Kone on aivan sekaisin ei tunnu oikein mikään pelaavan,lokista varmaan löytyy jotakin ongelmia. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:51:47, on 7.5.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Sygate\SPF\smc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe C:\Program Files\F-Secure Internet Security\fswsclds.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wdfmgr.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\wbem\wmiprvse.exe C:\WINDOWS\System32\alg.exe C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Ahead\InCD\InCD.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe C:\WINDOWS\system32\RunDll32.exe C:\WINDOWS\system32\wind32.exe C:\WINDOWS\system32\n2ewma1xxsv2234.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe C:\WINDOWS\system32\dllgh8jkd1q1.exe C:\WINDOWS\system32\dllgh8jkd1q6.exe C:\WINDOWS\system32\dllgh8jkd1q7.exe C:\WINDOWS\system32\dllgh8jkd1q5.exe C:\WINDOWS\explorer.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Arja_2\Työpöytä\HiJackThis_v2.0.2.exe C:\WINDOWS\System32\wbem\wmiprvse.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.xckylorddqgvjhlgrjgnx.ne...ZlFu/B8CCtLGSRxfANGG34YxHd5ku9I8/HYTPmEh.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O2 - BHO: (no name) - {008DB894-99ED-445D-8547-0E7C9808898D} - (no file) O2 - BHO: (no name) - {7F426BA4-4DBF-486B-A5A5-609BE19E1EDE} - (no file) O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll O2 - BHO: (no name) - {E9FE24FA-3113-4A03-908E-FF71D5AC683C} - (no file) O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [System] C:\WINDOWS\system32\wind32.exe O4 - HKLM\..\Run: [SystemSv121] C:\WINDOWS\system32\n2ewma1xxsv2234.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [Video Process] owbioxq.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunServices: [Video Process] owbioxq.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunServices: [Video Process] owbioxq.exe (User 'Default user') O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: PacificPoker - {94EDF7B4-4272-4af3-8F8B-4E2F68E225B7} - C:\PROGRA~1\PACIFI~1\pacificpoker.exe (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O17 - HKLM\System\CCS\Services\Tcpip\..\{11E8761E-B715-455D-B6E0-6D7DE4E5C5D7}: NameServer = 85.255.115.20,85.255.112.233 O17 - HKLM\System\CCS\Services\Tcpip\..\{14AC86B8-F647-4FF2-9397-D1E7DEA57756}: NameServer = 85.255.115.20,85.255.112.233 O17 - HKLM\System\CCS\Services\Tcpip\..\{7AEDD127-10AD-4C31-A100-5CCCC9BE558F}: NameServer = 85.255.115.20,85.255.112.233 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.20 85.255.112.233 O17 - HKLM\System\CS1\Services\Tcpip\..\{11E8761E-B715-455D-B6E0-6D7DE4E5C5D7}: NameServer = 85.255.115.20,85.255.112.233 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.20 85.255.112.233 O20 - Winlogon Notify: awvtu - C:\WINDOWS\system32\awvtu.dll (file missing) O20 - Winlogon Notify: khfdaww - khfdaww.dll (file missing) O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\fswsclds.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe -- End of file - 13188 bytes
scannaa hjt:llä merkkaa paina Fix checked O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O1 - Hosts: 124.217.252.78 secure.isoftpay.com O1 - Hosts: 124.217.252.77 www.bravesentry.com O1 - Hosts: 124.217.252.77 bravesentry.com O2 - BHO: (no name) - {008DB894-99ED-445D-8547-0E7C9808898D} - (no file) O2 - BHO: (no name) - {7F426BA4-4DBF-486B-A5A5-609BE19E1EDE} - (no file) O2 - BHO: (no name) - {E9FE24FA-3113-4A03-908E-FF71D5AC683C} - (no file) O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O20 - Winlogon Notify: awvtu - C:\WINDOWS\system32\awvtu.dll (file missing) O20 - Winlogon Notify: khfdaww - khfdaww.dll (file missing) ================= Lataa fixwareout.exe täältä > FixWareout.exe tai täältä > FixWareout.exe ja tallenna se työpöydälle. Tuplaklikkaa sitä ja seuraa ohjeita. Klikkaa Next, sitten Install ja varmistu, että "Run fixit" on valittu. Sinun pitää käynnistää kone uudelleen, kun niin käsketään. Lähetä uusi HjT-loki ja c:\fixwareout\report.txt sisältö ================ 1.Lataa combofix.exe työpöydällesi yhdestä linkistä: combofix1 combofix2 2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia. 3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi. Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:16, on 2008-05-08 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Sygate\SPF\smc.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe C:\Program Files\F-Secure Internet Security\fswsclds.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Ahead\InCD\InCD.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe C:\WINDOWS\system32\RunDll32.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Arja_2\Työpöytä\HiJackThis_v2.0.2.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.xckylorddqgvjhlgrjgnx.ne...ZlFu/B8CCtLGSRxfANGG34YxHd5ku9I8/HYTPmEh.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [Video Process] owbioxq.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunServices: [Video Process] owbioxq.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunServices: [Video Process] owbioxq.exe (User 'Default user') O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: PacificPoker - {94EDF7B4-4272-4af3-8F8B-4E2F68E225B7} - C:\PROGRA~1\PACIFI~1\pacificpoker.exe (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\fswsclds.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe -- End of file - 6621 bytes Username "Arja_2" - 08.05.2008 20:55:28 [Fixwareout edited 9/01/2007] ~~~~~ Prerun check HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters "nameserver"="85.255.115.20 85.255.112.233" <Value cleared. DNS-tulkintatoiminnon välimuistin tyhjentäminen onnistui. System was rebooted successfully. ~~~~~ Postrun check HKLM\SOFTWARE\~\Winlogon\ "System"="" .... .... ~~~~~ Misc files. C:\Documents and Settings\Arja_2\Application Data\Install.dat Deleted .... ~~~~~ Checking for older varients. .... ~~~~~ Current runs (hklm hkcu "run" Keys Only) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "CamMonitor"="C:\\Program Files\\Hewlett-Packard\\Digital Imaging\\\\Unload\\hpqcmon.exe" "Share-to-Web Namespace Daemon"="C:\\Program Files\\Hewlett-Packard\\HP Share-to-Web\\hpgs2wnd.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "InCD"="C:\\Program Files\\Ahead\\InCD\\InCD.exe" "MessengerPlus3"="\"C:\\Program Files\\Messenger Plus! 3\\MsgPlus.exe\"" "SmcService"="C:\\PROGRA~1\\Sygate\\SPF\\smc.exe -startgui" "avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe" "DataLayer"="C:\\Program Files\\Common Files\\PCSuite\\DataLayer\\DataLayer.exe" "PCSuiteTrayApplication"="C:\\Program Files\\Nokia\\Nokia PC Suite 6\\LaunchApplication.exe -onlytray" "Cmaudio"="RunDll32 cmicnfg.cpl,CMICtrlWnd" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe" "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NVMCTRAY.DLL,NvTaskbarInit" "PcSync"="C:\\Program Files\\Nokia\\Nokia PC Suite 6\\PcSync2.exe /NoDialog" "MessengerPlus3"="\"C:\\Program Files\\Messenger Plus! 3\\MsgPlus.exe\" /WinStart" .... Hosts file was reset, If you use a custom hosts file please replace it... C:\WINDOWS\System32\AUTOEXEC.NT missing ~~~~~ End report ~~~~~
sitten combofix ========= Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi. Käynnistä koneesi vikasietotilaan: sammuta ja käynnistä käynnistyksen yhteydessä hakkaa F8 nappia valitse nuolinäppäimellä vikasietotila paina enter ja enter valitse käyttäjätilisi paina kyllä Jossakin koneissa hakataan F8:sin sijasta F5:tä " Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix. " Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman. " Paina Y käynnistääksesi skriptin. " Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot". " Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen. " Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta. " Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished". " Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle. " Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.
Jäi combofix raportti viime ketjusta pois, otin uuden enkä löytänyt muunlaista raporttia kuin tämän. ComboFix 08-05-07.2 - Arja_2 2008-05-12 17:06:31.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.209 [GMT 3:00] Running from: C:\Documents and Settings\Arja_2\Työpöytä\ComboFix.exe WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . sitten sdfix SDFix: Version 1.182 Run by Arja_2 on 2008-05-12 at 17:25 Microsoft Windows XP [versio 5.1.2600] Running From: C:\DOCUME~1\Arja_2\TYPYT~1\SDFix Checking Services : Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting Checking Files : Trojan Files Found: C:\WINDOWS\SYSTEM32\DLLGH8~4.EXE - Deleted C:\Documents and Settings\Arja\Application Data\Install.dat - Deleted C:\WINDOWS\system32\dllgh8jkd1q8.exe - Deleted C:\WINDOWS\system32\TFTP1972 - Deleted C:\WINDOWS\system32\TFTP2064 - Deleted ja vielä hjt loki Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:52, on 2008-05-12 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Sygate\SPF\smc.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe C:\Program Files\F-Secure Internet Security\fswsclds.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Ahead\InCD\InCD.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe C:\WINDOWS\system32\RunDll32.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe C:\Program Files\Picasa2\PicasaMediaDetector.exe C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe C:\Documents and Settings\Arja_2\Työpöytä\HiJackThis_v2.0.2.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.xckylorddqgvjhlgrjgnx.ne...ZlFu/B8CCtLGSRxfANGG34YxHd5ku9I8/HYTPmEh.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [Video Process] owbioxq.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunServices: [Video Process] owbioxq.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunServices: [Video Process] owbioxq.exe (User 'Default user') O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: PacificPoker - {94EDF7B4-4272-4af3-8F8B-4E2F68E225B7} - C:\PROGRA~1\PACIFI~1\pacificpoker.exe (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\fswsclds.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe -- End of file - 6859 bytes
Poista lisää poista sovelutuksesta F-Secure Internet Security Poista vikasiedossa kansio C:\Program Files\F-Secure Internet Security ============= scannaa hjt:llä merkkaa paina Fix checked R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.xckylorddqgvjhlgrjgnx.net/jAZ...I8/HYTPmEh.html O4 - HKUS\S-1-5-18\..\Run: [Video Process] owbioxq.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunServices: [Video Process] owbioxq.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunServices: [Video Process] owbioxq.exe (User 'Default user') O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\fswsclds.exe ============== Kopioi / liitä seuraava teksti alapuolella tyhjään muistioFiluun Varmista että tiedoston tyyppi on ”all Files” ja tallenna se Poisto.bat. nimisenä työpöydällesi. @echo off sc stop Fswsclds sc delete Fswsclds Tupla-klikkaa Poisto.bat. filua työpöydälläsi , ikkuna avautuu ja Sulkeutuu tämä on normaalia. ========== scannaa uusi hjt:n loki
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:58, on 2008-05-13 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Sygate\SPF\smc.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Ahead\InCD\InCD.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe C:\WINDOWS\system32\RunDll32.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe C:\Program Files\Picasa2\PicasaMediaDetector.exe C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe C:\Documents and Settings\Arja_2\Työpöytä\HiJackThis_v2.0.2.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: PacificPoker - {94EDF7B4-4272-4af3-8F8B-4E2F68E225B7} - C:\PROGRA~1\PACIFI~1\pacificpoker.exe (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe -- End of file - 6223 bytes
