Logfile of HijackThis v1.99.1 Scan saved at 22:08:19, on 9.4.2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe c:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\slserv.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\system32\Rundll32.exe C:\Program Files\Office Mouse\moffice.exe C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Office Mouse\MOUSE32A.EXE C:\WINDOWS\system32\sistray.exe C:\Program Files\Winamp\winamp.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\system32\ntvdm.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Office Mouse\moffice.exe O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_7 O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://eu-housecall.trendmicro-europe.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4719/mcfscan.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{188E618B-50DB-429A-A43F-67820E0AAEF0}: NameServer = 212.50.131.153 213.139.190.3 O17 - HKLM\System\CS1\Services\Tcpip\..\{188E618B-50DB-429A-A43F-67820E0AAEF0}: NameServer = 212.50.131.153 213.139.190.3 O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN\nipsvc.exe (file missing) O23 - Service: Norman NJeeves - Unknown owner - C:\NORMAN\Nvc\BIN\NJEEVES.EXE (file missing) O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\Nvc\BIN\ZANDA.EXE (file missing) O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe olisin kiitollinen jos joku kertoisi mitä poistaa.
rar pakattujen tiedojen avaaminen kestää 2-3 minuuttia, jotkut ohjelmat eivät aina avaudu ollenkaan: tulee vain että "ohjelma ei vastaa". virusturvaa eikä palomuuria minulla ei ole ollut 3 kuukauteen muuten hyvin toiminut mutta nyt alkoi tökkimään. olen käyttänyt online virus scannereita (Trend Micro, Panda) viruksia ei löydy. ewidoa käytän kerran viikossa.
Ahaa. Noi servicet voisit sitten sammuttaa: Norman API-hooking helper (NipSvc) Norman NJeeves Norman ZANDA Käynnistä suorita ja kirjoita ruutuun services.msc etsi nuo yksitellen ja tuplaklikkaa niitä "seis (pysäytä)" ja valitse "ei käytössä" Lataa Escan päivitä ja scannaa koko koneesi sillä: Ohjeet ja ohjelmalinkki tuolta: http://koti.mbnet.fi/pattaya1/escanmwav.htm
escan tulokset: File C:\Program Files\mIRC\mirc.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.616. No Action Taken. File F:\lataukset 2\Don Rosa II [6 sarjista, FIN]\don rosa's cartoons\LIfe And Times Of Scrooge McDuck (don rosa)\Life and Times of Scrooge McDuckChapter 09\us_l&t09-04.jpg infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File F:\lataukset 2\Don Rosa II [6 sarjista, FIN]\don rosa's cartoons\LIfe And Times Of Scrooge McDuck (don rosa)\Life and Times of Scrooge McDuckChapter 09\us_l&t09-05.jpg infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File F:\lataukset 2\Don Rosa II [6 sarjista, FIN]\don rosa's cartoons\LIfe And Times Of Scrooge McDuck (don rosa)\Life and Times of Scrooge McDuckChapter 09\us_l&t09-06.jpg infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File F:\lataukset 2\Don Rosa II [6 sarjista, FIN]\don rosa's cartoons\LIfe And Times Of Scrooge McDuck (don rosa)\Life and Times of Scrooge McDuckChapter 09\us_l&t09-07.jpg infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File F:\lataukset 2\Don Rosa II [6 sarjista, FIN]\don rosa's cartoons\LIfe And Times Of Scrooge McDuck (don rosa)\Life and Times of Scrooge McDuckChapter 09\us_l&t09-08.jpg infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File F:\lataukset 2\Don Rosa II [6 sarjista, FIN]\don rosa's cartoons\LIfe And Times Of Scrooge McDuck (don rosa)\Life and Times of Scrooge McDuckChapter 09\us_l&t09-09.jpg infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File F:\lataukset 2\Don Rosa II [6 sarjista, FIN]\don rosa's cartoons\LIfe And Times Of Scrooge McDuck (don rosa)\Life and Times of Scrooge McDuckChapter 09\us_l&t09-10.jpg infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File F:\lataukset 2\Don Rosa II [6 sarjista, FIN]\don rosa's cartoons\LIfe And Times Of Scrooge McDuck (don rosa)\Life and Times of Scrooge McDuckChapter 09\us_l&t09-11.jpg infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File F:\lataukset 2\Don Rosa II [6 sarjista, FIN]\don rosa's cartoons\LIfe And Times Of Scrooge McDuck (don rosa)\Life and Times of Scrooge McDuckChapter 09\us_l&t09-12.jpg infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File F:\lataukset 2\Don Rosa II [6 sarjista, FIN]\don rosa's cartoons\LIfe And Times Of Scrooge McDuck (don rosa)\Life and Times of Scrooge McDuckChapter 09\us_l&t09-13.jpg infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File F:\lataukset 2\Don Rosa II [6 sarjista, FIN]\don rosa's cartoons\LIfe And Times Of Scrooge McDuck (don rosa)\Life and Times of Scrooge McDuckChapter 09\us_l&t09-14.jpg infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File F:\lataukset 2\Don Rosa II [6 sarjista, FIN]\don rosa's cartoons\LIfe And Times Of Scrooge McDuck (don rosa)\Life and Times of Scrooge McDuckChapter 09\us_l&t09-15.jpg infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File F:\lataukset 2\Don Rosa II [6 sarjista, FIN]\don rosa's cartoons\LIfe And Times Of Scrooge McDuck (don rosa)\Life and Times of Scrooge McDuckChapter 09\us_l&t09-16.jpg infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File F:\lataukset 2\05. Armo.mp3 infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File F:\lataukset 2\dmd-prime.sub infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File F:\lataukset 2\Prime (2005).en.srt infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
