IEXPLORE.EXE

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by jussih, Mar 6, 2007.

Page 1 of 2
  1. jussih

    jussih Member

    Joined:
    Jan 2, 2004
    Messages:
    50
    Likes Received:
    0
    Trophy Points:
    16
    eli kaksi kpl IEXPLORE.EXE tehtävää näkyy tehtävien hallinnassa vaikka en edes käytä ie:ta.Eivät poistu millään. oisko joku virus vai mikä lie. Virusohjelmat ei löydä mitään , eikä ad-aware / spybot. Jonkun escannin ajoin kanssa , eikä ongelma poistu millään. tässä ois hjt logi, josta itse en kyllä mitään älyä, enkä siksi uskalla oikein mitään tehdäkään. Jo joku vaan vois neuvoo niin oisin todella kiitollinen.

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\WELHO-~1\backweb\6629059\Program\SERVIC~1.EXE
    C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\bin\btwdins.exe
    C:\Program Files\Welho-tietoturvapalvelu\Anti-Virus\fsgk32st.exe
    C:\Program Files\Welho-tietoturvapalvelu\backweb\6629059\program\fsbwsys.exe
    C:\Program Files\Welho-tietoturvapalvelu\Anti-Virus\FSGK32.EXE
    C:\Program Files\Welho-tietoturvapalvelu\Common\FSMA32.EXE
    C:\Program Files\Welho-tietoturvapalvelu\Anti-Virus\fssm32.exe
    C:\Program Files\Welho-tietoturvapalvelu\Common\FSMB32.EXE
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Welho-tietoturvapalvelu\Common\FCH32.EXE
    C:\Program Files\Welho-tietoturvapalvelu\Common\FAMEH32.EXE
    C:\Program Files\Welho-tietoturvapalvelu\Anti-Virus\fsqh.exe
    C:\Program Files\Welho-tietoturvapalvelu\Anti-Virus\fsrw.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Welho-tietoturvapalvelu\FWES\Program\fsdfwd.exe
    C:\Program Files\Welho-tietoturvapalvelu\Anti-Virus\fsav32.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
    C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
    C:\Program Files\Welho-tietoturvapalvelu\Common\FSM32.EXE
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Welho-tietoturvapalvelu\FSGUI\ispnews.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\PROGRA~1\WELHO-~1\ANTI-S~1\fsaw.exe
    C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\BTTray.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\Welho-tietoturvapalvelu\FSGUI\fsguidll.exe
    C:\Program Files\Welho-tietoturvapalvelu\backweb\6629059\Program\fspex.exe
    C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
    C:\Program Files\HPQ\shared\hpqwmi.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    c:\progra~1\intern~1\iexplore.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\WINDOWS\system32\taskmgr.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\HJT\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hp.com
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://msnialogin.passport.com/ppsecure/md5auth.srf?lc=1035
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
    O4 - HKLM\..\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
    O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Welho-tietoturvapalvelu\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Welho-tietoturvapalvelu\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\Welho-tietoturvapalvelu\FSGUI\FSSW.EXE" /reboot
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [News Service] "C:\Program Files\Welho-tietoturvapalvelu\FSGUI\ispnews.exe"
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Poke four] C:\DOCUME~1\Jussi\APPLIC~1\GPLWIN~1\cool great.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: BTTray.lnk = ?
    O4 - Global Startup: DVD Check.lnk = C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: Welho Tietoturva.lnk = C:\Program Files\Welho-tietoturvapalvelu\backweb\6629059\Program\fspex.exe
    O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\Welho-tietoturvapalvelu\Anti-Spyware\blockpopups.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Lähetä &Bluetooth-laitteeseen - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\btsendto_ie_ctx.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Welho-tietoturvapalvelu\Anti-Spyware\ieshield.dll
    O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Welho-tietoturvapalvelu\Anti-Spyware\ieshield.dll
    O9 - Extra button: Doyles Room Poker - {40B2063F-DB01-4962-BE63-59435C01283C} - C:\PROGRA~1\DOYLES~1\client.exe
    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {94EB57FE-2720-496C-B33F-D9353C6E23F7} (F-Secure Online Scanner 2.1) - http://support.f-secure.com/ols/fscax.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O18 - Protocol: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINDOWS\system32\btxppanel.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: Welho Tietoturva (BackWeb Plug-in - 6629059) - BackWeb Technologies Inc. - C:\PROGRA~1\WELHO-~1\backweb\6629059\Program\SERVIC~1.EXE
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\bin\btwdins.exe
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Welho-tietoturvapalvelu\Anti-Virus\fsgk32st.exe
    O23 - Service: FSBWSYS (fsbwsys) - F-Secure Corp. - C:\Program Files\Welho-tietoturvapalvelu\backweb\6629059\program\fsbwsys.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Welho-tietoturvapalvelu\FWES\Program\fsdfwd.exe
    O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Welho-tietoturvapalvelu\Common\FSMA32.EXE
    O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\shared\hpqwmi.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe (file missing)
    O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
     
    jussih, Mar 6, 2007
    #1
  2. muuli123

    muuli123 Regular member

    Joined:
    Jan 13, 2007
    Messages:
    154
    Likes Received:
    0
    Trophy Points:
    26
    Lataa NoLop työpöydällesi yhdestä seuraavista linkeistä...
    Linkki 1
    Linkki 2
    Linkki 3

    [*]Sulje kaikki ohjelmat, koska tämä vaihe vaatii uudelleenkäynnistyksen
    [*]Tuplaklikkaa NoLop.exe ajaaksesi sen
    [*]Klikkaa nappulaa "Search and Destroy"
    <<Tietokoneesi skannataan saastuneiden tiedostojen osalta>>
    [*] Kun skannaus on valmis, sinua pyydetään käynnistämään kone uudestaan, jos infektio löytyy. Klikkaa OK
    [*] Klikkaa "REBOOT"-painiketta.
    [*] NoLopin pitäisi antaa viesti. Jos ei, tuplaklikkaa ohjelmaa ja se valmistuu. Lähetä C:\NoLop.log-tiedoston sisältö uuden HijackThis-lokin kera.

    -- Jos saat seuraavan virheen, "mscomctl.ocx or one of its dependencies are not correctly registered," lataa mscomctl.ocx ja tallenna se system32-hakemistoosi (yleensä c:\Windows\system32). Tämän jälkeen aja ohjelma uudestaan. --
     
    Last edited: Mar 6, 2007
    muuli123, Mar 6, 2007
    #2
  3. jussih

    jussih Member

    Joined:
    Jan 2, 2004
    Messages:
    50
    Likes Received:
    0
    Trophy Points:
    16
    [03/06/2007]
    [9:14:21 PM]

    ---Infection Files Found/Removed---
    C:\WINDOWS\tasks\AA1F31EE9184A6AA.job

    Beginning Removal...
    Rebooting...
    Removing Lop's Leftover Files/Folders...
    Editing Registry...
    **Fix Complete!**

    ---Listing AppData sub directories---

    C:\Documents and Settings\All Users\Application Data\Adobe
    C:\Documents and Settings\All Users\Application Data\Antivir Personaledition Classic
    C:\Documents and Settings\All Users\Application Data\Apple Computer
    C:\Documents and Settings\All Users\Application Data\Dvd Shrink
    C:\Documents and Settings\All Users\Application Data\F-secure
    C:\Documents and Settings\All Users\Application Data\F-secure(2)
    C:\Documents and Settings\All Users\Application Data\Hp
    C:\Documents and Settings\All Users\Application Data\Hpqwmi
    C:\Documents and Settings\All Users\Application Data\Locktime
    C:\Documents and Settings\All Users\Application Data\Microsoft
    C:\Documents and Settings\All Users\Application Data\Quicktime
    C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    C:\Documents and Settings\All Users\Application Data\Symantec
    C:\Documents and Settings\All Users\Application Data\Tuneup Software
    C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
    C:\Documents and Settings\All Users\Application Data\Wma Move Bait Roam
    C:\Documents and Settings\All Users\Application Data\{0b9e3b72-fce7-4b76-9f99-94e66a8c5760}
    C:\Documents and Settings\Default User\Application Data\Microsoft
    C:\Documents and Settings\Jussi\Application Data\Adobe
    C:\Documents and Settings\Jussi\Application Data\Adobeum -- EMPTY Directory
    C:\Documents and Settings\Jussi\Application Data\Apple Computer
    C:\Documents and Settings\Jussi\Application Data\Bsplayer
    C:\Documents and Settings\Jussi\Application Data\Bsplayer Pro
    C:\Documents and Settings\Jussi\Application Data\Divx
    C:\Documents and Settings\Jussi\Application Data\F-secure
    C:\Documents and Settings\Jussi\Application Data\Filemaker
    C:\Documents and Settings\Jussi\Application Data\Gplwinbarb
    C:\Documents and Settings\Jussi\Application Data\Help -- EMPTY Directory
    C:\Documents and Settings\Jussi\Application Data\Hewlett-packard
    C:\Documents and Settings\Jussi\Application Data\Hp
    C:\Documents and Settings\Jussi\Application Data\Identities
    C:\Documents and Settings\Jussi\Application Data\Intervideo
    C:\Documents and Settings\Jussi\Application Data\Ispnews
    C:\Documents and Settings\Jussi\Application Data\Lavasoft
    C:\Documents and Settings\Jussi\Application Data\Leadertech
    C:\Documents and Settings\Jussi\Application Data\Locktime
    C:\Documents and Settings\Jussi\Application Data\Macromedia
    C:\Documents and Settings\Jussi\Application Data\Microsoft
    C:\Documents and Settings\Jussi\Application Data\Mozilla
    C:\Documents and Settings\Jussi\Application Data\Pex
    C:\Documents and Settings\Jussi\Application Data\Real
    C:\Documents and Settings\Jussi\Application Data\Seven Zip
    C:\Documents and Settings\Jussi\Application Data\Sonic
    C:\Documents and Settings\Jussi\Application Data\Sun
    C:\Documents and Settings\Jussi\Application Data\Symantec
    C:\Documents and Settings\Jussi\Application Data\Tina1976
    C:\Documents and Settings\Jussi\Application Data\Tuneup Software
    C:\Documents and Settings\Jussi\Application Data\Utorrent
    C:\Documents and Settings\Jussi\Application Data\Vlc
    C:\Documents and Settings\Jussi\Application Data\Wholesecurity
    C:\Documents and Settings\Localservice\Application Data\Microsoft
    C:\Documents and Settings\Networkservice\Application Data\Microsoft
    C:\Documents and Settings\Networkservice\Application Data\Symantec
    C:\Documents and Settings\Vieras\Application Data\F-secure
    C:\Documents and Settings\Vieras\Application Data\Identities
    C:\Documents and Settings\Vieras\Application Data\Ispnews
    C:\Documents and Settings\Vieras\Application Data\Macromedia
    C:\Documents and Settings\Vieras\Application Data\Microsoft
    C:\Documents and Settings\Vieras\Application Data\Mozilla
    C:\Documents and Settings\Vieras\Application Data\Sun

    ja siten hjt-logi:

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\WELHO-~1\backweb\6629059\Program\SERVIC~1.EXE
    C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\bin\btwdins.exe
    C:\Program Files\Welho-tietoturvapalvelu\Anti-Virus\fsgk32st.exe
    C:\Program Files\Welho-tietoturvapalvelu\backweb\6629059\program\fsbwsys.exe
    C:\Program Files\Welho-tietoturvapalvelu\Anti-Virus\FSGK32.EXE
    C:\Program Files\Welho-tietoturvapalvelu\Common\FSMA32.EXE
    C:\Program Files\Welho-tietoturvapalvelu\Common\FSMB32.EXE
    C:\Program Files\Welho-tietoturvapalvelu\Anti-Virus\fssm32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Welho-tietoturvapalvelu\Common\FCH32.EXE
    C:\Program Files\Welho-tietoturvapalvelu\Common\FAMEH32.EXE
    C:\Program Files\Welho-tietoturvapalvelu\Anti-Virus\fsqh.exe
    C:\Program Files\Welho-tietoturvapalvelu\Anti-Virus\fsrw.exe
    C:\Program Files\Welho-tietoturvapalvelu\FWES\Program\fsdfwd.exe
    C:\Program Files\Welho-tietoturvapalvelu\Anti-Virus\fsav32.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
    C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
    C:\Program Files\Welho-tietoturvapalvelu\Common\FSM32.EXE
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Welho-tietoturvapalvelu\FSGUI\ispnews.exe
    C:\PROGRA~1\WELHO-~1\ANTI-S~1\fsaw.exe
    C:\WINDOWS\system32\ctfmon.exe
    c:\progra~1\intern~1\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\BTTray.exe
    C:\Program Files\Welho-tietoturvapalvelu\FSGUI\fsguidll.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\Welho-tietoturvapalvelu\backweb\6629059\Program\fspex.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\HPQ\shared\hpqwmi.exe
    C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\HJT\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://msnialogin.passport.com/ppsecure/md5auth.srf?lc=1035
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
    O4 - HKLM\..\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
    O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Welho-tietoturvapalvelu\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Welho-tietoturvapalvelu\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\Welho-tietoturvapalvelu\FSGUI\FSSW.EXE" /reboot
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [News Service] "C:\Program Files\Welho-tietoturvapalvelu\FSGUI\ispnews.exe"
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Poke four] C:\DOCUME~1\Jussi\APPLIC~1\GPLWIN~1\cool great.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: BTTray.lnk = ?
    O4 - Global Startup: DVD Check.lnk = C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: Welho Tietoturva.lnk = C:\Program Files\Welho-tietoturvapalvelu\backweb\6629059\Program\fspex.exe
    O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\Welho-tietoturvapalvelu\Anti-Spyware\blockpopups.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Lähetä &Bluetooth-laitteeseen - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\btsendto_ie_ctx.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Welho-tietoturvapalvelu\Anti-Spyware\ieshield.dll
    O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Welho-tietoturvapalvelu\Anti-Spyware\ieshield.dll
    O9 - Extra button: Doyles Room Poker - {40B2063F-DB01-4962-BE63-59435C01283C} - C:\PROGRA~1\DOYLES~1\client.exe
    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {94EB57FE-2720-496C-B33F-D9353C6E23F7} (F-Secure Online Scanner 2.1) - http://support.f-secure.com/ols/fscax.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O18 - Protocol: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINDOWS\system32\btxppanel.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: Welho Tietoturva (BackWeb Plug-in - 6629059) - BackWeb Technologies Inc. - C:\PROGRA~1\WELHO-~1\backweb\6629059\Program\SERVIC~1.EXE
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\bin\btwdins.exe
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Welho-tietoturvapalvelu\Anti-Virus\fsgk32st.exe
    O23 - Service: FSBWSYS (fsbwsys) - F-Secure Corp. - C:\Program Files\Welho-tietoturvapalvelu\backweb\6629059\program\fsbwsys.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Welho-tietoturvapalvelu\FWES\Program\fsdfwd.exe
    O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Welho-tietoturvapalvelu\Common\FSMA32.EXE
    O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\shared\hpqwmi.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe (file missing)
    O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

    Siinäpä kaikki mitä pyysit, menikö oikein? Selviääkö siitä mitään?
     
    jussih, Mar 6, 2007
    #3
  4. muuli123

    muuli123 Regular member

    Joined:
    Jan 13, 2007
    Messages:
    154
    Likes Received:
    0
    Trophy Points:
    26
    Sulla näyttää jääneen Nortonin jämiä kun olet poistanut sen, hoidetaan jämät pois kun ollaan saatu kone puhtaaksi ;)

    Lataa AVG Anti-Spyware 7.5 ja tallenna ohjelma työpöydällesi.

    [*]Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa.
    [*]Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää.
    [*]Käynnistä AVG Anti-Spyware.
    [*]Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta.
    [*]Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa.
    [*]Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti.
    [*]Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine".
    [*]Sitten "Reports" valikon alta:
    [*]Laita täppi kohtaan "Automatically generate report after every scan"
    [*]Ota täppi pois kohdasta"Only if threats were found"
    [*]Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa
    [*]"Resident shield is", muuta tila active:sta inactive:ksi
    [*]Sulje ohjelma, ÄLÄ skannaa vielä.

    Avaa HijackThis, paina do a system scan only,merkkaa tämä rivit:
    O4 - HKCU\..\Run: [Poke four] C:\DOCUME~1\Jussi\APPLIC~1\GPLWIN~1\cool great.exe
    Sitten paina Fix checked.

    Sitten laita piilotiedostot näkyviin, ohje siihen tässä:
    1.Napsauta Käynnistä-painiketta ja valitse Ohjauspaneeli.
    2.Valitse "Kansion asetukset"
    3.Siirry" Näytä välilehdelle"
    4.Valitse Näytä-välilehden Piilotetut tiedostot ja kansiot -kohdassa" Näytä piilotetut tiedostot ja kansiot."

    Sitten mene vikasietotilaan, ohje siihen tässä:
    1. Käynnistä tietokone uudelleen.
    2. Kun tietokone käynnistyy, paina F8-näppäintä.
    3. Näyttöön tulee erilaisia käynnistysvaihtoehtoja.
    4. Valitse näppäimistön nuolinäppäinten avulla Vikasietotila.
    5. Paina ENTER-näppäintä.

    Kun olet vikasietotilassa, niin poista nämä kansiot:
    C:\Documents and Settings\All Users\Application Data\-->Wma Move Bait Roam<--
    C:\Documents and Settings\Jussi\Application Data\-->Gplwinbarb<--

    Sitten aja aijemmin ladattu AVG Anti-Spyware:

    HUOM! Älä käytä muita ohjelmia AVG skannauksen aikana, tämä saattaa häiritä skannausta.
    [*]Kun vikasietotilassa, käynnistä AVG Anti-Spyware.
    [*]Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan".
    [*]AVG aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa.
    Kun skannaus on valmis:
    TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions"
    [*]Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta.
    [*]Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions"
    [​IMG]
    [*]Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta.
    [*]Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle.
    [*]Sulje ohjelma, käynnistä kone normaalisti, lähetä AVG:n raportti ja uusi HjT-loki viestiketjuusi.
     
    muuli123, Mar 6, 2007
    #4
  5. jussih

    jussih Member

    Joined:
    Jan 2, 2004
    Messages:
    50
    Likes Received:
    0
    Trophy Points:
    16
    AVG Anti-Spyware - Scan Report
    ---------------------------------------------------------

    + Created at: 1:23:27 PM 03/07/2007

    + Scan result:



    :mozilla.108:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.149:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.156:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.102:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
    :mozilla.105:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
    :mozilla.99:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
    :mozilla.52:C:\Documents and Settings\Vieras\Application Data\Mozilla\Firefox\Profiles\eictl3jb.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
    :mozilla.53:C:\Documents and Settings\Vieras\Application Data\Mozilla\Firefox\Profiles\eictl3jb.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
    :mozilla.77:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
    :mozilla.78:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
    :mozilla.79:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
    :mozilla.23:C:\Documents and Settings\Vieras\Application Data\Mozilla\Firefox\Profiles\eictl3jb.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.24:C:\Documents and Settings\Vieras\Application Data\Mozilla\Firefox\Profiles\eictl3jb.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.25:C:\Documents and Settings\Vieras\Application Data\Mozilla\Firefox\Profiles\eictl3jb.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.26:C:\Documents and Settings\Vieras\Application Data\Mozilla\Firefox\Profiles\eictl3jb.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.27:C:\Documents and Settings\Vieras\Application Data\Mozilla\Firefox\Profiles\eictl3jb.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.28:C:\Documents and Settings\Vieras\Application Data\Mozilla\Firefox\Profiles\eictl3jb.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.29:C:\Documents and Settings\Vieras\Application Data\Mozilla\Firefox\Profiles\eictl3jb.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.39:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.40:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.51:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.88:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
    :mozilla.28:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
    :mozilla.31:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
    :mozilla.32:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
    :mozilla.17:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
    :mozilla.18:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
    :mozilla.20:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
    :mozilla.21:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
    :mozilla.22:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
    :mozilla.24:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
    :mozilla.27:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
    :mozilla.116:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Clickbank : Cleaned.
    :mozilla.216:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Clickhype : Cleaned.
    C:\Documents and Settings\Jussi\Cookies\jussi@com[1].txt -> TrackingCookie.Com : Cleaned.
    :mozilla.21:C:\Documents and Settings\Vieras\Application Data\Mozilla\Firefox\Profiles\eictl3jb.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
    :mozilla.23:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
    :mozilla.25:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
    :mozilla.29:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
    :mozilla.30:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
    :mozilla.238:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
    :mozilla.239:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
    :mozilla.240:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
    :mozilla.241:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
    :mozilla.227:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
    :mozilla.228:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
    :mozilla.229:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
    :mozilla.50:C:\Documents and Settings\Vieras\Application Data\Mozilla\Firefox\Profiles\eictl3jb.default\cookies.txt -> TrackingCookie.Masterstats : Cleaned.
    :mozilla.174:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
    :mozilla.175:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
    :mozilla.30:C:\Documents and Settings\Vieras\Application Data\Mozilla\Firefox\Profiles\eictl3jb.default\cookies.txt -> TrackingCookie.Revenue : Cleaned.
    :mozilla.17:C:\Documents and Settings\Vieras\Application Data\Mozilla\Firefox\Profiles\eictl3jb.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
    :mozilla.18:C:\Documents and Settings\Vieras\Application Data\Mozilla\Firefox\Profiles\eictl3jb.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
    :mozilla.20:C:\Documents and Settings\Vieras\Application Data\Mozilla\Firefox\Profiles\eictl3jb.default\cookies.txt -> TrackingCookie.Sextracker : Cleaned.
    :mozilla.112:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
    :mozilla.113:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
    :mozilla.114:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
    :mozilla.195:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
    :mozilla.34:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.35:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.35:C:\Documents and Settings\Vieras\Application Data\Mozilla\Firefox\Profiles\eictl3jb.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.36:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.36:C:\Documents and Settings\Vieras\Application Data\Mozilla\Firefox\Profiles\eictl3jb.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.37:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.37:C:\Documents and Settings\Vieras\Application Data\Mozilla\Firefox\Profiles\eictl3jb.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.38:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.14:C:\Documents and Settings\Vieras\Application Data\Mozilla\Firefox\Profiles\eictl3jb.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
    :mozilla.15:C:\Documents and Settings\Vieras\Application Data\Mozilla\Firefox\Profiles\eictl3jb.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
    :mozilla.74:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
    :mozilla.75:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
    :mozilla.59:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
    :mozilla.60:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
    :mozilla.61:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
    :mozilla.62:C:\Documents and Settings\Jussi\Application Data\Mozilla\Firefox\Profiles\x3qopvib.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.


    ::Report end

    HJT:

    Logfile of HijackThis v1.99.1
    Scan saved at 1:35:58 PM, on 03/07/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\PROGRA~1\WELHO-~1\backweb\6629059\Program\SERVIC~1.EXE
    C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\bin\btwdins.exe
    C:\Program Files\Welho-tietoturvapalvelu\Anti-Virus\fsgk32st.exe
    C:\Program Files\Welho-tietoturvapalvelu\backweb\6629059\program\fsbwsys.exe
    C:\Program Files\Welho-tietoturvapalvelu\Anti-Virus\FSGK32.EXE
    C:\Program Files\Welho-tietoturvapalvelu\Common\FSMA32.EXE
    C:\Program Files\Welho-tietoturvapalvelu\Anti-Virus\fssm32.exe
    C:\Program Files\Welho-tietoturvapalvelu\Common\FSMB32.EXE
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Welho-tietoturvapalvelu\Common\FCH32.EXE
    C:\Program Files\Welho-tietoturvapalvelu\Common\FAMEH32.EXE
    C:\Program Files\Welho-tietoturvapalvelu\Anti-Virus\fsqh.exe
    C:\Program Files\Welho-tietoturvapalvelu\Anti-Virus\fsrw.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\Welho-tietoturvapalvelu\Anti-Virus\fsav32.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
    C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
    C:\Program Files\Welho-tietoturvapalvelu\Common\FSM32.EXE
    C:\Program Files\Welho-tietoturvapalvelu\FWES\Program\fsdfwd.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Welho-tietoturvapalvelu\FSGUI\ispnews.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\BTTray.exe
    C:\PROGRA~1\WELHO-~1\ANTI-S~1\fsaw.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\Welho-tietoturvapalvelu\backweb\6629059\Program\fspex.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Welho-tietoturvapalvelu\FSGUI\fsguidll.exe
    C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
    C:\Program Files\HPQ\shared\hpqwmi.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\HJT\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://msnialogin.passport.com/ppsecure/md5auth.srf?lc=1035
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
    O4 - HKLM\..\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
    O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Welho-tietoturvapalvelu\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Welho-tietoturvapalvelu\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\Welho-tietoturvapalvelu\FSGUI\FSSW.EXE" /reboot
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [News Service] "C:\Program Files\Welho-tietoturvapalvelu\FSGUI\ispnews.exe"
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Poke four] C:\DOCUME~1\Jussi\APPLIC~1\GPLWIN~1\cool great.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: BTTray.lnk = ?
    O4 - Global Startup: DVD Check.lnk = C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: Welho Tietoturva.lnk = C:\Program Files\Welho-tietoturvapalvelu\backweb\6629059\Program\fspex.exe
    O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\Welho-tietoturvapalvelu\Anti-Spyware\blockpopups.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Lähetä &Bluetooth-laitteeseen - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\btsendto_ie_ctx.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Welho-tietoturvapalvelu\Anti-Spyware\ieshield.dll
    O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Welho-tietoturvapalvelu\Anti-Spyware\ieshield.dll
    O9 - Extra button: Doyles Room Poker - {40B2063F-DB01-4962-BE63-59435C01283C} - C:\PROGRA~1\DOYLES~1\client.exe
    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {94EB57FE-2720-496C-B33F-D9353C6E23F7} (F-Secure Online Scanner 2.1) - http://support.f-secure.com/ols/fscax.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O18 - Protocol: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINDOWS\system32\btxppanel.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Welho Tietoturva (BackWeb Plug-in - 6629059) - BackWeb Technologies Inc. - C:\PROGRA~1\WELHO-~1\backweb\6629059\Program\SERVIC~1.EXE
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\bin\btwdins.exe
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Welho-tietoturvapalvelu\Anti-Virus\fsgk32st.exe
    O23 - Service: FSBWSYS (fsbwsys) - F-Secure Corp. - C:\Program Files\Welho-tietoturvapalvelu\backweb\6629059\program\fsbwsys.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Welho-tietoturvapalvelu\FWES\Program\fsdfwd.exe
    O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Welho-tietoturvapalvelu\Common\FSMA32.EXE
    O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\shared\hpqwmi.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe (file missing)
    O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

    Siinäpä ne.
     
    jussih, Mar 7, 2007
    #5
  6. muuli123

    muuli123 Regular member

    Joined:
    Jan 13, 2007
    Messages:
    154
    Likes Received:
    0
    Trophy Points:
    26
    Koititko poistaa nämä kansiot?
    C:\Documents and Settings\All Users\Application Data\-->Wma Move Bait Roam<--
    C:\Documents and Settings\Jussi\Application Data\-->Gplwinbarb<--

    ja fixasitko tämän rivin?
    O4 - HKCU\..\Run: [Poke four] C:\DOCUME~1\Jussi\APPLIC~1\GPLWIN~1\cool great.exe
     
    muuli123, Mar 7, 2007
    #6
  7. jussih

    jussih Member

    Joined:
    Jan 2, 2004
    Messages:
    50
    Likes Received:
    0
    Trophy Points:
    16
    Joo, fixasin ja poistin nuo kansiot. Ongelmat hävisivät. Kiitos tosi paljon neuvoista. Ei olisi itsekseen onnistunutkaan...
     
    jussih, Mar 7, 2007
    #7
  8. muuli123

    muuli123 Regular member

    Joined:
    Jan 13, 2007
    Messages:
    154
    Likes Received:
    0
    Trophy Points:
    26
    Älä karkaa vielä, laita uusi HjT-loki. Koneellasi on vielä ne nortonin jämät, joten hoidetaan ne pois.
     
    muuli123, Mar 7, 2007
    #8
  9. jussih

    jussih Member

    Joined:
    Jan 2, 2004
    Messages:
    50
    Likes Received:
    0
    Trophy Points:
    16
    ai niin joo.

    tässäpä se

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\PROGRA~1\WELHO-~1\backweb\6629059\Program\SERVIC~1.EXE
    C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\bin\btwdins.exe
    C:\Program Files\Welho-tietoturvapalvelu\Anti-Virus\fsgk32st.exe
    C:\Program Files\Welho-tietoturvapalvelu\backweb\6629059\program\fsbwsys.exe
    C:\Program Files\Welho-tietoturvapalvelu\Anti-Virus\FSGK32.EXE
    C:\Program Files\Welho-tietoturvapalvelu\Common\FSMA32.EXE
    C:\Program Files\Welho-tietoturvapalvelu\Anti-Virus\fssm32.exe
    C:\Program Files\Welho-tietoturvapalvelu\Common\FSMB32.EXE
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Welho-tietoturvapalvelu\Common\FCH32.EXE
    C:\Program Files\Welho-tietoturvapalvelu\Common\FAMEH32.EXE
    C:\Program Files\Welho-tietoturvapalvelu\Anti-Virus\fsqh.exe
    C:\Program Files\Welho-tietoturvapalvelu\Anti-Virus\fsrw.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\Welho-tietoturvapalvelu\Anti-Virus\fsav32.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
    C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
    C:\Program Files\Welho-tietoturvapalvelu\Common\FSM32.EXE
    C:\Program Files\Welho-tietoturvapalvelu\FWES\Program\fsdfwd.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Welho-tietoturvapalvelu\FSGUI\ispnews.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\BTTray.exe
    C:\PROGRA~1\WELHO-~1\ANTI-S~1\fsaw.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\Welho-tietoturvapalvelu\backweb\6629059\Program\fspex.exe
    C:\Program Files\Welho-tietoturvapalvelu\FSGUI\fsguidll.exe
    C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
    C:\Program Files\HPQ\shared\hpqwmi.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\Jussi\Työpöytä\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://msnialogin.passport.com/ppsecure/md5auth.srf?lc=1035
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
    O4 - HKLM\..\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
    O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Welho-tietoturvapalvelu\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Welho-tietoturvapalvelu\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\Welho-tietoturvapalvelu\FSGUI\FSSW.EXE" /reboot
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [News Service] "C:\Program Files\Welho-tietoturvapalvelu\FSGUI\ispnews.exe"
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Poke four] C:\DOCUME~1\Jussi\APPLIC~1\GPLWIN~1\cool great.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: BTTray.lnk = ?
    O4 - Global Startup: DVD Check.lnk = C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: Welho Tietoturva.lnk = C:\Program Files\Welho-tietoturvapalvelu\backweb\6629059\Program\fspex.exe
    O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\Welho-tietoturvapalvelu\Anti-Spyware\blockpopups.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Lähetä &Bluetooth-laitteeseen - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\btsendto_ie_ctx.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Welho-tietoturvapalvelu\Anti-Spyware\ieshield.dll
    O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Welho-tietoturvapalvelu\Anti-Spyware\ieshield.dll
    O9 - Extra button: Doyles Room Poker - {40B2063F-DB01-4962-BE63-59435C01283C} - C:\PROGRA~1\DOYLES~1\client.exe
    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {94EB57FE-2720-496C-B33F-D9353C6E23F7} (F-Secure Online Scanner 2.1) - http://support.f-secure.com/ols/fscax.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O18 - Protocol: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINDOWS\system32\btxppanel.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Welho Tietoturva (BackWeb Plug-in - 6629059) - BackWeb Technologies Inc. - C:\PROGRA~1\WELHO-~1\backweb\6629059\Program\SERVIC~1.EXE
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\bin\btwdins.exe
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Welho-tietoturvapalvelu\Anti-Virus\fsgk32st.exe
    O23 - Service: FSBWSYS (fsbwsys) - F-Secure Corp. - C:\Program Files\Welho-tietoturvapalvelu\backweb\6629059\program\fsbwsys.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Welho-tietoturvapalvelu\FWES\Program\fsdfwd.exe
    O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Welho-tietoturvapalvelu\Common\FSMA32.EXE
    O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\shared\hpqwmi.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe (file missing)
    O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

     
    jussih, Mar 7, 2007
    #9
  10. muuli123

    muuli123 Regular member

    Joined:
    Jan 13, 2007
    Messages:
    154
    Likes Received:
    0
    Trophy Points:
    26
    Ensiksi tee tämä, koska se estää todennäköisesti fixiä:
    Avaa AVG Anti-Spyware klikkaa "Shield" kuvaketta ikkunan ylälaidassa "Resident shield is", muuta tila active:sta inactive:ksi.

    Kopioi seuraavat tummennetut rivit muistioon ja tallenna nimellä poista.bat (tallennusmuoto kaikki tiedostot) esim. työpöydälle:

    @ECHO OFF
    sc stop ''Symantec Core LC''
    sc delete ''Symantec Core LC''

    Tuplaklikkaa poista.bat-tiedostoa työpöydällä.
    Komentoikkuna välähtää, se on normaalia.

    Sitten avaa HijackThis, paina do a system scan only, merkkaa nämä rivit:
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    O4 - HKCU\..\Run: [Poke four] C:\DOCUME~1\Jussi\APPLIC~1\GPLWIN~1\cool great.exe
    O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe (file missing)
    Sitten paina Fix checked.

    Sitten poista nämä kansiot vikasietotilassa (voi olla että näitä kaikkia kansioita ei löydy):
    C:\Program Files\Common Files\-->Symantec Shared<--
    C:\Documents and Settings\All Users\Application Data\-->Symantec<--
    C:\Documents and Settings\All Users\Application Data\-->Wma Move Bait Roam<--
    C:\Documents and Settings\Jussi\Application Data\-->Gplwinbarb<--

    Paina Käynnistä->Etsi, sitten valitse silleen että etsii myös piilotiedostoista.
    Sitten etsi näillä hakusanoilla Norton ja Symantec, poista ne mitä löytyy.

    Lähetä sitten uusi HjT-loki.
     
    muuli123, Mar 7, 2007
    #10
  11. jussih

    jussih Member

    Joined:
    Jan 2, 2004
    Messages:
    50
    Likes Received:
    0
    Trophy Points:
    16
    Joko ne ois asiat kunnossa vai miten?

    Logfile of HijackThis v1.99.1
    Scan saved at 5:39:27 AM, on 03/08/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\PROGRA~1\WELHO-~1\backweb\6629059\Program\SERVIC~1.EXE
    C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\bin\btwdins.exe
    C:\Program Files\Welho-tietoturvapalvelu\Anti-Virus\fsgk32st.exe
    C:\Program Files\Welho-tietoturvapalvelu\backweb\6629059\program\fsbwsys.exe
    C:\Program Files\Welho-tietoturvapalvelu\Anti-Virus\FSGK32.EXE
    C:\Program Files\Welho-tietoturvapalvelu\backweb\6629059\Program\fspex.exe
    C:\Program Files\Welho-tietoturvapalvelu\Common\FSMA32.EXE
    C:\Program Files\Welho-tietoturvapalvelu\Anti-Virus\fssm32.exe
    C:\Program Files\Welho-tietoturvapalvelu\Common\FSMB32.EXE
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Welho-tietoturvapalvelu\Common\FCH32.EXE
    C:\Program Files\Welho-tietoturvapalvelu\Common\FAMEH32.EXE
    C:\Program Files\Welho-tietoturvapalvelu\Anti-Virus\fsqh.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Welho-tietoturvapalvelu\Anti-Virus\fsrw.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
    C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
    C:\Program Files\Welho-tietoturvapalvelu\Common\FSM32.EXE
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Welho-tietoturvapalvelu\FSGUI\ispnews.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\BTTray.exe
    C:\Program Files\Welho-tietoturvapalvelu\FWES\Program\fsdfwd.exe
    C:\Program Files\Welho-tietoturvapalvelu\Anti-Virus\fsav32.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
    C:\PROGRA~1\WELHO-~1\ANTI-S~1\fsaw.exe
    C:\Program Files\Welho-tietoturvapalvelu\FSGUI\fsguidll.exe
    C:\Program Files\HPQ\shared\hpqwmi.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\Jussi\Työpöytä\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://msnialogin.passport.com/ppsecure/md5auth.srf?lc=1035
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
    O4 - HKLM\..\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
    O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Welho-tietoturvapalvelu\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Welho-tietoturvapalvelu\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\Welho-tietoturvapalvelu\FSGUI\FSSW.EXE" /reboot
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [News Service] "C:\Program Files\Welho-tietoturvapalvelu\FSGUI\ispnews.exe"
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: BTTray.lnk = ?
    O4 - Global Startup: DVD Check.lnk = C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: Welho Tietoturva.lnk = C:\Program Files\Welho-tietoturvapalvelu\backweb\6629059\Program\fspex.exe
    O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\Welho-tietoturvapalvelu\Anti-Spyware\blockpopups.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Lähetä &Bluetooth-laitteeseen - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\btsendto_ie_ctx.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Welho-tietoturvapalvelu\Anti-Spyware\ieshield.dll
    O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Welho-tietoturvapalvelu\Anti-Spyware\ieshield.dll
    O9 - Extra button: Doyles Room Poker - {40B2063F-DB01-4962-BE63-59435C01283C} - C:\PROGRA~1\DOYLES~1\client.exe
    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {94EB57FE-2720-496C-B33F-D9353C6E23F7} (F-Secure Online Scanner 2.1) - http://support.f-secure.com/ols/fscax.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O18 - Protocol: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINDOWS\system32\btxppanel.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Welho Tietoturva (BackWeb Plug-in - 6629059) - BackWeb Technologies Inc. - C:\PROGRA~1\WELHO-~1\backweb\6629059\Program\SERVIC~1.EXE
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth-ohjelmisto\bin\btwdins.exe
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Welho-tietoturvapalvelu\Anti-Virus\fsgk32st.exe
    O23 - Service: FSBWSYS (fsbwsys) - F-Secure Corp. - C:\Program Files\Welho-tietoturvapalvelu\backweb\6629059\program\fsbwsys.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Welho-tietoturvapalvelu\FWES\Program\fsdfwd.exe
    O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Welho-tietoturvapalvelu\Common\FSMA32.EXE
    O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\shared\hpqwmi.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

     
    jussih, Mar 7, 2007
    #11
  12. muuli123

    muuli123 Regular member

    Joined:
    Jan 13, 2007
    Messages:
    154
    Likes Received:
    0
    Trophy Points:
    26
    Alkaa näyttämään hyvältä :D

    Vielä javan päivitys, niin kaikki on kunnossa.

    Javan päivitys ja välimuistin tyhjennys:

    1. Klikkaa Käynnistä -> Ohjauspaneeli ja tupla-klikkaa Lisää tai poista sovellus Ohjauspaneelissa.
    2. Etsi listasta kaikki entiset Java versiosi. (J2SE Runtime Environment.... )
    Niissä pitäisi olla seuraava kuva vieressä: [​IMG]
    3. Valitse kaikki entiset Java versiosi ja valitse Poista.
    4. Asenna uusin Java päivitys seuraavasta linkistä..
    5. Käynnistä kone uudelleen asennuksen jälkeen:

    http://java.sun.com/javase/downloads/index.jsp

    Rullaa alas kohteeseen Java Runtime Environment (JRE) 6

    Paina Download

    Ruksaa Accept, ota offline installation, tallenna vaikka työpöydälle ja asenna se.

    6. Käynnistyksen jälkeen, mene takaisin Ohjauspaneeliin ja avaa Java asetuksesi (Muita Ohjauspaneelin asetuksia -> Java kahvikuppi).

    7. General Settings -osion alla, vedä liukusäädintä (Disk Space) pienemmälle, ja klikkaa Delete Files -nappia.

    (Jotkut javapohjaiset ohjelmat saattavat tarvita enemmän levytilaa.
    Jos huomaat säädön pienentämisen jälkeen koneessa hitautta, siirrä liukusäädintä isommalle    ).

    8. Varmista että kaikki kaksi valintaa ovat rastitettuja:

    [*]Applications and Applets

    [*]Trace and Log Files


    Ja paina OK -nappia

    9. Klikkaa OK "Temporary Files Settings" -ikkunassasi.
    Huomaa: Tämä poistaa kaikki ladatut sovellukset ja appletit VÄLIMUISTISTA.

    10. Klikkaa OK jättääksesi Java asetusikkunasi.
     
    muuli123, Mar 8, 2007
    #12
  13. jussih

    jussih Member

    Joined:
    Jan 2, 2004
    Messages:
    50
    Likes Received:
    0
    Trophy Points:
    16
    Nyt on javakin päivitetty. Tosi iso kiitos selkeistä ja kattavista ohjeista!!!!!!!!!! Hyvä , että joku aina jaksaa neuvoa ja opastaa...
     
    jussih, Mar 8, 2007
    #13
  14. muuli123

    muuli123 Regular member

    Joined:
    Jan 13, 2007
    Messages:
    154
    Likes Received:
    0
    Trophy Points:
    26
    Ole hyvä :D
     
    muuli123, Mar 8, 2007
    #14
  15. mth_84

    mth_84 Member

    Joined:
    Jun 22, 2005
    Messages:
    11
    Likes Received:
    0
    Trophy Points:
    11
    Terve!

    Itsellä samanmoinen hässäkkä koneessa.. kone toimii todella tahkeasti ja virustorjunta ohjelmia ajettu, norton, avg, spybot...etc mikään ei auta. Ohjelmat eivät löydä mitää outoa?
    ajoin nolopin ja ei löytänyt infektiota sekään.
    Suoritin käyttö jos ei koske mihinkää n. 2-3% mutta jos jotain käyttää niin pomppaa 100%.
    itsellä kanssa tuo iexplore vie muistia eniten ja toisena explorer.exe ja 3. svchost.exe. kaikki yli 25000kt.

    Ajoin hjt ja tässä loki. en itse niin ymmärrä mutta jos joku viitsisi auttaa..?

    Logfile of HijackThis v1.99.1
    Scan saved at 20:53:50, on 10.6.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16441)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    C:\Program Files\HP\TVPlay\Kernel\CLML_NTService\CLMLServer.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\HP\TVPlay\Kernel\TV\TVPCapSvc.exe
    C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\HP\QuickPlay\QPService.exe
    C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
    C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
    C:\Program Files\HP\TVPlay\TVPService.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Documents and Settings\Marko\Työpöytä\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.hp.com/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Seekmo Toolbar - {53E0B6E8-A51D-448B-B692-40B67B285543} - C:\Program Files\Seekmo Programs\Seekmo Toolbar\SeekmoTB.dll
    O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
    O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
    O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
    O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
    O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
    O4 - HKLM\..\Run: [TVPService] "C:\Program Files\HP\TVPlay\TVPService.exe"
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe
    O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: HP Photosmart Premier -pikakäynnistys.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Automattinen LiveUpdate-ajastustoiminto - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\ccPwdSvc.exe
    O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Norton Internet Security\comHost.exe
    O23 - Service: CyberLink Media Library Service(HP TVPlay) - Cyberlink - C:\Program Files\HP\TVPlay\Kernel\CLML_NTService\CLMLServer.exe
    O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: iPodService - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: Norton AntiVirus Auto-Protect -palvelu (navapsvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton Protection Center -palvelu (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: CyberLink Background Capture Service (CBCS HP TVPlay) (TVPCapSvc) - Unknown owner - C:\Program Files\HP\TVPlay\Kernel\TV\TVPCapSvc.exe

     
    mth_84, Jun 10, 2007
    #15
  16. mth_84

    mth_84 Member

    Joined:
    Jun 22, 2005
    Messages:
    11
    Likes Received:
    0
    Trophy Points:
    11
    voisiko joku katsoa tuon lokin? ei tahdo saada konetta enää auki..
     
    mth_84, Jun 13, 2007
    #16
  17. Hujo

    Hujo Guest

    kaksi virusohjelmaa avg ja norton mikäs on käytössä

     
    Hujo, Jun 13, 2007
    #17
  18. mth_84

    mth_84 Member

    Joined:
    Jun 22, 2005
    Messages:
    11
    Likes Received:
    0
    Trophy Points:
    11
    sekos enneku laitoin avg.. siksi laitoin tuon avg kun norton ei löytäny ikinä mitää. avg löysi pari troijaa ja poisti mutta ei vaikutusta..
     
    mth_84, Jun 13, 2007
    #18
  19. Hujo

    Hujo Guest

    mikäs noista pistät pois?
     
    Last edited by a moderator: Jun 13, 2007
    Hujo, Jun 13, 2007
    #19
  20. mth_84

    mth_84 Member

    Joined:
    Jun 22, 2005
    Messages:
    11
    Likes Received:
    0
    Trophy Points:
    11
    itseaisassa en kumpaakaa..:S mutta sama käytös vaikka oli vain norton.
     
    mth_84, Jun 13, 2007
    #20
Page 1 of 2

Share This Page