HJT-logia katsottavaksi

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by nasse1, Feb 6, 2007.

  1. nasse1

    nasse1 Member

    Joined:
    Feb 6, 2007
    Messages:
    7
    Likes Received:
    0
    Trophy Points:
    11
    Olen vähän käsi näissä hommissa, mut kokeillaan, virustorjuntana ja palomuurina on Bitdefenderin plus v10. Koneesta löytyy toisinaan sietämätöntä hitautta ja winantiviruspro pop-uppeja mutta tässä on kuitenkin logi.

    Logfile of HijackThis v1.99.1
    Scan saved at 21:14:10, on 6.2.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.5730.0011)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\SYSTEM32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\SYSTEM32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
    C:\Program Files\iolo\Common\Lib\ioloDMVSvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Softwin\BitDefender10\bdmcon.exe
    C:\Program Files\Softwin\BitDefender10\bdagent.exe
    C:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe
    C:\Program Files\Java\jre1.6.0\bin\jusched.exe
    C:\Program Files\mIRC\mirc.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
    C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
    C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
    C:\Program Files\Softwin\BitDefender10\vsserv.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\cmd.exe
    C:\PROGRA~1\irssi\bin\rxvt.exe
    C:\Program Files\irssi\usr\local\bin\irssi.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Documents and Settings\mie\Työpöytä\HijackThis_v1.99.1.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {2A484F5B-F91E-4E47-A13D-FB580EF5EB5B} - C:\WINDOWS\system32\efcddaa.dll
    O2 - BHO: (no name) - {68D5CF1D-EC5C-4bdd-A9EF-F0E517565D50} - (no file)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
    O2 - BHO: (no name) - {A1672AE6-29C9-42D1-9E5C-77127F51C7D5} - C:\WINDOWS\system32\gebyx.dll
    O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
    O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
    O4 - HKLM\..\Run: [SMSystemAnalyzer] "C:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
    O4 - HKCU\..\Run: [nasse] C:\Program Files\mIRC\mirc.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: @c:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: @c:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://pcpitstop.com/pcpitstop/PCPitStop.CAB
    O16 - DPF: {13EC55CF-D993-475B-9ACA-F4A384957956} (Controller Class) - https://www.windowsonecare.com/install/cli/1.1.1067.14/WinSSWebAgent.CAB
    O16 - DPF: {210D0CBC-8B17-48D1-B294-1A338DD2EB3A} (VatCtrl Class) - http://karinav.homeip.net/VatDec.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: efcddaa - C:\WINDOWS\SYSTEM32\efcddaa.dll
    O20 - Winlogon Notify: gebyx - C:\WINDOWS\system32\gebyx.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O20 - Winlogon Notify: winzzd32 - winzzd32.dll (file missing)
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
    O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iolo DMV Service (ioloDMV) - Unknown owner - C:\Program Files\iolo\Common\Lib\ioloDMVSvc.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: ODBC service - Unknown owner - (no file)
    O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing)
    O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

    Mitä kannattaisi tehä vai kannattaako mitään tehä?
     
    nasse1, Feb 6, 2007
    #1
  2. muuli123

    muuli123 Regular member

    Joined:
    Jan 13, 2007
    Messages:
    154
    Likes Received:
    0
    Trophy Points:
    26
    Lataa VundoFix.exe työpöydällesi.
    [*]Tupla-klikkaa VundoFix.exe ajaaksesi sen.
    [*]Klikkaa Scan for Vundo valintaa.
    [*]Kun skannaus on valmis, klikkaa Remove Vundo valintaa.
    [*]Sinulta kysytään haluatko poistaa filut - klikkaa YES.
    [*]Kun olet klikannut yes, työpöytäsi tyhjenee kun se alkaa poistamaan Vundoa.
    [*]Kun se on valmis, fiksi ilmoittaa käynnistäväsi koneesi uudelleen, klikkaa OK.
    [*]Postita C:\vundofix.txt lokin sekä tuoreen HijackThis lokin sisältö.

    Huomaa: Se on mahdollista että VundoFix löysi tiedoston jota se ei pystynyt poistamaan.
    Tässä tilanteessa, VundoFix ajaa itsensä rebootissa, seuraa vain yläpuolelle olevia ohjeita alkaen kohdasta "Klikkaa Scan for Vundo valintaa." kun VundoFix ilmaantuu uudelleenkäynnistyksen yhteydessä.
     
    muuli123, Feb 6, 2007
    #2
  3. nasse1

    nasse1 Member

    Joined:
    Feb 6, 2007
    Messages:
    7
    Likes Received:
    0
    Trophy Points:
    11
    VundoFix V6.3.5

    Checking Java version...

    Scan started at 22:14:24 6.2.2007

    Listing files found while scanning....

    C:\WINDOWS\system32\efcddaa.dll
    C:\WINDOWS\system32\gebyx.dll
    C:\WINDOWS\system32\xybeg.bak1
    C:\WINDOWS\system32\xybeg.bak2
    C:\WINDOWS\system32\xybeg.ini
    C:\WINDOWS\system32\xybeg.ini2
    C:\WINDOWS\system32\xybeg.tmp

    Beginning removal...

    Attempting to delete C:\WINDOWS\system32\efcddaa.dll
    C:\WINDOWS\system32\efcddaa.dll Could not be deleted.

    Attempting to delete C:\WINDOWS\system32\gebyx.dll
    C:\WINDOWS\system32\gebyx.dll Could not be deleted.

    Attempting to delete C:\WINDOWS\system32\xybeg.bak1
    C:\WINDOWS\system32\xybeg.bak1 Has been deleted!

    Attempting to delete C:\WINDOWS\system32\xybeg.bak2
    C:\WINDOWS\system32\xybeg.bak2 Has been deleted!

    Attempting to delete C:\WINDOWS\system32\xybeg.ini
    C:\WINDOWS\system32\xybeg.ini Has been deleted!

    Attempting to delete C:\WINDOWS\system32\xybeg.ini2
    C:\WINDOWS\system32\xybeg.ini2 Has been deleted!

    Attempting to delete C:\WINDOWS\system32\xybeg.tmp
    C:\WINDOWS\system32\xybeg.tmp Has been deleted!

    Performing Repairs to the registry.
    Done!

    Beginning removal...

    Attempting to delete C:\WINDOWS\system32\efcddaa.dll
    C:\WINDOWS\system32\efcddaa.dll Could not be deleted.

    Attempting to delete C:\WINDOWS\system32\gebyx.dll
    C:\WINDOWS\system32\gebyx.dll Could not be deleted.

    Performing Repairs to the registry.
    Done!

    Beginning removal...

    VundoFix V6.3.5

    Checking Java version...

    Scan started at 23:25:30 6.2.2007

    Listing files found while scanning....

    C:\WINDOWS\system32\efcddaa.dll

    Beginning removal...

    Performing Repairs to the registry.
    Done!


    Logfile of HijackThis v1.99.1
    Scan saved at 6:13:48, on 7.2.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.5730.0011)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\SYSTEM32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\SYSTEM32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Softwin\BitDefender10\bdmcon.exe
    C:\Program Files\Softwin\BitDefender10\bdagent.exe
    C:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe
    C:\Program Files\mIRC\mirc.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
    C:\Program Files\iolo\Common\Lib\ioloDMVSvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
    C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
    C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
    C:\Program Files\Softwin\BitDefender10\vsserv.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Documents and Settings\mie\Työpöytä\HijackThis_v1.99.1.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {2A484F5B-F91E-4E47-A13D-FB580EF5EB5B} - C:\WINDOWS\system32\efcddaa.dll (file missing)
    O2 - BHO: (no name) - {68D5CF1D-EC5C-4bdd-A9EF-F0E517565D50} - (no file)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
    O2 - BHO: (no name) - {A1672AE6-29C9-42D1-9E5C-77127F51C7D5} - C:\WINDOWS\system32\gebyx.dll (file missing)
    O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
    O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
    O4 - HKLM\..\Run: [SMSystemAnalyzer] "C:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe"
    O4 - HKCU\..\Run: [nasse] C:\Program Files\mIRC\mirc.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: @c:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: @c:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://pcpitstop.com/pcpitstop/PCPitStop.CAB
    O16 - DPF: {13EC55CF-D993-475B-9ACA-F4A384957956} (Controller Class) - https://www.windowsonecare.com/install/cli/1.1.1067.14/WinSSWebAgent.CAB
    O16 - DPF: {210D0CBC-8B17-48D1-B294-1A338DD2EB3A} (VatCtrl Class) - http://karinav.homeip.net/VatDec.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O20 - Winlogon Notify: winzzd32 - winzzd32.dll (file missing)
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
    O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iolo DMV Service (ioloDMV) - Unknown owner - C:\Program Files\iolo\Common\Lib\ioloDMVSvc.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: ODBC service - Unknown owner - (no file)
    O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing)
    O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)
     
    nasse1, Feb 6, 2007
    #3
  4. muuli123

    muuli123 Regular member

    Joined:
    Jan 13, 2007
    Messages:
    154
    Likes Received:
    0
    Trophy Points:
    26
    Luo HijackThis.exe:lle oma kansio C juureen ja laita se sinne. Eli näin C:\HjT\HijackThis.exe.

    Avaa HijackThis.exe, paina do a system scan only, merkkaa nämä rivit:
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    O2 - BHO: (no name) - {2A484F5B-F91E-4E47-A13D-FB580EF5EB5B} - C:\WINDOWS\system32\efcddaa.dll (file missing)
    O2 - BHO: (no name) - {68D5CF1D-EC5C-4bdd-A9EF-F0E517565D50} - (no file)
    O2 - BHO: (no name) - {A1672AE6-29C9-42D1-9E5C-77127F51C7D5} - C:\WINDOWS\system32\gebyx.dll (file missing)
    O20 - Winlogon Notify: winzzd32 - winzzd32.dll (file missing)
    Sitten paina Fix checked.

    Sitten etsi tätä tiedostoa winzzd32.dll, etsi toiminnolla ja poista jos löytyy (Käynnistä->Etsi). HUOM. muista laittaa sillälailla, että etsii myös piilotiedostoista.

    Tallenna nämä ohjeet tekstitiedostoon tai tulosta nämä, muuten et pääse niihin käsiksi vikasietotilasta

    Lataa AVG Anti-Spyware 7.5 ja tallenna ohjelma työpöydällesi.
    [*]Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa.
    [*]Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää.
    [*]Käynnistä AVG Anti-Spyware.
    [*]Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta.
    [*]Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa.
    [*]Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti.
    [*]Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine".
    [*]Sitten "Reports" valikon alta:
    • Laita täppi kohtaan "Automatically generate report after every scan"
    • Ota täppi pois kohdasta"Only if threats were found"
    • Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa
    • "Resident shield is", muuta tila active:sta inactive:ksi
    • Sulje ohjelma, ÄLÄ skannaa vielä.

      Mene vikasietotilaan, sinne pääset näin:
      1. Käynnistä tietokone uudelleen.
      2. Kun tietokone käynnistyy, paina F8-näppäintä.
      3. Näyttöön tulee erilaisia käynnistysvaihtoehtoja.
      4. Valitse näppäimistön nuolinäppäinten avulla Vikasietotila.
      5. Paina ENTER-näppäintä.

      HUOM! Älä käytä muita ohjelmia AVG skannauksen aikana, tämä saattaa häiritä skannausta.
    • Kun vikasietotilassa, käynnistä AVG Anti-Spyware.
      [*]Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan".
      [*]AVG aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa.

      Kun skannaus on valmis:
      TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions"
      [*]Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta.
      [*]Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions"
      [​IMG]
      [*]Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta.
      [*]Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle.
      [*]Sulje ohjelma, käynnistä kone normaalisti ja lähetä AVG:n raportti viestikejuusi.

      Lähetä myös uusi HjT-loki.
     
    muuli123, Feb 7, 2007
    #4
  5. nasse1

    nasse1 Member

    Joined:
    Feb 6, 2007
    Messages:
    7
    Likes Received:
    0
    Trophy Points:
    11
    Logfile of HijackThis v1.99.1
    Scan saved at 21:54:17, on 7.2.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.5730.0011)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\SYSTEM32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\SYSTEM32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Softwin\BitDefender10\bdmcon.exe
    C:\Program Files\Softwin\BitDefender10\bdagent.exe
    C:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\mIRC\mirc.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
    C:\Program Files\iolo\Common\Lib\ioloDMVSvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
    C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
    C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
    C:\Program Files\Softwin\BitDefender10\vsserv.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Hjt\HijackThis_v1.99.1.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
    O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
    O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
    O4 - HKLM\..\Run: [SMSystemAnalyzer] "C:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe"
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKCU\..\Run: [nasse] C:\Program Files\mIRC\mirc.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: @c:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: @c:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://pcpitstop.com/pcpitstop/PCPitStop.CAB
    O16 - DPF: {13EC55CF-D993-475B-9ACA-F4A384957956} (Controller Class) - https://www.windowsonecare.com/install/cli/1.1.1067.14/WinSSWebAgent.CAB
    O16 - DPF: {210D0CBC-8B17-48D1-B294-1A338DD2EB3A} (VatCtrl Class) - http://karinav.homeip.net/VatDec.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
    O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iolo DMV Service (ioloDMV) - Unknown owner - C:\Program Files\iolo\Common\Lib\ioloDMVSvc.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: ODBC service - Unknown owner - (no file)
    O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing)
    O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

    ---------------------------------------------------------
    AVG Anti-Spyware - Scan Report
    ---------------------------------------------------------

    + Created at: 21:50:42 7.2.2007

    + Scan result:



    C:\Documents and Settings\mie\Local Settings\Temp\egnfhaam.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
    C:\Documents and Settings\mie\Local Settings\Temp\hqiwhwla.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
    C:\Documents and Settings\mie\Local Settings\Temp\iudfwwhh.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
    C:\Documents and Settings\mie\Local Settings\Temp\kogdhrno.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
    C:\Documents and Settings\mie\Local Settings\Temp\lwbvcksb.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
    C:\Documents and Settings\mie\Local Settings\Temp\mwpnrvgm.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
    C:\Documents and Settings\mie\Local Settings\Temp\pqbrmufn.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
    C:\Documents and Settings\mie\Local Settings\Temp\qlchpfjl.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
    C:\Documents and Settings\mie\Local Settings\Temp\rcjyucye.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
    C:\Documents and Settings\mie\Local Settings\Temp\ughvmhmj.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
    C:\Documents and Settings\mie\Local Settings\Temp\xufniiei.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{FD03402A-EF7C-43A7-889D-F4CD082DD2D3}\RP84\A0035092.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{FD03402A-EF7C-43A7-889D-F4CD082DD2D3}\RP91\A0036518.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{FD03402A-EF7C-43A7-889D-F4CD082DD2D3}\RP91\A0036519.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{FD03402A-EF7C-43A7-889D-F4CD082DD2D3}\RP91\A0036520.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{FD03402A-EF7C-43A7-889D-F4CD082DD2D3}\RP33\A0015698.exe -> Backdoor.Nuclear.aq : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{FD03402A-EF7C-43A7-889D-F4CD082DD2D3}\RP77\A0030663.exe -> Downloader.Agent.ayi : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{FD03402A-EF7C-43A7-889D-F4CD082DD2D3}\RP44\A0017873.exe -> Downloader.Agent.bca : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{FD03402A-EF7C-43A7-889D-F4CD082DD2D3}\RP46\A0017951.dll -> Not-A-Virus.Hoax.Win32.Renos.gi : Cleaned with backup (quarantined)
    C:\Documents and Settings\mie\Local Settings\Temp\awcbffcs.exe -> Trojan.Agent.acl : Cleaned with backup (quarantined).
    C:\Documents and Settings\mie\Local Settings\Temp\cvplxllk.exe -> Trojan.Agent.acl : Cleaned with backup (quarantined).
    C:\Documents and Settings\mie\Local Settings\Temp\dgxtvjni.exe -> Trojan.Agent.acl : Cleaned with backup (quarantined).
    C:\Documents and Settings\mie\Local Settings\Temp\dpyegows.exe -> Trojan.Agent.acl : Cleaned with backup (quarantined).
    C:\Documents and Settings\mie\Local Settings\Temp\eangueuh.exe -> Trojan.Agent.acl : Cleaned with backup (quarantined).
    C:\Documents and Settings\mie\Local Settings\Temp\foepawvs.exe -> Trojan.Agent.acl : Cleaned with backup (quarantined).
    C:\Documents and Settings\mie\Local Settings\Temp\jvybaawh.exe -> Trojan.Agent.acl : Cleaned with backup (quarantined).
    C:\Documents and Settings\mie\Local Settings\Temp\jygedejk.exe -> Trojan.Agent.acl : Cleaned with backup (quarantined).
    C:\Documents and Settings\mie\Local Settings\Temp\knileexi.exe -> Trojan.Agent.acl : Cleaned with backup (quarantined).
    C:\Documents and Settings\mie\Local Settings\Temp\kxyvwxti.exe -> Trojan.Agent.acl : Cleaned with backup (quarantined).
    C:\Documents and Settings\mie\Local Settings\Temp\reontuxw.exe -> Trojan.Agent.acl : Cleaned with backup (quarantined).
    C:\Documents and Settings\mie\Local Settings\Temp\rnpvayxd.exe -> Trojan.Agent.acl : Cleaned with backup (quarantined).
    C:\Documents and Settings\mie\Local Settings\Temp\tyemkgop.exe -> Trojan.Agent.acl : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{FD03402A-EF7C-43A7-889D-F4CD082DD2D3}\RP105\A0038315.dll -> Trojan.Agent.acl : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{FD03402A-EF7C-43A7-889D-F4CD082DD2D3}\RP78\A0031091.dll -> Trojan.Agent.acl : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{FD03402A-EF7C-43A7-889D-F4CD082DD2D3}\RP79\A0032140.dll -> Trojan.Agent.acl : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{FD03402A-EF7C-43A7-889D-F4CD082DD2D3}\RP84\A0035072.dll -> Trojan.Agent.acl : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{FD03402A-EF7C-43A7-889D-F4CD082DD2D3}\RP86\A0035268.dll -> Trojan.Agent.acl : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{FD03402A-EF7C-43A7-889D-F4CD082DD2D3}\RP91\A0036521.exe -> Trojan.Agent.acl : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{FD03402A-EF7C-43A7-889D-F4CD082DD2D3}\RP91\A0036522.exe -> Trojan.Agent.acl : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{FD03402A-EF7C-43A7-889D-F4CD082DD2D3}\RP91\A0036523.exe -> Trojan.Agent.acl : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{FD03402A-EF7C-43A7-889D-F4CD082DD2D3}\RP91\A0036524.exe -> Trojan.Agent.acl : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{FD03402A-EF7C-43A7-889D-F4CD082DD2D3}\RP91\A0036525.exe -> Trojan.Agent.acl : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{FD03402A-EF7C-43A7-889D-F4CD082DD2D3}\RP91\A0036526.exe -> Trojan.Agent.acl : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{FD03402A-EF7C-43A7-889D-F4CD082DD2D3}\RP91\A0036527.exe -> Trojan.Agent.acl : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{FD03402A-EF7C-43A7-889D-F4CD082DD2D3}\RP43\A0017676.exe -> Trojan.Agent.vg : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{FD03402A-EF7C-43A7-889D-F4CD082DD2D3}\RP44\A0017803.exe -> Trojan.Agent.vg : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{FD03402A-EF7C-43A7-889D-F4CD082DD2D3}\RP77\A0030669.exe -> Trojan.Agent.ye : Cleaned with backup (quarantined).
    C:\Documents and Settings\mie\Local Settings\Temp\htxanpts.dll -> Trojan.BHO.g : Cleaned with backup (quarantined).


    ::Report end

    nuitten lisäks on vielä yli 3000 mozillan trackin cookieta et pistetäänkö nekii vai riittääkö noi? :p
     
    nasse1, Feb 7, 2007
    #5
  6. muuli123

    muuli123 Regular member

    Joined:
    Jan 13, 2007
    Messages:
    154
    Likes Received:
    0
    Trophy Points:
    26
    Hehhe :D ei tarvi laittaa.

    puhdista järjestelmän palautus:
    1. Klikkaa oikealla käynnistävalikon My Computer- tai oma tietokone-kuvaketta
    2. Valitse Properties/ominaisuudet
    3. Valitse System Restore/järjestelmän palauttaminen välilehti
    4. Valitse "Turn off System Restore"/poista järjestelmän palauttaminen kaikissa asemissa
    5. Paina Apply/käytä
    6. Paina OK
    7. Käynnistä kone uudelleen

    Lataa Atribunen ATF Cleaner

    Ohjeet;

    Tupla-klikkaa ATF-Cleaner.exe käynnistääksesi ohjelman.

    Main:n alla valitse: Select All
    Klikkaa Empty Selected valintaa.

    Jos käytät FireFoxia selaimenasi

    Klikkaa Firefox yläpuolelta ja valitse: Select All
    Klikkaa Empty Selected valintaa.
    HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy.

    Jos käytät Operaa selaimenasi

    Klikkaa Opera yläpuolelta ja valitse: Select All
    Klikkaa Empty Selected valintaa taas.
    HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy.

    Klikkaa Exit päävalikosta sulkeaksesi ohjelman.
    Teknistä tukea tulee jos tupla-klikkaat sähköpostiosoitetta joka sijaitsee jokaisen menun alapuolella kyseisessä työkalussa. (Huomatkaa että se tuki on sitten englanniksi)

    HUOM. Tämä toimii vain Internet Explorerilla
    Tarkista koneesi Panda Online Skannerilla:

    Panda ActiveScan

    [*] Kun olet Pandan sivulla, klikkaa Scan your PC-painiketta
    [*]Uusi ikkuna aukeaa...klikkaa Check Now-painiketta
    [*]Valitse maa, Country
    [*]Syötä kaupunki, State/Province
    [*]Syötä sähköpostiosoitteesi, e-mail address ja klikkaa send-painiketta
    [*]Valitse joko kotikäyttäjä Home User tai yritys Company
    [*]Klikkaa suurta Scan Now-painiketta
    [*]Jos ActiveX-komponentin asentamista kysytään, salli se.
    [*]Tarvittavien tiedostojen lataaminen alkaa (Huom: Tämä vaihe voi viedä muutamia minuutteja)
    [*]Kun lataukset ovat valmiit, klikkaa Local Disks aloittaaksesi skannauksen
    [*]Kun skannaus on valmis, klikkaa See Report-painiketta jos infektioita löytyi. Klikkaa sitten Save Report ja tallenna raportti johonkin sopivaan sijaintiin (esim työpöydälle).

    8. Laita järjestelmän palautus takaisin päälle (muuten samanlailla, mutta teet kohdan neljä käänteisesti)


    Liitä Pandan skannausraportin sisältö vastaukseesi uuden HijackThis-lokin kera.
     
    muuli123, Feb 7, 2007
    #6
  7. nasse1

    nasse1 Member

    Joined:
    Feb 6, 2007
    Messages:
    7
    Likes Received:
    0
    Trophy Points:
    11
    Logfile of HijackThis v1.99.1
    Scan saved at 9:38:54, on 8.2.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.5730.0011)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\SYSTEM32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\SYSTEM32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Softwin\BitDefender10\bdmcon.exe
    C:\Program Files\Softwin\BitDefender10\bdagent.exe
    C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
    C:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe
    C:\Program Files\iolo\Common\Lib\ioloDMVSvc.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
    C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\mIRC\mirc.exe
    C:\Program Files\VideoLAN\VLC\vlc.exe
    C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
    C:\Program Files\Softwin\BitDefender10\vsserv.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Hjt\HijackThis_v1.99.1.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
    O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
    O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
    O4 - HKLM\..\Run: [SMSystemAnalyzer] "C:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe"
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKCU\..\Run: [nasse] C:\Program Files\mIRC\mirc.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: @c:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: @c:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://pcpitstop.com/pcpitstop/PCPitStop.CAB
    O16 - DPF: {13EC55CF-D993-475B-9ACA-F4A384957956} (Controller Class) - https://www.windowsonecare.com/install/cli/1.1.1067.14/WinSSWebAgent.CAB
    O16 - DPF: {210D0CBC-8B17-48D1-B294-1A338DD2EB3A} (VatCtrl Class) - http://karinav.homeip.net/VatDec.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
    O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iolo DMV Service (ioloDMV) - Unknown owner - C:\Program Files\iolo\Common\Lib\ioloDMVSvc.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: ODBC service - Unknown owner - (no file)
    O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing)
    O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

    Activescan:
    Incident Status Location

    Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\mie\Application Data\Mozilla\Firefox\Profiles\j1ck7keh.default\cookies.txt[.advertising.com/]
    Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\mie\Cookies\mie@atdmt[2].txt
    Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\mie\Cookies\mie@doubleclick[1].txt

    tuossapas tuo
     
    nasse1, Feb 7, 2007
    #7
  8. muuli123

    muuli123 Regular member

    Joined:
    Jan 13, 2007
    Messages:
    154
    Likes Received:
    0
    Trophy Points:
    26
    Nyt kaikki on kunnossa :D

    Mutta aja CCleanerilla silloin tällöin. Ohjeet tässä sen käyttöön.
     
    muuli123, Feb 8, 2007
    #8
  9. nasse1

    nasse1 Member

    Joined:
    Feb 6, 2007
    Messages:
    7
    Likes Received:
    0
    Trophy Points:
    11
    kiitosta erittäin paljon :)
     
    nasse1, Feb 8, 2007
    #9
  10. muuli123

    muuli123 Regular member

    Joined:
    Jan 13, 2007
    Messages:
    154
    Likes Received:
    0
    Trophy Points:
    26
    Ole hyvä :D
     
    muuli123, Feb 8, 2007
    #10

Share This Page