Eli fsecure löysi kyllä olikohan renos hoaxin, muttei voinut tehdä sille mitään. Nyt kokoajan kuuluu semmonen plop-ääni, ja tulee varoituksia, että koneesi on uhattuna jne. hjt, kun en muuta keksiny.. :/ Logfile of HijackThis v1.99.1 Scan saved at 15:32:31, on 7.2.2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\AGRSMMSG.exe C:\PROGRA~1\LAUNCH~1\QtZpAcer.EXE C:\Program Files\OPOY Tietoturvapalvelu\Common\FSM32.EXE D:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE C:\WINDOWS\system32\ctfmon.exe D:\Program Files\Rainlendar\Rainlendar.exe C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE C:\PROGRA~1\OPOYTI~1\backweb\9683872\Program\SERVIC~1.EXE C:\PROGRA~1\FDD_FM~1\CZFMDSER.EXE C:\Program Files\OPOY Tietoturvapalvelu\Anti-Virus\fsgk32st.exe C:\Program Files\OPOY Tietoturvapalvelu\backweb\9683872\Program\OPOY-Tietoturva.exe C:\Program Files\OPOY Tietoturvapalvelu\Anti-Virus\FSGK32.EXE C:\Program Files\OPOY Tietoturvapalvelu\Anti-Virus\fssm32.exe C:\Program Files\OPOY Tietoturvapalvelu\backweb\9683872\program\fsbwsys.exe C:\Program Files\OPOY Tietoturvapalvelu\Common\FSMA32.EXE C:\Program Files\OPOY Tietoturvapalvelu\Common\FSMB32.EXE d:\Program Files\NetLimiter 2 Monitor\nlsvc.exe C:\Program Files\OPOY Tietoturvapalvelu\Common\FCH32.EXE C:\Program Files\OPOY Tietoturvapalvelu\Common\FAMEH32.EXE C:\Program Files\OPOY Tietoturvapalvelu\FWES\Program\fsdfwd.exe C:\Program Files\OPOY Tietoturvapalvelu\Anti-Virus\fsav32.exe d:\Program Files\NetLimiter 2 Monitor\NLClient.exe C:\Program Files\OPOY Tietoturvapalvelu\FSGUI\fsguiexe.exe C:\WINDOWS\system32\mssearchnet.exe C:\WINDOWS\system32\nvctrl.exe D:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe D:\Program Files\Microsoft AntiSpyware\gcasServ.exe C:\Program Files\hijackthis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dnainternet.fi R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dnafinland.fi/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = dna Internet Explorer R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.suomi.net:8080 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit F1 - win.ini: run= C:\WESTWOOD\REDALERT\INSTICON.EXE O2 - BHO: HomepageBHO - {4da4616d-7e6e-4fd9-a2d5-b6c535733e22} - C:\WINDOWS\system32\hp68B2.tmp O4 - HKLM\..\Run: [LaunchApp] Alaunch O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZpAcer.EXE O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\OPOY Tietoturvapalvelu\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\OPOY Tietoturvapalvelu\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\OPOY Tietoturvapalvelu\FSGUI\FSSW.EXE" /reboot O4 - HKLM\..\Run: [News Service] "C:\Program Files\OPOY Tietoturvapalvelu\FSGUI\ispnews.exe" O4 - HKLM\..\Run: [PCSuiteTrayApplication] D:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -onlytray O4 - HKLM\..\Run: [gcasServ] "D:\Program Files\Microsoft AntiSpyware\gcasServ.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - Startup: Rainlendar.lnk = D:\Program Files\Rainlendar\Rainlendar.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: Download with GetRight - D:\Program Files\GetRight\GRdownload.htm O8 - Extra context menu item: Open with GetRight Browser - D:\Program Files\GetRight\GRbrowse.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .rar: d:\Program Files\Opera\PLUGINS\NPGetRt1.dll O12 - Plugin for .zip: d:\Program Files\Opera\PLUGINS\NPGetRt1.dll O14 - IERESET.INF: START_PAGE_URL=http://www.dnainternet.fi O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab O16 - DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} (DD_v4.DDv4) - http://www.drivershq.com/DD_v4.CAB O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - https://www.gamespyid.com/alaunch.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} (F-Secure Online Scanner) - http://support.f-secure.com/ols/fscax.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://game16.zylomgames.com/activex/zylomloader.cab O16 - DPF: {D6E2C70F-C694-4FDB-9283-459FC77FEFE0} (Softers.efOrderX) - https://www.efoto.fi/efOrderX.CAB O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{82800091-ABBB-4082-8992-1E796BB3FB72}: NameServer = 212.50.131.153 213.139.190.3 O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O23 - Service: OPOY Tietoturvapalvelu (BackWeb Plug-in - 9683872) - Unknown owner - C:\PROGRA~1\OPOYTI~1\backweb\9683872\Program\SERVIC~1.EXE O23 - Service: CZFMDSER.EXE - Unknown owner - C:\PROGRA~1\FDD_FM~1\CZFMDSER.EXE O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\OPOY Tietoturvapalvelu\Anti-Virus\fsgk32st.exe O23 - Service: FBExec Service (FBExecService) - Unknown owner - d:\usr\FrontBase\bin\FBExec.exe O23 - Service: FBWebEnabler Service (FBWebEnablerService) - Unknown owner - d:\usr\FrontBase\bin\FBWebEnabler.exe (file missing) O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\OPOY Tietoturvapalvelu\backweb\9683872\program\fsbwsys.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\OPOY Tietoturvapalvelu\FWES\Program\fsdfwd.exe O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\OPOY Tietoturvapalvelu\Common\FSMA32.EXE O23 - Service: NetLimiter (nlsvc) - Locktime Software - d:\Program Files\NetLimiter 2 Monitor\nlsvc.exe O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - D:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe Kiitän jo etukäteen herroja tietäväisiä t. laspa
Smitfraudihan se siellä kummittelee. Fixaa HjT:lla O2 - BHO: HomepageBHO - {4da4616d-7e6e-4fd9-a2d5-b6c535733e22} - C:\WINDOWS\system32\hp68B2.tmp Hae smitrem täältä -> http://noahdfear.geekstogo.com/click counter/click.php?id=1 Tallenna työpöydälle ja tuplaklikkaa sitä, jolloin se luo smitRem-kansion työpöydälle. Käynnistä vikasietotilaan (paina F8 käynnistyksen yhteydessä, kunnes tulee valikko. Valitse valikosta vikasietotila), avaa smitRem-kansio ja tuplaklikkaa RunThis.bat. Seuraa ohjeita. Käynnistä kone uudestaan, lähetä uusi HjT-loki ja c:\smitfiles.txt-tiedoston sisältö.
Homma auttoi, ainakin toistaseks... Uus hjt: Logfile of HijackThis v1.99.1 Scan saved at 17:50:06, on 7.2.2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\AGRSMMSG.exe C:\PROGRA~1\LAUNCH~1\QtZpAcer.EXE C:\Program Files\OPOY Tietoturvapalvelu\Common\FSM32.EXE C:\PROGRA~1\OPOYTI~1\backweb\9683872\Program\SERVIC~1.EXE C:\Program Files\OPOY Tietoturvapalvelu\FSGUI\ispnews.exe D:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE D:\Program Files\Microsoft AntiSpyware\gcasServ.exe C:\PROGRA~1\FDD_FM~1\CZFMDSER.EXE C:\Program Files\OPOY Tietoturvapalvelu\backweb\9683872\Program\OPOY-Tietoturva.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\OPOY Tietoturvapalvelu\Anti-Virus\fsgk32st.exe C:\Program Files\OPOY Tietoturvapalvelu\Anti-Virus\FSGK32.EXE C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe D:\Program Files\Rainlendar\Rainlendar.exe D:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe C:\Program Files\OPOY Tietoturvapalvelu\backweb\9683872\program\fsbwsys.exe C:\Program Files\OPOY Tietoturvapalvelu\Common\FSMA32.EXE C:\Program Files\OPOY Tietoturvapalvelu\Anti-Virus\fssm32.exe C:\Program Files\OPOY Tietoturvapalvelu\Common\FSMB32.EXE d:\Program Files\NetLimiter 2 Monitor\nlsvc.exe C:\Program Files\OPOY Tietoturvapalvelu\Common\FCH32.EXE C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE C:\Program Files\OPOY Tietoturvapalvelu\Common\FAMEH32.EXE d:\Program Files\NetLimiter 2 Monitor\NLClient.exe C:\Program Files\OPOY Tietoturvapalvelu\FWES\Program\fsdfwd.exe C:\Program Files\OPOY Tietoturvapalvelu\Anti-Virus\fsav32.exe C:\Program Files\OPOY Tietoturvapalvelu\FSGUI\fsguiexe.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Opera\Opera.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\hijackthis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dnainternet.fi R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dnafinland.fi/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = dna Internet Explorer R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.suomi.net:8080 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit F1 - win.ini: run= C:\WESTWOOD\REDALERT\INSTICON.EXE O4 - HKLM\..\Run: [LaunchApp] Alaunch O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZpAcer.EXE O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\OPOY Tietoturvapalvelu\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\OPOY Tietoturvapalvelu\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\OPOY Tietoturvapalvelu\FSGUI\FSSW.EXE" /reboot O4 - HKLM\..\Run: [News Service] "C:\Program Files\OPOY Tietoturvapalvelu\FSGUI\ispnews.exe" O4 - HKLM\..\Run: [PCSuiteTrayApplication] D:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -onlytray O4 - HKLM\..\Run: [gcasServ] "D:\Program Files\Microsoft AntiSpyware\gcasServ.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - Startup: Rainlendar.lnk = D:\Program Files\Rainlendar\Rainlendar.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: Download with GetRight - D:\Program Files\GetRight\GRdownload.htm O8 - Extra context menu item: Open with GetRight Browser - D:\Program Files\GetRight\GRbrowse.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .rar: d:\Program Files\Opera\PLUGINS\NPGetRt1.dll O12 - Plugin for .zip: d:\Program Files\Opera\PLUGINS\NPGetRt1.dll O14 - IERESET.INF: START_PAGE_URL=http://www.dnainternet.fi O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab O16 - DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} (DD_v4.DDv4) - http://www.drivershq.com/DD_v4.CAB O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} (F-Secure Online Scanner) - http://support.f-secure.com/ols/fscax.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://game16.zylomgames.com/activex/zylomloader.cab O16 - DPF: {D6E2C70F-C694-4FDB-9283-459FC77FEFE0} (Softers.efOrderX) - https://www.efoto.fi/efOrderX.CAB O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{82800091-ABBB-4082-8992-1E796BB3FB72}: NameServer = 212.50.131.153 213.139.190.3 O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O23 - Service: OPOY Tietoturvapalvelu (BackWeb Plug-in - 9683872) - Unknown owner - C:\PROGRA~1\OPOYTI~1\backweb\9683872\Program\SERVIC~1.EXE O23 - Service: CZFMDSER.EXE - Unknown owner - C:\PROGRA~1\FDD_FM~1\CZFMDSER.EXE O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\OPOY Tietoturvapalvelu\Anti-Virus\fsgk32st.exe O23 - Service: FBExec Service (FBExecService) - Unknown owner - d:\usr\FrontBase\bin\FBExec.exe O23 - Service: FBWebEnabler Service (FBWebEnablerService) - Unknown owner - d:\usr\FrontBase\bin\FBWebEnabler.exe (file missing) O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\OPOY Tietoturvapalvelu\backweb\9683872\program\fsbwsys.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\OPOY Tietoturvapalvelu\FWES\Program\fsdfwd.exe O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\OPOY Tietoturvapalvelu\Common\FSMA32.EXE O23 - Service: NetLimiter (nlsvc) - Locktime Software - d:\Program Files\NetLimiter 2 Monitor\nlsvc.exe O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - D:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe Ja sitten tuosmittijuttu: smitRem © log file version 2.8 by noahdfear Microsoft Windows XP [versio 5.1.2600] Running from C:\Documents and Settings\Pekka\Ty”p”yt„\smitrem ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Pre-run SharedTask Export (GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler) Copyright(C) 2006 BleepingComputer.com Registry Pseudo-Format Mode (Not a valid reg file): [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" "{D81E2FC4-B0A2-11D3-21AC-07C04C21A18A}"="Replay for WindowsXP" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32] @="%SystemRoot%\System32\browseui.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32] @="%SystemRoot%\System32\browseui.dll" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ checking for ShudderLTD key ShudderLTD key not present! checking for PSGuard.com key PSGuard.com key not present! checking for WinHound.com key WinHound.com key not present! spyaxe uninstaller NOT present Winhound uninstaller NOT present SpywareStrike uninstaller NOT present ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Existing Pre-run Files ~~~ Program Files ~~~ ~~~ Shortcuts ~~~ ~~~ Favorites ~~~ ~~~ system32 folder ~~~ 1024 dir msvol.tlb ld****.tmp mssearchnet.exe ncompat.tlb nvctrl.exe mscornet.exe hp***.tmp ~~~ Icons in System32 ~~~ ts.ico ot.ico ~~~ Windows directory ~~~ ~~~ Drive root ~~~ ~~~ Miscellaneous Files/folders ~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03 Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org Killing PID 708 'explorer.exe' Killing PID 708 'explorer.exe' Starting registry repairs Registry repairs complete ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SharedTask Export after registry fix (GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler) Copyright(C) 2006 BleepingComputer.com Registry Pseudo-Format Mode (Not a valid reg file): [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32] @="%SystemRoot%\System32\browseui.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32] @="%SystemRoot%\System32\browseui.dll" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Deleting files ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Remaining Post-run Files ~~~ Program Files ~~~ ~~~ Shortcuts ~~~ ~~~ Favorites ~~~ ~~~ system32 folder ~~~ ~~~ Icons in System32 ~~~ ~~~ Windows directory ~~~ ~~~ Drive root ~~~ ~~~ Miscellaneous Files/folders ~~~ ~~~ Wininet.dll ~~~ CLEAN! Vieläkö on jotain häröä missään? (koneesta muutenki puhti pois, pitäs varmaan asentaa vinkkari uusiks muttakun ei ole dvdasemaa, niin hirvee homma ottaa esim valokuvat cdeille..) KIITOS JO TÄSTÄ!
Örkit lähti =) Katsotaanpa noita turhia mitä voitaisiin fixailla: O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [PCSuiteTrayApplication] D:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -onlytray Tuo PCSuite on mielestäni turhaan noissa käynnistyvissä ohjelmissa. Jos haluat, että se starttaa aina automaattisesti niin jätä se fixaamatta. Enempää en oikein löydä, kun tuo läppäri tarvitsee hieman eritavalla noita ohjelmia käynnistyksessä
Jees, kiitos. Homma toimii nyt! Nokia suite tosiaan turha, mullavaan vaihto/huoltopuhelimena nyt Nokialaine niin oli pakko ladata tuo Suitekin... Kiitos viel kerran!
Olepa hyvä =) Tosiaan vaikka tuon fixaisitkin se estää sitä vain käynnistymästä automaattisesti kun avaat koneen. Voit silti käytää sitä normaalisti tarvittaessa, kunhan ensin käynnistät sen. Se vie muuten koko ajan koneen resursseja.
