Mese virus

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by Miansa, Dec 1, 2007.

  1. Miansa

    Miansa Member

    Joined:
    Nov 29, 2006
    Messages:
    14
    Likes Received:
    0
    Trophy Points:
    11
    Moi

    Kaverille on päässyt mese virus koneelle joka lähettää kuva tiedostoa aina välillä toisille mesessä oleville ja haluaisin neuvoa sen poistamiseen

    Tässä olisi tämän hetkinen HiJackThis logi

    Kiitoksia kaikille vastaajille jo etukäteen

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 15:37:42, on 1.12.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    D:\WINDOWS\System32\smss.exe
    D:\WINDOWS\system32\winlogon.exe
    D:\WINDOWS\system32\services.exe
    D:\WINDOWS\system32\lsass.exe
    D:\WINDOWS\system32\svchost.exe
    D:\WINDOWS\System32\svchost.exe
    D:\WINDOWS\system32\spoolsv.exe
    D:\WINDOWS\Explorer.EXE
    D:\WINDOWS\system32\RUNDLL32.EXE
    D:\WINDOWS\SOUNDMAN.EXE
    D:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
    D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    D:\Program Files\D-Tools\daemon.exe
    D:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    D:\Program Files\Eset\nod32kui.exe
    D:\PROGRA~1\Ahead\Ahead\data\Xtras\mssysmgr.exe
    D:\Program Files\MSN Messenger\MsnMsgr.Exe
    D:\WINDOWS\system32\ctfmon.exe
    D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    D:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
    D:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    D:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    D:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    D:\Program Files\Eset\nod32krn.exe
    D:\WINDOWS\system32\nvsvc32.exe
    D:\WINDOWS\System32\svchost.exe
    D:\WINDOWS\system32\svchost.exe
    D:\Program Files\Internet Explorer\iexplore.exe
    D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://irc-galleria.net/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - D:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar4.dll
    O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
    O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - D:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - D:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar4.dll
    O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [AdobeVersionCue] D:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Program Files\D-Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [HP Software Update] D:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [nod32kui] "D:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
    O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] D:\PROGRA~1\Ahead\Ahead\data\Xtras\mssysmgr.exe
    O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Policies\Explorer\Run: [NTSpool] NTSpool.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Acrobat Assistant.lnk = D:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = D:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1100116539046
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
    O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
    O23 - Service: Adobe LM Service - Unknown owner - D:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: AdobeVersionCue - Adobe Sytems - D:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe
    O23 - Service: Google Updater Service (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - D:\Program Files\Eset\nod32krn.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Pml Driver HPZ12 - HP - D:\WINDOWS\system32\HPZipm12.exe

    --
    End of file - 7257 bytes
     
    Miansa, Dec 1, 2007
    #1
  2. hannu71

    hannu71 Regular member

    Joined:
    Feb 9, 2006
    Messages:
    256
    Likes Received:
    0
    Trophy Points:
    26
    Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

    Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi:
    [*]Käynnistä tietokone
    [*]Kun kuulet koneen piippaavan, paina F8, kuitenkin ennen Windowsin logon esiintuloa
    [*]Seuraavaksi pitäisi ilmestyä valikko
    [*]Valitse valikosta vikasietotila.

    [*] Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio). Työpöydälle ilmestyy sdfix.exe. Tuplakilikkaa sitä, niin tiedosto purkaantuu ja asentaa itsensä siihen levyasemaan, minne on käyttöjärjestelmä on asennettu ja juureen ilmestyy kansio SDFix, ESIM c:\SDFix
    [*] Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
    [*] Paina Y käynnistääksesi skriptin.
    [*] Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
    [*] Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
    [*] Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
    [*] Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
    [*] Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
    [*] Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis lokin kera.

    --------------------
    Tallenna nämä ohjeet tekstitiedostoon tai tulosta nämä, muuten et pääse niihin käsiksi vikasietotilasta

    Lataa AVG Anti-Spyware 7.5 ja tallenna ohjelma työpöydällesi.
    [*]Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa.
    [*]Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää.
    [*]Käynnistä AVG Anti-Spyware.
    [*]Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta.
    [*]Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa.

    [*]Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti.
    [*]Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine".
    [*]Sitten "Reports" valikon alta:
    [*]Laita täppi kohtaan "Do not Automatically generate report"
    [*]Ota täppi pois kohdasta"Only if threats were found"

    [*]Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa
    [*]"Resident shield is", muuta tila active:sta inactive:ksi
    [*]Sulje ohjelma, ÄLÄ skannaa vielä.
    Käynnistä koneesi vikasietotilaan, Ohje!
    HUOM! Älä käytä muita ohjelmia AVG skannauksen aikana, tämä saattaa häiritä skannausta.
    [*]Kun vikasietotilassa, käynnistä AVG Anti-Spyware.
    [*]Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan".
    [*]AVG aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa.

    Kun skannaus on valmis:
    TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions"
    [*]Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta.
    [*]Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions"
    [​IMG]
    [*]Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta.
    [*]Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle.
    [*]Sulje ohjelma, käynnistä kone normaalisti ja lähetä AVG Anti-Spyware:n raportti viestikejuusi.


    lähetä:
    sdfixin raportti
    avg:n antispywaren raportti
    uusi hjt-loki
     
    hannu71, Dec 1, 2007
    #2
  3. Miansa

    Miansa Member

    Joined:
    Nov 29, 2006
    Messages:
    14
    Likes Received:
    0
    Trophy Points:
    11
    Kiitos avusta tähän asti

    Nyt sain noi tehtyä kaverille


    <------------sdfix alkaa------------>


    SDFix: Version 1.116

    Run by Heini1 on ma 03.12.2007 at 14:55

    Microsoft Windows XP [versio 5.1.2600]

    Running From: D:\SDFix

    Safe Mode:
    Checking Services:


    Restoring Windows Registry Values
    Restoring Windows Default Hosts File

    Rebooting...


    Normal Mode:
    Checking Files:

    Trojan Files Found:

    D:\Documents and Settings\Heini1\Local Settings\Temp\Jav15.tmp.exe - Deleted
    D:\DOCUME~1\Heini1\LOCALS~1\Temp\eraseme_26377.exe - Deleted
    D:\DOCUME~1\Heini1\LOCALS~1\Temp\eraseme_42603.exe - Deleted
    D:\DOCUME~1\Heini1\LOCALS~1\Temp\eraseme_56820.exe - Deleted
    D:\DOCUME~1\Heini1\LOCALS~1\Temp\eraseme_88005.exe - Deleted
    D:\WINDOWS\system32\NTSpool.exe - Deleted




    Removing Temp Files...

    ADS Check:

    D:\WINDOWS
    No streams found.

    D:\WINDOWS\system32
    No streams found.

    D:\WINDOWS\system32\svchost.exe
    No streams found.

    D:\WINDOWS\system32\ntoskrnl.exe
    No streams found.



    Final Check:

    catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-12-03 14:59:56
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden services & system hive ...

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\d347prt\Cfg\0Jf40]
    "khjeh"=hex:20,02,00,00,16,db,69,8a,13,32,87,d7,72,3a,ba,90,c7,ff,60,dd,f1,..
    "hj34z0"=hex:6b,39,bf,02,cd,66,ac,e4,bd,a3,77,a9,62,83,0c,8e,a2,da,35,b8,07,..

    scanning hidden registry entries ...

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\\xb9m\xd3w\2]
    "AB79C053C7D38EE4AB9A00CB3B5D2472"="D?\Program Files\Common Files\Microsoft Shared\Web Folders\PUBPLACE.HTT"

    scanning hidden files ...

    D:\Documents and Settings\Heini1\Local Settings\Application Data\Microsoft\Messenger\markuslepola@hotmail.com\SharingMetadata\juhnu4@hotmail.com\DFSR\Staging\CS{226CAFFB-3E52-808F-6C3D-3FC1C8E1BEF2}\01\10-{226CAFFB-3E52-808F-6C3D-3FC1C8E1BEF2}-v1-{F30590B6-A787-4ACC-90AF-56CB3C373633}-v10-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 8 bytes hidden from API

    scan completed successfully
    hidden processes: 0
    hidden services: 0
    hidden files: 1


    Remaining Services:
    ------------------



    Authorized Application Key Export:

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "D:\\Program Files\\mIRC\\mirc.exe"="D:\\Program Files\\mIRC\\mirc.exe:*:Enabled:mIRC"
    "D:\\WINDOWS\\PCHEALTH\\HELPCTR\\Binaries\\helpctr.exe"="D:\\WINDOWS\\PCHEALTH\\HELPCTR\\Binaries\\helpctr.exe:*:Enabled:Et„tuki - Windows Messenger ja „„niyhteys"
    "D:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"="D:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe:*:Enabled:hpqtra08.exe"
    "D:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"="D:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe:*:Enabled:hpqste08.exe"
    "D:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"="D:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe:*:Enabled:hpofxm08.exe"
    "D:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"="D:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe:*:Enabled:hposfx08.exe"
    "D:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"="D:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe:*:Enabled:hposid01.exe"
    "D:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"="D:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
    "D:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"="D:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
    "D:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"="D:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe:*:Enabled:hpqcopy.exe"
    "D:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"="D:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe:*:Enabled:hpfccopy.exe"
    "D:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"="D:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
    "D:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"="D:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
    "D:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"="D:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe:*:Enabled:hpqdia.exe"
    "D:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"="D:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe:*:Enabled:hpoews01.exe"
    "D:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe"="D:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe:*:Disabled:HP Software Update Client"
    "D:\\Program Files\\eMule\\emule.exe"="D:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
    "D:\\Program Files\\MSN Messenger\\msnmsgr.exe"="D:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
    "D:\\Program Files\\MSN Messenger\\livecall.exe"="D:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
    "D:\\Program Files\\DC++\\DCPlusPlus.exe"="D:\\Program Files\\DC++\\DCPlusPlus.exe:*:Enabled:DC++"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "D:\\Program Files\\MSN Messenger\\msnmsgr.exe"="D:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
    "D:\\Program Files\\MSN Messenger\\livecall.exe"="D:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

    Remaining Files:
    ---------------

    File Backups: - D:\SDFix\backups\backups.zip

    Files with Hidden Attributes:

    Thu 15 May 2003 43,008 A..H. --- "D:\RECYCLER\NPROTECT\00076610.EXE"
    Sat 21 Oct 2006 4,348 ..SH. --- "D:\Documents and Settings\All Users\DRM\DRMv1.bak"
    Tue 4 May 2004 67,944 ...H. --- "D:\Program Files\Ahead\Ahead\data\Nero PhotoShow Express.exe"
    Wed 10 Nov 2004 1,206 A..HR --- "D:\Program Files\Common Files\Symantec Shared\Registry Backup\ccReg.reg"
    Wed 10 Nov 2004 12,888 A..HR --- "D:\Program Files\Common Files\Symantec Shared\Registry Backup\CommonClient.reg"

    Finished!




    <-----------sdfix päättyy------------>


    <----------avg alkaa------------------>



    ---------------------------------------------------------
    AVG Anti-Spyware - Scan Report
    ---------------------------------------------------------

    + Created at: 16:43:31 3.12.2007

    + Scan result:



    D:\Documents and Settings\Heini1\Työpöytä\Ohjelmat\Spybot - Search & Destroy 0.95\Recovery\Gator.zip/EGIEProcess.dll -> Adware.Gator : Cleaned.
    D:\Documents and Settings\Heini1\Työpöytä\Ohjelmat\Spybot - Search & Destroy 0.95\Recovery\Gator.zip/GUninstaller.exe -> Adware.Gator : Cleaned.
    D:\Documents and Settings\Heini1\Työpöytä\Ohjelmat\Spybot - Search & Destroy 0.95\Recovery\Gator1.zip/EGIEProcess.dll -> Adware.Gator : Cleaned.
    D:\Documents and Settings\Heini1\Työpöytä\Ohjelmat\Spybot - Search & Destroy 0.95\Recovery\Gator1.zip/GUninstaller.exe -> Adware.Gator : Cleaned.
    :mozilla.29:D:\Documents and Settings\Heini1\Application Data\Mozilla\Firefox\Profiles\k3h5ulju.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.30:D:\Documents and Settings\Heini1\Application Data\Mozilla\Firefox\Profiles\k3h5ulju.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.32:D:\Documents and Settings\Heini1\Application Data\Mozilla\Firefox\Profiles\k3h5ulju.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.33:D:\Documents and Settings\Heini1\Application Data\Mozilla\Firefox\Profiles\k3h5ulju.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.34:D:\Documents and Settings\Heini1\Application Data\Mozilla\Firefox\Profiles\k3h5ulju.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.35:D:\Documents and Settings\Heini1\Application Data\Mozilla\Firefox\Profiles\k3h5ulju.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.36:D:\Documents and Settings\Heini1\Application Data\Mozilla\Firefox\Profiles\k3h5ulju.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.37:D:\Documents and Settings\Heini1\Application Data\Mozilla\Firefox\Profiles\k3h5ulju.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.38:D:\Documents and Settings\Heini1\Application Data\Mozilla\Firefox\Profiles\k3h5ulju.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.39:D:\Documents and Settings\Heini1\Application Data\Mozilla\Firefox\Profiles\k3h5ulju.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.40:D:\Documents and Settings\Heini1\Application Data\Mozilla\Firefox\Profiles\k3h5ulju.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.41:D:\Documents and Settings\Heini1\Application Data\Mozilla\Firefox\Profiles\k3h5ulju.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@edsa.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@metacafe.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@microsoftwga.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@nordea.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.110:D:\Documents and Settings\Heini1\Application Data\Mozilla\Firefox\Profiles\k3h5ulju.default\cookies.txt -> TrackingCookie.Ad-logics : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@3.adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@ads.adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@axa.addcontrol[1].txt -> TrackingCookie.Addcontrol : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@ads.addynamix[2].txt -> TrackingCookie.Addynamix : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@rotator.adjuggler[2].txt -> TrackingCookie.Adjuggler : Cleaned.
    :mozilla.133:D:\Documents and Settings\Heini1\Application Data\Mozilla\Firefox\Profiles\k3h5ulju.default\cookies.txt -> TrackingCookie.Adobe : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@www.adobe[1].txt -> TrackingCookie.Adobe : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@adrenaline[1].txt -> TrackingCookie.Adrenaline : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@media.adrevolver[1].txt -> TrackingCookie.Adrevolver : Cleaned.
    :mozilla.49:D:\Documents and Settings\Heini1\Application Data\Mozilla\Firefox\Profiles\k3h5ulju.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
    :mozilla.51:D:\Documents and Settings\Heini1\Application Data\Mozilla\Firefox\Profiles\k3h5ulju.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@adtech[2].txt -> TrackingCookie.Adtech : Cleaned.
    :mozilla.48:D:\Documents and Settings\Heini1\Application Data\Mozilla\Firefox\Profiles\k3h5ulju.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.50:D:\Documents and Settings\Heini1\Application Data\Mozilla\Firefox\Profiles\k3h5ulju.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.52:D:\Documents and Settings\Heini1\Application Data\Mozilla\Firefox\Profiles\k3h5ulju.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@advertising[1].txt -> TrackingCookie.Advertising : Cleaned.
    D:\Documents and Settings\Heini1\Työpöytä\Ohjelmat\Spybot - Search & Destroy 0.95\Recovery\Advertisingcom.zip/pertti ekberg@servedby.advertising[1].txt -> TrackingCookie.Advertising : Cleaned.
    D:\Documents and Settings\Heini1\Työpöytä\Ohjelmat\Spybot - Search & Destroy 0.95\Recovery\Advertisingcom1.zip/pertti ekberg@advertising[1].txt -> TrackingCookie.Advertising : Cleaned.
    D:\Documents and Settings\Heini1\Työpöytä\Ohjelmat\Spybot - Search & Destroy 0.95\Recovery\Advertisingcom2.zip/ville@servedby.advertising[1].txt -> TrackingCookie.Advertising : Cleaned.
    D:\Documents and Settings\Heini1\Työpöytä\Ohjelmat\Spybot - Search & Destroy 0.95\Recovery\Advertisingcom3.zip/ville@advertising[1].txt -> TrackingCookie.Advertising : Cleaned.
    D:\Documents and Settings\Heini1\Työpöytä\Ohjelmat\Spybot - Search & Destroy 0.95\Recovery\Advertisingcom4.zip/ville@servedby.advertising[1].txt -> TrackingCookie.Advertising : Cleaned.
    D:\Documents and Settings\Heini1\Työpöytä\Ohjelmat\Spybot - Search & Destroy 0.95\Recovery\Advertisingcom5.zip/ville@advertising[1].txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.11:D:\Documents and Settings\Heini1\Application Data\Mozilla\Firefox\Profiles\k3h5ulju.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
    D:\Documents and Settings\Heini1\Työpöytä\Ohjelmat\Spybot - Search & Destroy 0.95\Recovery\AvenueAInc.zip/pertti ekberg@atdmt[1].txt -> TrackingCookie.Atdmt : Cleaned.
    D:\Documents and Settings\Heini1\Työpöytä\Ohjelmat\Spybot - Search & Destroy 0.95\Recovery\AvenueAInc1.zip/ville@atdmt[1].txt -> TrackingCookie.Atdmt : Cleaned.
    :mozilla.106:D:\Documents and Settings\Heini1\Application Data\Mozilla\Firefox\Profiles\k3h5ulju.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@bluestreak[1].txt -> TrackingCookie.Bluestreak : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@ads46.bpath[1].txt -> TrackingCookie.Bpath : Cleaned.
    :mozilla.83:D:\Documents and Settings\Heini1\Application Data\Mozilla\Firefox\Profiles\k3h5ulju.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@casalemedia[2].txt -> TrackingCookie.Casalemedia : Cleaned.
    :mozilla.116:D:\Documents and Settings\Heini1\Application Data\Mozilla\Firefox\Profiles\k3h5ulju.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@doubleclick[2].txt -> TrackingCookie.Doubleclick : Cleaned.
    D:\Documents and Settings\Heini1\Työpöytä\Ohjelmat\Spybot - Search & Destroy 0.95\Recovery\DoubleClick.zip/ville@doubleclick[2].txt -> TrackingCookie.Doubleclick : Cleaned.
    D:\Documents and Settings\Heini1\Työpöytä\Ohjelmat\Spybot - Search & Destroy 0.95\Recovery\DoubleClick1.zip/ville@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
    D:\Documents and Settings\Heini1\Työpöytä\Ohjelmat\Spybot - Search & Destroy 0.95\Recovery\DoubleClick2.zip/ville@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
    D:\Documents and Settings\Heini1\Työpöytä\Ohjelmat\Spybot - Search & Destroy 0.95\Recovery\DoubleClick3.zip/ville@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@c.enhance[1].txt -> TrackingCookie.Enhance : Cleaned.
    :mozilla.118:D:\Documents and Settings\Heini1\Application Data\Mozilla\Firefox\Profiles\k3h5ulju.default\cookies.txt -> TrackingCookie.Euniverseads : Cleaned.
    :mozilla.119:D:\Documents and Settings\Heini1\Application Data\Mozilla\Firefox\Profiles\k3h5ulju.default\cookies.txt -> TrackingCookie.Euniverseads : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@sel.as-us.falkag[2].txt -> TrackingCookie.Falkag : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned.
    D:\Documents and Settings\Heini1\Työpöytä\Ohjelmat\Spybot - Search & Destroy 0.95\Recovery\FastClick.zip/ville@fastclick[2].txt -> TrackingCookie.Fastclick : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@ehg-meevee.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@ehg-sanomadata.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@ehg-teliasonera.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@ehg-wssuk.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@ehg-youtube.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@ehg-yvesrocher.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
    D:\Documents and Settings\Heini1\Työpöytä\Ohjelmat\Spybot - Search & Destroy 0.95\Recovery\HitBox.zip/ville@hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
    D:\Documents and Settings\Heini1\Työpöytä\Ohjelmat\Spybot - Search & Destroy 0.95\Recovery\HitBox1.zip/ville@ehg-nokiafin.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
    :mozilla.84:D:\Documents and Settings\Heini1\Application Data\Mozilla\Firefox\Profiles\k3h5ulju.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@searchportal.information[1].txt -> TrackingCookie.Information : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@komtrack[2].txt -> TrackingCookie.Komtrack : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@image.masterstats[1].txt -> TrackingCookie.Masterstats : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.
    :mozilla.108:D:\Documents and Settings\Heini1\Application Data\Mozilla\Firefox\Profiles\k3h5ulju.default\cookies.txt -> TrackingCookie.Msn : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@auto.search.msn[1].txt -> TrackingCookie.Msn : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@ie.search.msn[1].txt -> TrackingCookie.Msn : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@search.msn[1].txt -> TrackingCookie.Msn : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@overture[1].txt -> TrackingCookie.Overture : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@ads.pointroll[2].txt -> TrackingCookie.Pointroll : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@questionmarket[1].txt -> TrackingCookie.Questionmarket : Cleaned.
    :mozilla.97:D:\Documents and Settings\Heini1\Application Data\Mozilla\Firefox\Profiles\k3h5ulju.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
    :mozilla.98:D:\Documents and Settings\Heini1\Application Data\Mozilla\Firefox\Profiles\k3h5ulju.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@realmedia[1].txt -> TrackingCookie.Realmedia : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@revsci[2].txt -> TrackingCookie.Revsci : Cleaned.
    :mozilla.107:D:\Documents and Settings\Heini1\Application Data\Mozilla\Firefox\Profiles\k3h5ulju.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@bs.serving-sys[1].txt -> TrackingCookie.Serving-sys : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@serving-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@cs.sexcounter[2].txt -> TrackingCookie.Sexcounter : Cleaned.
    D:\Documents and Settings\Heini1\Työpöytä\Ohjelmat\Spybot - Search & Destroy 0.95\Recovery\SexTracker.zip/ville@sextracker[2].txt -> TrackingCookie.Sextracker : Cleaned.
    D:\Documents and Settings\Heini1\Työpöytä\Ohjelmat\Spybot - Search & Destroy 0.95\Recovery\SexTracker1.zip/ville@counter4.sextracker[1].txt -> TrackingCookie.Sextracker : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@www.smartadserver[1].txt -> TrackingCookie.Smartadserver : Cleaned.
    :mozilla.67:D:\Documents and Settings\Heini1\Application Data\Mozilla\Firefox\Profiles\k3h5ulju.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.68:D:\Documents and Settings\Heini1\Application Data\Mozilla\Firefox\Profiles\k3h5ulju.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@statcounter[1].txt -> TrackingCookie.Statcounter : Cleaned.
    :mozilla.6:D:\Documents and Settings\Heini1\Application Data\Mozilla\Firefox\Profiles\k3h5ulju.default\cookies.txt -> TrackingCookie.Statistik-gallup : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@statistik-gallup[2].txt -> TrackingCookie.Statistik-gallup : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.
    :mozilla.131:D:\Documents and Settings\Heini1\Application Data\Mozilla\Firefox\Profiles\k3h5ulju.default\cookies.txt -> TrackingCookie.Targetnet : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@targetnet[1].txt -> TrackingCookie.Targetnet : Cleaned.
    :mozilla.105:D:\Documents and Settings\Heini1\Application Data\Mozilla\Firefox\Profiles\k3h5ulju.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@trafficmp[1].txt -> TrackingCookie.Trafficmp : Cleaned.
    :mozilla.99:D:\Documents and Settings\Heini1\Application Data\Mozilla\Firefox\Profiles\k3h5ulju.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@m.webtrends[1].txt -> TrackingCookie.Webtrends : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@statse.webtrendslive[1].txt -> TrackingCookie.Webtrendslive : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@yadro[1].txt -> TrackingCookie.Yadro : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned.
    D:\Documents and Settings\Heini1\Cookies\heini1@zedo[2].txt -> TrackingCookie.Zedo : Cleaned.


    ::Report end

    <------------avg loppuu--------->


    <-------hijackthis alkaa--------->


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 16:47:15, on 3.12.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    D:\WINDOWS\System32\smss.exe
    D:\WINDOWS\system32\winlogon.exe
    D:\WINDOWS\system32\services.exe
    D:\WINDOWS\system32\lsass.exe
    D:\WINDOWS\system32\svchost.exe
    D:\WINDOWS\System32\svchost.exe
    D:\WINDOWS\system32\spoolsv.exe
    D:\WINDOWS\Explorer.EXE
    D:\WINDOWS\system32\RUNDLL32.EXE
    D:\WINDOWS\SOUNDMAN.EXE
    D:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
    D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    D:\Program Files\D-Tools\daemon.exe
    D:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    D:\Program Files\Eset\nod32kui.exe
    D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    D:\PROGRA~1\Ahead\Ahead\data\Xtras\mssysmgr.exe
    D:\Program Files\MSN Messenger\MsnMsgr.Exe
    D:\WINDOWS\system32\ctfmon.exe
    D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    D:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
    D:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    D:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    D:\Program Files\Eset\nod32krn.exe
    D:\WINDOWS\system32\nvsvc32.exe
    D:\WINDOWS\System32\svchost.exe
    D:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    D:\WINDOWS\system32\NOTEPAD.EXE
    D:\WINDOWS\system32\NOTEPAD.EXE
    D:\WINDOWS\system32\wuauclt.exe
    D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://irc-galleria.net/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - D:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar4.dll
    O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
    O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - D:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - D:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar4.dll
    O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [AdobeVersionCue] D:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Program Files\D-Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [HP Software Update] D:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [nod32kui] "D:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] D:\PROGRA~1\Ahead\Ahead\data\Xtras\mssysmgr.exe
    O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Acrobat Assistant.lnk = D:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = D:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1100116539046
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
    O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
    O23 - Service: Adobe LM Service - Unknown owner - D:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: AdobeVersionCue - Adobe Sytems - D:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Google Updater Service (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - D:\Program Files\Eset\nod32krn.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Pml Driver HPZ12 - HP - D:\WINDOWS\system32\HPZipm12.exe

    --
    End of file - 7551 bytes


    <------------hijackthis loppuu--------->
     
    Miansa, Dec 3, 2007
    #3

Share This Page