HijackThis -logi, Troijalainen

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by Vanderlay, Sep 25, 2007.

Page 1 of 2
  1. Vanderlay

    Vanderlay Member

    Joined:
    May 29, 2007
    Messages:
    28
    Likes Received:
    0
    Trophy Points:
    11
    Jep, eli troijalainen on koneessa kiusana. Joka kerta windowsin käynnistyksen jälkeen F-Secure ilmoittaa löytäneensä trojan.win32.agent.bck:n ja trojan-downloader.win32.tiny.id:n. Lisäksi Firefoxin käynnistyksen yhteydessä Internet Explorer käynnistää itsensä ja tekee saman hetken kuluttua uudestaan moneen eri ikkunaan ja välilehteen. Kone myös yrittää silloin tällöin päästä systemdoctor.com sivuistolle.

    Olen yrittänyt ongelman poistoa F-Securella, AVG Anti-Spywarella, NoAdwarella, Spybotilla ja VundoFixilla siinä kuitenkaa onnistumatta. Onko teillä ideoita miten saan koneeni puhtaaksi? Kiitoksia jo etukäteen avusta.

    Logi näyttää seuraavanlaiselta:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 22:54:34, on 25.9.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
    C:\PROGRA~1\F-Secure\BackWeb\7681197\PROGRAM\SERVIC~1.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
    C:\Program Files\F-Secure\Common\FSMA32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
    C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\BACKWE~1.EXE
    C:\Program Files\F-Secure\Common\FSMB32.EXE
    C:\WINDOWS\system32\MsPMSPSv.exe
    C:\Program Files\F-Secure\Common\FCH32.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\F-Secure\Common\FSM32.EXE
    C:\Program Files\F-Secure\Common\FAMEH32.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\F-Secure\Common\FNRB32.EXE
    C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    C:\Program Files\F-Secure\Common\FIH32.EXE
    C:\WINDOWS\System32\alg.exe
    C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
    C:\Program Files\F-Secure\FSGUI\fsguiexe.exe
    C:\Program Files\NoAdware5.0\NoAdware5.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\HJT\HijackThis.exe
    C:\WINDOWS\System32\wbem\wmiprvse.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.kyweb.fi
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll (file missing)
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by13fd.bay13.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1108320440904
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: FS BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\PROGRAM\SERVIC~1.EXE
    O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exe
    O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE

    --
    End of file - 6142 bytes
     
    Vanderlay, Sep 25, 2007
    #1
  2. Hujo

    Hujo Guest

    Lataa VundoFix.exe työpöydällesi.

    Tupla-klikkaa VundoFix.exe ajaaksesi sen.
    Klikkaa Scan for Vundo valintaa.
    Kun skannaus on valmis, klikkaa Remove Vundo valintaa.
    Sinulta kysytään haluatko poistaa filut - klikkaa YES.
    Kun olet klikannut yes, työpöytäsi tyhjenee kun se alkaa poistamaan Vundoa.
    Kun se on valmis, fiksi ilmoittaa käynnistäväsi koneesi uudelleen, klikkaa OK.
    Postita C:\vundofix.txt lokin sekä tuoreen HijackThis lokin sisältö.

    Huomaa: Se on mahdollista että VundoFix löysi tiedoston jota se ei pystynyt poistamaan.
    Tässä tilanteessa, VundoFix ajaa itsensä rebootissa, seuraa vain yläpuolelle olevia ohjeita alkaen kohdasta "Klikkaa Scan for Vundo valintaa." kun VundoFix ilmaantuu uudelleenkäynnistyksen yhteydessä.

    ====================

    Escan
    Ohjeet tuolla sivulla.
    http://koti.mbnet.fi/pattaya1/escanmwav.htm
    lataa tuosta
    http://www.spywareinfo.dk/download/mwav.exe
    päivitä tuosta
    http://koti.mbnet.fi/pattaya1/lataus/Mwav.bat
    laita täpit merkkauksien mukaan
    http://koti.mbnet.fi/pattaya1/eScan6.jpg

    scannaa

    jos ala luukkuun tulee jotain niin kopioi se näin:
    Käytä komentoa Ctrl+A.
    Kopioi rivit komennolla Ctrl+C.
    Liitä rivit komennolla Ctrl+V.

    Laita virus log tänne.

    ===================

    Lataa tuolta http://www.ccleaner.com/download/builds.aspx
    CCleaner v2.00.500 - Standard Build, ÄLÄ aseenna Yahoo toolbaria!

    laita asetukset näin:
    Valinnat --> Lisäasetukset --> Ota ruksi pois kohdasta Poista vain yli 48 tuntia vanhat tilapäistiedostot.

    aja Puhdistaja > tutki nappi > aja ccleaner nappi oikea alakulma
    aja Virheet > etsi rekisteri virheitä nappi > Korjaa rekisteri virheet. nappi
     
    Hujo, Sep 27, 2007
    #2
  3. Vanderlay

    Vanderlay Member

    Joined:
    May 29, 2007
    Messages:
    28
    Likes Received:
    0
    Trophy Points:
    11
    Eli nyt on vundofix ajettu. Tässä logit:

    VundoFix V6.5.8

    Checking Java version...

    Java version is 1.5.0.2
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.5
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.6
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.8
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.9
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.10

    Java version is 1.5.0.11

    Scan started at 16:07:07 14.9.2007

    Listing files found while scanning....

    C:\windows\system32\alcgqurv.dll
    C:\windows\system32\austsvog.ini
    C:\WINDOWS\system32\cbpujvah.dll
    C:\windows\system32\cmfpbmtn.ini
    C:\windows\system32\dtggluae.ini
    C:\windows\system32\eaulggtd.dll
    C:\windows\system32\govstsua.dll
    C:\windows\system32\maaqfvvu.dll
    C:\WINDOWS\system32\mrxqfkrn.dll
    C:\windows\system32\ntmbpfmc.dll
    C:\windows\system32\uvvfqaam.ini
    C:\windows\system32\vruqgcla.ini

    Beginning removal...

    Attempting to delete C:\windows\system32\alcgqurv.dll
    C:\windows\system32\alcgqurv.dll Has been deleted!

    Attempting to delete C:\windows\system32\austsvog.ini
    C:\windows\system32\austsvog.ini Has been deleted!

    Attempting to delete C:\WINDOWS\system32\cbpujvah.dll
    C:\WINDOWS\system32\cbpujvah.dll Has been deleted!

    Attempting to delete C:\windows\system32\cmfpbmtn.ini
    C:\windows\system32\cmfpbmtn.ini Has been deleted!

    Attempting to delete C:\windows\system32\dtggluae.ini
    C:\windows\system32\dtggluae.ini Has been deleted!

    Attempting to delete C:\windows\system32\eaulggtd.dll
    C:\windows\system32\eaulggtd.dll Has been deleted!

    Attempting to delete C:\windows\system32\govstsua.dll
    C:\windows\system32\govstsua.dll Could not be deleted.

    Attempting to delete C:\windows\system32\maaqfvvu.dll
    C:\windows\system32\maaqfvvu.dll Has been deleted!

    Attempting to delete C:\windows\system32\ntmbpfmc.dll
    C:\windows\system32\ntmbpfmc.dll Has been deleted!

    Attempting to delete C:\windows\system32\uvvfqaam.ini
    C:\windows\system32\uvvfqaam.ini Has been deleted!

    Attempting to delete C:\windows\system32\vruqgcla.ini
    C:\windows\system32\vruqgcla.ini Has been deleted!

    Performing Repairs to the registry.
    Done!

    Beginning removal...

    Attempting to delete C:\windows\system32\govstsua.dll
    C:\windows\system32\govstsua.dll Has been deleted!

    Performing Repairs to the registry.
    Done!

    VundoFix V6.5.8

    Checking Java version...

    Java version is 1.5.0.2
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.5
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.6
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.8
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.9
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.10

    Java version is 1.5.0.11

    Scan started at 22:14:56 14.9.2007

    Listing files found while scanning....

    C:\WINDOWS\system32\mrxqfkrn.dll
    C:\WINDOWS\system32\nrkfqxrm.ini
    C:\windows\system32\nwynyjau.ini
    C:\windows\system32\qhrqduxq.ini
    C:\windows\system32\qxudqrhq.dll
    C:\WINDOWS\system32\trgtollm.dll
    C:\windows\system32\uajynywn.dll

    Beginning removal...

    Attempting to delete C:\WINDOWS\system32\nrkfqxrm.ini
    C:\WINDOWS\system32\nrkfqxrm.ini Has been deleted!

    Attempting to delete C:\windows\system32\nwynyjau.ini
    C:\windows\system32\nwynyjau.ini Has been deleted!

    Attempting to delete C:\windows\system32\qhrqduxq.ini
    C:\windows\system32\qhrqduxq.ini Has been deleted!

    Attempting to delete C:\windows\system32\qxudqrhq.dll
    C:\windows\system32\qxudqrhq.dll Could not be deleted.

    Attempting to delete C:\WINDOWS\system32\trgtollm.dll
    C:\WINDOWS\system32\trgtollm.dll Has been deleted!

    Attempting to delete C:\windows\system32\uajynywn.dll
    C:\windows\system32\uajynywn.dll Has been deleted!

    Performing Repairs to the registry.
    Done!

    Beginning removal...

    Attempting to delete C:\windows\system32\qxudqrhq.dll
    C:\windows\system32\qxudqrhq.dll Has been deleted!

    Performing Repairs to the registry.
    Done!

    VundoFix V6.5.8

    Checking Java version...

    Java version is 1.5.0.2
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.5
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.6
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.8
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.9
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.10

    Java version is 1.5.0.11

    Scan started at 10:01:53 17.9.2007

    Listing files found while scanning....

    C:\windows\system32\aujvhung.dll
    C:\windows\system32\cgbxmabm.ini
    C:\windows\system32\fjuxdwcp.ini
    C:\windows\system32\gnuhvjua.ini
    C:\windows\system32\mbamxbgc.dll
    C:\WINDOWS\system32\mrxqfkrn.dll
    C:\windows\system32\pcwdxujf.dll
    C:\WINDOWS\system32\rcnpmdjx.dll

    Beginning removal...

    Attempting to delete C:\windows\system32\aujvhung.dll
    C:\windows\system32\aujvhung.dll Has been deleted!

    Attempting to delete C:\windows\system32\cgbxmabm.ini
    C:\windows\system32\cgbxmabm.ini Has been deleted!

    Attempting to delete C:\windows\system32\fjuxdwcp.ini
    C:\windows\system32\fjuxdwcp.ini Has been deleted!

    Attempting to delete C:\windows\system32\gnuhvjua.ini
    C:\windows\system32\gnuhvjua.ini Has been deleted!

    Attempting to delete C:\windows\system32\mbamxbgc.dll
    C:\windows\system32\mbamxbgc.dll Could not be deleted.

    Attempting to delete C:\windows\system32\pcwdxujf.dll
    C:\windows\system32\pcwdxujf.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\rcnpmdjx.dll
    C:\WINDOWS\system32\rcnpmdjx.dll Has been deleted!

    Performing Repairs to the registry.
    Done!

    Beginning removal...

    Attempting to delete C:\windows\system32\mbamxbgc.dll
    C:\windows\system32\mbamxbgc.dll Has been deleted!

    Performing Repairs to the registry.
    Done!

    VundoFix V6.5.8

    Checking Java version...

    Java version is 1.5.0.2
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.5
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.6
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.8
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.9
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.10

    Java version is 1.5.0.11

    Scan started at 22:04:49 25.9.2007

    Listing files found while scanning....

    C:\windows\system32\bnbthtuj.dll
    C:\windows\system32\evktfain.ini
    C:\windows\system32\focruylq.ini
    C:\windows\system32\fyebeqss.ini
    C:\windows\system32\gmudatin.ini
    C:\windows\system32\ikqvwilv.dll
    C:\windows\system32\juthtbnb.ini
    C:\windows\system32\lkugkjrn.ini
    C:\windows\system32\mmikewdu.ini
    C:\WINDOWS\system32\mrxqfkrn.dll
    C:\windows\system32\niaftkve.dll
    C:\windows\system32\nitadumg.dll
    C:\windows\system32\nrjkgukl.dll
    C:\windows\system32\qlyurcof.dll
    C:\windows\system32\qwaoxcox.ini
    C:\WINDOWS\system32\rsganofw.dll
    C:\windows\system32\ssqebeyf.dll
    C:\windows\system32\udwekimm.dll
    C:\windows\system32\vbbdtesy.dll
    C:\windows\system32\vliwvqki.ini
    C:\windows\system32\xocxoawq.dll
    C:\windows\system32\ysetdbbv.ini

    Beginning removal...

    Attempting to delete C:\windows\system32\bnbthtuj.dll
    C:\windows\system32\bnbthtuj.dll Has been deleted!

    Attempting to delete C:\windows\system32\evktfain.ini
    C:\windows\system32\evktfain.ini Has been deleted!

    Attempting to delete C:\windows\system32\focruylq.ini
    C:\windows\system32\focruylq.ini Has been deleted!

    Attempting to delete C:\windows\system32\fyebeqss.ini
    C:\windows\system32\fyebeqss.ini Has been deleted!

    Attempting to delete C:\windows\system32\gmudatin.ini
    C:\windows\system32\gmudatin.ini Has been deleted!

    Attempting to delete C:\windows\system32\ikqvwilv.dll
    C:\windows\system32\ikqvwilv.dll Has been deleted!

    Attempting to delete C:\windows\system32\juthtbnb.ini
    C:\windows\system32\juthtbnb.ini Has been deleted!

    Attempting to delete C:\windows\system32\lkugkjrn.ini
    C:\windows\system32\lkugkjrn.ini Has been deleted!

    Attempting to delete C:\windows\system32\mmikewdu.ini
    C:\windows\system32\mmikewdu.ini Has been deleted!

    Attempting to delete C:\windows\system32\niaftkve.dll
    C:\windows\system32\niaftkve.dll Has been deleted!

    Attempting to delete C:\windows\system32\nitadumg.dll
    C:\windows\system32\nitadumg.dll Has been deleted!

    Attempting to delete C:\windows\system32\nrjkgukl.dll
    C:\windows\system32\nrjkgukl.dll Has been deleted!

    Attempting to delete C:\windows\system32\qlyurcof.dll
    C:\windows\system32\qlyurcof.dll Has been deleted!

    Attempting to delete C:\windows\system32\qwaoxcox.ini
    C:\windows\system32\qwaoxcox.ini Has been deleted!

    Attempting to delete C:\WINDOWS\system32\rsganofw.dll
    C:\WINDOWS\system32\rsganofw.dll Has been deleted!

    Attempting to delete C:\windows\system32\ssqebeyf.dll
    C:\windows\system32\ssqebeyf.dll Has been deleted!

    Attempting to delete C:\windows\system32\udwekimm.dll
    C:\windows\system32\udwekimm.dll Has been deleted!

    Attempting to delete C:\windows\system32\vbbdtesy.dll
    C:\windows\system32\vbbdtesy.dll Has been deleted!

    Attempting to delete C:\windows\system32\vliwvqki.ini
    C:\windows\system32\vliwvqki.ini Has been deleted!

    Attempting to delete C:\windows\system32\xocxoawq.dll
    C:\windows\system32\xocxoawq.dll Has been deleted!

    Attempting to delete C:\windows\system32\ysetdbbv.ini
    C:\windows\system32\ysetdbbv.ini Has been deleted!

    Performing Repairs to the registry.
    Done!

    VundoFix V6.5.8

    Checking Java version...

    Java version is 1.5.0.2
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.5
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.6
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.8
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.9
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.10

    Java version is 1.5.0.11

    Scan started at 23:24:29 27.9.2007

    Listing files found while scanning....


    VundoFix V6.5.8

    Checking Java version...

    Java version is 1.5.0.2
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.5
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.6
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.8
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.9
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.10

    Java version is 1.5.0.11

    Scan started at 12:48:02 28.9.2007

    Listing files found while scanning....

    C:\WINDOWS\system32\koaptktd.dll

    Beginning removal...

    Attempting to delete C:\WINDOWS\system32\koaptktd.dll
    C:\WINDOWS\system32\koaptktd.dll Has been deleted!

    Performing Repairs to the registry.
    Done!

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 13:10:11, on 28.9.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
    C:\PROGRA~1\F-Secure\BackWeb\7681197\PROGRAM\SERVIC~1.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure\Common\FSMA32.EXE
    C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
    C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\BACKWE~1.EXE
    C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
    C:\Program Files\F-Secure\Common\FSMB32.EXE
    C:\Program Files\F-Secure\Common\FCH32.EXE
    C:\WINDOWS\system32\MsPMSPSv.exe
    C:\Program Files\F-Secure\Common\FAMEH32.EXE
    C:\Program Files\F-Secure\Common\FNRB32.EXE
    C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    C:\Program Files\F-Secure\Common\FIH32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\F-Secure\Common\FSM32.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\F-Secure\FSGUI\fsguiexe.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\HJT\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.kyweb.fi
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll (file missing)
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [SearchIndexer] rundll32.exe "C:\WINDOWS\system32\lcafnnva.dll",sitypnow
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by13fd.bay13.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1108320440904
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: FS BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\PROGRAM\SERVIC~1.EXE
    O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exe
    O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE

    --
    End of file - 5992 bytes

    Nyt jatkan sitten Escanilla.
     
    Vanderlay, Sep 28, 2007
    #3
  4. Hujo

    Hujo Guest

    Uudelleen nimeäminen

    1. Klikkaa hiiren oikealla painikkeella HijackThis ikonia.

    [​IMG]
    2. Valitse Uudelleennineä/ Rename.
    [​IMG]
    3. Kirjoita scanner.exe
    [​IMG]
     
    Hujo, Sep 28, 2007
    #4
  5. Vanderlay

    Vanderlay Member

    Joined:
    May 29, 2007
    Messages:
    28
    Likes Received:
    0
    Trophy Points:
    11
    Escan ajettu, Virus log information –palkki:

    File C:\WINDOWS\system32\URQNKJK.0LL infected by "Trojan.Win32.Agent.bew" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Anssi\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive1213.jar-283f6e2-7985d2c0.zip infected by "Trojan.Java.ClassLoader.ak" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Anssi\Local Settings\Temp\DHEDFWTY.0XE infected by "Trojan.Win32.Agent.bck" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Anssi\Local Settings\Temp\ELNTCUPY.0XE infected by "Trojan-Downloader.Win32.Tiny.id" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Anssi\Local Settings\Temp\EONAEWCS.0XE infected by "Trojan-Downloader.Win32.Tiny.id" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Anssi\Local Settings\Temp\FVDUBKPS.0XE infected by "Trojan.Win32.Agent.bck" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Anssi\Local Settings\Temp\GSXTFWVS.0XE infected by "Trojan-Downloader.Win32.Tiny.id" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Anssi\Local Settings\Temp\KGHNTSJO.0XE infected by "Trojan.Win32.Agent.bck" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Anssi\Local Settings\Temp\LLHQGCSJ.0XE infected by "Trojan.Win32.Agent.bck" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Anssi\Local Settings\Temp\LWSRTOMO.0XE infected by "Trojan.Win32.Agent.bck" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Anssi\Local Settings\Temp\MKAIJJND.0XE infected by "Trojan-Downloader.Win32.Tiny.id" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Anssi\Local Settings\Temp\MLCFUTMX.0XE infected by "Trojan.Win32.Agent.bck" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Anssi\Local Settings\Temp\MLIVYBUC.0XE infected by "Trojan.Win32.Agent.bck" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Anssi\Local Settings\Temp\MUOCBVHG.0XE infected by "Trojan.Win32.Agent.bck" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Anssi\Local Settings\Temp\NOXJTGKY.0XE infected by "Trojan.Win32.Agent.bck" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Anssi\Local Settings\Temp\QDMCBVUT.0XE infected by "Trojan.Win32.Agent.bck" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Anssi\Local Settings\Temp\TBBUCRIN.0XE infected by "Trojan-Downloader.Win32.Tiny.id" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Anssi\Local Settings\Temp\TUNBAXPR.0XE infected by "Trojan-Downloader.Win32.Tiny.id" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Anssi\Local Settings\Temp\UNMXWPVA.0XE infected by "Trojan-Downloader.Win32.Tiny.id" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Anssi\Local Settings\Temp\VKDTYALB.0XE infected by "Trojan.Win32.Agent.bck" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Anssi\Local Settings\Temp\WGDPXHFH.0XE infected by "Trojan.Win32.Agent.bck" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Anssi\Local Settings\Temp\XFCQVQUR.0XE infected by "Trojan.Win32.Agent.bck" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Anssi\Local Settings\Temp\XOLQPRTY.0XE infected by "Trojan.Win32.Agent.bck" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Anssi\Local Settings\Temporary Internet Files\Content.IE5\01NWPHIE\valera[1] infected by "Trojan.Win32.Agent.bck" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Anssi\Local Settings\Temporary Internet Files\Content.IE5\SRTKJ2RL\lkjh[1] infected by "Trojan-Downloader.Win32.Tiny.id" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Terhi\Local Settings\Temp\AYKWYBOU.0XE infected by "Trojan.Win32.Agent.bck" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Terhi\Local Settings\Temp\HAYQLVFL.0XE infected by "Trojan.Win32.Agent.bck" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Terhi\Local Settings\Temp\IALDGMOI.0XE infected by "Trojan.Win32.Agent.bck" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Terhi\Local Settings\Temp\ITPJHCYC.0XE infected by "Trojan.Win32.Agent.bck" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Terhi\Local Settings\Temp\KDSSWURQ.0XE infected by "Trojan.Win32.Agent.bck" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Terhi\Local Settings\Temp\TOAFXFVF.0XE infected by "Trojan.Win32.Agent.bck" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Terhi\Local Settings\Temp\YICRUQYG.0XE infected by "Trojan.Win32.Agent.bck" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Terhi\Local Settings\Temporary Internet Files\Content.IE5\LHVQW9SS\lkjh[1] infected by "Trojan-Downloader.Win32.Tiny.id" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\Terhi\Local Settings\Temporary Internet Files\Content.IE5\WDENCH6J\valera[1] infected by "Trojan.Win32.Agent.bck" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{9D707E83-E35C-44D0-997E-77D06D6B9E99}\RP940\A0178984.0LL infected by "Trojan.Win32.Agent.bew" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{9D707E83-E35C-44D0-997E-77D06D6B9E99}\RP940\A0179045.exe infected by "Trojan.Win32.Agent.bew" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{9D707E83-E35C-44D0-997E-77D06D6B9E99}\RP940\A0179046.exe infected by "Trojan.Win32.Agent.bew" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{9D707E83-E35C-44D0-997E-77D06D6B9E99}\RP955\A0180704.exe infected by "Trojan.Win32.Obfuscated.en" Virus. Action Taken: File Deleted.
     
    Vanderlay, Sep 28, 2007
    #5
  6. Hujo

    Hujo Guest

    scannaa uusi hjt:n loki
     
    Hujo, Sep 28, 2007
    #6
  7. Vanderlay

    Vanderlay Member

    Joined:
    May 29, 2007
    Messages:
    28
    Likes Received:
    0
    Trophy Points:
    11
    Tossa olisi:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 10:23:26, on 29.9.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
    C:\PROGRA~1\F-Secure\BackWeb\7681197\PROGRAM\SERVIC~1.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure\Common\FSMA32.EXE
    C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
    C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\BACKWE~1.EXE
    C:\Program Files\F-Secure\Common\FSMB32.EXE
    C:\WINDOWS\system32\MsPMSPSv.exe
    C:\Program Files\F-Secure\Common\FCH32.EXE
    C:\Program Files\F-Secure\Common\FAMEH32.EXE
    C:\Program Files\F-Secure\Common\FNRB32.EXE
    C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    C:\Program Files\F-Secure\Common\FIH32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\F-Secure\Common\FSM32.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\F-Secure\FSGUI\fsguiexe.exe
    C:\Program Files\BitTorrent\btdownloadgui.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\HJT\scanner.exe.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.kyweb.fi
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: (no name) - {044CD35C-EAE4-453B-A329-0BB76B18DF27} - (no file)
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {10D0BCC4-9F5A-4667-AC77-A9E2D944C630} - (no file)
    O2 - BHO: (no name) - {3BCB9307-EB07-4D71-9DE5-4E1291DFE785} - (no file)
    O2 - BHO: (no name) - {40B9B8D4-1D31-4EAA-960B-F8EFD0426315} - C:\WINDOWS\system32\mllmj.dll
    O2 - BHO: (no name) - {49AE6849-A6F8-4A2E-A80E-98DB0A709B41} - (no file)
    O2 - BHO: (no name) - {52D4008A-BEA5-4B41-B69A-6828F9EBDB3B} - (no file)
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: (no name) - {5C6E0F6A-E98A-4A93-9F90-56C442CEF60B} - (no file)
    O2 - BHO: (no name) - {6955D3C3-E27F-45A0-89B6-EFB63FB55A59} - (no file)
    O2 - BHO: (no name) - {73466F58-3C92-49CF-A346-DEDE1CE77246} - (no file)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
    O2 - BHO: (no name) - {769AA9D3-EDD0-4A7D-9E2F-7FB152A40FF8} - (no file)
    O2 - BHO: (no name) - {8384D7D7-FD2D-4AB5-B152-B717A4958F07} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: (no name) - {9258BD96-30A1-4A6E-9FC2-644374A2DB02} - (no file)
    O2 - BHO: (no name) - {B4CBC733-03E4-4973-84AB-22778DF1018D} - (no file)
    O2 - BHO: (no name) - {CF46BFB3-2ACC-441b-B82B-36B9562C7FF1} - C:\WINDOWS\system32\csxscfmj.dll
    O2 - BHO: (no name) - {DB1222C8-E6CB-4A4A-9B8C-E9A205A03A3E} - (no file)
    O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [SearchIndexer] rundll32.exe "C:\WINDOWS\system32\vxftmjtt.dll",sitypnow
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by13fd.bay13.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1108320440904
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
    O20 - Winlogon Notify: urqnkjk - urqnkjk.dll (file missing)
    O20 - Winlogon Notify: wintuh32 - wintuh32.dll (file missing)
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: FS BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\PROGRAM\SERVIC~1.EXE
    O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exe
    O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE

    --
    End of file - 7786 bytes
     
    Vanderlay, Sep 28, 2007
    #7
  8. Hujo

    Hujo Guest

    scannaa hjt:llä merkkaa paina Fix checked

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
    O2 - BHO: (no name) - {044CD35C-EAE4-453B-A329-0BB76B18DF27} - (no file)
    O2 - BHO: (no name) - {10D0BCC4-9F5A-4667-AC77-A9E2D944C630} - (no file)
    O2 - BHO: (no name) - {3BCB9307-EB07-4D71-9DE5-4E1291DFE785} - (no file)
    O2 - BHO: (no name) - {49AE6849-A6F8-4A2E-A80E-98DB0A709B41} - (no file)
    O2 - BHO: (no name) - {52D4008A-BEA5-4B41-B69A-6828F9EBDB3B} - (no file)
    O2 - BHO: (no name) - {5C6E0F6A-E98A-4A93-9F90-56C442CEF60B} - (no file)
    O2 - BHO: (no name) - {6955D3C3-E27F-45A0-89B6-EFB63FB55A59} - (no file)
    O2 - BHO: (no name) - {73466F58-3C92-49CF-A346-DEDE1CE77246} - (no file)
    O2 - BHO: (no name) - {769AA9D3-EDD0-4A7D-9E2F-7FB152A40FF8} - (no file)
    O2 - BHO: (no name) - {8384D7D7-FD2D-4AB5-B152-B717A4958F07} - (no file)
    O2 - BHO: (no name) - {9258BD96-30A1-4A6E-9FC2-644374A2DB02} - (no file)
    O2 - BHO: (no name) - {B4CBC733-03E4-4973-84AB-22778DF1018D} - (no file)
    O2 - BHO: (no name) - {DB1222C8-E6CB-4A4A-9B8C-E9A205A03A3E} - (no file)
    O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
    O20 - Winlogon Notify: urqnkjk - urqnkjk.dll (file missing)
    O20 - Winlogon Notify: wintuh32 - wintuh32.dll (file missing)

    ============================

    Lataa tuolta http://www.ccleaner.com/download/builds.aspx
    CCleaner v2.00.500 - Standard Build, ÄLÄ aseenna Yahoo toolbaria!

    laita asetukset näin:
    Valinnat --> Lisäasetukset --> Ota ruksi pois kohdasta Poista vain yli 48 tuntia vanhat tilapäistiedostot.

    aja Puhdistaja > tutki nappi > aja ccleaner nappi oikea alakulma
    aja Virheet > etsi rekisteri virheitä nappi > Korjaa rekisteri virheet. nappi


    ============================

    scannaa sitten uusi hjt:n loki
     
    Last edited by a moderator: Sep 29, 2007
    Hujo, Sep 29, 2007
    #8
  9. Vanderlay

    Vanderlay Member

    Joined:
    May 29, 2007
    Messages:
    28
    Likes Received:
    0
    Trophy Points:
    11
    Tein kuten ohjeistit, tässä uusin loki:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:59:46, on 29.9.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
    C:\PROGRA~1\F-Secure\BackWeb\7681197\PROGRAM\SERVIC~1.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure\Common\FSMA32.EXE
    C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
    C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\BACKWE~1.EXE
    C:\Program Files\F-Secure\Common\FSMB32.EXE
    C:\WINDOWS\system32\MsPMSPSv.exe
    C:\Program Files\F-Secure\Common\FCH32.EXE
    C:\Program Files\F-Secure\Common\FAMEH32.EXE
    C:\Program Files\F-Secure\Common\FNRB32.EXE
    C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    C:\Program Files\F-Secure\Common\FIH32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\F-Secure\Common\FSM32.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\F-Secure\FSGUI\fsguiexe.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\HJT\scanner.exe.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.kyweb.fi
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {40B9B8D4-1D31-4EAA-960B-F8EFD0426315} - C:\WINDOWS\system32\mllmj.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: (no name) - {CF46BFB3-2ACC-441b-B82B-36B9562C7FF1} - C:\WINDOWS\system32\csxscfmj.dll
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [SearchIndexer] rundll32.exe "C:\WINDOWS\system32\vxftmjtt.dll",sitypnow
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by13fd.bay13.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1108320440904
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: FS BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\PROGRAM\SERVIC~1.EXE
    O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exe
    O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE

    --
    End of file - 6700 bytes
     
    Vanderlay, Sep 29, 2007
    #9
  10. Hujo

    Hujo Guest

    tehääs sitten tämä noita vanhoja javoja on sulla tuolla lisää poista sovelutuksesa vaikka muille jakaa.

    Javan päivitys ja välimuistin tyhjennys:

    1. Klikkaa Käynnistä -> Ohjauspaneeli ja tupla-klikkaa Lisää tai poista sovellus Ohjauspaneelissa.
    2. Etsi listasta kaikki entiset Java versiosi. (J2SE Runtime Environment.... )
    Niissä pitäisi olla seuraava kuva vieressä: [​IMG]

    3. Valitse kaikki entiset Java versiosi ja valitse Poista.
    4. Asenna uusin Java päivitys seuraavasta linkistä..
    5. Käynnistä kone uudelleen asennuksen jälkeen:

    http://java.sun.com/javase/downloads/index.jsp

    Rullaa alas kohteeseen Java Runtime Environment (JRE) 6u2

    Paina Download

    Ruksaa Accept, ota offline installation, tallenna vaikka työpöydälle ja asenna se.

    6. Käynnistyksen jälkeen, mene takaisin Ohjauspaneeliin ja avaa Java asetuksesi (Muita Ohjauspaneelin asetuksia -> Java kahvikuppi).

    7. General Settings -osion alla, vedä liukusäädintä (Disk Space) pienemmälle, ja klikkaa Delete Files -nappia.

    (Jotkut javapohjaiset ohjelmat saattavat tarvita enemmän levytilaa.
    Jos huomaat säädön pienentämisen jälkeen koneessa hitautta, siirrä liukusäädintä isommalle).

    8. Varmista että kaikki kaksi valintaa ovat rastitettuja:

    *Applications and Applets

    *Trace and Log Files

    Ja paina OK -nappia

    9. Klikkaa OK "Temporary Files Settings" -ikkunassasi.

    10. Klikkaa OK jättääksesi Java asetusikkunasi.

    ===========================

    Lataa Dr.Web CureIt työpöydälle:

    Tuplaklikkaa drweb-cureit.exe ja anna sen tehdä express scan
    Se skannaa käynnissä olevat ohjelmat ja jos jotain löytyy, klikkaa yes kun se kysyy haluatko poistaa sen. Tämä on vain lyhyt scan.
    Kun scan on valmis, Klikkaa Custom scan merkkaa asemat, jotka haluat scannata.
    Valitse kaikki asemat. Punainen piste osoittaa, mitkä asemat on valittu.
    Klikaa vihreää nuolta oikealla ja scan alkaa.
    Klikkaa 'Yes to all', jos kysytään haluatko poistaa/siirtää tiedoston.
    Kun scan on valmis, katso voitko klikata next-kuvaketta löytyneiden tiedostojen vieressä: [​IMG]
    Jos asia on niin, klikkaa sitä ja sitten klikkaa next-kuvaketta oikealla alhaalla ja valitse Move incurable kuten alla olevalla kuvassa:
    [​IMG]
    Tämä siirtää sen %userprofile%\DoctorWeb\quarantine-hakemistoon.
    Tämän jälkeen klikkaa Dr.Web CureIt-valikossa file ja valitse save report list
    Tallenna raportti työpöydälle. Raportin nimi on DrWeb.csv
    Sulje Dr.Web Cureit.
    Käynnistä kone uudelleen !! Tämä siksi, että käytössä olevat tiedostot poistetaan/siirretään käynnistyksen yhteydessä.
    Käynnistyksen jälkeen liitä Dr.Web-lokin, jonka tallensit aiemmin, sisältö seuraavaan vastaukseesi.

    ==================

    laita myös uusi hjt:n loki scannaten viimisenä
     
    Last edited by a moderator: Sep 29, 2007
    Hujo, Sep 29, 2007
    #10
  11. Vanderlay

    Vanderlay Member

    Joined:
    May 29, 2007
    Messages:
    28
    Likes Received:
    0
    Trophy Points:
    11
    Olen yrittänyt nyt neljä kertaa skannausta Dr.Web Cureitilla, mutta kone on kaatunut jokaisella kerralla, ilmeisesti ennenkuin custom scan on päässyt loppuun asti. Kone käynnistyy uudelleen ja Windows ilmoittaa järjestelmän palautuneen vakavasta virheestä. Windows error reporting sivusto kertoo, että "problem caused by device driver" ja "stop error"ista myös jotain puhetta.

    Tässä tämänhetkinen loki:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 9:10:48, on 30.9.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
    C:\PROGRA~1\F-Secure\BackWeb\7681197\PROGRAM\SERVIC~1.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure\Common\FSMA32.EXE
    C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
    C:\Program Files\F-Secure\Common\FSMB32.EXE
    C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\BACKWE~1.EXE
    C:\WINDOWS\system32\MsPMSPSv.exe
    C:\Program Files\F-Secure\Common\FCH32.EXE
    C:\Program Files\F-Secure\Common\FAMEH32.EXE
    C:\Program Files\F-Secure\Common\FNRB32.EXE
    C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    C:\Program Files\F-Secure\Common\FIH32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\F-Secure\Common\FSM32.EXE
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\F-Secure\FSGUI\fsguiexe.exe
    C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
    C:\HJT\scanner.exe.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.kyweb.fi
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {4AC3D45C-5957-456F-A358-D60725CFB5F3} - C:\WINDOWS\system32\mllmj.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: (no name) - {CF46BFB3-2ACC-441b-B82B-36B9562C7FF1} - C:\WINDOWS\system32\ularwyel.dll
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
    O4 - HKLM\..\Run: [SearchIndexer] rundll32.exe "C:\WINDOWS\system32\qyomjgni.dll",sitypnow
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by13fd.bay13.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1108320440904
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: FS BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\PROGRAM\SERVIC~1.EXE
    O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exe
    O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE

    --
    End of file - 6789 bytes
     
    Vanderlay, Sep 29, 2007
    #11
  12. Hujo

    Hujo Guest

    Lataa KillBox http://www.killbox.net/downloads/KillBox.exe

    Tallenna työpöydälle. Jolloin ilmestyy kuvake KillBox.exe

    Avaa KillBox ja laita "täppi" kohtaan Delete on Reboot sekä paina kohdasta All Files niin ,että se alkaa "vilkkumaan" vihreänä.

    Kopioi tuosta alta kaikki yhtäaikkaa

    C:\WINDOWS\system32\mllmj.dll
    C:\WINDOWS\system32\ularwyel.dll

    Valitse ylhäältä valikosta File ja sitten Paste from Clipboard.

    Riville Full Path of File to Delete ilmestyy jokin annetuista poluista ja tiedosto näkyy rivin alapuolella sinisellä merkittynä jos se löytyy koneelta.Paina tämän jälkeen oikealla olevaa punaista ympyrää jossa on valkoinen rasti.

    Haluatko buutata nyt ? Vastaa tähän Kyllä

    Tämän jälkeen kone buuttaa itsensä. Jos ei buuttaa niin suorita toimenpide itse "käsin".


    ==========================

    käytä tässä ie selainta

    Scannaa koneesi Kaspersky Online Scannerin

    Ohjelman käynnistyessä kysytään sallitaanko ActiveX -komponentin asentamisen Kasperskyltä, klikkaa Kyllä.
    " Ohjelma käynnistyy ja aloittaa viimeisimpien tunnistetiedostojen lataamisen.
    " Kun skanneri on asennettu ja tunnistetiedot ladattu, klikkaa Next.
    " Klikkaa nyt asetuksia, Scan Settings
    " Tarkista asetuksista, että seuraavat ovat valittuina:
    o Scan using the following Anti-Virus database:
    + Extended (Jos valittavissa, muuten valitse Standard)
    o Scan Options:
    + Scan Archives
    + Scan Mail Bases
    " Klikkaa OK
    " Nyt valitse "select a target to scan" otsikon alta Oma Tietokone, My Computer
    " Skannaus vie aikaa, joten ole kärsivällinen. Kun skannaus on valmis saat ilmoituksen, jos koneesi on saastunut.
    " Klikkaa nyt Save as Text-painiketta.
    " Tallenna tiedosto työpöydällesi.
    " Mikäli haluat jatkaa asian käsittelyä foorumissa niin kopioi tiedoston sisältö viestiisi.


     
    Hujo, Sep 29, 2007
    #12
  13. Vanderlay

    Vanderlay Member

    Joined:
    May 29, 2007
    Messages:
    28
    Likes Received:
    0
    Trophy Points:
    11
    Tämmöstä sieltä tuli:

    KASPERSKY ONLINE SCANNER REPORT
    Monday, October 01, 2007 12:06:52 AM
    Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
    Kaspersky Online Scanner version: 5.0.93.1
    Kaspersky Anti-Virus database last update: 30/09/2007
    Kaspersky Anti-Virus database records: 425647
    Scan Settings
    Scan using the following antivirus database extended
    Scan Archives true
    Scan Mail Bases true
    Scan Target My Computer
    A:\
    C:\
    D:\
    E:\
    Scan Statistics
    Total number of scanned objects 69212
    Number of viruses found 2
    Number of infected objects 4
    Number of suspicious objects 0
    Duration of the scan process 02:09:45

    Infected Object Name Virus Name Last Action
    C:\check_LSA7.txt Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
    C:\Documents and Settings\Anssi\Application Data\Mozilla\Firefox\Profiles\w5g4fv3y.default\cert8.db Object is locked skipped
    C:\Documents and Settings\Anssi\Application Data\Mozilla\Firefox\Profiles\w5g4fv3y.default\formhistory.dat Object is locked skipped
    C:\Documents and Settings\Anssi\Application Data\Mozilla\Firefox\Profiles\w5g4fv3y.default\history.dat Object is locked skipped
    C:\Documents and Settings\Anssi\Application Data\Mozilla\Firefox\Profiles\w5g4fv3y.default\key3.db Object is locked skipped
    C:\Documents and Settings\Anssi\Application Data\Mozilla\Firefox\Profiles\w5g4fv3y.default\parent.lock Object is locked skipped
    C:\Documents and Settings\Anssi\Application Data\Mozilla\Firefox\Profiles\w5g4fv3y.default\search.sqlite Object is locked skipped
    C:\Documents and Settings\Anssi\Application Data\Mozilla\Firefox\Profiles\w5g4fv3y.default\urlclassifier2.sqlite Object is locked skipped
    C:\Documents and Settings\Anssi\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\Anssi\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\Anssi\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\Anssi\Local Settings\Application Data\Mozilla\Firefox\Profiles\w5g4fv3y.default\Cache\_CACHE_001_ Object is locked skipped
    C:\Documents and Settings\Anssi\Local Settings\Application Data\Mozilla\Firefox\Profiles\w5g4fv3y.default\Cache\_CACHE_002_ Object is locked skipped
    C:\Documents and Settings\Anssi\Local Settings\Application Data\Mozilla\Firefox\Profiles\w5g4fv3y.default\Cache\_CACHE_003_ Object is locked skipped
    C:\Documents and Settings\Anssi\Local Settings\Application Data\Mozilla\Firefox\Profiles\w5g4fv3y.default\Cache\_CACHE_MAP_ Object is locked skipped
    C:\Documents and Settings\Anssi\Local Settings\Sivuhistoria\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\Anssi\Local Settings\Temp\DRAJNHJV.0XE Infected: Trojan.Win32.Agent.bck skipped
    C:\Documents and Settings\Anssi\Local Settings\Temp\UUUBKQAW.0XE Infected: Trojan.Win32.Agent.bck skipped
    C:\Documents and Settings\Anssi\Local Settings\Temporary Internet Files\Content.IE5\0ZVB0MLK\valera[1] Infected: Trojan.Win32.Agent.bck skipped
    C:\Documents and Settings\Anssi\Local Settings\Temporary Internet Files\Content.IE5\173CALJ1\lkjh[1] Infected: Trojan-Downloader.Win32.Tiny.id skipped
    C:\Documents and Settings\Anssi\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\Anssi\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\Anssi\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Sivuhistoria\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
    C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\chandir.dat Object is locked skipped
    C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\chandir.idx Object is locked skipped
    C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\chn.dat Object is locked skipped
    C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\chn.idx Object is locked skipped
    C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\D0000000.FCS Object is locked skipped
    C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\inuse.txt Object is locked skipped
    C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\L0000001.FCS Object is locked skipped
    C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\main.log Object is locked skipped
    C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\prs.dat Object is locked skipped
    C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\prs.idx Object is locked skipped
    C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\prs_die.dat Object is locked skipped
    C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\prs_die.idx Object is locked skipped
    C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\prs_dnd.dat Object is locked skipped
    C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\prs_dnd.idx Object is locked skipped
    C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\prs_ext.dat Object is locked skipped
    C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\prs_ext.idx Object is locked skipped
    C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\prs_rcv.dat Object is locked skipped
    C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\prs_rcv.idx Object is locked skipped
    C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\storydb.dat Object is locked skipped
    C:\Program Files\F-Secure\BackWeb\7681197\Users\Default\Data\storydb.idx Object is locked skipped
    C:\Program Files\F-Secure\Common\policy.ipf Object is locked skipped
    C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
    C:\System Volume Information\_restore{9D707E83-E35C-44D0-997E-77D06D6B9E99}\RP971\change.log Object is locked skipped
    C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
    C:\WINDOWS\SchedLgU.Txt Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\EventCache\{0782A461-BB45-427A-90ED-160BDD457329}.bin Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
    C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\default Object is locked skipped
    C:\WINDOWS\system32\config\default.LOG Object is locked skipped
    C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
    C:\WINDOWS\system32\config\SAM Object is locked skipped
    C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
    C:\WINDOWS\system32\config\software Object is locked skipped
    C:\WINDOWS\system32\config\software.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\system Object is locked skipped
    C:\WINDOWS\system32\config\system.LOG Object is locked skipped
    C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped
    C:\WINDOWS\system32\h323log.txt Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
    C:\WINDOWS\WindowsUpdate.log Object is locked skipped
    E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
    Scan process completed.
     
    Vanderlay, Sep 30, 2007
    #13
  14. Hujo

    Hujo Guest

    scannaa uusi hjt:n loki
     
    Hujo, Sep 30, 2007
    #14
  15. Vanderlay

    Vanderlay Member

    Joined:
    May 29, 2007
    Messages:
    28
    Likes Received:
    0
    Trophy Points:
    11
    Tossa:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 9:10:23, on 1.10.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
    C:\PROGRA~1\F-Secure\BackWeb\7681197\PROGRAM\SERVIC~1.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
    C:\Program Files\F-Secure\Common\FSMA32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
    C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\BACKWE~1.EXE
    C:\Program Files\F-Secure\Common\FSMB32.EXE
    C:\WINDOWS\system32\MsPMSPSv.exe
    C:\Program Files\F-Secure\Common\FCH32.EXE
    C:\Program Files\F-Secure\Common\FNRB32.EXE
    C:\Program Files\F-Secure\Common\FAMEH32.EXE
    C:\Program Files\F-Secure\Common\FIH32.EXE
    C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\F-Secure\Common\FSM32.EXE
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\F-Secure\FSGUI\fsguiexe.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\HJT\scanner.exe.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.kyweb.fi
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.kyweb.fi
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: (no name) - {CF46BFB3-2ACC-441b-B82B-36B9562C7FF1} - C:\WINDOWS\system32\ularwyel.dll
    O2 - BHO: (no name) - {DD4D5F24-2448-4D24-BE11-D4170CA2D02F} - C:\WINDOWS\system32\mllmj.dll
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
    O4 - HKLM\..\Run: [SearchIndexer] rundll32.exe "C:\WINDOWS\system32\tsograom.dll",sitypnow
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by13fd.bay13.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1108320440904
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: FS BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\PROGRAM\SERVIC~1.EXE
    O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exe
    O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE

    --
    End of file - 6577 bytes
     
    Vanderlay, Sep 30, 2007
    #15
  16. Hujo

    Hujo Guest

    vundofix käyttöön

    Lataa VundoFix.exe työpöydällesi.
    [*]Tupla-klikkaa VundoFix.exe ajaaksesi sen.
    [*]Klikkaa Scan for Vundo valintaa.
    [*]Kun skannaus on valmis, oikea-klikkaa kyseisen listaboksin sisällä (valkoinen laatikko jossa on löydetyt tiedostot listattu) ja valitse Add more files
    [*]Kopioi ja liitä seuraavat 2 riviä kahteen ylimmäiseen boksiin

    C:\WINDOWS\system32\ularwyel.dll
    C:\WINDOWS\system32\mllmj.dll

    [*]Klikkaa Add Files ja sitten klikkaa Close Window.
    [*]Kun skannaus on valmis, klikkaa Remove Vundo valintaa.
    [*]Sinulta kysytään haluatko poistaa filut - klikkaa YES.
    [*]Kun olet klikannut yes, työpöytäsi tyhjenee kun se alkaa poistamaan Vundoa.
    [*]Kun se on valmis, fiksi ilmoittaa käynnistäväsi koneesi uudelleen, klikkaa OK.
    [*]Postita C:\vundofix.txt lokin sekä tuoreen HijackThis lokin sisältö.

    =======================
    Tuosta on uudempi versio
    VundoFix V6.5.8 < --- vanha
     
    Last edited by a moderator: Sep 30, 2007
    Hujo, Sep 30, 2007
    #16
  17. Vanderlay

    Vanderlay Member

    Joined:
    May 29, 2007
    Messages:
    28
    Likes Received:
    0
    Trophy Points:
    11

    VundoFix V6.5.8

    Checking Java version...

    Java version is 1.5.0.2
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.5
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.6
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.8
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.9
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.10

    Java version is 1.5.0.11

    Scan started at 16:07:07 14.9.2007

    Listing files found while scanning....

    C:\windows\system32\alcgqurv.dll
    C:\windows\system32\austsvog.ini
    C:\WINDOWS\system32\cbpujvah.dll
    C:\windows\system32\cmfpbmtn.ini
    C:\windows\system32\dtggluae.ini
    C:\windows\system32\eaulggtd.dll
    C:\windows\system32\govstsua.dll
    C:\windows\system32\maaqfvvu.dll
    C:\WINDOWS\system32\mrxqfkrn.dll
    C:\windows\system32\ntmbpfmc.dll
    C:\windows\system32\uvvfqaam.ini
    C:\windows\system32\vruqgcla.ini

    Beginning removal...

    Attempting to delete C:\windows\system32\alcgqurv.dll
    C:\windows\system32\alcgqurv.dll Has been deleted!

    Attempting to delete C:\windows\system32\austsvog.ini
    C:\windows\system32\austsvog.ini Has been deleted!

    Attempting to delete C:\WINDOWS\system32\cbpujvah.dll
    C:\WINDOWS\system32\cbpujvah.dll Has been deleted!

    Attempting to delete C:\windows\system32\cmfpbmtn.ini
    C:\windows\system32\cmfpbmtn.ini Has been deleted!

    Attempting to delete C:\windows\system32\dtggluae.ini
    C:\windows\system32\dtggluae.ini Has been deleted!

    Attempting to delete C:\windows\system32\eaulggtd.dll
    C:\windows\system32\eaulggtd.dll Has been deleted!

    Attempting to delete C:\windows\system32\govstsua.dll
    C:\windows\system32\govstsua.dll Could not be deleted.

    Attempting to delete C:\windows\system32\maaqfvvu.dll
    C:\windows\system32\maaqfvvu.dll Has been deleted!

    Attempting to delete C:\windows\system32\ntmbpfmc.dll
    C:\windows\system32\ntmbpfmc.dll Has been deleted!

    Attempting to delete C:\windows\system32\uvvfqaam.ini
    C:\windows\system32\uvvfqaam.ini Has been deleted!

    Attempting to delete C:\windows\system32\vruqgcla.ini
    C:\windows\system32\vruqgcla.ini Has been deleted!

    Performing Repairs to the registry.
    Done!

    Beginning removal...

    Attempting to delete C:\windows\system32\govstsua.dll
    C:\windows\system32\govstsua.dll Has been deleted!

    Performing Repairs to the registry.
    Done!

    VundoFix V6.5.8

    Checking Java version...

    Java version is 1.5.0.2
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.5
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.6
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.8
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.9
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.10

    Java version is 1.5.0.11

    Scan started at 22:14:56 14.9.2007

    Listing files found while scanning....

    C:\WINDOWS\system32\mrxqfkrn.dll
    C:\WINDOWS\system32\nrkfqxrm.ini
    C:\windows\system32\nwynyjau.ini
    C:\windows\system32\qhrqduxq.ini
    C:\windows\system32\qxudqrhq.dll
    C:\WINDOWS\system32\trgtollm.dll
    C:\windows\system32\uajynywn.dll

    Beginning removal...

    Attempting to delete C:\WINDOWS\system32\nrkfqxrm.ini
    C:\WINDOWS\system32\nrkfqxrm.ini Has been deleted!

    Attempting to delete C:\windows\system32\nwynyjau.ini
    C:\windows\system32\nwynyjau.ini Has been deleted!

    Attempting to delete C:\windows\system32\qhrqduxq.ini
    C:\windows\system32\qhrqduxq.ini Has been deleted!

    Attempting to delete C:\windows\system32\qxudqrhq.dll
    C:\windows\system32\qxudqrhq.dll Could not be deleted.

    Attempting to delete C:\WINDOWS\system32\trgtollm.dll
    C:\WINDOWS\system32\trgtollm.dll Has been deleted!

    Attempting to delete C:\windows\system32\uajynywn.dll
    C:\windows\system32\uajynywn.dll Has been deleted!

    Performing Repairs to the registry.
    Done!

    Beginning removal...

    Attempting to delete C:\windows\system32\qxudqrhq.dll
    C:\windows\system32\qxudqrhq.dll Has been deleted!

    Performing Repairs to the registry.
    Done!

    VundoFix V6.5.8

    Checking Java version...

    Java version is 1.5.0.2
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.5
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.6
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.8
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.9
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.10

    Java version is 1.5.0.11

    Scan started at 10:01:53 17.9.2007

    Listing files found while scanning....

    C:\windows\system32\aujvhung.dll
    C:\windows\system32\cgbxmabm.ini
    C:\windows\system32\fjuxdwcp.ini
    C:\windows\system32\gnuhvjua.ini
    C:\windows\system32\mbamxbgc.dll
    C:\WINDOWS\system32\mrxqfkrn.dll
    C:\windows\system32\pcwdxujf.dll
    C:\WINDOWS\system32\rcnpmdjx.dll

    Beginning removal...

    Attempting to delete C:\windows\system32\aujvhung.dll
    C:\windows\system32\aujvhung.dll Has been deleted!

    Attempting to delete C:\windows\system32\cgbxmabm.ini
    C:\windows\system32\cgbxmabm.ini Has been deleted!

    Attempting to delete C:\windows\system32\fjuxdwcp.ini
    C:\windows\system32\fjuxdwcp.ini Has been deleted!

    Attempting to delete C:\windows\system32\gnuhvjua.ini
    C:\windows\system32\gnuhvjua.ini Has been deleted!

    Attempting to delete C:\windows\system32\mbamxbgc.dll
    C:\windows\system32\mbamxbgc.dll Could not be deleted.

    Attempting to delete C:\windows\system32\pcwdxujf.dll
    C:\windows\system32\pcwdxujf.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\rcnpmdjx.dll
    C:\WINDOWS\system32\rcnpmdjx.dll Has been deleted!

    Performing Repairs to the registry.
    Done!

    Beginning removal...

    Attempting to delete C:\windows\system32\mbamxbgc.dll
    C:\windows\system32\mbamxbgc.dll Has been deleted!

    Performing Repairs to the registry.
    Done!

    VundoFix V6.5.8

    Checking Java version...

    Java version is 1.5.0.2
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.5
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.6
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.8
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.9
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.10

    Java version is 1.5.0.11

    Scan started at 22:04:49 25.9.2007

    Listing files found while scanning....

    C:\windows\system32\bnbthtuj.dll
    C:\windows\system32\evktfain.ini
    C:\windows\system32\focruylq.ini
    C:\windows\system32\fyebeqss.ini
    C:\windows\system32\gmudatin.ini
    C:\windows\system32\ikqvwilv.dll
    C:\windows\system32\juthtbnb.ini
    C:\windows\system32\lkugkjrn.ini
    C:\windows\system32\mmikewdu.ini
    C:\WINDOWS\system32\mrxqfkrn.dll
    C:\windows\system32\niaftkve.dll
    C:\windows\system32\nitadumg.dll
    C:\windows\system32\nrjkgukl.dll
    C:\windows\system32\qlyurcof.dll
    C:\windows\system32\qwaoxcox.ini
    C:\WINDOWS\system32\rsganofw.dll
    C:\windows\system32\ssqebeyf.dll
    C:\windows\system32\udwekimm.dll
    C:\windows\system32\vbbdtesy.dll
    C:\windows\system32\vliwvqki.ini
    C:\windows\system32\xocxoawq.dll
    C:\windows\system32\ysetdbbv.ini

    Beginning removal...

    Attempting to delete C:\windows\system32\bnbthtuj.dll
    C:\windows\system32\bnbthtuj.dll Has been deleted!

    Attempting to delete C:\windows\system32\evktfain.ini
    C:\windows\system32\evktfain.ini Has been deleted!

    Attempting to delete C:\windows\system32\focruylq.ini
    C:\windows\system32\focruylq.ini Has been deleted!

    Attempting to delete C:\windows\system32\fyebeqss.ini
    C:\windows\system32\fyebeqss.ini Has been deleted!

    Attempting to delete C:\windows\system32\gmudatin.ini
    C:\windows\system32\gmudatin.ini Has been deleted!

    Attempting to delete C:\windows\system32\ikqvwilv.dll
    C:\windows\system32\ikqvwilv.dll Has been deleted!

    Attempting to delete C:\windows\system32\juthtbnb.ini
    C:\windows\system32\juthtbnb.ini Has been deleted!

    Attempting to delete C:\windows\system32\lkugkjrn.ini
    C:\windows\system32\lkugkjrn.ini Has been deleted!

    Attempting to delete C:\windows\system32\mmikewdu.ini
    C:\windows\system32\mmikewdu.ini Has been deleted!

    Attempting to delete C:\windows\system32\niaftkve.dll
    C:\windows\system32\niaftkve.dll Has been deleted!

    Attempting to delete C:\windows\system32\nitadumg.dll
    C:\windows\system32\nitadumg.dll Has been deleted!

    Attempting to delete C:\windows\system32\nrjkgukl.dll
    C:\windows\system32\nrjkgukl.dll Has been deleted!

    Attempting to delete C:\windows\system32\qlyurcof.dll
    C:\windows\system32\qlyurcof.dll Has been deleted!

    Attempting to delete C:\windows\system32\qwaoxcox.ini
    C:\windows\system32\qwaoxcox.ini Has been deleted!

    Attempting to delete C:\WINDOWS\system32\rsganofw.dll
    C:\WINDOWS\system32\rsganofw.dll Has been deleted!

    Attempting to delete C:\windows\system32\ssqebeyf.dll
    C:\windows\system32\ssqebeyf.dll Has been deleted!

    Attempting to delete C:\windows\system32\udwekimm.dll
    C:\windows\system32\udwekimm.dll Has been deleted!

    Attempting to delete C:\windows\system32\vbbdtesy.dll
    C:\windows\system32\vbbdtesy.dll Has been deleted!

    Attempting to delete C:\windows\system32\vliwvqki.ini
    C:\windows\system32\vliwvqki.ini Has been deleted!

    Attempting to delete C:\windows\system32\xocxoawq.dll
    C:\windows\system32\xocxoawq.dll Has been deleted!

    Attempting to delete C:\windows\system32\ysetdbbv.ini
    C:\windows\system32\ysetdbbv.ini Has been deleted!

    Performing Repairs to the registry.
    Done!

    VundoFix V6.5.8

    Checking Java version...

    Java version is 1.5.0.2
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.5
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.6
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.8
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.9
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.10

    Java version is 1.5.0.11

    Scan started at 23:24:29 27.9.2007

    Listing files found while scanning....


    VundoFix V6.5.8

    Checking Java version...

    Java version is 1.5.0.2
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.5
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.6
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.8
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.9
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.10

    Java version is 1.5.0.11

    Scan started at 12:48:02 28.9.2007

    Listing files found while scanning....

    C:\WINDOWS\system32\koaptktd.dll

    Beginning removal...

    Attempting to delete C:\WINDOWS\system32\koaptktd.dll
    C:\WINDOWS\system32\koaptktd.dll Has been deleted!

    Performing Repairs to the registry.
    Done!

    VundoFix V6.5.8

    Checking Java version...

    Scan started at 12:35:31 1.10.2007

    Listing files found while scanning....

    C:\WINDOWS\system32\ularwyel.dll

    Beginning removal...

    Attempting to delete C:\WINDOWS\system32\ularwyel.dll
    C:\WINDOWS\system32\ularwyel.dll Has been deleted!

    Performing Repairs to the registry.
    Done!

    VundoFix V6.5.8

    Checking Java version...

    Scan started at 14:06:09 1.10.2007

    Listing files found while scanning....

    C:\WINDOWS\system32\oetwudsb.dll

    Beginning removal...

    Attempting to delete C:\WINDOWS\system32\oetwudsb.dll
    C:\WINDOWS\system32\oetwudsb.dll Has been deleted!

    Performing Repairs to the registry.
    Done!

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 15:24:02, on 1.10.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
    C:\PROGRA~1\F-Secure\BackWeb\7681197\PROGRAM\SERVIC~1.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
    C:\Program Files\F-Secure\Common\FSMA32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
    C:\Program Files\F-Secure\Common\FSMB32.EXE
    C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\BACKWE~1.EXE
    C:\Program Files\F-Secure\Common\FCH32.EXE
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\F-Secure\Common\FAMEH32.EXE
    C:\WINDOWS\system32\MsPMSPSv.exe
    C:\Program Files\F-Secure\Common\FNRB32.EXE
    C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    C:\Program Files\F-Secure\Common\FIH32.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\F-Secure\Common\FSM32.EXE
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
    C:\Program Files\Real\RealPlayer\RealPlay.exe
    C:\Program Files\F-Secure\FSGUI\fsguiexe.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\HJT\scanner.exe.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.kyweb.fi
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.kyweb.fi
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {14F487DA-85BE-4E99-A284-5DF5BE741130} - C:\WINDOWS\system32\mllmj.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
    O4 - HKLM\..\Run: [SearchIndexer] rundll32.exe "C:\WINDOWS\system32\trukvshf.dll",sitypnow
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by13fd.bay13.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1108320440904
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: FS BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\PROGRAM\SERVIC~1.EXE
    O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exe
    O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE

    --
    End of file - 6528 bytes

     
    Vanderlay, Oct 1, 2007
    #17
  18. Hujo

    Hujo Guest

    eipä lähtenyt mäkeen vielä

    Poista toi vanha vundofix:n koneelta ja lataa se uusi versio koneelle.

    ylhäällä olevasta linkistä missä ohje on ja uudelleen vundofixsin ajo
     
    Hujo, Oct 1, 2007
    #18
  19. Vanderlay

    Vanderlay Member

    Joined:
    May 29, 2007
    Messages:
    28
    Likes Received:
    0
    Trophy Points:
    11
    Mikäs sen uusimman version numero nyt sit onkaan? Lataamiskelpoista 6.5.9 -versiota en ainakaa onnistunut löytämään.
     
    Vanderlay, Oct 2, 2007
    #19
  20. Hujo

    Hujo Guest

    se on just tuo versio 6.5.9

    Sulla tulee kokoajan lokia tuolla vanhalla versiolla V6.5.8

    heitä roskiin noi vanhat raportit
     
    Last edited by a moderator: Oct 3, 2007
    Hujo, Oct 3, 2007
    #20
Page 1 of 2

Share This Page