HJT loki

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by rmb81, Mar 26, 2007.

  1. rmb81

    rmb81 Member

    Joined:
    Feb 1, 2007
    Messages:
    25
    Likes Received:
    0
    Trophy Points:
    11
    Virus ilmoituksia tullut sen verran useasti ja myös netti hidastelee joten olisi varmaan aika tarkistaa hjt loki.


    Logfile of HijackThis v1.99.1
    Scan saved at 20:32:16, on 28.3.2007
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Sygate\SPF\smc.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\System32\RunDll32.exe
    D:\Ohjelmat\Winamp\winampa.exe
    C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe
    C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
    C:\WINDOWS\System32\spoolsvc.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\WINDOWS\system32\sistray.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\WINDOWS\System32\wuauclt.exe
    C:\WINDOWS\System32\spooIsv.exe
    C:\Documents and Settings\esa\Työpöytä\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.saunalahti.fi/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Ohjelmat\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - (no file)
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
    O4 - HKLM\..\Run: [WinampAgent] D:\Ohjelmat\Winamp\winampa.exe
    O4 - HKLM\..\Run: [Device Detector] "C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe" -autorun
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
    O4 - HKLM\..\Run: [Spooler SubSystem App] C:\WINDOWS\System32\spooIsv.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Ohjelmat\Reader\reader_sl.exe
    O4 - Global Startup: Adobe Reader Synchronizer.lnk = D:\Ohjelmat\Reader\AdobeCollabSync.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Autodata Limited License Service - Unknown owner - C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
    O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
     
    rmb81, Mar 26, 2007
    #1
  2. tomato71

    tomato71 Regular member

    Joined:
    Apr 30, 2006
    Messages:
    1,151
    Likes Received:
    0
    Trophy Points:
    46
    Moi!
    Käy ensin Windows update sivoilla ja päivitä SP1 koneelle
    sen jälkeen lähetä uusi hjt-loki(Huom!! Älä kuitenkaan vielä päivitä SP2:sta voi mennä kone juntturaan)
    Ilman tuota Sp1:stä on ihan turha lähtee putsaamaan,
     
    Last edited: Mar 26, 2007
    tomato71, Mar 26, 2007
    #2
  3. rmb81

    rmb81 Member

    Joined:
    Feb 1, 2007
    Messages:
    25
    Likes Received:
    0
    Trophy Points:
    11
    Jaa, minä kun luulin, että minulla on jo koneella SP1 olemassa. Ilmeisesti ei kuitenkaan sitten sitä ole.
     
    rmb81, Mar 26, 2007
    #3
  4. tomato71

    tomato71 Regular member

    Joined:
    Apr 30, 2006
    Messages:
    1,151
    Likes Received:
    0
    Trophy Points:
    46
    juu,ei ole sp1 koneella,näkyis tuossa rivis jos olisi
     
    tomato71, Mar 26, 2007
    #4
  5. rmb81

    rmb81 Member

    Joined:
    Feb 1, 2007
    Messages:
    25
    Likes Received:
    0
    Trophy Points:
    11

    Jep, täytyy asentaa se sp1 kun jostain sen löytäisin. Microsoft:n sivuilla oli ettei ole enää saatavilla, mutta sp1a:n saa vielä eli laitan sellaisen. Ennen tätä windows:a minulla oli sp1 ja koskaan ei ollut mitään ongelmia. Nyt kun olen joutunut kovalevyn puhdistamaan ja asentamaan windows:n uudestaan niin on ongelmia ja viruksia esiintynyt aika lailla. Ehkä johtuu siitä kun ei ole sp1:stä tässä käyttiksessä.
     
    rmb81, Mar 26, 2007
    #5
  6. tomato71

    tomato71 Regular member

    Joined:
    Apr 30, 2006
    Messages:
    1,151
    Likes Received:
    0
    Trophy Points:
    46
    tomato71, Mar 26, 2007
    #6
  7. rmb81

    rmb81 Member

    Joined:
    Feb 1, 2007
    Messages:
    25
    Likes Received:
    0
    Trophy Points:
    11
    Nyt on sp1a asennettuna ja uusi hjt loki tässä

    Jotain mätää on kyllä kun palomuuri "huuta" punaisena ja kuormittaa verkkoa myös. Joku outo "prosessi" palomuurissa blokattuna (spooIsv.exe) ilmeisesti on joku virus.

    ogfile of HijackThis v1.99.1
    Scan saved at 22:41:34, on 28.3.2007
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Sygate\SPF\smc.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\System32\RunDll32.exe
    D:\Ohjelmat\Winamp\winampa.exe
    C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe
    C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
    C:\WINDOWS\System32\spooIsv.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\WINDOWS\System32\adxvu.exe
    C:\Program Files\Messenger\msmsgs.exe
    D:\Ohjelmat\Reader\reader_sl.exe
    C:\WINDOWS\system32\sistray.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\WINDOWS\System32\msiexec.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\Documents and Settings\esa\Työpöytä\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.saunalahti.fi/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Ohjelmat\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - (no file)
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
    O4 - HKLM\..\Run: [WinampAgent] D:\Ohjelmat\Winamp\winampa.exe
    O4 - HKLM\..\Run: [Device Detector] "C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe" -autorun
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
    O4 - HKLM\..\Run: [Spooler SubSystem App] C:\WINDOWS\System32\spooIsv.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Ohjelmat\Reader\reader_sl.exe
    O4 - Global Startup: Adobe Reader Synchronizer.lnk = D:\Ohjelmat\Reader\AdobeCollabSync.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
    O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Autodata Limited License Service - Unknown owner - C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
    O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
     
    rmb81, Mar 26, 2007
    #7
  8. tomato71

    tomato71 Regular member

    Joined:
    Apr 30, 2006
    Messages:
    1,151
    Likes Received:
    0
    Trophy Points:
    46
    Kyllä vain... se on tämä örkki-->W32/Poebot-KL
    Vaihda kaikki Käyttäjätunnukset ja salasanat
    Jos olet käyttänyt Verkkokauppoja,Verkkopankkia tai Visa netis niin ota yhteyttä palveluntarjoajaan




    Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

    Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi:
    • Käynnistä tietokone
    • Kun kuulet koneen piippaavan, paina F8, kuitenkin ennen Windowsin logon esiintuloa
    • Seuraavaksi pitäisi ilmestyä valikko
    • Valitse valikosta vikasietotila.
    • Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio). Työpöydälle ilmestyy sdfix.exe. Tuplakilikkaa sitä, niin tiedosto purkaantuu ja asentaa itsensä siihen levyasemaan, minne on käyttöjärjestelmä on asennettu ja juureen ilmestyy kansio SDFix, ESIM c:\SDFix
    • Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
    • Paina Y käynnistääksesi skriptin.
    • Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
    • Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
    • Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
    • Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
    • Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
    • Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis lokin kera.


      Lähetä Report.txt sisältö viestiketjuusi uuden HijackThis lokin kera.[/b]
     
    Last edited: Mar 26, 2007
    tomato71, Mar 26, 2007
    #8
  9. rmb81

    rmb81 Member

    Joined:
    Feb 1, 2007
    Messages:
    25
    Likes Received:
    0
    Trophy Points:
    11
    Tässä raportti SDfix:

    SDFix: Version 1.75

    Run by esa - to 29.03.2007 - 17:28:17,57

    Microsoft Windows XP [versio 5.1.2600]

    Running From: C:\SDFix

    Safe Mode:
    Checking Services:





    Restoring Windows Registry Entries
    Restoring Default Hosts File


    Rebooting...

    Normal Mode:
    Checking Files:

    Below files will be copied to Backups folder then removed:

    C:\WINDOWS\SYSTEM32\TJZLMWQ.EXE - Deleted
    C:\DOCUME~1\esa\LOCALS~1\Temp\ICD1.tmp\jinstall-1_5_0_11.inf - Deleted
    C:\DOCUME~1\esa\LOCALS~1\Temp\ICD1.tmp\jinstall.exe - Deleted
    C:\WINDOWS\system32\spooIsv.exe - Deleted
    C:\WINDOWS\system32\spoolsvc.exe - Deleted


    Folder C:\DOCUME~1\esa\LOCALS~1\Temp\ICD1.tmp - Removed

    ADS Check:

    C:\WINDOWS\system32
    No streams found.


    Final Check:

    Remaining Services:
    ------------------




    Remaining Files:
    ---------------

    Backups Folder: - C:\SDFix\backups\backups.zip

    Checking For Files with Hidden Attributes :


    Finished


    Ja uusi hjt loki:

    Logfile of HijackThis v1.99.1
    Scan saved at 17:33:14, on 29.3.2007
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Sygate\SPF\smc.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\System32\RunDll32.exe
    D:\Ohjelmat\Winamp\winampa.exe
    C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe
    C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\Messenger\msmsgs.exe
    D:\Ohjelmat\Reader\reader_sl.exe
    C:\WINDOWS\system32\sistray.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Documents and Settings\esa\Työpöytä\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.saunalahti.fi/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Ohjelmat\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - (no file)
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
    O4 - HKLM\..\Run: [WinampAgent] D:\Ohjelmat\Winamp\winampa.exe
    O4 - HKLM\..\Run: [Device Detector] "C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe" -autorun
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Ohjelmat\Reader\reader_sl.exe
    O4 - Global Startup: Adobe Reader Synchronizer.lnk = D:\Ohjelmat\Reader\AdobeCollabSync.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
    O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Autodata Limited License Service - Unknown owner - C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
    O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe


     
    rmb81, Mar 27, 2007
    #9
  10. tomato71

    tomato71 Regular member

    Joined:
    Apr 30, 2006
    Messages:
    1,151
    Likes Received:
    0
    Trophy Points:
    46
    jep...

    Siirrä hijackthis.exe omaan kansioon C:\HJT\HijackThis.exe

    Tee uusi hjt-scannaus Do a System scan only
    Sulje kaikki muut ikkunat ja selaimen.Merkkaa nämä rivit ja paina Fix checked

    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

    ja sitten...

    Skannaa koneesi Kaspersky Online Skannerilla
    Käytä Internet Explorer
    Sinulta kysytään sallitko ActiveX -komponentin asentamisen Kasperskyltä, klikkaa Kyllä.
    • Ohjelma käynnistyy ja aloittaa viimeisimpien tunnistetiedostojen lataamisen.
    • Kun skanneri on asennettu ja tunnistetiedot ladattu, klikkaa Next.
    • Klikkaa nyt asetuksia, Scan Settings
    • Tarkista asetuksista, että seuraavat ovat valittuina:

      o Scan using the following Anti-Virus database:

      + Extended (Jos valittavissa, muuten valitse Standard)

      o Scan Options:

      + Scan Archives
      + Scan Mail Bases
    • Klikkaa OK
    • Nyt valitse "select a target to scan" otsikon alta Oma Tietokone, My Computer
    • Skannaus vie aikaa, joten ole kärsivällinen. Kun skannaus on valmis saat ilmoituksen, jos koneesi on saastunut.
    • Klikkaa nyt Save as Text-painiketta.
    • Tallenna tiedosto työpöydällesi.
    • Kopioi ja Liitä tiedoston sisältö seuraavaan vastaukseesi.


      Lähetä uusi Hjt-loki ja Kaperskyn-loki
     
    tomato71, Mar 27, 2007
    #10
  11. rmb81

    rmb81 Member

    Joined:
    Feb 1, 2007
    Messages:
    25
    Likes Received:
    0
    Trophy Points:
    11
    kapersky report olisi tässä:

    Thursday, March 29, 2007 9:55:17 PM
    Operating System: Microsoft Windows XP Professional, Service Pack 1 (Build 2600)
    Kaspersky Online Scanner version: 5.0.93.0
    Kaspersky Anti-Virus database last update: 27/03/2007
    Kaspersky Anti-Virus database records: 287083


    Scan Settings
    Scan using the following antivirus database extended
    Scan Archives true
    Scan Mail Bases true

    Scan Target My Computer
    C:\
    D:\
    E:\

    Scan Statistics
    Total number of scanned objects 52508
    Number of viruses found 4
    Number of infected objects 177
    Number of suspicious objects 0
    Duration of the scan process 00:46:01

    Infected Object Name Virus Name Last Action
    C:\Documents and Settings\All Users\Application Data\ACD Systems\ACDSee\6.0\ACDInTouch\EN\StaticPages\privacy-popup.htm Infected: Net-Worm.Win32.Allaple.a skipped

    C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped

    C:\Documents and Settings\esa\Cookies\index.dat Object is locked skipped

    C:\Documents and Settings\esa\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

    C:\Documents and Settings\esa\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

    C:\Documents and Settings\esa\Local Settings\Sivuhistoria\History.IE5\index.dat Object is locked skipped

    C:\Documents and Settings\esa\Local Settings\Temp\~DF7B39.tmp Object is locked skipped

    C:\Documents and Settings\esa\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

    C:\Documents and Settings\esa\NTUSER.DAT Object is locked skipped

    C:\Documents and Settings\esa\ntuser.dat.LOG Object is locked skipped

    C:\Documents and Settings\Järjestelmänvalvoja\Local Settings\Temporary Internet Files\Content.IE5\0XEB0D63\CAELANYH.htm Infected: Net-Worm.Win32.Allaple.a skipped

    C:\Documents and Settings\Järjestelmänvalvoja\Local Settings\Temporary Internet Files\Content.IE5\0XEB0D63\CAL4VLZ7.HTM Infected: Net-Worm.Win32.Allaple.a skipped

    C:\Documents and Settings\Järjestelmänvalvoja\Local Settings\Temporary Internet Files\Content.IE5\0XEB0D63\CAMFIFOF.htm Infected: Net-Worm.Win32.Allaple.a skipped

    C:\Documents and Settings\Järjestelmänvalvoja\Local Settings\Temporary Internet Files\Content.IE5\0XEB0D63\foorumi_mainos[1].htm Infected: Net-Worm.Win32.Allaple.a skipped

    C:\Documents and Settings\Järjestelmänvalvoja\Local Settings\Temporary Internet Files\Content.IE5\49Q70TA7\CA2J55E4.htm Infected: Net-Worm.Win32.Allaple.a skipped

    C:\Documents and Settings\Järjestelmänvalvoja\Local Settings\Temporary Internet Files\Content.IE5\49Q70TA7\search[1].htm Infected: Net-Worm.Win32.Allaple.a skipped

    C:\Documents and Settings\Järjestelmänvalvoja\Local Settings\Temporary Internet Files\Content.IE5\GLUZWDUZ\CA7U9CXL.htm Infected: Net-Worm.Win32.Allaple.a skipped

    C:\Documents and Settings\Järjestelmänvalvoja\Local Settings\Temporary Internet Files\Content.IE5\GLUZWDUZ\CAKLQVUR.htm Infected: Net-Worm.Win32.Allaple.a skipped

    C:\Documents and Settings\Järjestelmänvalvoja\Local Settings\Temporary Internet Files\Content.IE5\GLUZWDUZ\google[1].htm Infected: Net-Worm.Win32.Allaple.a skipped

    C:\Documents and Settings\Järjestelmänvalvoja\Local Settings\Temporary Internet Files\Content.IE5\S9MVG9MJ\CAYNCXEZ.htm Infected: Net-Worm.Win32.Allaple.a skipped

    C:\Documents and Settings\Järjestelmänvalvoja\Local Settings\Temporary Internet Files\Content.IE5\S9MVG9MJ\CAYTX4O4.htm Infected: Net-Worm.Win32.Allaple.a skipped

    C:\Documents and Settings\Järjestelmänvalvoja\Local Settings\Temporary Internet Files\Content.IE5\S9MVG9MJ\search[1].htm Infected: Net-Worm.Win32.Allaple.a skipped

    C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

    C:\Documents and Settings\LocalService\Local Settings\Sivuhistoria\History.IE5\index.dat Object is locked skipped

    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

    C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

    C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

    C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\0TOJETSN\CAL8I1TJ.HTM Infected: Net-Worm.Win32.Allaple.a skipped

    C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\0TOJETSN\CAYFSHUB.HTM Infected: Net-Worm.Win32.Allaple.a skipped

    C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

    C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

    C:\Program Files\Adobe\Adobe Help Viewer\1.0\help.html Infected: Net-Worm.Win32.Allaple.a skipped

    C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped

    C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped

    C:\Program Files\Alwil Software\Avast4\DATA\log\AshWebSv.ws Object is locked skipped

    C:\Program Files\Alwil Software\Avast4\DATA\log\aswMaiSv.log Object is locked skipped

    C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped

    C:\Program Files\Alwil Software\Avast4\DATA\report\Taustasuojaus.txt Object is locked skipped

    C:\Program Files\Alwil Software\Avast4\FINNISH\aswClnTg.htm Infected: Net-Worm.Win32.Allaple.a skipped

    C:\Program Files\Alwil Software\Avast4\FINNISH\aswInfTg.htm Infected: Net-Worm.Win32.Allaple.a skipped

    C:\Program Files\Common Files\Adobe\Help\en_US\Adobe Reader\8.0\version.html Infected: Net-Worm.Win32.Allaple.a skipped

    C:\Program Files\Common Files\System\ado\MDACReadme.htm Infected: Net-Worm.Win32.Allaple.a skipped

    C:\Program Files\Microsoft Office\Office\1035\FEEDBACK.HTM Infected: Net-Worm.Win32.Allaple.a skipped

    C:\Program Files\Microsoft Office\Office\1035\THANKYOU.HTM Infected: Net-Worm.Win32.Allaple.a skipped

    C:\Program Files\Microsoft Office\Office\INTLBAND.HTM Infected: Net-Worm.Win32.Allaple.a skipped

    C:\Program Files\MSN\MSNCoreFiles\msnread.htm Infected: Net-Worm.Win32.Allaple.a skipped

    C:\Program Files\NetMeeting\netmeet.htm Infected: Net-Worm.Win32.Allaple.a skipped

    C:\Program Files\Sygate\SPF\debug.log Object is locked skipped

    C:\Program Files\Sygate\SPF\rawlog.log Object is locked skipped

    C:\Program Files\Sygate\SPF\seclog.log Object is locked skipped

    C:\Program Files\Sygate\SPF\syslog.log Object is locked skipped

    C:\Program Files\Sygate\SPF\tralog.log Object is locked skipped

    C:\Program Files\WinRAR\Order.htm Infected: Net-Worm.Win32.Allaple.a skipped

    C:\SDFix\backups\backups.zip/backups/spooIsv.exe Infected: Backdoor.Win32.VanBot.ax skipped

    C:\SDFix\backups\backups.zip/backups/spoolsvc.exe Infected: Backdoor.Win32.VanBot.ax skipped

    C:\SDFix\backups\backups.zip ZIP: infected - 2 skipped

    C:\SDFix\backups_old1\backups.zip/backups/urdvxc.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\SDFix\backups_old1\backups.zip ZIP: infected - 1 skipped

    C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028652.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028653.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028654.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028655.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028656.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028657.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028658.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028659.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028660.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028661.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028662.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028663.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028664.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028665.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028666.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028667.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028668.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028669.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028670.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028671.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028672.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028673.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028674.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028675.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028676.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028677.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028678.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028679.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028680.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028681.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028682.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028683.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028684.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028685.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028686.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028687.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028688.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028689.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028690.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028691.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028692.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028693.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028694.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028695.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028696.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028697.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028698.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028699.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028700.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028701.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028702.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028703.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028704.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028705.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028706.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028707.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028708.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028709.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028710.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028711.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028712.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028713.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028714.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028715.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028716.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028717.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028718.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028719.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028720.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028721.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028722.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028723.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028724.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028725.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028726.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028727.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028728.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028729.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028730.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028731.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028732.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028733.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028734.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028735.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028736.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028737.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028738.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028739.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028740.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028741.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028742.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028743.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028744.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028745.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028746.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028747.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028748.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028749.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028750.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028751.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028752.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028753.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028754.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028755.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028756.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028757.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028758.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028759.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028760.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028761.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028762.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028763.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028764.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028765.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028766.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028767.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028768.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028769.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028770.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028771.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028772.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028773.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028774.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028775.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028776.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP55\A0028777.exe Infected: Net-Worm.Win32.Allaple.b skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP58\A0034001.exe Infected: Backdoor.Win32.VanBot.ax skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP58\A0034002.exe Infected: Backdoor.Win32.VanBot.ax skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP58\A0034009.exe Infected: Backdoor.Win32.VanBot.ax skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP58\A0034010.exe Infected: Backdoor.Win32.VanBot.ax skipped

    C:\System Volume Information\_restore{3ECA481B-5BEE-4985-B96D-2CDFB2F6F2BE}\RP58\change.log Object is locked skipped

    C:\WINDOWS\Debug\oakley.log Object is locked skipped

    C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

    C:\WINDOWS\Help\ciadmin.htm Infected: Net-Worm.Win32.Allaple.a skipped

    C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Audio\snd.htm Infected: Net-Worm.Win32.Allaple.a skipped

    C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Cnt\contents.htm Infected: Net-Worm.Win32.Allaple.a skipped

    C:\WINDOWS\SchedLgU.Txt Object is locked skipped

    C:\WINDOWS\Sti_Trace.log Object is locked skipped

    C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped

    C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

    C:\WINDOWS\system32\config\default Object is locked skipped

    C:\WINDOWS\system32\config\default.LOG Object is locked skipped

    C:\WINDOWS\system32\config\SAM Object is locked skipped

    C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

    C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

    C:\WINDOWS\system32\config\SECURITY Object is locked skipped

    C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

    C:\WINDOWS\system32\config\software Object is locked skipped

    C:\WINDOWS\system32\config\software.LOG Object is locked skipped

    C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

    C:\WINDOWS\system32\config\system Object is locked skipped

    C:\WINDOWS\system32\config\system.LOG Object is locked skipped

    C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat Object is locked skipped

    C:\WINDOWS\system32\config\systemprofile\Local Settings\Sivuhistoria\History.IE5\index.dat Object is locked skipped

    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

    C:\WINDOWS\system32\h323log.txt Object is locked skipped

    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

    C:\WINDOWS\Temp\Perflib_Perfdata_59c.dat Object is locked skipped

    C:\WINDOWS\Temp\_avast4_\unp97104302.tmp Infected: Trojan-Proxy.Win32.Agent.mf skipped

    C:\WINDOWS\Temp\_avast4_\Webshlock.txt Object is locked skipped

    C:\WINDOWS\wiadebug.log Object is locked skipped

    C:\WINDOWS\wiaservc.log Object is locked skipped

    D:\Documents and Settings\All Users\Application Data\ACD Systems\ACDSee\6.0\ACDInTouch\EN\StaticPages\privacy-popup.htm Infected: Net-Worm.Win32.Allaple.a skipped

    D:\Documents and Settings\Käyttäjä\Application Data\Real\Msg\104_1169249968\ipm_movies011907.html Infected: Net-Worm.Win32.Allaple.a skipped

    D:\Documents and Settings\Käyttäjä\Application Data\Real\Msg\3115_1169234317\070118_bom.html Infected: Net-Worm.Win32.Allaple.a skipped

    D:\Documents and Settings\Käyttäjä\Application Data\Real\Msg\4155_1168979496\20070116123136newmusicalerts.html Infected: Net-Worm.Win32.Allaple.a skipped

    D:\Documents and Settings\Käyttäjä\Application Data\Real\Msg\4155_1169397992\20070120Newmusic_9links.html Infected: Net-Worm.Win32.Allaple.a skipped

    D:\Documents and Settings\Käyttäjä\Application Data\Sereniti\Active Security Monitor\IEReport.htm Infected: Net-Worm.Win32.Allaple.a skipped

    D:\Documents and Settings\Käyttäjä\Application Data\Sereniti\Active Security Monitor\Report.htm Infected: Net-Worm.Win32.Allaple.a skipped

    D:\Ohjelmat\Reader\HowTo\ENU\version.html Infected: Net-Worm.Win32.Allaple.a skipped

    D:\Ohjelmat\Winamp\Plugins\milkdrop.html Infected: Net-Worm.Win32.Allaple.a skipped

    D:\Ohjelmat\Winamp\Plugins\milkdrop_preset_authoring.html Infected: Net-Worm.Win32.Allaple.a skipped

    D:\Ohjelmat\Winamp\Plugins\Predixis MusicMagic\help.htm Infected: Net-Worm.Win32.Allaple.a skipped

    D:\Ohjelmat\Winamp\Plugins\Predixis MusicMagic\index.htm Infected: Net-Worm.Win32.Allaple.a skipped

    Scan process completed.

    Tässä uusi hjt:

    Logfile of HijackThis v1.99.1
    Scan saved at 21:58:56, on 29.3.2007
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Sygate\SPF\smc.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\System32\RunDll32.exe
    D:\Ohjelmat\Winamp\winampa.exe
    C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe
    C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\WINDOWS\system32\sistray.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\HJT\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.saunalahti.fi/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Ohjelmat\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
    O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - (no file)
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
    O4 - HKLM\..\Run: [WinampAgent] D:\Ohjelmat\Winamp\winampa.exe
    O4 - HKLM\..\Run: [Device Detector] "C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe" -autorun
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Ohjelmat\Reader\reader_sl.exe
    O4 - Global Startup: Adobe Reader Synchronizer.lnk = D:\Ohjelmat\Reader\AdobeCollabSync.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Autodata Limited License Service - Unknown owner - C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
    O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
     
    rmb81, Mar 27, 2007
    #11
  12. tomato71

    tomato71 Regular member

    Joined:
    Apr 30, 2006
    Messages:
    1,151
    Likes Received:
    0
    Trophy Points:
    46
    jaahans... kaspersky sekoilee taas :( väittää .htm tiedostoja Net-Worm.Win32.Allaple.a :s


    Loki on OK :)

    ja sitten jälkipuhdistus...

    Poista kansio C:\SDFix

    Tyhjennä Avstin karanteeni

    Lataa Atribunen ATF Cleaner

    Ohjeet;

    Sulje Firefox selain

    Tupla-klikkaa ATF-Cleaner.exe käynnistääksesi ohjelman.
    Main:n alla valitse: Select All
    Klikkaa Empty Selected valintaa.

    Jos käytät FireFoxia selaimenasiKlikkaa Firefox yläpuolelta ja valitse: Select All
    Klikkaa Empty Selected valintaa.
    HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy.

    Jos käytät Operaa selaimenasi
    Klikkaa Opera yläpuolelta ja valitse: Select All
    Klikkaa Empty Selected valintaa taas.
    HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy.
    Klikkaa Exit päävalikosta sulkeaksesi ohjelman.
    Teknistä tukea tulee jos tupla-klikkaat sähköpostiosoitetta joka sijaitsee jokaisen menun alapuolella kyseisessä työkalussa. (Huomatkaa että se tuki on sitten englanniksi)


    Putsaa järjestelmän palautus:
    1. Klikkaa oikealla käynnistävalikon My Computer- tai oma tietokone-kuvaketta
    2. Valitse Properties/ominaisuudet
    3. Valitse System Restore/järjestelmän palauttaminen välilehti
    4. Valitse "Turn off System Restore"/poista järjestelmän palauttaminen kaikissa asemissa
    5. Paina Apply/käytä
    6. Paina OK
    7. Käynnistä kone uudelleen
    8. Palauta asetukset takaisin


    Päivitä Windowsiin SP2 (Windowsin Update sivuston kautta)
    tai tästä(jos linkki vielä toimii)--->ServicePack2


    ja lisä vinkkejä...

    Pysy Puhtaana !

    Käytä Firefox
    Firefox on nopeampi turvallisempi selain kuin Internet Explorer
    Lataa Firefox

    Asenna Hosts-tiedosto
    Hosts-tiedosto estää haitalliset internet-osoitteet
    Lataa Hosts-tiedosto
    Opas!

    Asenna AVG Anti-Spyware
    AVG Anti-Spyware poistaa haittaohjelmia ja puhdistaa myös rekisteriä
    Lataa AVG Anti-Spyware
    Opas!

    Asenna Ccleaner
    Ccleaner puhdistaa väliaikaistiedostot ja rekisteriä
    Lataa Ccleaner
    Opas!

    Asenna SpywareBlaster
    SpywareBlaster estää haittaohjelmien asentumista koneelle
    Lataa SpywareBlaster
    Opas!

    Tyhjennä järjestelmänpalautuskansio ja luo uusi palautuspiste.
    Tämä puhdistaa palautuskansion mahdollisista haittaohjelmajäännöksistä.
    Opas!

    Pidä järjestelmäsi ajantasalla
    Windows Update

    Pidä palomuuri ja virustorjunta ajantasalla
    Päivitä ja skannaa koneesi säännöllisesti virustorjuntaohjelmallasi.

    Taistele vastaan!!--> Malware Complaints
    Sivusto antaa haittaohjelmien uhreille mahdollisuuden kertoa tarinansa ja tehdä valituksen asiasta. Taistellaan yhdessä haittaohjelmien tekijöitä vastaan!
     
    tomato71, Mar 27, 2007
    #12
  13. rmb81

    rmb81 Member

    Joined:
    Feb 1, 2007
    Messages:
    25
    Likes Received:
    0
    Trophy Points:
    11

    Ok, teen vielä tuon yllämainitun. kiitoksia paljon avusta ja neuvoista.
     
    rmb81, Mar 27, 2007
    #13
  14. tomato71

    tomato71 Regular member

    Joined:
    Apr 30, 2006
    Messages:
    1,151
    Likes Received:
    0
    Trophy Points:
    46
    oleppa hyvä :)
     
    tomato71, Mar 27, 2007
    #14

Share This Page