HJT-Log

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by JereHakal, Jan 6, 2009.

Page 1 of 2
  1. JereHakal

    JereHakal Regular member

    Joined:
    Oct 18, 2008
    Messages:
    118
    Likes Received:
    0
    Trophy Points:
    26
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:01:34 PM, on 1/6/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Creative\Shared Files\CTAudSvc.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\system32\svchost.exe
    C:\PROGRA~1\AVG\AVG8\avgam.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\AVG\AVG8\avgnsx.exe
    C:\PROGRA~1\AVG\AVG8\avgemc.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\CTXFIHLP.EXE
    C:\Program Files\FlashGet\flashget.exe
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\Unlocker\UnlockerAssistant.exe
    C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
    C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\program files\steam\steam.exe
    C:\Documents and Settings\JereH\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Rockstar Games\Rockstar Games Social Club\1_1_3_0\RGSC.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\foobar2000\foobar2000.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Last.fm\LastFM.exe
    C:\Program Files\iTunes\iTunes.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceHelper.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\distnoted.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\SyncServer.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.codecguide.com/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O2 - BHO: (no name) - {E9B5BA28-C732-49DC-94CE-9079F7F75F4E} - (no file)
    O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
    O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
    O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\flashget.exe /min
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
    O4 - HKLM\..\Run: [16 test dupe acid] C:\Documents and Settings\All Users\Application Data\dumb tray 16 test\comp noun.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
    O4 - HKCU\..\Run: [RGSC] C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent
    O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
    O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\JereH\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
    O4 - HKCU\..\Run: [BOOK CHIC] C:\DOCUME~1\JereH\APPLIC~1\CLOSED~1\phone knob.exe
    O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
    O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
    O8 - Extra context menu item: Download with NetPumper - C:\Program Files\NetPumper\AddUrl.htm
    O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
    O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
    O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
    O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
    O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1228424905140
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - AppInit_DLLs: avgrsstx.dll,wbsys.dll
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
    O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
    O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
    O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

    --
    End of file - 8184 bytes
     
    JereHakal, Jan 6, 2009
    #1
  2. Hujo

    Hujo Guest

    scannaa hjt:llä merkkaa paina Fix checked

    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: (no name) - {E9B5BA28-C732-49DC-94CE-9079F7F75F4E} - (no file)
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\JereH\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c

    ============

    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
    Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
    3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
    5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
    6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
    7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
    löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
    Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    8. Lähetä lokin sisältö seuraavassa viestissäsi
     
    Hujo, Jan 6, 2009
    #2
  3. JereHakal

    JereHakal Regular member

    Joined:
    Oct 18, 2008
    Messages:
    118
    Likes Received:
    0
    Trophy Points:
    26
    Malwarebytes' Anti-Malware 1.32
    Database version: 1625
    Windows 5.1.2600 Service Pack 3

    1/7/2009 3:40:36 PM
    mbam-log-2009-01-07 (15-40-36).txt

    Scan type: Full Scan (C:\|D:\|E:\|F:\|)
    Objects scanned: 318679
    Time elapsed: 1 hour(s), 11 minute(s), 4 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 13
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 13
    Files Infected: 208

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_CLASSES_ROOT\alsali (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\alsali.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{8dfe3882-5474-4010-bf17-544d1d390117} (Rogue.PestPatrol) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{fef72f04-58f1-433f-8b51-4c6e85b4605b} (Rogue.PestPatrol) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{a8954909-1f0f-41a5-a7fa-3b376d69e226} (Rogue.PestPatrol) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{e9b5ba28-c732-49dc-94ce-9079f7f75f4e} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\netpumper (Adware.NetPumper) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with NetPumper (Adware.NetPumper) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/x-netpumper-detector (Adware.NetPumper) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\NetPumper (Adware.NetPumper) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\anti-leech alnn (Trojan.AntiLeechPlugin) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@anti-leech.com/anti-leech plugin,version=1.0.2.3 (Trojan.AntiLeechPlugin) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Anti-Leech (Trojan.AntiLeechPlugin) -> Quarantined and deleted successfully.

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    C:\Program Files\NetPumper (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\props (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\tmp (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\tmp\prop-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\tmp\props (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\tmp\text-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\Anti-Leech (Trojan.AntiLeechPlugin) -> Quarantined and deleted successfully.
    C:\Program Files\Anti-Leech\ALNN (Trojan.AntiLeechPlugin) -> Quarantined and deleted successfully.

    Files Infected:
    C:\Program Files\Anti-Leech\ALNN\alhlp.exe (Trojan.AntiLeechPlugin) -> Quarantined and deleted successfully.
    C:\Program Files\Anti-Leech\ALNN\npalnn.dll (Trojan.AntiLeechPlugin) -> Quarantined and deleted successfully.
    C:\Program Files\Anti-Leech\ALNN\setup2.exe (Rogue.Installer) -> Quarantined and deleted successfully.
    C:\Program Files\Opera\program\plugins\alhlp.exe (Trojan.AntiLeechPlugin) -> Quarantined and deleted successfully.
    C:\Program Files\Opera\program\plugins\npalnn.dll (Trojan.AntiLeechPlugin) -> Quarantined and deleted successfully.
    C:\Program Files\Mozilla Firefox\plugins\alhlp.exe (Trojan.AntiLeechPlugin) -> Quarantined and deleted successfully.
    C:\Program Files\Mozilla Firefox\plugins\npalnn.dll (Trojan.AntiLeechPlugin) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{73530B66-2471-4166-A103-905D64D0E156}\RP46\A0017038.exe (Trojan.AntiLeechPlugin) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\AddUrl.htm (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\uninstall.exe (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\commonheadfoot.htm (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\compat.htm (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\details.htm (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\features.htm (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\index.htm (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\mainwin.htm (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\nphelp.css (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\prefwindow.htm (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\register.htm (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\schedwin.htm (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\tips.htm (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\apllimit.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\bandwidthpanel.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\buttons.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\cmdadd.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\cmdaddtoschedule.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\cmddetails.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\cmdeditschedule.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\cmdfolder.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\cmdhelp.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\cmdopen.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\cmdopenfolder.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\cmdpause.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\cmdprefs.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\cmdremove.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\cmdresume.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\cmdselectall.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\detailwin-wide.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\detailwin.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\droptoschedule.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\editbandwidth.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\ignlimit.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\limserver.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\limservergold.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\limuser.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\mainwin.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\moveicons.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\prefw-bandwidth.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\prefw-connections.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\prefw-general.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\prefw-login.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\prefw-monitoring.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\prefw-proxy-ftp.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\prefw-proxy-http.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\register-1.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\register-2.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\register-3-1.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\register-3-2.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\schedulewin.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\scnoresume.bmp (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\scnoresume.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\scresumes.bmp (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\scresumes.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\scunk.bmp (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\scunk.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\stanalyzing.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\starticon.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\stcompleted.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\stfatal.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\stinpro.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\stnhelp-old.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\stnhelp.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\stopicon.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\stpaused.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\stqueued.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\stretrying.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\stscheduled.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\summary.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\throtdn.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\zoombtn.gif (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\entries (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\format (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\apllimit.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\bandwidthpanel.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\buttons.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\cmdadd.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\cmdaddtoschedule.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\cmddetails.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\cmdeditschedule.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\cmdfolder.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\cmdhelp.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\cmdopen.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\cmdopenfolder.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\cmdpause.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\cmdprefs.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\cmdremove.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\cmdresume.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\cmdselectall.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\detailwin-wide.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\detailwin.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\droptoschedule.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\editbandwidth.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\ignlimit.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\limserver.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\limservergold.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\limuser.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\mainwin.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\moveicons.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\prefw-bandwidth.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\prefw-connections.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\prefw-general.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\prefw-login.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\prefw-monitoring.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\prefw-proxy-ftp.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\prefw-proxy-http.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\register-1.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\register-2.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\register-3-1.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\register-3-2.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\schedulewin.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\scnoresume.bmp.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\scnoresume.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\scresumes.bmp.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\scresumes.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\scunk.bmp.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\scunk.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\stanalyzing.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\starticon.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\stcompleted.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\stfatal.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\stinpro.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\stnhelp-old.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\stnhelp.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\stopicon.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\stpaused.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\stqueued.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\stretrying.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\stscheduled.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\summary.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\throtdn.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\prop-base\zoombtn.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\apllimit.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\bandwidthpanel.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\buttons.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\cmdadd.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\cmdaddtoschedule.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\cmddetails.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\cmdeditschedule.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\cmdfolder.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\cmdhelp.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\cmdopen.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\cmdopenfolder.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\cmdpause.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\cmdprefs.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\cmdremove.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\cmdresume.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\cmdselectall.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\detailwin-wide.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\detailwin.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\droptoschedule.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\editbandwidth.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\ignlimit.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\limserver.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\limservergold.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\limuser.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\mainwin.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\moveicons.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\prefw-bandwidth.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\prefw-connections.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\prefw-general.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\prefw-login.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\prefw-monitoring.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\prefw-proxy-ftp.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\prefw-proxy-http.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\register-1.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\register-2.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\register-3-1.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\register-3-2.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\schedulewin.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\scnoresume.bmp.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\scnoresume.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\scresumes.bmp.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\scresumes.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\scunk.bmp.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\scunk.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\stanalyzing.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\starticon.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\stcompleted.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\stfatal.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\stinpro.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\stnhelp-old.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\stnhelp.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\stopicon.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\stpaused.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\stqueued.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\stretrying.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\stscheduled.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\summary.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\throtdn.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\Program Files\NetPumper\help\images\.svn\text-base\zoombtn.gif.svn-base (Adware.NetPumper) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\c.ico (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\m.ico (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\p.ico (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\s.ico (Malware.Trace) -> Quarantined and deleted successfully.
    C:\Documents and Settings\JereH\Favorites\Search Online.url (Rogue.Link) -> Quarantined and deleted successfully.
    C:\Documents and Settings\JereH\Favorites\VIP Casino.url (Rogue.Link) -> Quarantined and deleted successfully.
    C:\Documents and Settings\JereH\Favorites\Cheap Pharmacy Online.url (Rogue.Link) -> Quarantined and deleted successfully.
    C:\Documents and Settings\JereH\Favorites\SMS TRAP.url (Rogue.Link) -> Quarantined and deleted successfully.

    Ei Jeesus D:.

    Ja tässä vielä HJT jos kiinnostaa ;E.
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 3:41:57 PM, on 1/7/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Creative\Shared Files\CTAudSvc.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\system32\svchost.exe
    C:\PROGRA~1\AVG\AVG8\avgam.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\AVG\AVG8\avgnsx.exe
    C:\PROGRA~1\AVG\AVG8\avgemc.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\CTXFIHLP.EXE
    C:\Program Files\FlashGet\flashget.exe
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Unlocker\UnlockerAssistant.exe
    C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\program files\steam\steam.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Rockstar Games\Rockstar Games Social Club\1_1_3_0\RGSC.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\foobar2000\foobar2000.exe
    C:\Program Files\Last.fm\LastFM.exe
    C:\Program Files\uTorrent\uTorrent.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\Documents and Settings\JereH\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
    C:\Program Files\iTunes\iTunes.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.codecguide.com/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
    O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
    O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\flashget.exe /min
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
    O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
    O4 - HKLM\..\Run: [16 test dupe acid] C:\Documents and Settings\All Users\Application Data\dumb tray 16 test\comp noun.exe
    O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
    O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
    O4 - HKCU\..\Run: [RGSC] C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent
    O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
    O4 - HKCU\..\Run: [BOOK CHIC] C:\DOCUME~1\JereH\APPLIC~1\CLOSED~1\phone knob.exe
    O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
    O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
    O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
    O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
    O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
    O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
    O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1228424905140
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - AppInit_DLLs: avgrsstx.dll,wbsys.dll
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
    O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
    O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
    O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

    --
    End of file - 7312 bytes

     
    JereHakal, Jan 7, 2009
    #3
  4. JereHakal

    JereHakal Regular member

    Joined:
    Oct 18, 2008
    Messages:
    118
    Likes Received:
    0
    Trophy Points:
    26
    Nyt tuli kahteen kertaan, eka viesti ei näyttänyt menevän, latasi vain tyhjän sivun :E sitten sitä ei näkynyt niin ajattelin ettei toimi kun niin pitkä D:
     
    Last edited: Jan 7, 2009
    JereHakal, Jan 7, 2009
    #4
  5. Hujo

    Hujo Guest

    Scannaa koneesi Kaspersky Online Scannerin

    Ohjelman käynnistyessä kysytään sallitaanko ActiveX -komponentin asentamisen Kasperskyltä, klikkaa Kyllä.
    " Ohjelma käynnistyy ja aloittaa viimeisimpien tunnistetiedostojen lataamisen.
    " Kun skanneri on asennettu ja tunnistetiedot ladattu, klikkaa Next.
    " Klikkaa nyt asetuksia, Scan Settings
    " Tarkista asetuksista, että seuraavat ovat valittuina:
    o Scan using the following Anti-Virus database:
    + Extended (Jos valittavissa, muuten valitse Standard)
    o Scan Options:
    + Scan Archives
    + Scan Mail Bases
    " Klikkaa OK
    " Nyt valitse "select a target to scan" otsikon alta Oma Tietokone, My Computer
    " Skannaus vie aikaa, joten ole kärsivällinen. Kun skannaus on valmis saat ilmoituksen, jos koneesi on saastunut.
    " Klikkaa nyt Save as Text-painiketta.
    " Tallenna tiedosto työpöydällesi.
    " Mikäli haluat jatkaa asian käsittelyä foorumissa niin kopioi tiedoston sisältö viestiisi.
     
    Hujo, Jan 7, 2009
    #5
  6. JereHakal

    JereHakal Regular member

    Joined:
    Oct 18, 2008
    Messages:
    118
    Likes Received:
    0
    Trophy Points:
    26
    Joo kiitoksia, aika paljon löytyi kyllä noita spywareja :D.
     
    JereHakal, Jan 8, 2009
    #6
  7. Hujo

    Hujo Guest

    Lataa Tästä Ccleaner
    CCleaner v 2.14.750.- Standard Build, ÄLÄ aseenna Yahoo toolbaria!
    Asennuksessa poista merkki/rasti kohdasta "asenna Yahoo! toolbar/työkalupalkki".
    Asennuksen jälkeen aukaise CCleaneri.
    Valitse vasemmalta pystyrivistä Options.
    Valitse viereisestä pystyrivistä Settings.
    Language kohtaan valitse Suomi.

    Puhdistaja
    Valitse vasemmalta pystyrivistä Puhdistaja.
    Paina alhaalta Tutki.
    Nyt CCleaneri tutkii, mitä voidaan poistaa (tempit, cookiessit jne.).
    Kun tutkiminen on valmis, paina Aja CCleaner.
    Nyt CCleaneri poistaa löydetyt tempit, cookiessit jne.

    Rekisterin virheiden korjaus
    Valitse vasemmalta pystyrivistä Rekisteri.
    Paina alhaalta Etsi rekisterin virheitä.
    Kun etsintä on valmis ja olet varma, että haluat korjata ne rivit jotka ovat merkattuja, niin paina Korjaa valitut rekisterin virheet.
    Sinulta kysytään "haluatko varmuuskopioida muutokset rekisteriin", paina Kyllä. Tallenna varmuuskopio vaikka "Omat tiedostot" -kansioon.
    Klikkaa uudesta aukeavasta ikkunasta Korjaa kaikki valitut virheet.
    Saat vielä varmistus kysymyksen, paina Ok.
    Kun virheet on korjattu, paina Sulje.
    Nyt voit sulkea CCleanerin painamalla oikealta ylhäältä punaista rastia.

    Poista lisää poista sovelutuksesta

    NetPumper

    Poista kansio vikasiedossa

    C:\Program Files\NetPumper jos vielä nuo näkyy
     
    Last edited by a moderator: Jan 8, 2009
    Hujo, Jan 8, 2009
    #7
  8. JereHakal

    JereHakal Regular member

    Joined:
    Oct 18, 2008
    Messages:
    118
    Likes Received:
    0
    Trophy Points:
    26
    Ole tuon tehnytkin, ja on crap cleaneri :E.

     
    JereHakal, Jan 8, 2009
    #8
  9. Hujo

    Hujo Guest

    lisäsin tuohon ylös vielä pikku tarkistukset
     
    Hujo, Jan 8, 2009
    #9
  10. JereHakal

    JereHakal Regular member

    Joined:
    Oct 18, 2008
    Messages:
    118
    Likes Received:
    0
    Trophy Points:
    26
    Joo, poistan sen kun pääsen kotiin, tiedän mistä se on tullut :E.
     
    JereHakal, Jan 8, 2009
    #10
  11. Hujo

    Hujo Guest

    Scannaa sitten uusi hjt:n loki.
    Jostain niitä aina Ilmaatuu, kaupan pikku kylkiäiset ;)
     
    Hujo, Jan 8, 2009
    #11
  12. JereHakal

    JereHakal Regular member

    Joined:
    Oct 18, 2008
    Messages:
    118
    Likes Received:
    0
    Trophy Points:
    26
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 2:42:21 PM, on 1/8/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Creative\Shared Files\CTAudSvc.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\system32\svchost.exe
    C:\PROGRA~1\AVG\AVG8\avgam.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\AVG\AVG8\avgnsx.exe
    C:\PROGRA~1\AVG\AVG8\avgemc.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\CTXFIHLP.EXE
    C:\Program Files\FlashGet\flashget.exe
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Unlocker\UnlockerAssistant.exe
    C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\program files\steam\steam.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\foobar2000\foobar2000.exe
    C:\Program Files\Last.fm\LastFM.exe
    C:\Program Files\uTorrent\uTorrent.exe
    C:\Documents and Settings\JereH\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\QuickTime\QuicktimePlayer.exe
    C:\Program Files\Webteh\BSplayerPro\bsplayer.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.codecguide.com/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
    O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
    O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\flashget.exe /min
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
    O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
    O4 - HKLM\..\Run: [16 test dupe acid] C:\Documents and Settings\All Users\Application Data\dumb tray 16 test\comp noun.exe
    O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
    O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
    O4 - HKCU\..\Run: [RGSC] C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent
    O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
    O4 - HKCU\..\Run: [BOOK CHIC] C:\DOCUME~1\JereH\APPLIC~1\CLOSED~1\phone knob.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
    O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
    O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
    O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
    O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
    O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
    O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1228424905140
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - AppInit_DLLs: avgrsstx.dll,wbsys.dll
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
    O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
    O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
    O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

    --
    End of file - 7564 bytes
     
    JereHakal, Jan 8, 2009
    #12
  13. Hujo

    Hujo Guest

    Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

    Käynnistä koneesi vikasietotilaan:

    sammuta ja käynnistä
    käynnistyksen yhteydessä hakkaa F8 nappia
    valitse nuolinäppäimellä vikasietotila
    paina enter ja enter
    valitse käyttäjätilisi
    paina kyllä

    Jossakin koneissa hakataan F8:sin sijasta F5:tä

    " Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
    " Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
    " Paina Y käynnistääksesi skriptin.
    " Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
    " Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
    " Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
    " Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
    " Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
    " Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.
     
    Hujo, Jan 8, 2009
    #13
  14. JereHakal

    JereHakal Regular member

    Joined:
    Oct 18, 2008
    Messages:
    118
    Likes Received:
    0
    Trophy Points:
    26

    SDFix: Version 1.240
    Run by JereH on Thu 01/08/2009 at 11:17 PM

    Microsoft Windows XP [Version 5.1.2600]
    Running From: C:\Documents and Settings\JereH\Desktop\SDFix

    Checking Services :


    Restoring Default Security Values
    Restoring Default Hosts File

    Rebooting


    Checking Files :

    No Trojan Files Found






    Removing Temp Files

    ADS Check :



    Final Check :

    catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-01-09 00:38:56
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden services & system hive ...

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
    "s1"=dword:2df9c43f
    "s2"=dword:110480d0
    "h0"=dword:00000001

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
    "p0"="C:\Program Files\DAEMON Tools Pro\"
    "h0"=dword:00000000
    "hdf12"=hex:f5,f8,2f,63,cb,ff,b6,f6,87,cc,5a,6b,6a,95,ac,94,40,9f,31,f3,80,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
    "a0"=hex:20,01,00,00,e2,ba,95,73,61,75,dd,ec,f6,4d,a9,35,42,19,c3,93,54,..
    "hdf12"=hex:b6,33,fa,d7,33,49,3f,ef,53,ea,aa,99,e2,9e,49,68,16,6b,85,8b,6c,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
    "hdf12"=hex:7a,a5,78,39,92,8f,4f,01,1b,c3,23,e7,06,47,ba,24,a7,60,2f,86,76,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1]
    "hdf12"=hex:80,76,ee,65,51,53,7b,19,9f,95,d9,ea,2f,79,28,02,ba,6e,50,fc,d1,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2]
    "hdf12"=hex:c7,98,61,5d,4a,03,a8,80,e6,18,ad,9b,7b,29,18,04,4e,04,86,dd,35,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq3]
    "hdf12"=hex:eb,ea,8a,6d,09,cb,0f,48,77,92,d4,d5,5f,e3,82,8a,1b,2a,0b,db,0d,..
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
    "p0"="C:\Program Files\DAEMON Tools Pro\"
    "h0"=dword:00000000
    "hdf12"=hex:f5,f8,2f,63,cb,ff,b6,f6,87,cc,5a,6b,6a,95,ac,94,40,9f,31,f3,80,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
    "a0"=hex:20,01,00,00,e2,ba,95,73,61,75,dd,ec,f6,4d,a9,35,42,19,c3,93,54,..
    "hdf12"=hex:b6,33,fa,d7,33,49,3f,ef,53,ea,aa,99,e2,9e,49,68,16,6b,85,8b,6c,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
    "hdf12"=hex:7a,a5,78,39,92,8f,4f,01,1b,c3,23,e7,06,47,ba,24,a7,60,2f,86,76,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1]
    "hdf12"=hex:80,76,ee,65,51,53,7b,19,9f,95,d9,ea,2f,79,28,02,ba,6e,50,fc,d1,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2]
    "hdf12"=hex:c7,98,61,5d,4a,03,a8,80,e6,18,ad,9b,7b,29,18,04,4e,04,86,dd,35,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq3]
    "hdf12"=hex:eb,ea,8a,6d,09,cb,0f,48,77,92,d4,d5,5f,e3,82,8a,1b,2a,0b,db,0d,..

    scanning hidden registry entries ...

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
    "TracesProcessed"=dword:00000b3d
    "TracesSuccessful"=dword:00000036

    scanning hidden files ...

    scan completed successfully
    hidden processes: 0
    hidden services: 0
    hidden files: 0


    Remaining Services :




    Authorized Application Key Export:

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\FlashGet\\flashget.exe"="C:\\Program Files\\FlashGet\\flashget.exe:*:Enabled:Flashget"
    "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:æTorrent"
    "C:\\Program Files\\AVG\\AVG8\\avgupd.exe"="C:\\Program Files\\AVG\\AVG8\\avgupd.exe:*:Enabled:avgupd.exe"
    "C:\\Program Files\\AVG\\AVG8\\avgemc.exe"="C:\\Program Files\\AVG\\AVG8\\avgemc.exe:*:Enabled:avgemc.exe"
    "C:\\Program Files\\AVG\\AVG8\\avgnsx.exe"="C:\\Program Files\\AVG\\AVG8\\avgnsx.exe:*:Enabled:avgnsx.exe"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"
    "C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
    "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
    "C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox"
    "C:\\Program Files\\Steam\\steamapps\\jerehakala\\counter-strike\\hl.exe"="C:\\Program Files\\Steam\\steamapps\\jerehakala\\counter-strike\\hl.exe:*:Enabled:Half-Life Launcher"
    "C:\\Program Files\\Steam\\steamapps\\jerehakala\\counter-strike source\\hl2.exe"="C:\\Program Files\\Steam\\steamapps\\jerehakala\\counter-strike source\\hl2.exe:*:Enabled:hl2"
    "C:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"="C:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe:*:Disabled:Rockstar Games Social Club"
    "C:\\Program Files\\iPhone Tunnel Suite\\iTunnel\\iTunnel.exe"="C:\\Program Files\\iPhone Tunnel Suite\\iTunnel\\iTunnel.exe:*:Enabled:iTunnel"
    "C:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"="C:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe:*:Enabled:Adobe CSI CS4"
    "C:\\Program Files\\mIRC\\mirc.exe"="C:\\Program Files\\mIRC\\mirc.exe:*:Enabled:mIRC"
    "C:\\Program Files\\Microsoft Games\\Age of Empires II\\age2_x1.exe"="C:\\Program Files\\Microsoft Games\\Age of Empires II\\age2_x1.exe:*:Enabled:Age of Empires II Expansion"
    "C:\\Program Files\\Microsoft Games\\Age of Empires II\\empires2.exe"="C:\\Program Files\\Microsoft Games\\Age of Empires II\\empires2.exe:*:Enabled:Age of Empires II"
    "C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
    "C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
    "C:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\LaunchGTAIV.exe"="C:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\LaunchGTAIV.exe:*:Enabled:Grand Theft Auto IV"
    "C:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\GTAIV.exe"="C:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\GTAIV.exe:*:Enabled:Grand Theft Auto IV"
    "C:\\Program Files\\Steam\\Steam.exe"="C:\\Program Files\\Steam\\Steam.exe:*:Enabled:Steam"
    "C:\\Program Files\\Deep Silver\\S.T.A.L.K.E.R. - Clear Sky\\bin\\xrEngine.exe"="C:\\Program Files\\Deep Silver\\S.T.A.L.K.E.R. - Clear Sky\\bin\\xrEngine.exe:*:Enabled:S.T.A.L.K.E.R. - Clear Sky (CLI)"
    "C:\\Program Files\\Deep Silver\\S.T.A.L.K.E.R. - Clear Sky\\bin\\dedicated\\xrEngine.exe"="C:\\Program Files\\Deep Silver\\S.T.A.L.K.E.R. - Clear Sky\\bin\\dedicated\\xrEngine.exe:*:Enabled:S.T.A.L.K.E.R. - Clear Sky (SRV)"
    "C:\\Program Files\\Mozilla Firefox\\plugins\\alhlp.exe"="C:\\Program Files\\Mozilla Firefox\\plugins\\alhlp.exe:*:Enabled:Anti-Leech plugin helper program"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

    Remaining Files :



    Files with Hidden Attributes :

    Thu 4 Dec 2008 211 ...H. --- "C:\Boot.BAK"
    Tue 6 Jan 2009 8,192 A.SHR --- "C:\BOOTSECT.BAK"
    Sat 3 Jan 2009 243,712 A..H. --- "C:\VAC2.dll"
    Tue 16 Dec 2008 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
    Fri 19 Dec 2008 857 ...HR --- "C:\Documents and Settings\JereH\Application Data\SecuROM\UserData\securom_v7_01.bak"

    Finished!

     
    JereHakal, Jan 8, 2009
    #14
  15. Hujo

    Hujo Guest

    scannaa uusi hjt:n loki
     
    Hujo, Jan 10, 2009
    #15
  16. JereHakal

    JereHakal Regular member

    Joined:
    Oct 18, 2008
    Messages:
    118
    Likes Received:
    0
    Trophy Points:
    26
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 3:36:49 PM, on 1/10/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Creative\Shared Files\CTAudSvc.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\system32\svchost.exe
    C:\PROGRA~1\AVG\AVG8\avgam.exe
    C:\PROGRA~1\AVG\AVG8\avgnsx.exe
    C:\PROGRA~1\AVG\AVG8\avgemc.exe
    C:\WINDOWS\Explorer.EXE
    C:\Documents and Settings\JereH\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
    C:\Program Files\Last.fm\LastFM.exe
    C:\WINDOWS\system32\CTXFIHLP.EXE
    C:\Program Files\FlashGet\flashget.exe
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Unlocker\UnlockerAssistant.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\uTorrent\uTorrent.exe
    C:\Program Files\Steam\Steam.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\foobar2000\foobar2000.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.codecguide.com/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
    O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
    O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\flashget.exe /min
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
    O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
    O4 - HKLM\..\Run: [16 test dupe acid] C:\Documents and Settings\All Users\Application Data\dumb tray 16 test\comp noun.exe
    O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
    O4 - HKCU\..\Run: [RGSC] C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent
    O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
    O4 - HKCU\..\Run: [BOOK CHIC] C:\DOCUME~1\JereH\APPLIC~1\CLOSED~1\phone knob.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
    O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
    O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
    O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
    O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
    O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
    O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1228424905140
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
    O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
    O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
    O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

    --
    End of file - 7307 bytes
     
    JereHakal, Jan 10, 2009
    #16
  17. Hujo

    Hujo Guest

    scannaa hjt:llä merkkaa paina Fix checked

    O4 - HKLM\..\Run: [16 test dupe acid] C:\Documents and Settings\All Users\Application Data\dumb tray 16 test\comp noun.exe
    O4 - HKCU\..\Run: [BOOK CHIC] C:\DOCUME~1\JereH\APPLIC~1\CLOSED~1\phone knob.exe
     
    Hujo, Jan 10, 2009
    #17
  18. JereHakal

    JereHakal Regular member

    Joined:
    Oct 18, 2008
    Messages:
    118
    Likes Received:
    0
    Trophy Points:
    26
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 1:15:50 AM, on 1/11/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Creative\Shared Files\CTAudSvc.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\system32\svchost.exe
    C:\PROGRA~1\AVG\AVG8\avgam.exe
    C:\PROGRA~1\AVG\AVG8\avgnsx.exe
    C:\PROGRA~1\AVG\AVG8\avgemc.exe
    C:\WINDOWS\Explorer.EXE
    C:\Documents and Settings\JereH\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
    C:\Program Files\Last.fm\LastFM.exe
    C:\WINDOWS\system32\CTXFIHLP.EXE
    C:\Program Files\FlashGet\flashget.exe
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Unlocker\UnlockerAssistant.exe
    C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\uTorrent\uTorrent.exe
    C:\Program Files\Steam\Steam.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\foobar2000\foobar2000.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\Windows Live\Contacts\wlcomm.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.codecguide.com/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
    O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
    O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\flashget.exe /min
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
    O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
    O4 - HKLM\..\RunOnce: [MessengerPlusLiveUninstall] "C:\DOCUME~1\JereH\LOCALS~1\Temp\MsgPlusUninstall.exe" /Cleanup
    O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
    O4 - HKCU\..\Run: [RGSC] C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent
    O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
    O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
    O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
    O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
    O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
    O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
    O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1228424905140
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
    O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
    O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
    O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

    --
    End of file - 7103 bytes


    :E Se oli siinä sitte?
     
    JereHakal, Jan 10, 2009
    #18
  19. Hujo

    Hujo Guest

    Fixsaa tuokin pois

    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O4 - HKLM\..\RunOnce: [MessengerPlusLiveUninstall] "C:\DOCUME~1\JereH\LOCALS~1\Temp\MsgPlusUninstall.exe" /Cleanup
     
    Hujo, Jan 10, 2009
    #19
  20. JereHakal

    JereHakal Regular member

    Joined:
    Oct 18, 2008
    Messages:
    118
    Likes Received:
    0
    Trophy Points:
    26
    Done, noi ois kuitenki pitäny mennä sitteku restarttaan koneen :E.
     
    JereHakal, Jan 10, 2009
    #20
Page 1 of 2

Share This Page