Elikkä kone pysähtyy täysin muutamaksi sekunniksi, jonka jälkeen toimii taas normaalisti hetken kunnes tulee seuraava pysähdys Onko koneessa jotain ylimääräisiä ohjelmia vaiko sitten iha muuta vikaa Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:32:57, on 13.2.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Normal Running processes: E:\WINDOWS\System32\smss.exe E:\WINDOWS\system32\winlogon.exe E:\WINDOWS\system32\services.exe E:\WINDOWS\system32\lsass.exe E:\WINDOWS\system32\Ati2evxx.exe E:\WINDOWS\system32\svchost.exe E:\WINDOWS\System32\svchost.exe E:\WINDOWS\system32\Ati2evxx.exe E:\Program Files\Sygate\SPF\smc.exe E:\WINDOWS\Explorer.EXE C:\Ohjelmat\aswUpdSv.exe C:\Ohjelmat\ashServ.exe E:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe E:\Program Files\NetLimiter\NetLimiter.exe E:\Program Files\Microsoft Hardware\Keyboard\type32.exe C:\Ohjelmat\ashDisp.exe E:\Program Files\Microsoft Hardware\Mouse\point32.exe E:\WINDOWS\system32\CTHELPER.EXE E:\Program Files\Java\jre1.6.0_03\bin\jusched.exe E:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe E:\WINDOWS\system32\oodtray.exe E:\Program Files\Common Files\InstallShield\UpdateService\issch.exe E:\Program Files\QuickTime\QTTask.exe E:\WINDOWS\system32\spoolsv.exe E:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE E:\Program Files\iTunes\iTunesHelper.exe E:\WINDOWS\system32\ctfmon.exe E:\Program Files\MSN Messenger\MsnMsgr.Exe E:\Program Files\Skype\Phone\Skype.exe E:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe E:\Program Files\DAEMON Tools\daemon.exe E:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe E:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Ohjelmat\AVG Anti-Spyware 7.5\guard.exe E:\Program Files\MagicTune Premium\MagicTuneEngine.exe E:\WINDOWS\system32\oodag.exe C:\Ohjelmat\Last.fm\LastFM.exe C:\Ohjelmat\Last.fm\LastFMHelper.exe E:\WINDOWS\system32\MsPMSPSv.exe C:\Ohjelmat\ashMaiSv.exe C:\Ohjelmat\ashWebSv.exe E:\Program Files\iPod\bin\iPodService.exe E:\Program Files\PC Connectivity Solution\ServiceLayer.exe E:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe E:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe E:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe E:\Program Files\Skype\Plugin Manager\skypePM.exe E:\Program Files\MSN Messenger\usnsvc.exe F:\Mirc\mirc.exe E:\Program Files\iTunes\iTunes.exe E:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceHelper.exe E:\Program Files\Common Files\Apple\Mobile Device Support\bin\distnoted.exe C:\Ohjelmat\Opera.exe E:\Program Files\winbond\Hardware Doctor\Hwdoctor.exe E:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/ig?hl=fi R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Ohjelmat\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O4 - HKLM\..\Run: [IMJPMIG8.1] "E:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [PHIME2002ASync] E:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] E:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [ATIPTA] E:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [SmcService] E:\PROGRA~1\Sygate\SPF\smc.exe -startgui O4 - HKLM\..\Run: [NetLimiter] E:\Program Files\NetLimiter\NetLimiter.exe /s O4 - HKLM\..\Run: [IntelliType] "E:\Program Files\Microsoft Hardware\Keyboard\type32.exe" O4 - HKLM\..\Run: [avast!] C:\Ohjelmat\ashDisp.exe O4 - HKLM\..\Run: [POINTER] point32.exe O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [UpdReg] E:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [Jet Detection] C:\Ohjelmat\SBlaster\PROGRAM\ADGJDet.exe O4 - HKLM\..\Run: [NeroFilterCheck] E:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Ohjelmat\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [NVMixerTray] "E:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" O4 - HKLM\..\Run: [OODefragTray] E:\WINDOWS\system32\oodtray.exe O4 - HKLM\..\Run: [StartCCC] "E:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKLM\..\Run: [ISUSPM Startup] E:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "E:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "E:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "E:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [Skype] "E:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "E:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [DAEMON Tools] "E:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [Steam] F:\Steam\Steam.exe -silent O4 - HKCU\..\Run: [PC Suite Tray] "E:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Last.fm Helper.lnk = C:\Ohjelmat\Last.fm\LastFMHelper.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = E:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = E:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: GammaTray.lnk = ? O4 - Global Startup: Last.fm.lnk = C:\Ohjelmat\Last.fm\LastFM.exe O4 - Global Startup: NCProTray.lnk = ? O4 - Global Startup: SATARaid.lnk = ? O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: e:\windows\system32\nwprovau.dll O12 - Plugin for .spop: E:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - E:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Apple Mobile Device - Apple, Inc. - E:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Ohjelmat\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - E:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - E:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Ohjelmat\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Ohjelmat\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Ohjelmat\ashWebSv.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Ohjelmat\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Creative Service for CDROM Access - Unknown owner - E:\WINDOWS\system32\CTsvcCDA.exe (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - E:\Program Files\iPod\bin\iPodService.exe O23 - Service: MagicTuneEngine - Unknown owner - E:\Program Files\MagicTune Premium\MagicTuneEngine.exe O23 - Service: O&O Defrag - O&O Software GmbH - E:\WINDOWS\system32\oodag.exe O23 - Service: ServiceLayer - Nokia. - E:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - E:\Program Files\Sygate\SPF\smc.exe -- End of file - 9827 bytes
Escan Ohjeet tuolla sivulla. http://koti.mbnet.fi/pattaya1/escanmwav.htm lataa tuosta http://www.spywareinfo.dk/download/mwav.exe päivitä tuosta http://koti.mbnet.fi/pattaya1/lataus/Mwav.bat laita täpit merkkauksien mukaan http://koti.mbnet.fi/pattaya1/eScan6.jpg scannaa jos ala luukkuun tulee jotain niin kopioi se näin: Käytä komentoa Ctrl+A. Kopioi rivit komennolla Ctrl+C. Liitä rivit komennolla Ctrl+V. Laita virus log tänne. ============== Lataa: RegSeeker.zip työpöydälle: Pura zip C:\RegSeeker\ kansioon. Sieltä käynnistät RegSeeker.exe ohjelman. Oikeasa yläkulmassa on Languages.... linkki, josta valitset Suomenkielen. Vasemmasta alakulmasta ruksit Luo vrmuuskopio ja sitten linkki Puhdista rekisteri Ruksit kaikkiin muihin kohtiin paitsi "Käyttökelvottomat.." sitten "OK" (odotat hetken). Ruutuun ilmestyy lista epäkelvoista rekisterimerkinnöistä, jotka alapalkista Valitse kohdasta klikkaat Valitse kaikki jolloin valitut saavat keltaisen pohjavärin. Alapalkin Toiminnot linkistä klikkaat Poista valitut kohteet Ponnahdusikkunaan "Kaikki valitut kohteet poistetaan ? vastaat "OK". Seuraavaan Ponnahdusikkunaan "Varmuuskopiot" vastaat "OK". Klikaa vasemmalta Lopeta RegSeeker ja käynnistä koneesi uudelleen. ====== lataa startuplite tallena tiedosto työpöydälle. Tuplalikkaa StartUpLitenn.exe:ä sitten voi valita mitä jätät käynnistyviin ja paina sitten continue. ====== Lataa tuolta http://www.ccleaner.com/download/builds.aspx CCleaner v2.03.532- Standard Build, ÄLÄ aseenna Yahoo toolbaria! laita asetukset näin: Valinnat --> Lisäasetukset --> Ota ruksi pois kohdasta Poista vain yli 48 tuntia vanhat tilapäistiedostot. aja Puhdistaja > tutki nappi > aja ccleaner nappi oikea alakulma aja Virheet > etsi rekisteri virheitä nappi > Korjaa rekisteri virheet. nappi
Tässä sitten logeja File F:\Mirc\mirc.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.62. No Action Taken. File C:\16.1 imut\Albums\2001.04.28 - Best Da Ze!!\07 ulfuls A·A·P no theme.mp3 infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File E:\Documents and Settings\arttu\Application Data\SecuROM\UserData\???????????p????????? infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File E:\Documents and Settings\arttu\Application Data\SecuROM\UserData\???????????p????????? infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File E:\Documents and Settings\arttu\Recent\Mai Kuraki - Silent love ~ open my heart ~ BE WITH U.lnk infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File F:\Maps\FrozenThrone\Download\(12)·egendary heroes v2.0·w3m infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File F:\Mirc\backup\mirc.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.617. No Action Taken. File F:\Mirc\mirc.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.62. No Action Taken. File F:\Mirc\sysreset\mirc.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.614. No Action Taken. File F:\System Volume Information\_restore{290E5D42-03CC-42E4-B4F5-46444D33DBAF}\RP211\A0034011.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.617. No Action Taken. File F:\System Volume Information\_restore{290E5D42-03CC-42E4-B4F5-46444D33DBAF}\RP211\A0034014.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.617. No Action Taken. File F:\Warcraft III\Maps\FrozenThrone\Download\(12)·egendary heroes v2.0·w3m infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File G:\imut 24.4\BENNIE K - THE WORLD\01.??? ~Opening~.mp3 infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File G:\imut 24.4\BENNIE K - THE WORLD\05.????? ~Interlude~.mp3 infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File G:\imut 24.4\BENNIE K - THE WORLD\12.??___ ~Interlude~.mp3 infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File H:\Omat tiedostot\Omat musiikkitiedostot\iTunes\iTunes Music\HIGH and MIGHTY COLOR\Dreams\03 ?????-?.m4a infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File H:\Omat tiedostot\Torskat\Ayumi Hamasaki - glitter/fated.torrent infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File H:\Omat tiedostot\Torskat\Joey Yung ??? & Grasshopper ?? - 903 id club ?????07???2?.torrent infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File H:\Omat tiedostot\Torskat\L'Arc~en~Ciel - SEVENTH HEAVEN.torrent infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File H:\Omat tiedostot\Torskat\Mai Kuraki - Silent love ~ open my heart ~ BE WITH U.torrent infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File H:\Omat tiedostot\Torskat\TOKIO - Honjitsu, Mijukumono/Over Drive.torrent infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File H:\Omat tiedostot\Torskat\U-ka saegusa IN db - Ashita wa Ashita no Kaze no Naka.....Yume no Naka/Atarashii Jibun he Kawaru Switch.torrent infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File H:\Omat tiedostot\Torskat\YUI - My Generation/Understand.torrent infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File H:\Omat tiedostot\Torskat\[2007.09.12] L'Arc~en~Ciel - 15th L'Anniversary Live.torrent infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File Z:\A-B-C\Baby Boo\Baby Boo - travelogue (Album)\08 Prays~interlude~.mp3 infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File Z:\A-B-C\BeForU\BeForU\07. BRE?K DOWN!(LIVE BAND style) .mp3 infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File Z:\A-B-C\BeForU\BRE?K DOWN ! .mp3 infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File Z:\A-B-C\BeForU\GRADUATION~???????~.mp3 infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File Z:\A-B-C\BeForU\true... (radio edit).mp3 infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File Z:\G-H-I\HIGH and MIGHTY COLOR\Dreams\01 Dreams (MBS/TBS?????DARKER THAN BLACK ???????????????).wma infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File Z:\G-H-I\HIGH and MIGHTY COLOR\Dreams\03 ?????-?.wma infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File Z:\G-H-I\HIGH and MIGHTY COLOR\HIGH and MIGHTY COLOR - PRIDE Remix (Single)\6. PRIDE ~“Phantom pain” norishirobreakmegamix~.mp3 infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File Z:\J-K-L\KM-Markit\Vivid\09 - ????? ~The Key~ feat. SPHERE of INFLUENCE.mp3 infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File Z:\J-K-L\Love For Nana\LOVE for NANA - Only 1 Tribute (Album)\01 BEAT 7~The Theme of LOVE for NANA~.mp3 infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File Z:\Kokoelmat\Music Station Top 100 love songs\(022) KAN - Ai wa Katsu.mp3 infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File Z:\Kokoelmat\Music Station Top 100 love songs\(032) PRINCESS PRINCESS - M.mp3 infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File Z:\M-N-O\Naka no Mori BAND\ISOBRAVO Yuki\04.??????(Instrumental).mp3 infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File Z:\pia\Pia - Dark Side [Crazy Town Cover] feat. ?··mp3.mp3 infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File Z:\pia\Pia - Jump feat. ?··2001-11-23 KMTV Club Live.mp3 infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File Z:\pia\Pia - Jump [Kriss Kross Cover] feat. ?··.mp3 infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File Z:\pia\[2001] pia@arrogantempire.xxx\12 ????? ???? ???·??????? ???·?).mp3 infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File Z:\S-T-U\Serina\Serina - Serina (Album)\13 (Bonus Track).mp3 infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File Z:\S-T-U\The Gospellers\The Gospellers - Be as One\08 Street Corner Symphony~Reprise.mp3 infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File Z:\V-W-X\Vo Vo Tau\VO VO Tau - 01hz (2003)\10 VO VO Tau - skit~DAMN!~.mp3 infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File Z:\Y-Z\Yuri Chika\Yuri Chika - Good Luck To You (Album)\03 Pray you'll come back~share the ALOHA~.mp3 infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File Z:\Y-Z\Yuri Chika\Yuri Chika - Good Luck To You (Album)\08 Island Dancer~noviembre MIX~.mp3 infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. File Z:\Y-Z\Zwei\Pretty Queen\01 Pretty Queen(????????????????10???????????).mp3 infected by "BkCln.Unknown" Virus. Action Taken: File Renamed. Ja HJT Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:33:24, on 18.2.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Normal Running processes: E:\WINDOWS\System32\smss.exe E:\WINDOWS\system32\winlogon.exe E:\WINDOWS\system32\services.exe E:\WINDOWS\system32\lsass.exe E:\WINDOWS\system32\Ati2evxx.exe E:\WINDOWS\system32\svchost.exe E:\WINDOWS\System32\svchost.exe E:\WINDOWS\system32\Ati2evxx.exe E:\Program Files\Sygate\SPF\smc.exe E:\WINDOWS\Explorer.EXE C:\Ohjelmat\aswUpdSv.exe C:\Ohjelmat\ashServ.exe E:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe E:\Program Files\NetLimiter\NetLimiter.exe E:\Program Files\Microsoft Hardware\Keyboard\type32.exe C:\Ohjelmat\ashDisp.exe C:\Ohjelmat\AVG Anti-Spyware 7.5\avgas.exe E:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe E:\WINDOWS\system32\oodtray.exe E:\Program Files\iTunes\iTunesHelper.exe E:\Program Files\Skype\Phone\Skype.exe E:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE E:\WINDOWS\system32\spoolsv.exe E:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe E:\Program Files\DAEMON Tools\daemon.exe E:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe E:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Ohjelmat\Last.fm\LastFM.exe C:\Ohjelmat\AVG Anti-Spyware 7.5\guard.exe C:\Ohjelmat\Last.fm\LastFMHelper.exe E:\Program Files\MagicTune Premium\MagicTuneEngine.exe E:\WINDOWS\system32\oodag.exe E:\WINDOWS\system32\MsPMSPSv.exe E:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\Ohjelmat\ashMaiSv.exe C:\Ohjelmat\ashWebSv.exe E:\Program Files\iPod\bin\iPodService.exe E:\Program Files\PC Connectivity Solution\ServiceLayer.exe E:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe E:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe E:\Program Files\Skype\Plugin Manager\skypePM.exe F:\Mirc\mirc.exe C:\Ohjelmat\Opera.exe E:\WINDOWS\system32\NOTEPAD.EXE E:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/ig?hl=fi R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Ohjelmat\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O4 - HKLM\..\Run: [IMJPMIG8.1] "E:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [PHIME2002ASync] E:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] E:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [ATIPTA] E:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [SmcService] E:\PROGRA~1\Sygate\SPF\smc.exe -startgui O4 - HKLM\..\Run: [NetLimiter] E:\Program Files\NetLimiter\NetLimiter.exe /s O4 - HKLM\..\Run: [IntelliType] "E:\Program Files\Microsoft Hardware\Keyboard\type32.exe" O4 - HKLM\..\Run: [avast!] C:\Ohjelmat\ashDisp.exe O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Ohjelmat\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [NVMixerTray] "E:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" O4 - HKLM\..\Run: [OODefragTray] E:\WINDOWS\system32\oodtray.exe O4 - HKLM\..\Run: [iTunesHelper] "E:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [StartCCC] "E:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKCU\..\Run: [Skype] "E:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "E:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [DAEMON Tools] "E:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [Steam] F:\Steam\Steam.exe -silent O4 - HKCU\..\Run: [PC Suite Tray] "E:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Last.fm Helper.lnk = C:\Ohjelmat\Last.fm\LastFMHelper.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = E:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = E:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: GammaTray.lnk = ? O4 - Global Startup: Last.fm.lnk = C:\Ohjelmat\Last.fm\LastFM.exe O4 - Global Startup: NCProTray.lnk = ? O4 - Global Startup: SATARaid.lnk = ? O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe O10 - Unknown file in Winsock LSP: e:\windows\system32\nwprovau.dll O12 - Plugin for .spop: E:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - E:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Apple Mobile Device - Apple, Inc. - E:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Ohjelmat\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - E:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - E:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Ohjelmat\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Ohjelmat\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Ohjelmat\ashWebSv.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Ohjelmat\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Creative Service for CDROM Access - Unknown owner - (no file) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - E:\Program Files\iPod\bin\iPodService.exe O23 - Service: MagicTuneEngine - Unknown owner - E:\Program Files\MagicTune Premium\MagicTuneEngine.exe O23 - Service: O&O Defrag - O&O Software GmbH - E:\WINDOWS\system32\oodag.exe O23 - Service: ServiceLayer - Nokia. - E:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - E:\Program Files\Sygate\SPF\smc.exe -- End of file - 8090 bytes
Ja tässä uusi hjt Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 4:07:42, on 20.2.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Normal Running processes: E:\WINDOWS\System32\smss.exe E:\WINDOWS\system32\winlogon.exe E:\WINDOWS\system32\services.exe E:\WINDOWS\system32\lsass.exe E:\WINDOWS\system32\Ati2evxx.exe E:\WINDOWS\system32\svchost.exe E:\WINDOWS\System32\svchost.exe E:\Program Files\Sygate\SPF\smc.exe E:\WINDOWS\system32\Ati2evxx.exe E:\WINDOWS\Explorer.EXE C:\Ohjelmat\aswUpdSv.exe C:\Ohjelmat\ashServ.exe E:\WINDOWS\system32\spoolsv.exe E:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe E:\Program Files\NetLimiter\NetLimiter.exe E:\Program Files\Microsoft Hardware\Keyboard\type32.exe C:\Ohjelmat\ashDisp.exe E:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Ohjelmat\AVG Anti-Spyware 7.5\avgas.exe E:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe E:\WINDOWS\system32\oodtray.exe C:\Ohjelmat\AVG Anti-Spyware 7.5\guard.exe E:\Program Files\iTunes\iTunesHelper.exe E:\Program Files\Skype\Phone\Skype.exe E:\Program Files\MagicTune Premium\MagicTuneEngine.exe E:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe E:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE E:\Program Files\DAEMON Tools\daemon.exe F:\Steam\Steam.exe E:\WINDOWS\system32\oodag.exe E:\WINDOWS\system32\ctfmon.exe E:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe E:\Program Files\MSN Messenger\msnmsgr.exe E:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe C:\Ohjelmat\Last.fm\LastFM.exe C:\Ohjelmat\Last.fm\LastFMHelper.exe E:\WINDOWS\system32\MsPMSPSv.exe C:\Ohjelmat\ashMaiSv.exe C:\Ohjelmat\ashWebSv.exe E:\Program Files\iPod\bin\iPodService.exe E:\Program Files\PC Connectivity Solution\ServiceLayer.exe E:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe E:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe E:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe E:\Program Files\Skype\Plugin Manager\skypePM.exe E:\Program Files\MSN Messenger\usnsvc.exe E:\Program Files\MagicTune Premium\MagicTune.exe E:\WINDOWS\system32\wuauclt.exe E:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/ig?hl=fi R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Ohjelmat\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O4 - HKLM\..\Run: [IMJPMIG8.1] "E:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [PHIME2002ASync] E:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] E:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [ATIPTA] E:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [SmcService] E:\PROGRA~1\Sygate\SPF\smc.exe -startgui O4 - HKLM\..\Run: [NetLimiter] E:\Program Files\NetLimiter\NetLimiter.exe /s O4 - HKLM\..\Run: [IntelliType] "E:\Program Files\Microsoft Hardware\Keyboard\type32.exe" O4 - HKLM\..\Run: [avast!] C:\Ohjelmat\ashDisp.exe O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Ohjelmat\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [NVMixerTray] "E:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" O4 - HKLM\..\Run: [OODefragTray] E:\WINDOWS\system32\oodtray.exe O4 - HKLM\..\Run: [iTunesHelper] "E:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [StartCCC] "E:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKCU\..\Run: [Skype] "E:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "E:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [DAEMON Tools] "E:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [Steam] F:\Steam\Steam.exe -silent O4 - HKCU\..\Run: [ctfmon.exe] E:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] "E:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [PC Suite Tray] "E:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Last.fm Helper.lnk = C:\Ohjelmat\Last.fm\LastFMHelper.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = E:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = E:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: GammaTray.lnk = ? O4 - Global Startup: Last.fm.lnk = C:\Ohjelmat\Last.fm\LastFM.exe O4 - Global Startup: NCProTray.lnk = ? O4 - Global Startup: SATARaid.lnk = ? O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe O10 - Unknown file in Winsock LSP: e:\windows\system32\nwprovau.dll O12 - Plugin for .spop: E:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - E:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Apple Mobile Device - Apple, Inc. - E:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Ohjelmat\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - E:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - E:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Ohjelmat\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Ohjelmat\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Ohjelmat\ashWebSv.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Ohjelmat\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Creative Service for CDROM Access - Unknown owner - (no file) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - E:\Program Files\iPod\bin\iPodService.exe O23 - Service: MagicTuneEngine - Unknown owner - E:\Program Files\MagicTune Premium\MagicTuneEngine.exe O23 - Service: O&O Defrag - O&O Software GmbH - E:\WINDOWS\system32\oodag.exe O23 - Service: ServiceLayer - Nokia. - E:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - E:\Program Files\Sygate\SPF\smc.exe -- End of file - 8442 bytes
1. Klikkaa käynnistä > Oma tietokone oikean puoleisella hiiren napilla 2. Valitse ominaisuudet 3. Valitse järjestelmän palauttaminen välilehti 4. Ruksi eteen ¤ poista järjestelmän palauttaminen kaikissa asemissa 5. Paina Käytä 6. Paina ok 7. Sammuta ja käynnistä 8. Ota ruksi pois ¤ poista järjestelmän palauttaminen kaikissa asemissa 9. Käytä ja OK
Ja tässä uusin Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:16:22, on 20.2.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Normal Running processes: E:\WINDOWS\System32\smss.exe E:\WINDOWS\system32\winlogon.exe E:\WINDOWS\system32\services.exe E:\WINDOWS\system32\lsass.exe E:\WINDOWS\system32\Ati2evxx.exe E:\WINDOWS\system32\svchost.exe E:\WINDOWS\System32\svchost.exe E:\Program Files\Sygate\SPF\smc.exe E:\WINDOWS\system32\Ati2evxx.exe C:\Ohjelmat\aswUpdSv.exe E:\WINDOWS\Explorer.EXE C:\Ohjelmat\ashServ.exe E:\WINDOWS\system32\spoolsv.exe E:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe E:\Program Files\NetLimiter\NetLimiter.exe E:\Program Files\Microsoft Hardware\Keyboard\type32.exe C:\Ohjelmat\ashDisp.exe C:\Ohjelmat\AVG Anti-Spyware 7.5\avgas.exe E:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe E:\WINDOWS\system32\oodtray.exe E:\Program Files\iTunes\iTunesHelper.exe E:\Program Files\Skype\Phone\Skype.exe E:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe E:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE E:\Program Files\DAEMON Tools\daemon.exe E:\WINDOWS\system32\ctfmon.exe E:\Program Files\MSN Messenger\msnmsgr.exe E:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe E:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Ohjelmat\AVG Anti-Spyware 7.5\guard.exe E:\Program Files\MagicTune Premium\MagicTuneEngine.exe C:\Ohjelmat\Last.fm\LastFM.exe E:\WINDOWS\system32\oodag.exe C:\Ohjelmat\Last.fm\LastFMHelper.exe E:\WINDOWS\system32\MsPMSPSv.exe C:\Ohjelmat\ashMaiSv.exe C:\Ohjelmat\ashWebSv.exe E:\Program Files\iPod\bin\iPodService.exe E:\Program Files\PC Connectivity Solution\ServiceLayer.exe E:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe E:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe E:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe E:\Program Files\MSN Messenger\usnsvc.exe E:\Program Files\Skype\Plugin Manager\skypePM.exe F:\Mirc\mirc.exe E:\Program Files\iTunes\iTunes.exe E:\Program Files\Common Files\Apple\Mobile Device Support\bin\distnoted.exe E:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceHelper.exe C:\Ohjelmat\Opera.exe E:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/ig?hl=fi R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Ohjelmat\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O4 - HKLM\..\Run: [IMJPMIG8.1] "E:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [PHIME2002ASync] E:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] E:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [ATIPTA] E:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [SmcService] E:\PROGRA~1\Sygate\SPF\smc.exe -startgui O4 - HKLM\..\Run: [NetLimiter] E:\Program Files\NetLimiter\NetLimiter.exe /s O4 - HKLM\..\Run: [IntelliType] "E:\Program Files\Microsoft Hardware\Keyboard\type32.exe" O4 - HKLM\..\Run: [avast!] C:\Ohjelmat\ashDisp.exe O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Ohjelmat\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [NVMixerTray] "E:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" O4 - HKLM\..\Run: [OODefragTray] E:\WINDOWS\system32\oodtray.exe O4 - HKLM\..\Run: [iTunesHelper] "E:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [StartCCC] "E:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKCU\..\Run: [Skype] "E:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "E:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [DAEMON Tools] "E:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [Steam] F:\Steam\Steam.exe -silent O4 - HKCU\..\Run: [ctfmon.exe] E:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] "E:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [PC Suite Tray] "E:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Last.fm Helper.lnk = C:\Ohjelmat\Last.fm\LastFMHelper.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = E:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = E:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: GammaTray.lnk = ? O4 - Global Startup: Last.fm.lnk = C:\Ohjelmat\Last.fm\LastFM.exe O4 - Global Startup: NCProTray.lnk = ? O4 - Global Startup: SATARaid.lnk = ? O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe O10 - Unknown file in Winsock LSP: e:\windows\system32\nwprovau.dll O12 - Plugin for .spop: E:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - E:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Apple Mobile Device - Apple, Inc. - E:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Ohjelmat\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - E:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - E:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Ohjelmat\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Ohjelmat\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Ohjelmat\ashWebSv.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Ohjelmat\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Creative Service for CDROM Access - Unknown owner - (no file) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - E:\Program Files\iPod\bin\iPodService.exe O23 - Service: MagicTuneEngine - Unknown owner - E:\Program Files\MagicTune Premium\MagicTuneEngine.exe O23 - Service: O&O Defrag - O&O Software GmbH - E:\WINDOWS\system32\oodag.exe O23 - Service: ServiceLayer - Nokia. - E:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - E:\Program Files\Sygate\SPF\smc.exe -- End of file - 8529 bytes
