HJT logi / hosts

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by koivta-j, Feb 29, 2008.

  1. koivta-j

    koivta-j Member

    Joined:
    Apr 14, 2004
    Messages:
    23
    Likes Received:
    0
    Trophy Points:
    11
    Tässä olis parit jutut joihin haluaisin apua, eli onko viallisia?

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 15:07:28, on 29.2.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16608)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\system32\BacsTray.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Creative\Shared Files\CamTray.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
    C:\WINDOWS\system32\bpowmon.exe
    C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe
    C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
    C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe
    C:\Program Files\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.saunalahti.fi/jrajala/suomi.htm
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    R3 - URLSearchHook: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbSha1.dll
    O1 - Hosts: 212.150.54.250 dv-networks.com
    O1 - Hosts: 212.150.54.250 dv-networks.com
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O2 - BHO: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbSha1.dll
    O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - C:\Program Files\WS_FTP Pro\wsbho2K0.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Elisa Avustaja Plugin - {DB87CDE1-EF9C-44EB-A42F-6D0B3C72C516} - C:\Program Files\Elisa\Avustaja\IEFixItNowPlugin.dll
    O3 - Toolbar: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbSha1.dll
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [bacstray] BacsTray.exe
    O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
    O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Program Files\Creative\Shared Files\CamTray.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
    O4 - HKLM\..\Run: [tjk] C:\Program Files\BPK\tjk.exe
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [SIDEBAR] "C:\Program Files\Desktop Sidebar\dsidebar.exe"
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: HP Image Zone -pikakäynnistys.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
    O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\Paltalk.exe
    O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://sifyimg.speedera.net/sify.com/eot/tdserver.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by108fd.bay108.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/luxr/default/mjolauncher.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.0 Control) - https://ssl.extrafilm.org/upload/activex/ImageUploader3.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
    O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Broadcom Power monitoring service v1.0.1 (BPowMon) - Unknown owner - C:\WINDOWS\system32\bpowmon.exe
    O23 - Service: Pinnacle Systems tvtv Spooler (EpgSpooler) - Unknown owner - c:\progra~1\pinnacle\mediac~1\epgspo~2.exe (file missing)
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
    End of file - 10587 bytes

    Alla on hosts tiedosto, onko ok?

    # Copyright (c) 1993-1999 Microsoft Corp.
    #
    # Tämä on malli HOSTS-tiedosto Windowsin Microsoft TCP/IP:tä varten.
    #
    # Tässä tiedostossa on IP-osoitteiden kartoitus isäntänimiin.
    # Jokainen määritys tulee olla omalla rivillä. IP-osoite tulee olla ensin,
    # sitten isäntänimi. IP-osoitteen ja isäntänimen välissä tulee olla
    # vähintään yksi välimerkki.
    #
    # Lisäksi huomautuksia (kuten tämä teksti) voidaan lisätä omalle riville
    # tai tietokonenimen perään #-merkillä erotettuna.
    #
    # Esimerkki:
    #
    # 102.54.94.97 rhino.acme.com # source server
    # 38.25.63.10 x.acme.com # x client host

    127.0.0.1 localhost
    212.150.54.250 dv-networks.com
    212.150.54.250 dv-networks.com

    127.0.0.1 muser.messenger.hotmail.com
     
    koivta-j, Feb 29, 2008
    #1
  2. Hujo

    Hujo Guest

    Poista lisää poista sovelutuksesta

    Share_Accelerator_MM
    BPK
    Paltalk

    Poista kansiot vikasiedossa

    C:\Program Files\Share_Accelerator_MM
    C:\Program Files\BPK
    C:\Program Files\Paltalk Messenger

    ==========

    scannaa hjt:llä merkkaa paina Fix checked

    R3 - URLSearchHook: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbSha1.dll
    O1 - Hosts: 212.150.54.250 dv-networks.com
    O1 - Hosts: 212.150.54.250 dv-networks.com
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O3 - Toolbar: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbSha1.dll
    O4 - HKLM\..\Run: [tjk] C:\Program Files\BPK\tjk.exe
    O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\Paltalk.exe

    ================

    Lataa CWShredder
    http://www.trendmicro.com/ftp/products/online-tools/cwshredder.exe
    Ja tallenna se työpöydälle

    -Scannaa kone CWShredder avulla : Muista sulkea selain + kaikki muut ikkunat ennenkuin käytät tuota CWShredderiä.
    -Paina Fix-->näppäintä.
    -Vastaa ohjelman kysymyksiin OK.
    -Ohjelman käytyä kohteet läpi paina Next-->näppäintä.
    -Loppuyhteenvedon tulos tulee tämän jälkeen.
    -puhdistuksen jälkeen käynnistä kone uudelleen.

    Lähetä CWShredder raportti.

    ============

    Ohje AVG:n Anti-Spyware 7.5:n käyttöön
    Huom! Tässä ohjeessa sammutetaan tuo reaaliaikasuojaus (Shield). Näin vältetään tilanteet joissa suojaus estäisi esim HijackThis:n työkalun toimintaa.

    Tallenna nämä ohjeet tekstitiedostoon tai tulosta nämä, muuten et pääse niihin käsiksi vikasietotilasta

    Lataa AVG:n Anti-Spyware 7.5:n
    ja tallenna ohjelma työpöydällesi.
    o Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa.
    o Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää.
    o Käynnistä AVG:n Anti-Spyware.
    o Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta.

    o Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa.

    o Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti.
    o Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine".

    o Sitten "Reports" valikon alta:
    o Laita täppi kohtaan "Automatically generate report after every scan"
    o Ota täppi pois kohdasta"Only if threats were found"

    o Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa
    o "Resident shield is", muuta tila active:sta inactive:ksi
    o Sulje ohjelma, ÄLÄ skannaa vielä.

    Käynnistä koneesi vikasietotilaan,
    sammuta ja käynnistä
    käynnistyksen yhteydessä naputtele F8
    valitse nuoli näppäimellä vikasietotila
    paina enter ja enter

    Toisissa koneissa paukutetaan F8:sin sijasta F5:tä

    HUOM! Älä käytä muita ohjelmia AVG:n skannauksen aikana, tämä saattaa häiritä skannausta.
    o Kun vikasietotilassa, käynnistä AVG:n Anti-Spyware.
    o Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan".
    o Ewido aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa.

    Kun skannaus on valmis:
    TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions"
    o Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta.
    o Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions"
    [​IMG]
    o Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta.
    o Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle.
    o Sulje ohjelma, käynnistä kone normaalisti ja lähetä AVG:n raportti viestikejuusi.
     
    Hujo, Feb 29, 2008
    #2
  3. koivta-j

    koivta-j Member

    Joined:
    Apr 14, 2004
    Messages:
    23
    Likes Received:
    0
    Trophy Points:
    11
    Tässä on CWShredder raportti.


    **** Run Keys ****

    RUN: [SoundMan] SOUNDMAN.EXE
    RUN: [bacstray] BacsTray.exe
    RUN: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
    RUN: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
    RUN: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
    RUN: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    RUN: [Creative WebCam Tray] C:\Program Files\Creative\Shared Files\CamTray.exe
    RUN: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    RUN: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    RUN: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    RUN: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    RUN: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
    RUN: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    RUN: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
    RUN: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    RUN: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    RUN: [SIDEBAR] "C:\Program Files\Desktop Sidebar\dsidebar.exe"


    **** Browser Helper Objects ****

    BHO: [Adobe PDF Reader Link Helper] C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    BHO: [Skype add-on (mastermind)] C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    BHO: [WsftpBrowserHelper Class] C:\Program Files\WS_FTP Pro\wsbho2K0.dll
    BHO: [SSVHelper Class] C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    BHO: [Elisa Avustaja Plugin] C:\Program Files\Elisa\Avustaja\IEFixItNowPlugin.dll


    **** IE Toolbars ****



    **** IE Extensions ****

    IEExt: []
    IEExt: [Skype]
    IEExt: [Research]
    IEExt: [Research]
    IEExt: [Messenger] C:\Program Files\Messenger\msmsgs.exe


    **** Hosts File Entries ****

    HOSTS: 127.0.0.1 localhost
    HOSTS: 127.0.0.1 muser.messenger.hotmail.com
    HOSTS: 127.0.0.1 muser.messenger.hotmail.com


    **** IE Settings ****

    Default Page: http://go.microsoft.com/fwlink/?LinkId=69157
    Default Search: http://go.microsoft.com/fwlink/?LinkId=54896
    Local Page: C:\WINDOWS\system32\blank.htm
    Search Page: http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch


    **** IE Context Menu (Right click) ****

    IEContext: [Vie Microsoft E&xceliin] res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000


    **** Layered Service Providers ****

    LSP: MSAFD Tcpip [TCP/IP]
    LSP: MSAFD Tcpip [UDP/IP]
    LSP: RSVP UDP Service Provider
    LSP: RSVP TCP Service Provider
    LSP: MSAFD RfComm [Bluetooth]
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{33DE8A85-A897-4876-9712-BB268A7C14BB}] SEQPACKET 12
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{33DE8A85-A897-4876-9712-BB268A7C14BB}] DATAGRAM 12
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{FB4B9427-5132-4236-AC79-2C1DAE046F99}] SEQPACKET 11
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{FB4B9427-5132-4236-AC79-2C1DAE046F99}] DATAGRAM 11
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{BF6C761D-047A-40E0-B0EE-F85EDAFE6C98}] SEQPACKET 8
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{BF6C761D-047A-40E0-B0EE-F85EDAFE6C98}] DATAGRAM 8
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{33D275EB-DF5D-4179-9577-05AB9A8BFA8C}] SEQPACKET 7
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{33D275EB-DF5D-4179-9577-05AB9A8BFA8C}] DATAGRAM 7
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{EBB8DEA3-804A-4AF6-81A0-F7C6F79C16F8}] SEQPACKET 5
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{EBB8DEA3-804A-4AF6-81A0-F7C6F79C16F8}] DATAGRAM 5
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{ABA26F90-947B-487B-A843-BC1F121FB0ED}] SEQPACKET 6
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{ABA26F90-947B-487B-A843-BC1F121FB0ED}] DATAGRAM 6
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{C5DDA7DE-8B59-4846-8391-716BC00A2578}] SEQPACKET 4
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{C5DDA7DE-8B59-4846-8391-716BC00A2578}] DATAGRAM 4
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{5313CAB3-B9CD-4C17-B579-E56322924F76}] SEQPACKET 3
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{5313CAB3-B9CD-4C17-B579-E56322924F76}] DATAGRAM 3
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{EF397E19-A0F2-476C-8C40-B9E9F87E0BDE}] SEQPACKET 0
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{EF397E19-A0F2-476C-8C40-B9E9F87E0BDE}] DATAGRAM 0
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{287F7937-9CAF-4DB6-902C-0F15B300484B}] SEQPACKET 1
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{287F7937-9CAF-4DB6-902C-0F15B300484B}] DATAGRAM 1
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{85CABFA6-8C88-4598-9E0D-1B3E5CC0A4DD}] SEQPACKET 2
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{85CABFA6-8C88-4598-9E0D-1B3E5CC0A4DD}] DATAGRAM 2
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{72105DE2-64C9-4966-AD76-E7048F4C1FA0}] SEQPACKET 9
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{72105DE2-64C9-4966-AD76-E7048F4C1FA0}] DATAGRAM 9
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{47DD9FC4-5F1E-4586-9A6E-38C397A53230}] SEQPACKET 10
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{47DD9FC4-5F1E-4586-9A6E-38C397A53230}] DATAGRAM 10


    **** Blocked Control Panel Items ****

    BLOCKED: [ncpa.cpl] No
    BLOCKED: [odbccp32.cpl] No


    **** Downloaded Program Files ****

    {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} [http://sifyimg.speedera.net/sify.com/eot/tdserver.cab] C:\WINDOWS\system32\msvcrt.dll C:\WINDOWS\system32\mfc42.dll C:\WINDOWS\system32\olepro32.dll C:\WINDOWS\Downloaded Program Files\tdserver.ocx
    {17492023-C23A-453E-A040-C7C580BBF700} [http://go.microsoft.com/fwlink/?linkid=39204]
    {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} [C:\Program Files\Yahoo!\Common\Yinsthelper.dll]
    {4F1E5B1A-2A80-42CA-8532-2D05CB959537} [http://by108fd.bay108.hotmail.msn.com/resources/MsnPUpld.cab]
    {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} [http://zone.msn.com/bingame/luxr/default/mjolauncher.cab]
    {8AD9C840-044E-11D1-B3E9-00805F499D93} [http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab]
    {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} [http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab]
    {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} [https://ssl.extrafilm.org/upload/activex/ImageUploader3.cab]
    {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} [http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab]
    {B8BE5E93-A60C-4D26-A2DC-220313175592} [http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab]
    {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} [http://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab]
    {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} [http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab]
    {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} [http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab]
    {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} [http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab]
    {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} [http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab]
    {D27CDB6E-AE6D-11CF-96B8-444553540000} [http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab]
    {E8F628B5-259A-4734-97EE-BA914D7BE941} [http://driveragent.com/files/driveragent.cab]
    {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} [http://chat.msn.com/controls/msnchat45.cab]


    **** Windows Services ****

    [AdobeActiveFileMonitor4.0] C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
    [Alerter] %SystemRoot%\System32\svchost.exe -k LocalService
    [ALG] %SystemRoot%\System32\alg.exe
    [AppMgmt] %SystemRoot%\system32\svchost.exe -k netsvcs
    [aspnet_state] %SystemRoot%\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
    [Ati HotKey Poller] %SystemRoot%\system32\Ati2evxx.exe
    [ATI Smart] C:\WINDOWS\system32\ati2sgag.exe
    [AudioSrv] %SystemRoot%\System32\svchost.exe -k netsvcs
    [BITS] %SystemRoot%\System32\svchost.exe -k netsvcs
    [BPowMon] C:\WINDOWS\system32\bpowmon.exe
    [Browser] %SystemRoot%\System32\svchost.exe -k netsvcs
    [BthServ] %SystemRoot%\system32\svchost.exe -k bthsvcs
    [cisvc] C:\WINDOWS\System32\cisvc.exe
    [ClipSrv] %SystemRoot%\system32\clipsrv.exe
    [COMSysApp] C:\WINDOWS\System32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
    [CryptSvc] %SystemRoot%\system32\svchost.exe -k netsvcs
    [DcomLaunch] %SystemRoot%\system32\svchost -k DcomLaunch
    [Dhcp] %SystemRoot%\System32\svchost.exe -k netsvcs
    [dmadmin] %SystemRoot%\System32\dmadmin.exe /com
    [dmserver] %SystemRoot%\System32\svchost.exe -k netsvcs
    [Dnscache] %SystemRoot%\System32\svchost.exe -k NetworkService
    [EpgSpooler] c:\progra~1\pinnacle\mediac~1\epgspo~2.exe
    [ERSvc] %SystemRoot%\System32\svchost.exe -k netsvcs
    [Eventlog] %SystemRoot%\system32\services.exe
    [EventSystem] C:\WINDOWS\System32\svchost.exe -k netsvcs
    [FastUserSwitchingCompatibility] %SystemRoot%\System32\svchost.exe -k netsvcs
    [helpsvc] %SystemRoot%\System32\svchost.exe -k netsvcs
    [HidServ] %SystemRoot%\System32\svchost.exe -k netsvcs
    [HTTPFilter] %SystemRoot%\System32\svchost.exe -k HTTPFilter
    [IDriverT] "C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe"
    [ImapiService] C:\WINDOWS\System32\imapi.exe
    [iPodService] C:\Program Files\iPod\bin\iPodService.exe
    [lanmanserver] %SystemRoot%\System32\svchost.exe -k netsvcs
    [lanmanworkstation] %SystemRoot%\System32\svchost.exe -k netsvcs
    [LmHosts] %SystemRoot%\System32\svchost.exe -k LocalService
    [MDM] "C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE"
    [Messenger] %SystemRoot%\System32\svchost.exe -k netsvcs
    [mnmsrvc] C:\WINDOWS\System32\mnmsrvc.exe
    [MSDTC] C:\WINDOWS\System32\msdtc.exe
    [MSIServer] C:\WINDOWS\system32\msiexec.exe /V
    [MSSQL$PINNACLESYS] C:\Program Files\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe -sPINNACLESYS
    [MSSQLServerADHelper] C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe
    [NetDDE] %SystemRoot%\system32\netdde.exe
    [NetDDEdsdm] %SystemRoot%\system32\netdde.exe
    [Netlogon] %SystemRoot%\System32\lsass.exe
    [Netman] %SystemRoot%\System32\svchost.exe -k netsvcs
    [Nla] %SystemRoot%\System32\svchost.exe -k netsvcs
    [NtLmSsp] %SystemRoot%\System32\lsass.exe
    [NtmsSvc] %SystemRoot%\system32\svchost.exe -k netsvcs
    [ose] "C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    [PlugPlay] %SystemRoot%\system32\services.exe
    [Pml Driver HPZ12] C:\WINDOWS\system32\HPZipm12.exe
    [PolicyAgent] %SystemRoot%\System32\lsass.exe
    [ProtectedStorage] %SystemRoot%\system32\lsass.exe
    [RasAuto] %SystemRoot%\System32\svchost.exe -k netsvcs
    [RasMan] %SystemRoot%\System32\svchost.exe -k netsvcs
    [RDSessMgr] C:\WINDOWS\system32\sessmgr.exe
    [RemoteAccess] %SystemRoot%\System32\svchost.exe -k netsvcs
    [RpcLocator] %SystemRoot%\System32\locator.exe
    [RpcSs] %SystemRoot%\system32\svchost -k rpcss
    [RSVP] %SystemRoot%\System32\rsvp.exe
    [SamSs] %SystemRoot%\system32\lsass.exe
    [SCardSvr] %SystemRoot%\System32\SCardSvr.exe
    [Schedule] %SystemRoot%\System32\svchost.exe -k netsvcs
    [seclogon] %SystemRoot%\System32\svchost.exe -k netsvcs
    [SENS] %SystemRoot%\system32\svchost.exe -k netsvcs
    [SharedAccess] %SystemRoot%\System32\svchost.exe -k netsvcs
    [ShellHWDetection] %SystemRoot%\System32\svchost.exe -k netsvcs
    [Spooler] %SystemRoot%\system32\spoolsv.exe
    [SQLAgent$PINNACLESYS] C:\Program Files\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlagent.EXE -i PINNACLESYS
    [srservice] %SystemRoot%\System32\svchost.exe -k netsvcs
    [SSDPSRV] %SystemRoot%\System32\svchost.exe -k LocalService
    [stisvc] %SystemRoot%\System32\svchost.exe -k imgsvc
    [svcWRSSSDK] C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
    [SwPrv] C:\WINDOWS\System32\dllhost.exe /Processid:{09100375-5062-4566-8D64-FB5BD3A10782}
    [SysmonLog] %SystemRoot%\system32\smlogsvc.exe
    [TapiSrv] %SystemRoot%\System32\svchost.exe -k netsvcs
    [TermService] %SystemRoot%\System32\svchost -k DComLaunch
    [Themes] %SystemRoot%\System32\svchost.exe -k netsvcs
    [TrkWks] %SystemRoot%\system32\svchost.exe -k netsvcs
    [upnphost] %SystemRoot%\System32\svchost.exe -k LocalService
    [UPS] %SystemRoot%\System32\ups.exe
    [vsmon] C:\WINDOWS\system32\ZoneLabs\vsmon.exe -service
    [VSS] %SystemRoot%\System32\vssvc.exe
    [W32Time] %SystemRoot%\System32\svchost.exe -k netsvcs
    [WebClient] %SystemRoot%\System32\svchost.exe -k LocalService
    [winmgmt] %systemroot%\system32\svchost.exe -k netsvcs
    [WmdmPmSN] %SystemRoot%\System32\svchost.exe -k netsvcs
    [WmiApSrv] C:\WINDOWS\System32\wbem\wmiapsrv.exe
    [wscsvc] %SystemRoot%\System32\svchost.exe -k netsvcs
    [wuauserv] %systemRoot%\System32\svchost.exe -k netsvcs
    [WZCSVC] %SystemRoot%\System32\svchost.exe -k netsvcs
    [xmlprov] %SystemRoot%\System32\svchost.exe -k netsvcs


    **** Custom IE Search Items ****

    SEARCH: [SearchAssistant] http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
    SEARCH: [CustomizeSearch] http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm


    **** Complete IE Options ****

    IEOPT: [NoUpdateCheck]
    IEOPT: [NoJITSetup]
    IEOPT: [Disable Script Debugger] yes
    IEOPT: [Show_ChannelBand] No
    IEOPT: [Anchor Underline] yes
    IEOPT: [Cache_Update_Frequency] Once_Per_Session
    IEOPT: [Display Inline Images] yes
    IEOPT: [Do404Search]
    IEOPT: [Save_Session_History_On_Exit] no
    IEOPT: [Show_FullURL] no
    IEOPT: [Show_StatusBar] yes
    IEOPT: [Show_ToolBar] yes
    IEOPT: [Show_URLinStatusBar] yes
    IEOPT: [Show_URLToolBar] yes
    IEOPT: [Start Page] http://www.saunalahti.fi/jrajala/suomi.htm
    IEOPT: [Use_DlgBox_Colors] yes
    IEOPT: [Search Page] http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    IEOPT: [Check_Associations] yes
    IEOPT: [NotifyDownloadComplete] no
    IEOPT: [FullScreen] no
    IEOPT: [Window_Placement] ,
    IEOPT: [Use FormSuggest] yes
    IEOPT: [FormSuggest PW Ask] no
    IEOPT: [AddToFavoritesExpanded]
    IEOPT: [AutoSearch]
    IEOPT: [Show image placeholders]
    IEOPT: [Enable AutoImageResize] yes
    IEOPT: [Enable_MyPics_Hoverbar] yes
    IEOPT: [Play_Animations] yes
    IEOPT: [Display Inline Videos] yes
    IEOPT: [Play_Background_Sounds] yes
    IEOPT: [Expand Alt Text] no
    IEOPT: [Move System Caret] no
    IEOPT: [NoWebJITSetup]
    IEOPT: [AllowWindowReuse]
    IEOPT: [Enable Browser Extensions] yes
    IEOPT: [UseThemes]
    IEOPT: [Friendly http errors] yes
    IEOPT: [Error Dlg Displayed On Every Error] no
    IEOPT: [ShowGoButton] yes
    IEOPT: [Page_Transitions]
    IEOPT: [FavIntelliMenus] yes
    IEOPT: [Force Offscreen Composition]
    IEOPT: [DisableScriptDebuggerIE] yes
    IEOPT: [NscSingleExpand]
    IEOPT: [SmoothScroll]
    IEOPT: [Print_Background] no
    IEOPT: [FormSuggest Passwords] yes
    IEOPT: [StatusBarOther]
    IEOPT: [Use Custom Search URL]
    IEOPT: [Error Dlg Details Pane Open] no
    IEOPT: [Local Page] C:\WINDOWS\system32\blank.htm
    IEOPT: [XMLHTTP]
    IEOPT: [UseClearType] yes
    IEOPT: [CompatibilityFlags]
    IEOPT: [SearchMigrated]
    IEOPT: [AlwaysShowMenus]
    IEOPT: [StatusBarWeb]
    IEOPT: [EnableSearchPane]
    IEOPT: [AutoHide] yes
    IEOPT: [RunOnceHasShown]
    IEOPT: [RunOnceComplete]
    IEOPT: [FavChevron] NO
    IEOPT: [Default_Page_URL] http://go.microsoft.com/fwlink/?LinkId=69157
    IEOPT: [Default_Search_URL] http://go.microsoft.com/fwlink/?LinkId=54896
    IEOPT: [Search Page] http://go.microsoft.com/fwlink/?LinkId=54896
    IEOPT: [Enable_Disk_Cache] yes
    IEOPT: [Cache_Percent_of_Disk]
    IEOPT: [Delete_Temp_Files_On_Exit] yes
    IEOPT: [Local Page] %SystemRoot%\system32\blank.htm
    IEOPT: [Anchor_Visitation_Horizon]
    IEOPT: [Use_Async_DNS] yes
    IEOPT: [Placeholder_Width]
    IEOPT: [Placeholder_Height]
    IEOPT: [Start Page] http://go.microsoft.com/fwlink/?LinkId=69157
    IEOPT: [CompanyName] Microsoft Corporation
    IEOPT: [Custom_Key] MICROSO
    IEOPT: [Wizard_Version] 6.0.2600.0000
    IEOPT: [FullScreen] no
    IEOPT: [Check_Associations] yes
    IEOPT: [Default_Secondary_Page_URL]
    IEOPT: [Extensions Off Page] about:NoAdd-ons
    IEOPT: [Security Risk Page] about:SecurityRisk
     
    koivta-j, Feb 29, 2008
    #3
  4. Hujo

    Hujo Guest

    paina sitä next näppäintä
     
    Hujo, Feb 29, 2008
    #4
  5. koivta-j

    koivta-j Member

    Joined:
    Apr 14, 2004
    Messages:
    23
    Likes Received:
    0
    Trophy Points:
    11
    Moi

    Kiitos hyvistä neuvoista, koneessa oli mato ja troijalainen, toimii taas moitteettomasti.
     
    koivta-j, Feb 29, 2008
    #5
  6. Hujo

    Hujo Guest

    laita se uusi scannattu hjt:n loki
     
    Last edited by a moderator: Feb 29, 2008
    Hujo, Feb 29, 2008
    #6
  7. koivta-j

    koivta-j Member

    Joined:
    Apr 14, 2004
    Messages:
    23
    Likes Received:
    0
    Trophy Points:
    11
    Tässä on hjt loki

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 23:22:00, on 29.2.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16608)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\system32\BacsTray.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Creative\Shared Files\CamTray.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
    C:\WINDOWS\system32\bpowmon.exe
    C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
    C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe
    C:\Program Files\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.saunalahti.fi/jrajala/suomi.htm
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - C:\Program Files\WS_FTP Pro\wsbho2K0.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: Elisa Avustaja Plugin - {DB87CDE1-EF9C-44EB-A42F-6D0B3C72C516} - C:\Program Files\Elisa\Avustaja\IEFixItNowPlugin.dll
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [bacstray] BacsTray.exe
    O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
    O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Program Files\Creative\Shared Files\CamTray.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [SIDEBAR] "C:\Program Files\Desktop Sidebar\dsidebar.exe"
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: HP Image Zone -pikakäynnistys.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
    O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://sifyimg.speedera.net/sify.com/eot/tdserver.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by108fd.bay108.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/luxr/default/mjolauncher.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.0 Control) - https://ssl.extrafilm.org/upload/activex/ImageUploader3.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
    O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Broadcom Power monitoring service v1.0.1 (BPowMon) - Unknown owner - C:\WINDOWS\system32\bpowmon.exe
    O23 - Service: Pinnacle Systems tvtv Spooler (EpgSpooler) - Unknown owner - c:\progra~1\pinnacle\mediac~1\epgspo~2.exe (file missing)
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
    End of file - 9754 bytes
     
    koivta-j, Feb 29, 2008
    #7
  8. Hujo

    Hujo Guest

    Ok hyvältähän tuo näyttää.
     
    Hujo, Feb 29, 2008
    #8

Share This Page