HJT-log + TR/DELPHI.DOWNLOADER.GEN-virus?

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by arttu32, Feb 19, 2008.

  1. arttu32

    arttu32 Member

    Joined:
    Feb 19, 2008
    Messages:
    5
    Likes Received:
    0
    Trophy Points:
    11
    Terve

    Ensi kerta täällä ja taitaa tulla nyt huutia koneelle, toivottavasti, sillä alkaa olla tämä touhu jo aika epätoivoista. Eli neuvoja kaipailisin, please.

    Sisällä on joku virus TR/DELPHI.DOWNLOADER.GEN eikä Antivir (ilmaisversio) saa sitä kuriin, ei edes karanteeniin.

    Logfile of HijackThis v1.99.1
    Scan saved at 18:41:26, on 19.2.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Google\Gmail Notifier\gnotify.exe
    C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
    C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
    C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\Microsoft IntelliType Pro\type32.exe
    C:\Program Files\Microsoft IntelliPoint\point32.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    C:\WINDOWS\system32\PSIService.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
    c:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\System32\Rundll32.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\wksmgrtsgs.exe
    C:\PROGRA~1\Mozilla Firefox\firefox.exe
    C:\unzipped\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://finnish.toggle.com/index.php?rvs=hompag
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/*http://www.yahoo.com/ext/search/search.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr7/*http://www.yahoo.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: MySidesearch Search Assistant - {1648E328-3E5A-4EA5-A9C6-E5F09EE272DA} - C:\WINDOWS\system32\mysidesearch_sidebar.dll
    O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: dcads - {6FC3C36D-7635-4D43-BA62-0D9D2F2CD06E} - C:\WINDOWS\system32\nstE5.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O2 - BHO: superiorads browser enhancer - {79F562E5-768C-4494-8E6C-824ADA4A9C2C} - C:\WINDOWS\system32\sprt_ads.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: (no name) - {B9341481-E0DC-479A-9970-2018DE3E0CB6} - C:\WINDOWS\system32\cmud.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Program Files\Creative\Shared Files\CamTray.exe
    O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
    O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
    O4 - HKLM\..\Run: [SM_IAN] C:\Program Files\AdvancedCleaner Free\ian_monitor.exe
    O4 - HKLM\..\Run: [SeekmoOE] C:\Program Files\Seekmo\bin\10.0.406.0\OEAddOn.exe
    O4 - HKLM\..\Run: [SeekmoSA] "C:\Program Files\Seekmo\bin\10.0.406.0\SeekmoSA.exe"
    O4 - HKLM\..\Run: [HP Software Update] c:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [NI.UGDCFI_0001_N122M1712] "C:\Documents and Settings\Legend\Application Data\installer_fi[1].exe"
    O4 - HKLM\..\Run: [spa_start] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\sprt_ads.dll" DllStart
    O4 - HKLM\..\Run: [Windows Control Server] wksmgrtsgs.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
    O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
    O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: HP Image Zone -pikakäynnistys.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
    O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZSzeb066CFFI_ZNxdm824CQUS
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Avaa uuteen etuvälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/230?124be78767444ab6be94112dcfaaf238
    O8 - Extra context menu item: Avaa uuteen taustavälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/229?124be78767444ab6be94112dcfaaf238
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
    O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
     
    arttu32, Feb 19, 2008
    #1
  2. Hujo

    Hujo Guest

    Escan
    Ohjeet tuolla sivulla.
    http://koti.mbnet.fi/pattaya1/escanmwav.htm
    lataa tuosta
    http://www.spywareinfo.dk/download/mwav.exe
    päivitä tuosta
    http://koti.mbnet.fi/pattaya1/lataus/Mwav.bat
    laita täpit merkkauksien mukaan
    http://koti.mbnet.fi/pattaya1/eScan6.jpg

    scannaa

    jos ala luukkuun tulee jotain niin kopioi se näin:
    Käytä komentoa Ctrl+A.
    Kopioi rivit komennolla Ctrl+C.
    Liitä rivit komennolla Ctrl+V.

    Laita virus log tänne.

    ===============

    Ohje AVG:n Anti-Spyware 7.5:n käyttöön
    Huom! Tässä ohjeessa sammutetaan tuo reaaliaikasuojaus (Shield). Näin vältetään tilanteet joissa suojaus estäisi esim HijackThis:n työkalun toimintaa.

    Tallenna nämä ohjeet tekstitiedostoon tai tulosta nämä, muuten et pääse niihin käsiksi vikasietotilasta

    Lataa AVG:n Anti-Spyware 7.5:n
    ja tallenna ohjelma työpöydällesi.
    o Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa.
    o Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää.
    o Käynnistä AVG:n Anti-Spyware.
    o Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta.

    o Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa.

    o Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti.
    o Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine".

    o Sitten "Reports" valikon alta:
    o Laita täppi kohtaan "Automatically generate report after every scan"
    o Ota täppi pois kohdasta"Only if threats were found"

    o Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa
    o "Resident shield is", muuta tila active:sta inactive:ksi
    o Sulje ohjelma, ÄLÄ skannaa vielä.

    Käynnistä koneesi vikasietotilaan,
    sammuta ja käynnistä
    käynnistyksen yhteydessä naputtele F8
    valitse nuoli näppäimellä vikasietotila
    paina enter ja enter

    Toisissa koneissa paukutetaan F8:sin sijasta F5:tä

    HUOM! Älä käytä muita ohjelmia AVG:n skannauksen aikana, tämä saattaa häiritä skannausta.
    o Kun vikasietotilassa, käynnistä AVG:n Anti-Spyware.
    o Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan".
    o Ewido aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa.

    Kun skannaus on valmis:
    TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions"
    o Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta.
    o Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions"
    [​IMG]
    o Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta.
    o Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle.
    o Sulje ohjelma, käynnistä kone normaalisti ja lähetä AVG:n raportti viestikejuusi.
     
    Last edited by a moderator: Feb 20, 2008
    Hujo, Feb 20, 2008
    #2
  3. arttu32

    arttu32 Member

    Joined:
    Feb 19, 2008
    Messages:
    5
    Likes Received:
    0
    Trophy Points:
    11
    eScanin virusloki olisi tässä.

    AVG loki seuraa perässä......

    File C:\WINDOWS\system32\nstE5.dll tagged as not-a-virus:AdWare.Win32.BHO.wt. No Action Taken.
    File C:\WINDOWS\system32\nstE5.dll tagged as not-a-virus:AdWare.Win32.BHO.wt. No Action Taken.
    File C:\Documents and Settings\Legend\Application Data\installer_fi[1].exe tagged as not-a-virus:Downloader.Win32.WinFixer.ds. No Action Taken.
    File C:\Documents and Settings\Legend\Local Settings\Temp\install\setup.exe tagged as not-a-virus:AdWare.Win32.TrafficSol.t. No Action Taken.
    File C:\Documents and Settings\Legend\Local Settings\Temp\NI.UGDCFI_0001_N122M1712\setup.exe tagged as not-a-virus:FraudTool.Win32.SanitarDiska.o. No Action Taken.
    File C:\Documents and Settings\Legend\Local Settings\Temporary Internet Files\Content.IE5\2UVD8GMQ\whCC-TRAFE7[1].exe tagged as not-a-virus:AdWare.Win32.WebHancer.390. No Action Taken.
    File C:\Documents and Settings\Legend\Local Settings\Temporary Internet Files\Content.IE5\VKG7US92\RKInstaller[1].exe tagged as not-a-virus:AdWare.Win32.Relevant.a. No Action Taken.
    File C:\Documents and Settings\Legend\Työpöytä\SmileyCentralPFSetup2.2.60.11.ZNfox000.exe tagged as not-a-virus:AdTool.Win32.MyWebSearch.bc. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\008B821A-EF42-4A1D-8FEA-D8D5A1\02D11BF3-BDA4-4CBB-A9ED-80DBB6 tagged as not-a-virus:AdWare.Win32.Altnet.a. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\008B821A-EF42-4A1D-8FEA-D8D5A1\02EE6181-163A-409A-8361-6DAF5A tagged as not-a-virus:AdWare.Win32.Altnet.a. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\008B821A-EF42-4A1D-8FEA-D8D5A1\334253C4-137D-4C41-B7E4-5F7FAE tagged as not-a-virus:AdWare.Win32.BrilliantDigital.1007. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\008B821A-EF42-4A1D-8FEA-D8D5A1\3FE6AE11-1352-4D22-B47B-967F5D tagged as not-a-virus:AdWare.Win32.Altnet.a. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\008B821A-EF42-4A1D-8FEA-D8D5A1\455CD8C2-A14E-4F9C-B636-4C79AD tagged as not-a-virus:AdWare.Win32.Altnet.t. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\008B821A-EF42-4A1D-8FEA-D8D5A1\607D2F4F-43A2-49F6-B1F3-DD5AB3 tagged as not-a-virus:AdWare.Win32.Altnet.h. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\008B821A-EF42-4A1D-8FEA-D8D5A1\7A50313F-FFE2-4794-BBF4-8346A0 tagged as not-a-virus:AdTool.Win32.MyWebSearch.o. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\008B821A-EF42-4A1D-8FEA-D8D5A1\7EC5255F-F9A5-4800-A9D2-0352AD tagged as not-a-virus:AdWare.Win32.Altnet.h. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\008B821A-EF42-4A1D-8FEA-D8D5A1\800B0DC6-40F5-49AE-9593-23FBE4 tagged as not-a-virus:AdWare.Win32.Altnet.b. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\008B821A-EF42-4A1D-8FEA-D8D5A1\886D8E21-9B77-4CC3-A24C-178EE6 tagged as not-a-virus:AdWare.Win32.Altnet.a. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\008B821A-EF42-4A1D-8FEA-D8D5A1\90E7A2C1-7464-4655-9AC5-B9EA1D tagged as not-a-virus:AdWare.Win32.Altnet.g. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\008B821A-EF42-4A1D-8FEA-D8D5A1\C65471F3-A140-468F-9931-44EF58 tagged as not-a-virus:AdWare.Win32.Altnet.j. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\008B821A-EF42-4A1D-8FEA-D8D5A1\D83B68E8-0C86-4460-B2B3-C11972 tagged as not-a-virus:AdWare.Win32.BrilliantDigital.3039. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\187CAADB-BEC4-45B5-9703-B16D84\43030E5E-841B-496E-B9F5-3CA158 tagged as not-a-virus:AdWare.Win32.RXBar.e. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\187CAADB-BEC4-45B5-9703-B16D84\D6431B4D-D174-4288-96E6-09767C tagged as not-a-virus:AdWare.Win32.RXBar.d. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\3E5F6ED9-EAC0-471B-B6C5-8756D2\41D1C2D9-4D21-4C4B-9527-8475F5 tagged as not-a-virus:AdWare.Win32.180Solutions.al. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\440BF8EC-AC46-419D-9910-E6F2BB\63EAFF25-B424-4FC5-AEF6-894025 tagged as not-a-virus:AdWare.Win32.RXBar.d. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\440BF8EC-AC46-419D-9910-E6F2BB\D74630AB-A354-47E4-9CBF-AE170E tagged as not-a-virus:AdWare.Win32.RXBar.e. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\8C8A6C29-521B-4F6C-A3CC-8D21FE\6E37CC11-4B76-4E1D-A7B8-96BCAF tagged as not-a-virus:AdWare.Win32.Altnet.d. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\96B004C8-C901-4303-B46B-726F82\0D7A58F5-0F76-4BB7-B2DC-5550AD tagged as not-a-virus:AdWare.Win32.RXBar.e. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\96B004C8-C901-4303-B46B-726F82\0FB00551-3665-4669-9481-E4BAC8 tagged as not-a-virus:AdWare.Win32.RXBar.d. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\A5D7C837-830B-45F1-91AF-20A931\01DD0EA3-EE19-4827-AA35-0E6CAB tagged as not-a-virus:AdWare.Win32.Altnet.h. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\A5D7C837-830B-45F1-91AF-20A931\0812BC6C-7681-4696-8E84-15D876 tagged as not-a-virus:AdWare.Win32.Altnet.j. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\A5D7C837-830B-45F1-91AF-20A931\11034DC8-0CC9-4FB2-8FBD-8290AB tagged as not-a-virus:AdWare.Win32.Altnet.l. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\A5D7C837-830B-45F1-91AF-20A931\11100AD7-88C5-4C59-B7C5-745E7D tagged as not-a-virus:AdWare.Win32.Altnet.a. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\A5D7C837-830B-45F1-91AF-20A931\1496DF39-826D-4B09-9E21-98CACA tagged as not-a-virus:AdWare.Win32.BrilliantDigital.3039. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\A5D7C837-830B-45F1-91AF-20A931\26686517-8D0F-4625-A3A0-C2B234 tagged as not-a-virus:AdWare.Win32.Altnet.b. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\A5D7C837-830B-45F1-91AF-20A931\33DF6BA2-1DDB-43F0-A4BE-47A15F tagged as not-a-virus:AdWare.Win32.Altnet.g. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\A5D7C837-830B-45F1-91AF-20A931\4564E389-4F33-471C-B8C0-3A192B tagged as not-a-virus:AdWare.Win32.Altnet.a. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\A5D7C837-830B-45F1-91AF-20A931\47842119-56C2-4C0D-92CE-8AD1E2 tagged as not-a-virus:AdWare.Win32.Altnet.j. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\A5D7C837-830B-45F1-91AF-20A931\4B56CC1C-7AE5-468E-A12F-CF239F tagged as not-a-virus:AdWare.Win32.Altnet.t. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\A5D7C837-830B-45F1-91AF-20A931\4CD3F206-6E46-4A3C-A9D6-2230DE tagged as not-a-virus:AdWare.Win32.BrilliantDigital.3039. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\A5D7C837-830B-45F1-91AF-20A931\5BB7FC8C-556C-496F-8A2D-62A5E9 tagged as not-a-virus:AdWare.Win32.Altnet.a. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\A5D7C837-830B-45F1-91AF-20A931\6040AB3A-93EB-4647-BA58-88057F tagged as not-a-virus:AdWare.Win32.Altnet.a. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\A5D7C837-830B-45F1-91AF-20A931\66D809EF-9936-4610-A4AD-B56DD1 tagged as not-a-virus:AdWare.Win32.BrilliantDigital.1007. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\A5D7C837-830B-45F1-91AF-20A931\826D4536-6707-4B5C-9708-54B6C7 tagged as not-a-virus:AdWare.Win32.Altnet.d. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\A5D7C837-830B-45F1-91AF-20A931\9BE6A0B3-682F-4D6D-B38A-1E9321 tagged as not-a-virus:AdWare.Win32.Altnet.g. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\A5D7C837-830B-45F1-91AF-20A931\A90D4745-C17A-42F7-AD14-4BDC35 tagged as not-a-virus:AdWare.Win32.Altnet.a. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\A5D7C837-830B-45F1-91AF-20A931\B376FA39-2DAF-453B-810A-C000B4 tagged as not-a-virus:AdWare.Win32.BrilliantDigital.1007. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\A5D7C837-830B-45F1-91AF-20A931\B50174A4-3C7F-4CD7-82DB-BA1945 tagged as not-a-virus:AdWare.Win32.Altnet.a. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\A5D7C837-830B-45F1-91AF-20A931\B53D9B43-E970-4829-A485-71632F tagged as not-a-virus:AdWare.Win32.Altnet.a. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\A5D7C837-830B-45F1-91AF-20A931\DA70ED7F-1F32-4F31-B2BA-124832 tagged as not-a-virus:AdWare.Win32.Altnet.a. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\A5D7C837-830B-45F1-91AF-20A931\DDEF3FD1-0154-4E0E-A474-C8D91F tagged as not-a-virus:AdWare.Win32.Altnet.h. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\A5D7C837-830B-45F1-91AF-20A931\FAD3CD3F-0605-4876-BF0C-248B9F tagged as not-a-virus:AdTool.Win32.MyWebSearch.o. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\E85ABE43-F5D7-4159-9F3E-D66B6A\017E281F-466B-4AEE-A2F4-DA63EF tagged as not-a-virus:AdWare.Win32.RXBar.d. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\E85ABE43-F5D7-4159-9F3E-D66B6A\6BBA9857-9C81-41D2-A962-608D6E tagged as not-a-virus:AdWare.Win32.RXBar.e. No Action Taken.
    File C:\Program Files\Microsoft AntiSpyware\Quarantine\F0308F69-CAB7-4573-872F-07BF5A\DD73669C-5D0C-4854-84A0-D2CAF6 tagged as not-a-virus:AdWare.Win32.180Solutions.al. No Action Taken.
    File C:\Program Files\Mozilla Firefox\components\nsBrowserOpt.dll tagged as not-a-virus:AdWare.Win32.BHO.wt. No Action Taken.
    File C:\Program Files\Mozilla Firefox\plugins\NPMyWebS.dll tagged as not-a-virus:AdTool.Win32.MyWebSearch.i. No Action Taken.
    File C:\Program Files\MSN Messenger\riched20.dll tagged as not-a-virus:AdTool.Win32.MyWebSearch. No Action Taken.
     
    arttu32, Feb 20, 2008
    #3
  4. Hujo

    Hujo Guest

    Rumpaa sampaa karampaa

    Poista lisää poista sovelutuksesta

    SweetIM For Internet Explorer
    MySidesearch Search Assistant
    SWEETIE
    AdvancedCleaner Free
    Seekmo

    poista vikasiesossa kansiot

    C:\Program Files\Macrogaming
    C:\Program Files\AdvancedCleaner Free

    C:\Program Files\Seekmo

    ========

    SCANNAA HJT;LLÄ MERKKAA PAINA fIX CHECKED

    R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
    O2 - BHO: MySidesearch Search Assistant - {1648E328-3E5A-4EA5-A9C6-E5F09EE272DA} - C:\WINDOWS\system32\mysidesearch_sidebar.dll
    O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
    O2 - BHO: dcads - {6FC3C36D-7635-4D43-BA62-0D9D2F2CD06E} - C:\WINDOWS\system32\nstE5.dll
    O2 - BHO: superiorads browser enhancer - {79F562E5-768C-4494-8E6C-824ADA4A9C2C} - C:\WINDOWS\system32\sprt_ads.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
    O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
    O4 - HKLM\..\Run: [SM_IAN] C:\Program Files\AdvancedCleaner Free\ian_monitor.exe
    O4 - HKLM\..\Run: [SeekmoOE] C:\Program Files\Seekmo\bin\10.0.406.0\OEAddOn.exe
    O4 - HKLM\..\Run: [SeekmoSA] "C:\Program Files\Seekmo\bin\10.0.406.0\SeekmoSA.exe"
    O4 - HKLM\..\Run: [NI.UGDCFI_0001_N122M1712] "C:\Documents and Settings\Legend\Application Data\installer_fi[1].exe"
    O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
    O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.ht...FI_ZNxdm824CQUS

    ===============

    Lataa SmitfraudFix (c) S!Ri
    Pura sisältö (kansio nimeltä SmitfraudFix) työpöydällesi:

    Avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
    Valitse optio #1 - Search kirjoittamalla 1 ja painamalla "Enter"; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa).
    Postita tämän tekstitiedoston sisältö viestiketjuusi.

    Huomaa : process.exe filun tunnistaa jotkut Anti-virus ohjelmat (AntiVir, Dr.Web, Kaspersky) "Haittakaluna"; se ei ole virus, vaan ohjelma joka pysäyttää prosesseja. A/V ohjelmat eivät pysty tunnistamaan hyvän ja pahan käytön tälläisten ohjelmian väliltä, silloin ne saattavat varoittaa käyttäjää.


    ============

    1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
    combofix1
    combofix2

    2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

    ====

    Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

    Käynnistä koneesi vikasietotilaan:

    sammuta ja käynnistä
    käynnistyksen yhteydessä hakkaa F8 nappia
    valitse nuolinäppäimellä vikasietotila
    paina enter ja enter
    valitse käyttäjätilisi
    paina kyllä

    Jossakin koneissa hakataan F8:sin sijasta F5:tä

    " Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
    " Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
    " Paina Y käynnistääksesi skriptin.
    " Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
    " Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
    " Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
    " Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
    " Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
    " Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.
     
    Last edited by a moderator: Feb 20, 2008
    Hujo, Feb 20, 2008
    #4
  5. arttu32

    arttu32 Member

    Joined:
    Feb 19, 2008
    Messages:
    5
    Likes Received:
    0
    Trophy Points:
    11
    AVG ei jostain syystä tee automaattisesti viruslokia vaikka asetukset ovat ohjeiden mukaiset, mutta näillä ennen antamillasi ohjeilla on ongelmat poistunut ja koneesta tullut nopeampi. AVG kyllä löysi spywarea koneelta mutta mitään raporttia niistä se ei tee, karanteenin kyllä laittaa.
     
    arttu32, Feb 22, 2008
    #5
  6. Hujo

    Hujo Guest

    scannaa uusi hjt;n loki
     
    Hujo, Feb 22, 2008
    #6
  7. arttu32

    arttu32 Member

    Joined:
    Feb 19, 2008
    Messages:
    5
    Likes Received:
    0
    Trophy Points:
    11
    Uusi thj loki

    Logfile of HijackThis v1.99.1
    Scan saved at 13:43:36, on 22.2.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Creative\Shared Files\CamTray.exe
    C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
    C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\WINDOWS\system32\PSIService.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\unzipped\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://finnish.toggle.com/index.php?rvs=hompag
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/*http://www.yahoo.com/ext/search/search.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr7/*http://www.yahoo.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: (no name) - {B9341481-E0DC-479A-9970-2018DE3E0CB6} - C:\WINDOWS\system32\cmud.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Program Files\Creative\Shared Files\CamTray.exe
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
    O4 - HKLM\..\Run: [spa_start] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\sprt_ads.dll" DllStart
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Avaa uuteen etuvälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/230?124be78767444ab6be94112dcfaaf238
    O8 - Extra context menu item: Avaa uuteen taustavälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/229?124be78767444ab6be94112dcfaaf238
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
    O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
     
    arttu32, Feb 22, 2008
    #7
  8. Hujo

    Hujo Guest

    scannaa hjt;llä merkkaa paina Fix checked

    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    O4 - HKLM\..\Run: [spa_start] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\sprt_ads.dll" DllStart

    Mihkä oot virustorjunnan heittänyt ja palomuurin
     
    Hujo, Feb 22, 2008
    #8
  9. arttu32

    arttu32 Member

    Joined:
    Feb 19, 2008
    Messages:
    5
    Likes Received:
    0
    Trophy Points:
    11
    Tässä viimeisin Hjt loki (nyt meni nimikin oikein)Logfile of HijackThis v1.99.1
    Scan saved at 19:26:36, on 22.2.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Creative\Shared Files\CamTray.exe
    C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
    C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\WINDOWS\system32\PSIService.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZENG12.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\unzipped\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://finnish.toggle.com/index.php?rvs=hompag
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/*http://www.yahoo.com/ext/search/search.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr7/*http://www.yahoo.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: (no name) - {B9341481-E0DC-479A-9970-2018DE3E0CB6} - C:\WINDOWS\system32\cmud.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Program Files\Creative\Shared Files\CamTray.exe
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
    O4 - HKLM\..\Run: [spa_start] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\sprt_ads.dll" DllStart
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Avaa uuteen etuvälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/230?124be78767444ab6be94112dcfaaf238
    O8 - Extra context menu item: Avaa uuteen taustavälilehteen - res://C:\Program Files\Windows Live Toolbar\Components\fi-fi\msntabres.dll.mui/229?124be78767444ab6be94112dcfaaf238
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
    O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe

     
    arttu32, Feb 22, 2008
    #9
  10. Hujo

    Hujo Guest

    laita piilotiedostot näkyviin

    * Klikkaa Käynnistä.
    * Avaa Oma Tietokone.
    * Valitse Työkalut ylämenusta ja klikkaa Kansion asetukset.
    * Valitse Näytä välilehti.
    * Piilotiedostot/kansiot kohdalla valitse Näytä piilotetut tiedostot ja kansiot.
    * Poista rasti ruudusta -> Piilota suojatut käyttöjärjestelmätiedostot
    * Klikkaa Kyllä varmistaaksesi muutokset.
    * Klikkaa OK.

    poista
    C:\WINDOWS\system32\sprt_ads.dll

    laita piilotiedostot pois näkyvistä
     
    Hujo, Feb 22, 2008
    #10

Share This Page