Logfile of HijackThis v1.99.1 Scan saved at 17:07:48, on 8.10.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\PROGRA~1\PCPROT~1\backweb\4384293\Program\SERVIC~1.EXE C:\Program Files\PC Protection\Anti-Virus\fsgk32st.exe C:\Program Files\PC Protection\Anti-Virus\FSGK32.EXE C:\Program Files\PC Protection\Anti-Virus\fssm32.exe C:\Program Files\PC Protection\backweb\4384293\program\fsbwsys.exe C:\Program Files\PC Protection\Common\FSMA32.EXE C:\Program Files\PC Protection\Common\FSMB32.EXE C:\NVIDIA\NetworkAccessManager\bin\nSvcIp.exe C:\Program Files\PC Protection\backweb\4384293\Program\fspex.exe C:\NVIDIA\NetworkAccessManager\bin\nSvcLog.exe C:\Program Files\PC Protection\Common\FCH32.EXE C:\Program Files\PC Protection\Common\FAMEH32.EXE C:\Program Files\PC Protection\Anti-Virus\fsqh.exe C:\Program Files\PC Protection\Anti-Virus\fsrw.exe C:\Program Files\PC Protection\Anti-Virus\fsav32.exe C:\Program Files\PC Protection\FWES\Program\fsdfwd.exe C:\Program Files\PC Protection\Common\FSM32.EXE C:\Program Files\PC Protection\FSGUI\ispnews.exe C:\PROGRA~1\PCPROT~1\ANTI-S~1\fsaw.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\System32\svchost.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\Program Files\PC Protection\FSGUI\fsguidll.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\MSN Messenger\usnsvc.exe D:\PROGRA~1\MOZILL~1\FIREFOX.EXE D:\Downloads\HijackThis.exe O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\PC Protection\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\PC Protection\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\PC Protection\FSGUI\FSSW.EXE" /reboot O4 - HKLM\..\Run: [News Service] "C:\Program Files\PC Protection\FSGUI\ispnews.exe" O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe O4 - HKLM\..\Run: [Viewbar] C:\Program Files\AGLOCO Viewbar\Viewbar.exe O4 - HKLM\..\Run: [WinampAgent] d:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [anysee_TR] d:\Program Files\anysee\anysee-E30\anysee_TR.exe O4 - HKLM\..\Run: [SearchIndexer] rundll32.exe "C:\WINDOWS\system32\hjmculkk.dll",sitypnow O4 - HKCU\..\Run: [Steam] "d:\program files\valve\steam\steam.exe" -silent O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - Startup: MagicDisc.lnk = D:\Program Files\MagicDisc\MagicDisc.exe O4 - Global Startup: F-Secure PC Protection.lnk = C:\Program Files\PC Protection\backweb\4384293\Program\fspex.exe O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\PC Protection\Anti-Spyware\blockpopups.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\PC Protection\Anti-Spyware\ieshield.dll O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\PC Protection\Anti-Spyware\ieshield.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Broken Internet access because of LSP provider 'c:\program files\bonjour\mdnsnsp.dll' missing O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: F-Secure PC Protection (BackWeb Plug-in - 4384293) - BackWeb Technologies Inc. - C:\PROGRA~1\PCPROT~1\backweb\4384293\Program\SERVIC~1.EXE O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\PC Protection\Anti-Virus\fsgk32st.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing) O23 - Service: FSBWSYS - F-Secure Corp. - C:\Program Files\PC Protection\backweb\4384293\program\fsbwsys.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\PC Protection\FWES\Program\fsdfwd.exe O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\PC Protection\Common\FSMA32.EXE O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\NVIDIA\NetworkAccessManager\bin\nSvcIp.exe O23 - Service: ForceWare user log service (nSvcLog) - Unknown owner - C:\NVIDIA\NetworkAccessManager\bin\nSvcLog.exe
siirrä hijackthis omaan kansioon, vaikka näin C:/HJT/Hijackthis.exe uudelleen nimeä tuo Hijackthis.exe vaikka zido:ksi Lataa VundoFix.exe työpöydällesi. Tupla-klikkaa VundoFix.exe ajaaksesi sen. Klikkaa Scan for Vundo valintaa. Kun skannaus on valmis, klikkaa Remove Vundo valintaa. Sinulta kysytään haluatko poistaa filut - klikkaa YES. Kun olet klikannut yes, työpöytäsi tyhjenee kun se alkaa poistamaan Vundoa. Kun se on valmis, fiksi ilmoittaa käynnistäväsi koneesi uudelleen, klikkaa OK. Postita C:\vundofix.txt lokin sekä tuoreen HijackThis lokin sisältö. Huomaa: Se on mahdollista että VundoFix löysi tiedoston jota se ei pystynyt poistamaan. Tässä tilanteessa, VundoFix ajaa itsensä rebootissa, seuraa vain yläpuolelle olevia ohjeita alkaen kohdasta "Klikkaa Scan for Vundo valintaa." kun VundoFix ilmaantuu uudelleenkäynnistyksen yhteydessä. lähetä: uusi hjt loki vundofixin loki
VundoFix V6.5.0 Checking Java version... Scan started at 21:25:48 8.10.2007 Listing files found while scanning.... C:\windows\system32\bcbeg.bak1 C:\WINDOWS\system32\bcbeg.bak2 C:\WINDOWS\system32\bcbeg.ini C:\WINDOWS\system32\gebcb.dll C:\windows\system32\urqpoom.dll Beginning removal... Attempting to delete C:\windows\system32\bcbeg.bak1 C:\windows\system32\bcbeg.bak1 Has been deleted! Attempting to delete C:\WINDOWS\system32\bcbeg.bak2 C:\WINDOWS\system32\bcbeg.bak2 Has been deleted! Attempting to delete C:\WINDOWS\system32\bcbeg.ini C:\WINDOWS\system32\bcbeg.ini Has been deleted! Attempting to delete C:\WINDOWS\system32\gebcb.dll C:\WINDOWS\system32\gebcb.dll Has been deleted! Attempting to delete C:\windows\system32\urqpoom.dll C:\windows\system32\urqpoom.dll Has been deleted! Performing Repairs to the registry. Done! Logfile of HijackThis v1.99.1 Scan saved at 21:45:30, on 8.10.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\PC Protection\Common\FSM32.EXE C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe D:\Program Files\Winamp\winampa.exe D:\Program Files\anysee\anysee-E30\anysee_TR.exe D:\program files\valve\steam\steam.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\PROGRA~1\PCPROT~1\backweb\4384293\Program\SERVIC~1.EXE C:\Program Files\PC Protection\Anti-Virus\fsgk32st.exe C:\Program Files\PC Protection\Anti-Virus\FSGK32.EXE C:\Program Files\PC Protection\Anti-Virus\fssm32.exe C:\Program Files\PC Protection\backweb\4384293\program\fsbwsys.exe C:\Program Files\PC Protection\Common\FSMA32.EXE C:\Program Files\PC Protection\Common\FSMB32.EXE C:\NVIDIA\NetworkAccessManager\bin\nSvcIp.exe C:\NVIDIA\NetworkAccessManager\bin\nSvcLog.exe C:\Program Files\PC Protection\Common\FCH32.EXE C:\Program Files\PC Protection\backweb\4384293\Program\fspex.exe C:\Program Files\PC Protection\Common\FAMEH32.EXE C:\Program Files\PC Protection\Anti-Virus\fsqh.exe C:\Program Files\PC Protection\Anti-Virus\fsrw.exe C:\Program Files\PC Protection\FWES\Program\fsdfwd.exe C:\Program Files\PC Protection\Anti-Virus\fsav32.exe C:\PROGRA~1\PCPROT~1\ANTI-S~1\fsaw.exe C:\Program Files\PC Protection\FSGUI\fsguidll.exe D:\PROGRA~1\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\NOTEPAD.EXE D:\hjt\zido.exe.exe O2 - BHO: (no name) - {5BDC6C7E-B07E-44CB-8801-7184DC24B941} - C:\WINDOWS\system32\gebcb.dll (file missing) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: (no name) - {F4002052-AB29-4B33-8C8D-0E99084564EC} - C:\WINDOWS\system32\urqpoom.dll (file missing) O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\PC Protection\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\PC Protection\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\PC Protection\FSGUI\FSSW.EXE" /reboot O4 - HKLM\..\Run: [News Service] "C:\Program Files\PC Protection\FSGUI\ispnews.exe" O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe O4 - HKLM\..\Run: [Viewbar] C:\Program Files\AGLOCO Viewbar\Viewbar.exe O4 - HKLM\..\Run: [WinampAgent] d:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [anysee_TR] d:\Program Files\anysee\anysee-E30\anysee_TR.exe O4 - HKLM\..\Run: [SearchIndexer] rundll32.exe "C:\WINDOWS\system32\hjmculkk.dll",sitypnow O4 - HKCU\..\Run: [Steam] "d:\program files\valve\steam\steam.exe" -silent O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - Startup: MagicDisc.lnk = D:\Program Files\MagicDisc\MagicDisc.exe O4 - Global Startup: F-Secure PC Protection.lnk = C:\Program Files\PC Protection\backweb\4384293\Program\fspex.exe O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\PC Protection\Anti-Spyware\blockpopups.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\PC Protection\Anti-Spyware\ieshield.dll O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\PC Protection\Anti-Spyware\ieshield.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Broken Internet access because of LSP provider 'c:\program files\bonjour\mdnsnsp.dll' missing O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: F-Secure PC Protection (BackWeb Plug-in - 4384293) - BackWeb Technologies Inc. - C:\PROGRA~1\PCPROT~1\backweb\4384293\Program\SERVIC~1.EXE O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\PC Protection\Anti-Virus\fsgk32st.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing) O23 - Service: FSBWSYS - F-Secure Corp. - C:\Program Files\PC Protection\backweb\4384293\program\fsbwsys.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\PC Protection\FWES\Program\fsdfwd.exe O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\PC Protection\Common\FSMA32.EXE O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\NVIDIA\NetworkAccessManager\bin\nSvcIp.exe O23 - Service: ForceWare user log service (nSvcLog) - Unknown owner - C:\NVIDIA\NetworkAccessManager\bin\nSvcLog.exe Tossa oli nyt joitain muitakin ohjelmia auki mitä ei viime kerralla ollut.
Avaa HijackThis, klikkaa do a system scan only, merkkaa nämä rivit. Sitten sulje kaikki muut ikkunat ja paina fix checked. O2 - BHO: (no name) - {5BDC6C7E-B07E-44CB-8801-7184DC24B941} - C:\WINDOWS\system32\gebcb.dll (file missing) O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: (no name) - {F4002052-AB29-4B33-8C8D-0E99084564EC} - C:\WINDOWS\system32\urqpoom.dll (file missing) O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [SearchIndexer] rundll32.exe "C:\WINDOWS\system32\hjmculkk.dll",sitypnow aita tarvittaessa piilotiedostot näkyviin. ohje mene vikasietotilaan. ohje poista seuraava: C:\WINDOWS\system32\hjmculkk.dll Viewbar, sorry enkuksi Related to AGLOCO I suggest you read the Privacy Statement. Perticularly the "Consent to Collect and Process Your Information, including Personal Data." Decide if you want to keep it. Note: Located in \%Program Files%\AGLOCO Viewbar\ eli jos et tykkää tollasesta tietojen keräilystä niin merkkaa tuokin rivi ja paina fix checked. O4 - HKLM\..\Run: [Viewbar] C:\Program Files\AGLOCO Viewbar\Viewbar.exe ja poista se ohjauspaanelin kautta. ja tuo tiedosto kans C:\Program Files\AGLOCO Viewbar. sammuta ja käynnistä kone uudestaan. lähetä uus hjt-loki
tässä se ois. Logfile of HijackThis v1.99.1 Scan saved at 23:32:58, on 8.10.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\PC Protection\Common\FSM32.EXE C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe D:\Program Files\anysee\anysee-E30\anysee_TR.exe D:\program files\valve\steam\steam.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe D:\Program Files\MagicDisc\MagicDisc.exe C:\PROGRA~1\PCPROT~1\backweb\4384293\Program\SERVIC~1.EXE C:\Program Files\PC Protection\Anti-Virus\fsgk32st.exe C:\Program Files\PC Protection\Anti-Virus\FSGK32.EXE C:\Program Files\PC Protection\Anti-Virus\fssm32.exe C:\Program Files\PC Protection\backweb\4384293\program\fsbwsys.exe C:\Program Files\PC Protection\Common\FSMA32.EXE C:\Program Files\PC Protection\Common\FSMB32.EXE C:\NVIDIA\NetworkAccessManager\bin\nSvcIp.exe C:\NVIDIA\NetworkAccessManager\bin\nSvcLog.exe C:\Program Files\PC Protection\Common\FCH32.EXE C:\Program Files\PC Protection\backweb\4384293\Program\fspex.exe C:\Program Files\PC Protection\Common\FAMEH32.EXE C:\Program Files\PC Protection\Anti-Virus\fsqh.exe C:\Program Files\PC Protection\Anti-Virus\fsrw.exe C:\Program Files\PC Protection\FWES\Program\fsdfwd.exe C:\Program Files\PC Protection\Anti-Virus\fsav32.exe C:\WINDOWS\system32\wuauclt.exe C:\PROGRA~1\PCPROT~1\ANTI-S~1\fsaw.exe C:\Program Files\PC Protection\FSGUI\fsguidll.exe D:\hjt\zido.exe O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\PC Protection\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\PC Protection\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\PC Protection\FSGUI\FSSW.EXE" /reboot O4 - HKLM\..\Run: [News Service] "C:\Program Files\PC Protection\FSGUI\ispnews.exe" O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe O4 - HKLM\..\Run: [anysee_TR] d:\Program Files\anysee\anysee-E30\anysee_TR.exe O4 - HKCU\..\Run: [Steam] "d:\program files\valve\steam\steam.exe" -silent O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - Startup: MagicDisc.lnk = D:\Program Files\MagicDisc\MagicDisc.exe O4 - Global Startup: F-Secure PC Protection.lnk = C:\Program Files\PC Protection\backweb\4384293\Program\fspex.exe O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\PC Protection\Anti-Spyware\blockpopups.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\PC Protection\Anti-Spyware\ieshield.dll O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\PC Protection\Anti-Spyware\ieshield.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Broken Internet access because of LSP provider 'c:\program files\bonjour\mdnsnsp.dll' missing O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: F-Secure PC Protection (BackWeb Plug-in - 4384293) - BackWeb Technologies Inc. - C:\PROGRA~1\PCPROT~1\backweb\4384293\Program\SERVIC~1.EXE O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\PC Protection\Anti-Virus\fsgk32st.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing) O23 - Service: FSBWSYS - F-Secure Corp. - C:\Program Files\PC Protection\backweb\4384293\program\fsbwsys.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\PC Protection\FWES\Program\fsdfwd.exe O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\PC Protection\Common\FSMA32.EXE O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\NVIDIA\NetworkAccessManager\bin\nSvcIp.exe O23 - Service: ForceWare user log service (nSvcLog) - Unknown owner - C:\NVIDIA\NetworkAccessManager\bin\nSvcLog.exe
Lataa MWav eScan työpöydälle. Tuplaklikkaa mwav.exeä, aukeaa lisenssisopimus, hyväksy se. Merkitse seuraavat kohdat ennen scannausta. Muisti Käynnistyskansiot Asema - Kaikki paikalliset levyt Kansio - Paina selaa ja vaihda hakemistoksi C:\ Rekisteri Järjestelmäkansiot Palvelut Vain skannaa Sisällä alikansiot Skannaa kaikki tiedostot Varmistu että kaikki edellämainitut kohdat ovat varmasti merkattu, paina Vain Skannaa. Huom. eScan voi näyttää siltä että se olisi valmis, mutta se ei välttämättä ole. Ohjelma ilmoittaa kun on valmis. eScan listaa alempaan ikkunaan saastuneet tiedostot kun scannaus on valmis, kopio(CTRL+C) ja liitä(CTRL+V) kaikki mitä boksiin tulee seuraavaan viestiisi.
huh huh scannaus kesti 2h 45min tässä tulokset Tiedoston C:\Documents and Settings\Juho\Desktop\MSSetup.exe on saastuttanut virus "NULL.Corrupted". Tehty toiminto: Ei toimintoa. Objekti "grokster Spyware/Adware" löytynyt tiedostojärjestelmästä! Tehty toiminto: Ei toimintoa. Objekti "Possible Fujacks-type Worm" löytynyt tiedostojärjestelmästä! Tehty toiminto: Ei toimintoa. Asetus "HKCU\Software\Netscape\Netscape Navigator\User Trusted External Applications" viittaa virheelliseen objektiin "C:\Program Files\PC Protection\backweb\4384293\6.3.2.116-4384293L\Program\PrvCnt.exe". Tehty tominto: Ei toimintoa. Asetus "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" viittaa virheelliseen objektiin "C:\WINDOWS\system32\pxwma.dll". Tehty tominto: Ei toimintoa. Asetus "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" viittaa virheelliseen objektiin ".001". Tehty tominto: Ei toimintoa. Asetus "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" viittaa virheelliseen objektiin ".002". Tehty tominto: Ei toimintoa. Asetus "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" viittaa virheelliseen objektiin ".003". Tehty tominto: Ei toimintoa. Asetus "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" viittaa virheelliseen objektiin ".004". Tehty tominto: Ei toimintoa. Asetus "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" viittaa virheelliseen objektiin ".005". Tehty tominto: Ei toimintoa. Asetus "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" viittaa virheelliseen objektiin ".009". Tehty tominto: Ei toimintoa. Asetus "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" viittaa virheelliseen objektiin ".014". Tehty tominto: Ei toimintoa. Asetus "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" viittaa virheelliseen objektiin ".141". Tehty tominto: Ei toimintoa. Asetus "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" viittaa virheelliseen objektiin ".mdf". Tehty tominto: Ei toimintoa. Asetus "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" viittaa virheelliseen objektiin ".mds". Tehty tominto: Ei toimintoa. Asetus "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" viittaa virheelliseen objektiin ".properties". Tehty tominto: Ei toimintoa. Asetus "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" viittaa virheelliseen objektiin ".sfv". Tehty tominto: Ei toimintoa. Asetus "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" viittaa virheelliseen objektiin ".sub". Tehty tominto: Ei toimintoa. Asetus "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" viittaa virheelliseen objektiin "Mozilla Firefox (2.0.0.5)". Tehty tominto: Ei toimintoa. Tiedosto C:\DOCUME~1\Juho\LOCALS~1\TEMPOR~1\Content.IE5\41B1F8SP\lo1[1]//PE_Patch.PECompact merkitty "not-a-virus:AdWare.Win32.Virtumonde.fp":ksi. Tehty toiminto: Ei toimintoa. Tiedoston C:\DOCUME~1\Juho\LOCALS~1\TEMPOR~1\Content.IE5\SD6JU90L\ErrorSafeFreeInstall_fi[1].cab/UERSJ_0001_N86M0707NetInstaller.exe on saastuttanut virus "Trojan-Downloader.Win32.Agent.alr". Tehty toiminto: Ei toimintoa. Tiedoston C:\Documents and Settings\Juho\Desktop\MSSetup.exe on saastuttanut virus "NULL.Corrupted". Tehty toiminto: Ei toimintoa. Tiedosto C:\Documents and Settings\Juho\Local Settings\Temporary Internet Files\Content.IE5\41B1F8SP\lo1[1]//PE_Patch.PECompact merkitty "not-a-virus:AdWare.Win32.Virtumonde.fp":ksi. Tehty toiminto: Ei toimintoa. Tiedoston C:\Documents and Settings\Juho\Local Settings\Temporary Internet Files\Content.IE5\SD6JU90L\ErrorSafeFreeInstall_fi[1].cab/UERSJ_0001_N86M0707NetInstaller.exe on saastuttanut virus "Trojan-Downloader.Win32.Agent.alr". Tehty toiminto: Ei toimintoa. Tiedosto C:\Program Files\mIRC\mirc.exe merkitty not-a-virus:Client-IRC.Win32.mIRC.621. Ei toimintoa. Tiedosto C:\System Volume Information\_restore{1AD954CB-6E12-494A-8105-0C53E6D3518E}\RP100\A0067504.dll//PE_Patch.PECompact merkitty "not-a-virus:AdWare.Win32.Virtumonde.fp":ksi. Tehty toiminto: Ei toimintoa. Tiedosto C:\System Volume Information\_restore{1AD954CB-6E12-494A-8105-0C53E6D3518E}\RP100\A0067505.dll merkitty "not-a-virus:AdWare.Win32.Virtumonde.jp":ksi. Tehty toiminto: Ei toimintoa. Tiedosto C:\VundoFix Backups\gebcb.dll.bad//PE_Patch.PECompact merkitty "not-a-virus:AdWare.Win32.Virtumonde.fp":ksi. Tehty toiminto: Ei toimintoa. Tiedosto C:\VundoFix Backups\urqpoom.dll.bad merkitty "not-a-virus:AdWare.Win32.Virtumonde.jp":ksi. Tehty toiminto: Ei toimintoa. Tiedoston D:\Juho\NHL 2008 Keygen Working.exe on saastuttanut virus "Exe.Corrupted". Tehty toiminto: Ei toimintoa. Tiedosto D:\Program Files\Azureus\is68309.exe merkitty "not-a-virus:AdWare.Win32.Virtumonde.ks":ksi. Tehty toiminto: Ei toimintoa. Tiedosto D:\Program Files\Azureus\is68312.exe merkitty "not-a-virus:AdWare.Win32.Virtumonde.ks":ksi. Tehty toiminto: Ei toimintoa. Tiedosto D:\System Volume Information\_restore{1AD954CB-6E12-494A-8105-0C53E6D3518E}\RP100\A0069578.exe merkitty "not-a-virus:AdWare.Win32.Virtumonde.ks":ksi. Tehty toiminto: Ei toimintoa. Tiedoston C:\Documents and Settings\Juho\Desktop\MSSetup.exe on saastuttanut virus "NULL.Corrupted". Tehty toiminto: Ei toimintoa. Tiedosto C:\Documents and Settings\Juho\Local Settings\Temporary Internet Files\Content.IE5\41B1F8SP\lo1[1]//PE_Patch.PECompact merkitty "not-a-virus:AdWare.Win32.Virtumonde.fp":ksi. Tehty toiminto: Ei toimintoa. Tiedoston C:\Documents and Settings\Juho\Local Settings\Temporary Internet Files\Content.IE5\SD6JU90L\ErrorSafeFreeInstall_fi[1].cab/UERSJ_0001_N86M0707NetInstaller.exe on saastuttanut virus "Trojan-Downloader.Win32.Agent.alr". Tehty toiminto: Ei toimintoa. Tiedosto C:\Program Files\mIRC\mirc.exe merkitty not-a-virus:Client-IRC.Win32.mIRC.621. Ei toimintoa. Tiedosto C:\System Volume Information\_restore{1AD954CB-6E12-494A-8105-0C53E6D3518E}\RP100\A0067504.dll//PE_Patch.PECompact merkitty "not-a-virus:AdWare.Win32.Virtumonde.fp":ksi. Tehty toiminto: Ei toimintoa. Tiedosto C:\System Volume Information\_restore{1AD954CB-6E12-494A-8105-0C53E6D3518E}\RP100\A0067505.dll merkitty "not-a-virus:AdWare.Win32.Virtumonde.jp":ksi. Tehty toiminto: Ei toimintoa. Tiedosto C:\VundoFix Backups\gebcb.dll.bad//PE_Patch.PECompact merkitty "not-a-virus:AdWare.Win32.Virtumonde.fp":ksi. Tehty toiminto: Ei toimintoa. Tiedosto C:\VundoFix Backups\urqpoom.dll.bad merkitty "not-a-virus:AdWare.Win32.Virtumonde.jp":ksi. Tehty toiminto: Ei toimintoa.
joo toi on aika pitkä skannaus otetaan toinen scannaus, eri ohjelmalla.On huomattavasti lyhyempi ja poistaa sen löydökset. Tallenna nämä ohjeet tekstitiedostoon tai tulosta nämä, muuten et pääse niihin käsiksi vikasietotilasta Lataa AVG Anti-Spyware 7.5 ja tallenna ohjelma työpöydällesi. Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa. Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää. Käynnistä AVG Anti-Spyware. Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta. Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa. Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti. Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine". Sitten "Reports" valikon alta: Laita täppi kohtaan "Do not Automatically generate report" Ota täppi pois kohdasta"Only if threats were found" Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa "Resident shield is", muuta tila active:sta inactive:ksi Sulje ohjelma, ÄLÄ skannaa vielä. Käynnistä koneesi vikasietotilaan , Ohje! HUOM! Älä käytä muita ohjelmia AVG skannauksen aikana, tämä saattaa häiritä skannausta. Kun vikasietotilassa, käynnistä AVG Anti-Spyware. Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan". AVG aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa. Kun skannaus on valmis: TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions" Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta. Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions" Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta. Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle. Sulje ohjelma, käynnistä kone normaalisti ja lähetä AVG Anti-Spyware:n raportti viestikejuusi. lähetä: avg:n antispywaren loki uusi hjt-loki
--------------------------------------------------------- AVG Anti-Spyware - Scan Report --------------------------------------------------------- + Created at: 17:29:05 11.10.2007 + Scan result: C:\Documents and Settings\Juho\Local Settings\Temporary Internet Files\Content.IE5\SD6JU90L\ErrorSafeFreeInstall_fi[1].cab/UERSJ_0001_N86M0707NetInstaller.exe -> Downloader.Agent.alr : Cleaned. :mozilla.189:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.42:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.100:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.101:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.102:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.103:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.104:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.65:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.66:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.67:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.68:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.69:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.70:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.176:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.177:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.178:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.179:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.180:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.218:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.219:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.220:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.221:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.119:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned. :mozilla.749:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned. :mozilla.750:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned. :mozilla.495:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Clickhype : Cleaned. :mozilla.56:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Com : Cleaned. :mozilla.118:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned. :mozilla.394:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned. :mozilla.378:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned. :mozilla.121:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.123:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.168:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.169:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.389:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Hotlog : Cleaned. :mozilla.298:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned. :mozilla.299:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned. C:\Documents and Settings\Juho\Cookies\juho@search.live[1].txt -> TrackingCookie.Live : Cleaned. :mozilla.47:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Masterstats : Cleaned. :mozilla.122:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned. C:\Documents and Settings\Juho\Cookies\juho@auto.search.msn[2].txt -> TrackingCookie.Msn : Cleaned. C:\Documents and Settings\Juho\Cookies\juho@ie.search.msn[1].txt -> TrackingCookie.Msn : Cleaned. :mozilla.215:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Netflame : Cleaned. :mozilla.286:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Paypal : Cleaned. :mozilla.395:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned. :mozilla.396:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned. :mozilla.317:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.318:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.319:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.320:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.321:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.287:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.288:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.289:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.290:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.291:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.296:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.458:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned. :mozilla.459:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned. :mozilla.35:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.38:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.39:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.40:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.12:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Statistik-gallup : Cleaned. :mozilla.31:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned. :mozilla.32:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned. :mozilla.33:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned. :mozilla.802:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Yadro : Cleaned. :mozilla.80:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.81:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.82:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.83:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.190:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\nua72t7w.default\cookies.txt -> TrackingCookie.Zedo : Cleaned. ::Report end -------------------------------------------------- hjt Logfile of HijackThis v1.99.1 Scan saved at 17:39:27, on 11.10.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\PC Protection\Common\FSM32.EXE C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe D:\Program Files\anysee\anysee-E30\anysee_TR.exe D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe D:\program files\valve\steam\steam.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe D:\Program Files\MagicDisc\MagicDisc.exe d:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\PROGRA~1\PCPROT~1\backweb\4384293\Program\SERVIC~1.EXE C:\Program Files\PC Protection\Anti-Virus\fsgk32st.exe C:\Program Files\PC Protection\Anti-Virus\FSGK32.EXE C:\Program Files\PC Protection\Anti-Virus\fssm32.exe C:\Program Files\PC Protection\backweb\4384293\program\fsbwsys.exe C:\Program Files\PC Protection\Common\FSMA32.EXE C:\Program Files\PC Protection\Common\FSMB32.EXE C:\Program Files\PC Protection\backweb\4384293\Program\fspex.exe C:\NVIDIA\NetworkAccessManager\bin\nSvcIp.exe C:\NVIDIA\NetworkAccessManager\bin\nSvcLog.exe C:\Program Files\PC Protection\Common\FCH32.EXE C:\Program Files\PC Protection\Common\FAMEH32.EXE C:\Program Files\PC Protection\Anti-Virus\fsqh.exe C:\Program Files\PC Protection\Anti-Virus\fsrw.exe C:\Program Files\PC Protection\FWES\Program\fsdfwd.exe C:\Program Files\PC Protection\Anti-Virus\fsav32.exe C:\PROGRA~1\PCPROT~1\ANTI-S~1\fsaw.exe C:\Program Files\PC Protection\FSGUI\fsguidll.exe D:\PROGRA~1\Mozilla Firefox\firefox.exe D:\hjt\zido.exe.exe O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\PC Protection\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\PC Protection\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\PC Protection\FSGUI\FSSW.EXE" /reboot O4 - HKLM\..\Run: [News Service] "C:\Program Files\PC Protection\FSGUI\ispnews.exe" O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe O4 - HKLM\..\Run: [anysee_TR] d:\Program Files\anysee\anysee-E30\anysee_TR.exe O4 - HKLM\..\Run: [!AVG Anti-Spyware] "d:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [Steam] "d:\program files\valve\steam\steam.exe" -silent O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - Startup: MagicDisc.lnk = D:\Program Files\MagicDisc\MagicDisc.exe O4 - Global Startup: F-Secure PC Protection.lnk = C:\Program Files\PC Protection\backweb\4384293\Program\fspex.exe O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\PC Protection\Anti-Spyware\blockpopups.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\PC Protection\Anti-Spyware\ieshield.dll O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\PC Protection\Anti-Spyware\ieshield.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Broken Internet access because of LSP provider 'c:\program files\bonjour\mdnsnsp.dll' missing O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - d:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: F-Secure PC Protection (BackWeb Plug-in - 4384293) - BackWeb Technologies Inc. - C:\PROGRA~1\PCPROT~1\backweb\4384293\Program\SERVIC~1.EXE O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\PC Protection\Anti-Virus\fsgk32st.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing) O23 - Service: FSBWSYS - F-Secure Corp. - C:\Program Files\PC Protection\backweb\4384293\program\fsbwsys.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\PC Protection\FWES\Program\fsdfwd.exe O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\PC Protection\Common\FSMA32.EXE O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\NVIDIA\NetworkAccessManager\bin\nSvcIp.exe O23 - Service: ForceWare user log service (nSvcLog) - Unknown owner - C:\NVIDIA\NetworkAccessManager\bin\nSvcLog.exe
