:\System Volume Information\*.*": Käyttö estetty.
    2007-04-02, 20:19:21, Files Detected:
    Copyright (c) 1990 - 2004 Trend Micro Inc.
    Report Date : 4/2/2007 20:19:21
    VSAPI Engine Version : 8.000-1001
    VSCANTM Version : 1.1-1001
    Command Line: C:\Uusi kansio (3)\VSCANTM.BIN /NBPM /S /CLEANALL /DCEGENCLEAN /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 C:\*.*

    2007-04-02, 20:19:21, Files Clean:
    Copyright (c) 1990 - 2004 Trend Micro Inc.
    Report Date : 4/2/2007 20:19:21
    VSAPI Engine Version : 8.000-1001
    VSCANTM Version : 1.1-1001
    Command Line: C:\Uusi kansio (3)\VSCANTM.BIN /NBPM /S /CLEANALL /DCEGENCLEAN /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 C:\*.*

    2007-04-02, 20:19:21, Clean Fail:
    Copyright (c) 1990 - 2004 Trend Micro Inc.
    Report Date : 4/2/2007 20:19:21
    VSAPI Engine Version : 8.000-1001
    VSCANTM Version : 1.1-1001
    Command Line: C:\Uusi kansio (3)\VSCANTM.BIN /NBPM /S /CLEANALL /DCEGENCLEAN /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 C:\*.*

    2007-04-02, 20:19:21, Scanner "C:\Uusi kansio (3)\VSCANTM.BIN" has finished running.
    2007-04-02, 20:19:21, Files Detected:
    Copyright (c) 1990 - 2004 Trend Micro Inc.
    Report Date : 4/2/2007 20:19:21
    VSAPI Engine Version : 8.000-1001
    VSCANTM Version : 1.1-1001
    Command Line: C:\Uusi kansio (3)\VSCANTM.BIN /NBPM /S /CLEANALL /DCEGENCLEAN /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 D:\*.*

    2007-04-02, 20:19:21, Files Clean:
    Copyright (c) 1990 - 2004 Trend Micro Inc.
    Report Date : 4/2/2007 20:19:21
    VSAPI Engine Version : 8.000-1001
    VSCANTM Version : 1.1-1001
    Command Line: C:\Uusi kansio (3)\VSCANTM.BIN /NBPM /S /CLEANALL /DCEGENCLEAN /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 D:\*.*

    2007-04-02, 20:19:21, Clean Fail:
    Copyright (c) 1990 - 2004 Trend Micro Inc.
    Report Date : 4/2/2007 20:19:21
    VSAPI Engine Version : 8.000-1001
    VSCANTM Version : 1.1-1001
    Command Line: C:\Uusi kansio (3)\VSCANTM.BIN /NBPM /S /CLEANALL /DCEGENCLEAN /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 D:\*.*

    2007-04-02, 20:19:21, Scanner "C:\Uusi kansio (3)\VSCANTM.BIN" has finished running.
    2007-04-02, 20:19:21, Files Detected:
    Copyright (c) 1990 - 2004 Trend Micro Inc.
    Report Date : 4/2/2007 20:19:21
    VSAPI Engine Version : 8.000-1001
    VSCANTM Version : 1.1-1001
    Command Line: C:\Uusi kansio (3)\VSCANTM.BIN /NBPM /S /CLEANALL /DCEGENCLEAN /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 F:\*.*

    2007-04-02, 20:19:21, Files Clean:
    Copyright (c) 1990 - 2004 Trend Micro Inc.
    Report Date : 4/2/2007 20:19:21
    VSAPI Engine Version : 8.000-1001
    VSCANTM Version : 1.1-1001
    Command Line: C:\Uusi kansio (3)\VSCANTM.BIN /NBPM /S /CLEANALL /DCEGENCLEAN /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 F:\*.*

    2007-04-02, 20:19:21, Clean Fail:
    Copyright (c) 1990 - 2004 Trend Micro Inc.
    Report Date : 4/2/2007 20:19:21
    VSAPI Engine Version : 8.000-1001
    VSCANTM Version : 1.1-1001
    Command Line: C:\Uusi kansio (3)\VSCANTM.BIN /NBPM /S /CLEANALL /DCEGENCLEAN /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 F:\*.*

    2007-04-02, 20:19:21, Scanner "C:\Uusi kansio (3)\VSCANTM.BIN" has finished running.


    /--------------------------------------------------------------\
    | Trend Micro System Cleaner |
    | Copyright 2006, Trend Micro, Inc. |
    | http://www.antivirus.com |
    \--------------------------------------------------------------/


    2007-04-02, 20:25:09, Auto-clean mode specified.
    2007-04-02, 20:25:09, Running scanner "C:\Uusi kansio (3)\TSC.BIN"...
    2007-04-02, 20:25:17, Scanner "C:\Uusi kansio (3)\TSC.BIN" has finished running.
    2007-04-02, 20:25:17, TSC Log:

    Damage Cleanup Engine (DCE) 5.0(Build 1107)
    Windows XP(Build 2600: Service Pack 2)

    Start time : ma huhti 02 2007 20:25:10

    Load Damage Cleanup Template (DCT) "C:\Uusi kansio (3)\tsc.ptn" (version 850) [success]

    Complete time : ma huhti 02 2007 20:25:17
    Execute pattern count(3073), Virus found count(0), Virus clean count(0), Clean failed count(0)

    2007-04-02, 20:25:29, An error was detected on "C:\System Volume Information\*.*": Käyttö estetty.
    2007-04-02, 20:25:35, An error was detected on "D:\SOVELLUKSIA 2\Namo WebEditor 2006 suite + Namo FreeMotion 2006\Namo FreeMotion 2006???????\*.*": Tiedostonimen, hakemistonimen tai levynimen syntaksi ei kelpaa.
    2007-04-02, 20:25:35, An error was detected on "D:\SOVELLUKSIA 2\Namo WebEditor 2006 suite + Namo FreeMotion 2006\Namo WebEditor 2006 Suite???????\*.*": Tiedostonimen, hakemistonimen tai levynimen syntaksi ei kelpaa.
    2007-04-02, 20:25:36, An error was detected on "D:\System Volume Information\*.*": Käyttö estetty.
    2007-04-02, 20:25:43, An error was detected on "F:\System Volume Information\*.*": Käyttö estetty.
    2007-04-02, 20:41:43, Files Detected:
    Copyright (c) 1990 - 2004 Trend Micro Inc.
    Report Date : 4/2/2007 20:25:44
    VSAPI Engine Version : 8.000-1001
    VSCANTM Version : 1.1-1001
    Virus Pattern Version : 385 (172515 Patterns) (2007/04/02) (438500)
    Command Line: C:\Uusi kansio (3)\VSCANTM.BIN /NBPM /S /CLEANALL /DCEGENCLEAN /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 C:\*.* /P=C:\Uusi kansio (3)

    61490 files have been read.
    61490 files have been checked.
    53857 files have been scanned.
    87592 files have been scanned. (including files in archived)
    0 files containing viruses.
    Found 0 viruses totally.
    Maybe 0 viruses totally.
    Stop At : 4/2/2007 20:41:43
    ---------*---------*---------*---------*---------*---------*---------*---------*
    2007-04-02, 20:41:43, Files Clean:
    Copyright (c) 1990 - 2004 Trend Micro Inc.
    Report Date : 4/2/2007 20:25:44
    VSAPI Engine Version : 8.000-1001
    VSCANTM Version : 1.1-1001
    Virus Pattern Version : 385 (172515 Patterns) (2007/04/02) (438500)
    Command Line: C:\Uusi kansio (3)\VSCANTM.BIN /NBPM /S /CLEANALL /DCEGENCLEAN /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 C:\*.* /P=C:\Uusi kansio (3)

    61490 files have been read.
    61490 files have been checked.
    53857 files have been scanned.
    87592 files have been scanned. (including files in archived)
    0 files containing viruses.
    Found 0 viruses totally.
    Maybe 0 viruses totally.
    Stop At : 4/2/2007 20:41:43 15 minutes 59 seconds (958.78 seconds) has elapsed.

    ---------*---------*---------*---------*---------*---------*---------*---------*
    2007-04-02, 20:41:43, Clean Fail:
    Copyright (c) 1990 - 2004 Trend Micro Inc.
    Report Date : 4/2/2007 20:25:44
    VSAPI Engine Version : 8.000-1001
    VSCANTM Version : 1.1-1001
    Virus Pattern Version : 385 (172515 Patterns) (2007/04/02) (438500)
    Command Line: C:\Uusi kansio (3)\VSCANTM.BIN /NBPM /S /CLEANALL /DCEGENCLEAN /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 C:\*.* /P=C:\Uusi kansio (3)

    61490 files have been read.
    61490 files have been checked.
    53857 files have been scanned.
    87592 files have been scanned. (including files in archived)
    0 files containing viruses.
    Found 0 viruses totally.
    Maybe 0 viruses totally.
    Stop At : 4/2/2007 20:41:43 15 minutes 59 seconds (958.78 seconds) has elapsed.

    ---------*---------*---------*---------*---------*---------*---------*---------*
    2007-04-02, 20:41:43, Scanner "C:\Uusi kansio (3)\VSCANTM.BIN" has finished running.
    2007-04-02, 20:52:33, Files Detected:
    Copyright (c) 1990 - 2004 Trend Micro Inc.
    Report Date : 4/2/2007 20:41:43
    VSAPI Engine Version : 8.000-1001
    VSCANTM Version : 1.1-1001
    Virus Pattern Version : 385 (172515 Patterns) (2007/04/02) (438500)
    Command Line: C:\Uusi kansio (3)\VSCANTM.BIN /NBPM /S /CLEANALL /DCEGENCLEAN /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 D:\*.* /P=C:\Uusi kansio (3)

    44671 files have been read.
    44671 files have been checked.
    40835 files have been scanned.
    61200 files have been scanned. (including files in archived)
    1 files containing viruses.
    Found 3 viruses totally.
    Maybe 0 viruses totally.
    Stop At : 4/2/2007 20:52:33
    ---------*---------*---------*---------*---------*---------*---------*---------*
    2007-04-02, 20:52:33, Files Clean:
    Copyright (c) 1990 - 2004 Trend Micro Inc.
    Report Date : 4/2/2007 20:41:43
    VSAPI Engine Version : 8.000-1001
    VSCANTM Version : 1.1-1001
    Virus Pattern Version : 385 (172515 Patterns) (2007/04/02) (438500)
    Command Line: C:\Uusi kansio (3)\VSCANTM.BIN /NBPM /S /CLEANALL /DCEGENCLEAN /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 D:\*.* /P=C:\Uusi kansio (3)

    Success Clean [ TROJ_Generic]( 1) from D:\SOVELLUKSIA 2\vista-international(all in one)finnish toimii\Windows.Vista.All.Versions.x86.x64.Final.Crack-CLoNY.zip,(Validate.exe)
    44671 files have been read.
    44671 files have been checked.
    40835 files have been scanned.
    61200 files have been scanned. (including files in archived)
    1 files containing viruses.
    Found 3 viruses totally.
    Maybe 0 viruses totally.
    Stop At : 4/2/2007 20:52:33 10 minutes 48 seconds (648.63 seconds) has elapsed.

    ---------*---------*---------*---------*---------*---------*---------*---------*
    2007-04-02, 20:52:33, Clean Fail:
    Copyright (c) 1990 - 2004 Trend Micro Inc.
    Report Date : 4/2/2007 20:41:43
    VSAPI Engine Version : 8.000-1001
    VSCANTM Version : 1.1-1001
    Virus Pattern Version : 385 (172515 Patterns) (2007/04/02) (438500)
    Command Line: C:\Uusi kansio (3)\VSCANTM.BIN /NBPM /S /CLEANALL /DCEGENCLEAN /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 D:\*.* /P=C:\Uusi kansio (3)

    44671 files have been read.
    44671 files have been checked.
    40835 files have been scanned.
    61200 files have been scanned. (including files in archived)
    1 files containing viruses.
    Found 3 viruses totally.
    Maybe 0 viruses totally.
    Stop At : 4/2/2007 20:52:33 10 minutes 48 seconds (648.63 seconds) has elapsed.

    ---------*---------*---------*---------*---------*---------*---------*---------*
    2007-04-02, 20:52:33, Scanner "C:\Uusi kansio (3)\VSCANTM.BIN" has finished running.
    2007-04-02, 21:02:16, Files Detected:
    Copyright (c) 1990 - 2004 Trend Micro Inc.
    Report Date : 4/2/2007 20:52:33
    VSAPI Engine Version : 8.000-1001
    VSCANTM Version : 1.1-1001
    Virus Pattern Version : 385 (172515 Patterns) (2007/04/02) (438500)
    Command Line: C:\Uusi kansio (3)\VSCANTM.BIN /NBPM /S /CLEANALL /DCEGENCLEAN /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 F:\*.* /P=C:\Uusi kansio (3)

    F:\sovelluksia 1\Registry Mechanic 6.0 + Crack\Crack.exe [TROJ_Generic.CON]
    16235 files have been read.
    16235 files have been checked.
    15865 files have been scanned.
    45431 files have been scanned. (including files in archived)
    2 files containing viruses.
    Found 2 viruses totally.
    Maybe 0 viruses totally.
    Stop At : 4/2/2007 21:02:16
    ---------*---------*---------*---------*---------*---------*---------*---------*
    2007-04-02, 21:02:16, Files Clean:
    Copyright (c) 1990 - 2004 Trend Micro Inc.
    Report Date : 4/2/2007 20:52:33
    VSAPI Engine Version : 8.000-1001
    VSCANTM Version : 1.1-1001
    Virus Pattern Version : 385 (172515 Patterns) (2007/04/02) (438500)
    Command Line: C:\Uusi kansio (3)\VSCANTM.BIN /NBPM /S /CLEANALL /DCEGENCLEAN /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 F:\*.* /P=C:\Uusi kansio (3)

    Success Clean [ TROJ_Generic]( 1) from F:\sovelluksia 1\BS.Player.Pro.v2.11.940.Multilingual.Incl.Keymaker-CORE.rar,(CR-BP211.EXE)
    16235 files have been read.
    16235 files have been checked.
    15865 files have been scanned.
    45431 files have been scanned. (including files in archived)
    2 files containing viruses.
    Found 2 viruses totally.
    Maybe 0 viruses totally.
    Stop At : 4/2/2007 21:02:16 9 minutes 41 seconds (580.99 seconds) has elapsed.

    ---------*---------*---------*---------*---------*---------*---------*---------*
    2007-04-02, 21:02:16, Clean Fail:
    Copyright (c) 1990 - 2004 Trend Micro Inc.
    Report Date : 4/2/2007 20:52:33
    VSAPI Engine Version : 8.000-1001
    VSCANTM Version : 1.1-1001
    Virus Pattern Version : 385 (172515 Patterns) (2007/04/02) (438500)
    Command Line: C:\Uusi kansio (3)\VSCANTM.BIN /NBPM /S /CLEANALL /DCEGENCLEAN /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 F:\*.* /P=C:\Uusi kansio (3)

    16235 files have been read.
    16235 files have been checked.
    15865 files have been scanned.
    45431 files have been scanned. (including files in archived)
    2 files containing viruses.
    Found 2 viruses totally.
    Maybe 0 viruses totally.
    Stop At : 4/2/2007 21:02:16 9 minutes 41 seconds (580.99 seconds) has elapsed.

    ---------*---------*---------*---------*---------*---------*---------*---------*
    2007-04-02, 21:02:16, Scanner "C:\Uusi kansio (3)\VSCANTM.BIN" has finished running.
     
    make1972, Apr 2, 2007
    #4
  5. Auttaja

    Auttaja Guest

    Lataa ATF Cleaner
    http://www.atribune.org/ccount/click.php?id=1

    Tupla-klikkaa ATF-Cleaner.exe käynnistääksesi ohjelman. Main:n alla valitse: Select All
    Klikkaa Empty Selected valintaa.
    Jos käytät FireFoxia selaimenasi Klikkaa Firefox yläpuolelta ja valitse: Select All
    Klikkaa Empty Selected valintaa.
    HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy.
    Jos käytät Operaa selaimenasi Klikkaa Opera yläpuolelta ja valitse: Select All
    Klikkaa Empty Selected valintaa taas.
    HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy.
    Klikkaa Exit päävalikosta sulkeaksesi ohjelman.
    Teknistä tukea tulee jos tupla-klikkaat sähköpostiosoitetta joka sijaitsee jokaisen menun alapuolella kyseisessä työkalussa. (Huomatkaa että se tuki on sitten englanniksi)

    Lataa NoLop työpöydällesi yhdestä seuraavista linkeistä...
    http://www.spywareedge.net/nolop/NoLop.exe1
    http://www.spywaretimes.com/Tools/Download/Anti-malwareToolsLinkki
    http://www.thespykiller.co.uk/index.php?action=tpmod;dl=get16

    * Sulje kaikki ohjelmat, koska tämä vaihe vaatii uudelleenkäynnistyksen
    * Tuplaklikkaa NoLop.exe ajaaksesi sen
    * Klikkaa nappulaa "Search and Destroy"
    <<Tietokoneesi skannataan saastuneiden tiedostojen osalta>>
    * Kun skannaus on valmis, sinua pyydetään käynnistämään kone uudestaan, jos infektio löytyy. Klikkaa OK
    * Klikkaa "REBOOT"-painiketta.
    * NoLopin pitäisi antaa viesti. Jos ei, tuplaklikkaa ohjelmaa ja se valmistuu. Lähetä C:\NoLop.log-tiedoston sisältö uuden HijackThis-lokin kera.

    -- Jos saat seuraavan virheen, "mscomctl.ocx or one of its dependencies are not correctly registered," lataa mscomctl.ocx http://www.boletrice.com/downloads/mscomctl.ocx ja tallenna se system32-hakemistoosi (yleensä c:\Windows\system32). Tämän jälkeen aja ohjelma uudestaan. --

    *********

    O4 - HKLM\..\Run: [services.exe] C:\WINDOWS\Fonts\services.exe
    fixaa tuo rivi, poista tää tiedosto vikasietotilassa

    C:\WINDOWS\Fonts\services.exe

    Laita uusi hijackthis logi
     
    Last edited by a moderator: Apr 3, 2007
    Auttaja, Apr 3, 2007
    #5
  6. make1972

    make1972 Member

    Joined:
    Dec 16, 2006
    Messages:
    82
    Likes Received:
    0
    Trophy Points:
    16
    NoLop ei löytänyt mitään,alkaa olemaan aika epätoivonen tilanne,tässä uusi hijack logi..poistin C:\WINDOWS\Fonts\services.exe mutta se ei vaikuttanut asiaan..

    Logfile of HijackThis v1.99.1
    Scan saved at 18:44:41, on 3.4.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16414)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
    C:\Program Files\Styler\Styler.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\LClock\LClock.exe
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    C:\Program Files\VisualTooltip\VisualToolTip.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Thoosje Vista Sidebar v1.7.8\thoosje's sidebar.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
    C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
    C:\DOCUME~1\Marko\LOCALS~1\Temp\{2F31A5F9-C925-4E53-9AD3-C71C3AE15C8F}\Blaero Start Orb.exe
    C:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
    C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
    C:\Program Files\Sonera Tietoturva\Anti-Virus\FSGK32.EXE
    C:\PROGRA~1\INCRED~1\bin\IMApp.exe
    C:\Program Files\Sonera Tietoturva\Anti-Virus\fssm32.exe
    C:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Sonera Tietoturva\Common\FSM32.EXE
    C:\Program Files\Sonera Tietoturva\Common\FSMB32.EXE
    C:\Program Files\Sonera Tietoturva\Common\FCH32.EXE
    C:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
    C:\Program Files\Sonera Tietoturva\Common\FAMEH32.EXE
    C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
    C:\Program Files\Sonera Tietoturva\Anti-Virus\fsrw.exe
    C:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
    C:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
    C:\Program Files\Sonera Tietoturva\Anti-Virus\fsav32.exe
    C:\Program Files\Sonera Tietoturva\FSGUI\fsguidll.exe
    C:\Program Files\uTorrent\utorrent.exe
    C:\Program Files\Webteh\BSplayerPro\bsplayer.exe
    C:\HJT\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
    O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
    O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
    O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Sonera Tietoturva\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Sonera Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\Sonera Tietoturva\FSGUI\FSSW.EXE" /reboot
    O4 - HKLM\..\Run: [News Service] "C:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe"
    O4 - HKLM\..\Run: [Styler] C:\Program Files\Styler\Styler.exe
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
    O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
    O4 - HKLM\..\Run: [Blaero Start Orb] C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe
    O4 - HKLM\..\Run: [VisualTooltip] C:\Program Files\VisualTooltip\VisualToolTip.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [thoosje's sidebar] C:\Program Files\Thoosje Vista Sidebar v1.7.8\thoosje's sidebar.exe
    O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
    O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
    O4 - Global Startup: Sonera Tietoturva.lnk = C:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
    O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\Sonera Tietoturva\Anti-Spyware\blockpopups.htm
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
    O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
    O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
    O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
    O8 - Extra context menu item: Muutavalikkoa - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
    O8 - Extra context menu item: RF Työkalupalkki - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
    O8 - Extra context menu item: Tallenna lomakkeet - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
    O8 - Extra context menu item: Täytä lomakkeet - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
    O8 - Extra context menu item: V&ie Microsoft Exceliin - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Lukutulkki - {B66541E2-E167-4084-8E77-68CA13C4B3B8} - C:\Program Files\NetClickup\Lukutulkki\Lutu.dll
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Sonera Tietoturva (BackWeb Plug-in - 4436233) - Sonera Tietoturva - C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
    O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - C:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
    O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
    O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

     
    make1972, Apr 3, 2007
    #6
  7. Auttaja

    Auttaja Guest

    Koitetaanpa jotain muuta:

    Lataa ja tallenna Blacklight työpöydällesi;

    Tupla-klikkaa blbeta.exe, http://www.f-secure.com/blacklight/try_blacklight.html hyväksy sopimus, klikkaa > Scan, sitten > Next

    Näet listan kaikesta mitä löytyi. Työpöydällesi myös ilmestyy loki jonka nimi on fsbl.xxxxxxx.log (xxxxxxx;n tilalla on luultavimmin numeroita).

    Kopioi ja liitä tämä loki seuraavaan vastaukseesi. Älä valitse "Rename" optiota vielä! Haluamme nähdä login ensin, koska hyviä tiedostoja saattaa olla mukana, kuten "wbemtest.exe".

    Sinulla on takaovi tietokoneessa nimeltään CIADOOR-F TROJAN, formatointi olisi paras ratkaisu, vaihda salasanat yms.
     
    Auttaja, Apr 4, 2007
    #7

Share This Page