Mitähän noi prosessit on?

Discussion in 'Virukset ja haittaohjelmat' started by kreivi79, May 16, 2005.

  1. kreivi79

    kreivi79 Guest

    onkohan ihan normaalia että mulla on 51 prosessia päällä kokoajan vaikka ei olis mitään ohjelmia päällä? konekki tilttailee kokoajan... :-(

    ja toi suoritinkäyttö hyppii välillä sadassa prosentissa..
    hommasin normanin virus ohjelman mutta sitäkään ei voi käyttää ku kone menee tilttiin heti..

    oisko hyviä vihjeitä uusavuttomalle? vai kannattaskohan siirtyä suosiolla käyttään vanhanaikaisempia menetelmiä...
     
    kreivi79, May 16, 2005
    #1
  2. Jouko?

    Jouko? Moderator Staff Member

    Joined:
    Jul 14, 2004
    Messages:
    3,858
    Likes Received:
    32
    Trophy Points:
    78
    Jouko?, May 16, 2005
    #2
  3. V-kos

    V-kos Regular member

    Joined:
    Mar 13, 2005
    Messages:
    1,345
    Likes Received:
    0
    Trophy Points:
    46
    Oiskohan tuo jo hjt-login paikka.

    http://koti.mbnet.fi/pattaya1/hijackthis.htm

    Hae tuolta HijackThis. Lue ohjeet tarkkaan ja noudata myös niitä. Sitten pyöräytät sen login sillä ja lähetät sen tänne. Se sitten aikoinaan (huomenna) tutkitaan ja kerrotaan jos on aihetta jatkotoimen piteisiin. Vastauksia odotellessa voisit käydä koneen läpi vaikka trendmicron online skannerilla ja kerrot sitten kans jos sillä tulee löydöksiä.

    EDIT: Tässä Trend-micron online scannerin osoite.
    http://fi.trendmicro-europe.com/consumer/products/housecall_launch.php
     
    Last edited: May 16, 2005
    V-kos, May 16, 2005
    #3
  4. kreivi79

    kreivi79 Guest

    Juu, taidan kantaa koko myllyn suosiolla jollekkin joka tajuaa tän päälle..

    toi online scannerinki käyttö tilttaa koneen..

    ja toi hjt:n käyttö taitaa mun kannattaa jättää pois suosiolla. :)
    ei vaikuta aloittelijoiden hommalta...

    kiitos kuitenkin..
     
    kreivi79, May 17, 2005
    #4
  5. Takajammu

    Takajammu Regular member

    Joined:
    Mar 1, 2005
    Messages:
    508
    Likes Received:
    0
    Trophy Points:
    26
    Laita se loki tänne, ni tuollainen kiva pikku viruksen tuhooja Toymaatti tutkii ja kertoo, että mitä pitää fixata
     
    Takajammu, May 17, 2005
    #5
  6. V-kos

    V-kos Regular member

    Joined:
    Mar 13, 2005
    Messages:
    1,345
    Likes Received:
    0
    Trophy Points:
    46
    Joo älä nyt luovuta. Ei sun tarvi itse muutakuin asentaa se hjt ja sitten laitat login tänne. Siellä on nyt varmaan sellanen örkki että pakko nähdä.
     
    V-kos, May 17, 2005
    #6
  7. kreivi79

    kreivi79 Guest

    no tollasen se anto.. kaveri tätä konetta jo kyllä räpläs et tiedä vaikka se jo toimis..

    Logfile of HijackThis v1.99.1
    Scan saved at 17:34:16, on 17.5.2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\D-Tools\daemon.exe
    C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
    C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
    C:\Program Files\MessengerPlus! 3\MsgPlus.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\WildTangent\Apps\CDA\GameDrvr.exe
    C:\Norman\bin\ZLH.EXE
    C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\FinePixViewer\QuickDCF.exe
    C:\Program Files\WinZip\WZQKPICK.EXE
    C:\Program Files\Microsoft Office\Office\OSA.EXE
    C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
    C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
    C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    C:\Norman\Nvc\BIN\NPFSVICE.EXE
    C:\Norman\Bin\Zanda.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Norman\Nvc\BIN\NIP.EXE
    C:\Norman\Nvc\BIN\npfmsg2.exe
    C:\Norman\Nvc\bin\nvcoas.exe
    C:\Norman\bin\NJEEVES.EXE
    C:\Norman\Nvc\BIN\NVCSCHED.EXE
    C:\Norman\Nvc\BIN\nipsvc.exe
    C:\WINDOWS\System32\alg.exe
    C:\Norman\Nvc\bin\cclaw.exe
    C:\Program Files\Real\RealPlayer\RealPlay.exe
    C:\WINDOWS\system32\taskmgr.exe
    C:\Documents and Settings\esiasennettu\Omat tiedostot\Vastaanotetut tiedostot\virusjuttuja\hjt\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bkghiraghtrcjzzwpdojagzs.biz..._iOUCgHyDQKDGc57hgLpD4vDYINLHaX7FyBN0UXP.html
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = dna Internet Explorer
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.hoqcmmoapqxviatifsqavrg.com/JtQ8CoSwO8yQagy_3380uC_m1Hf5H5DKSMrC_NBAIBo.html"); (C:\Documents and Settings\esiasennettu\Application Data\Mozilla\Profiles\default\kbtnluk0.slt\prefs.js)
    N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\esiasennettu\Application Data\Mozilla\Profiles\default\kbtnluk0.slt\prefs.js)
    O1 - Hosts: 80.69.74.15 auto.search.msn.com
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {4888C95B-0E15-B4E1-C6E3-4FA425D732AB} - C:\DOCUME~1\ESIASE~1\APPLIC~1\MEETSO~1\CAKE INSIDE.exe
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: MSN-työkalurivi - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.1601.0\fi\msntb.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    O4 - HKLM\..\Run: [YkFJYcEw] C:\PROGRA~1\ouvqpqtx\dcADf4BM.exe
    O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
    O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [browse type clock knob] C:\Documents and Settings\All Users\Application Data\SECOND BAT BROWSE TYPE\peak wipe.exe
    O4 - HKLM\..\Run: [WildTangent CDA] "C:\Program Files\WildTangent\Apps\CDA\GameDrvr.exe" /startup "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0500.dll"
    O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
    O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - Startup: Microsoft Office Pikahaku.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
    O4 - Startup: Officen käynnistys.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
    O4 - Startup: OpenOffice.org 1.0.lnk = C:\Program Files\OpenOffice.org1.0\program\quickstart.exe
    O4 - Startup: PowerReg Scheduler V3.exe
    O4 - Startup: PowerReg Scheduler.exe
    O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{92B66993-EFE0-47DD-84D1-85EA91D4154E}: NameServer = 212.50.211.55 212.50.192.226
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN\nipsvc.exe
    O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE
    O23 - Service: Norman Type-R - Unknown owner - C:\Norman\Nvc\BIN\NPFSVICE.EXE
    O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\Bin\Zanda.exe
    O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe
    O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\Norman\Nvc\BIN\NVCSCHED.EXE
     
    kreivi79, May 17, 2005
    #7
  8. juuzo

    juuzo Regular member

    Joined:
    May 24, 2004
    Messages:
    462
    Likes Received:
    0
    Trophy Points:
    26
    Messenger plus kannattaa ainakin poistaa. Siitä ei ole kuin harmia.
     
    juuzo, May 17, 2005
    #8
  9. V-kos

    V-kos Regular member

    Joined:
    Mar 13, 2005
    Messages:
    1,345
    Likes Received:
    0
    Trophy Points:
    46
    Toi Wild Tanget on kans ihan turhanpäivänen ainakin mun mielestä. Eikö se ainakin ennen asentanu jotain pelejä ihan omin luvin. sitten nuo osoitteet pistää silmään kuin tuhat kimalaista.


    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bkghiraghtrcjzzwpdojagzs.biz/JtQ8CoSwO8y1mrGwSF8m4REN_iOUC...

    N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.hoqcmmoapqxviatifsqavrg.com/JtQ8CoSwO8yQagy_3380uC_m1H...);

    Mutta odottelehan rauhassa niin Toymaatti kertoo oikeat fixit sulle.
     
    V-kos, May 17, 2005
    #9
  10. LaLLi80

    LaLLi80 Senior member

    Joined:
    Nov 23, 2003
    Messages:
    5,010
    Likes Received:
    0
    Trophy Points:
    116
    Kreivi79 odota suosiolla toymaatin vastausta ja voithan pistää sille yksityistä viestii että tulee kattomaan.

    Toi 51 prosessia on aika helvetin paljon...mulla on moniajossakin hikiseen 40 prosessia.
     
    LaLLi80, May 17, 2005
    #10
  11. Toymaatti

    Toymaatti Active member

    Joined:
    Feb 4, 2005
    Messages:
    1,038
    Likes Received:
    0
    Trophy Points:
    66
    Siirrä HjT kansioineen C:n juureen näin C:\hjt\HijackThis.exe

    Poista Lisää/Poista sovelluksesta
    MessengerPlus! 3
    WildTangent

    Scannaa HjT:llä, laita merkki noiden eteen, sulje selain ja muut ikkunat, klikkaa Fix
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bkghiraghtrcjzzwpdojagzs.biz/JtQ8CoSwO8y1mrGwSF8m4REN_iOUC...
    N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.hoqcmmoapqxviatifsqavrg.com/JtQ8CoSwO8yQagy_3380uC_m1H...); (C:\Documents and Settings\esiasennettu\Application Data\Mozilla\Profiles\default\kbtnluk0.slt\prefs.js)
    O2 - BHO: (no name) - {4888C95B-0E15-B4E1-C6E3-4FA425D732AB} - C:\DOCUME~1\ESIASE~1\APPLIC~1\MEETSO~1\CAKE INSIDE.exe
    O4 - HKLM\..\Run: [YkFJYcEw] C:\PROGRA~1\ouvqpqtx\dcADf4BM.exe
    O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
    O4 - HKLM\..\Run: [browse type clock knob] C:\Documents and Settings\All Users\Application Data\SECOND BAT BROWSE TYPE\peak wipe.exe
    O4 - HKLM\..\Run: [WildTangent CDA] "C:\Program Files\WildTangent\Apps\CDA\GameDrvr.exe" /startup "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0500.dll"
    O4 - Startup: PowerReg Scheduler V3.exe
    O4 - Startup: PowerReg Scheduler.exe

    Käynnistä vikasietotilaan, etsi ja poista nuo kansiot
    C:\DOCUME~1\ESIASE~1\APPLIC~1\===>MEETSO~1<===
    C:\PROGRA~1\===>ouvqpqtx<===
    C:\Program Files\===>MessengerPlus!3<===
    C:\Documents and Settings\All Users\Application Data\===>SECOND BAT BROWSE TYPE<===
    C:\Program Files\===>WildTangent<===

    Normaali käynnistys, laita uusi loki.
     
    Toymaatti, May 17, 2005
    #11
  12. kreivi79

    kreivi79 Guest

    en oikeen tiedä kuinka edes kehtaisin kysyä mutta pakko kai se on... kuinka käynnistän vikasietotilaan? :)
     
    kreivi79, May 17, 2005
    #12
  13. Toymaatti

    Toymaatti Active member

    Joined:
    Feb 4, 2005
    Messages:
    1,038
    Likes Received:
    0
    Trophy Points:
    66
    Tottakai kehtaa, painele F8 käynnistyksen aikana. Mulla iski kiire palaan myöhemmällä.
     
    Toymaatti, May 17, 2005
    #13
  14. kreivi79

    kreivi79 Guest

    C:\DOCUME~1\ESIASE~1\APPLIC~1\===>MEETSO~1<===
    C:\PROGRA~1\===>ouvqpqtx<===

    noita kansioita en onnistunut poistamaan...

    ja tämän näkönen se on tälläkertaa...



    Logfile of HijackThis v1.99.1
    Scan saved at 20:21:53, on 17.5.2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\D-Tools\daemon.exe
    C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
    C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Norman\bin\ZLH.EXE
    C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\FinePixViewer\QuickDCF.exe
    C:\Program Files\WinZip\WZQKPICK.EXE
    C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
    C:\Program Files\Microsoft Office\Office\OSA.EXE
    C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
    C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    C:\Norman\Nvc\BIN\NPFSVICE.EXE
    C:\Norman\Bin\Zanda.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Norman\Nvc\BIN\NIP.EXE
    C:\Norman\Nvc\BIN\npfmsg2.exe
    C:\Norman\Nvc\BIN\NVCSCHED.EXE
    C:\Norman\bin\NJEEVES.EXE
    C:\Norman\Nvc\BIN\nipsvc.exe
    C:\Norman\Nvc\bin\nvcoas.exe
    C:\WINDOWS\System32\alg.exe
    C:\Norman\Nvc\bin\cclaw.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\hjt\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = dna Internet Explorer
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.hoqcmmoapqxviatifsqavrg.com/JtQ8CoSwO8yQagy_3380uC_m1Hf5H5DKSMrC_NBAIBo.html"); (C:\Documents and Settings\esiasennettu\Application Data\Mozilla\Profiles\default\kbtnluk0.slt\prefs.js)
    N3 - Netscape 7: user_pref("browser.search.defaultengine", "http://www.google.com/"); (C:\Documents and Settings\esiasennettu\Application Data\Mozilla\Profiles\default\kbtnluk0.slt\prefs.js)
    O1 - Hosts: 80.69.74.15 auto.search.msn.com
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: MSN-työkalurivi - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.1601.0\fi\msntb.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    O4 - HKLM\..\Run: [YkFJYcEw] C:\PROGRA~1\ouvqpqtx\dcADf4BM.exe
    O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
    O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - Startup: Microsoft Office Pikahaku.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
    O4 - Startup: Officen käynnistys.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
    O4 - Startup: OpenOffice.org 1.0.lnk = C:\Program Files\OpenOffice.org1.0\program\quickstart.exe
    O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{92B66993-EFE0-47DD-84D1-85EA91D4154E}: NameServer = 212.50.211.55 212.50.192.226
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN\nipsvc.exe
    O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE
    O23 - Service: Norman Type-R - Unknown owner - C:\Norman\Nvc\BIN\NPFSVICE.EXE
    O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\Bin\Zanda.exe
    O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe
    O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\Norman\Nvc\BIN\NVCSCHED.EXE

     
    kreivi79, May 17, 2005
    #14
  15. kreivi79

    kreivi79 Guest

    voikohan tuo munki koneen sammuminen johtua ylikuumenemisesta?

    lueskelin noita toisia kirjotuksia ja siellä tarjottiin joka ongelmaan lämpöjen nousua... ku netissä voi surffailla mielinmäärin mutta en käyttään mitään muuta ohjelmaa, kuten virus ohjelmia tai pelejä, nyyh...
     
    kreivi79, May 17, 2005
    #15
  16. Toymaatti

    Toymaatti Active member

    Joined:
    Feb 4, 2005
    Messages:
    1,038
    Likes Received:
    0
    Trophy Points:
    66
    Toymaatti, May 17, 2005
    #16
  17. kreivi79

    kreivi79 Guest

    ilmeisesti ei ku ei voinu deletoida noita.. tollanen tuli lukeen..

    Log for VX2.BetterInternet File Finder (ALL)

    Files Found---

    Additional Files---

    Keys Under Notify---
    AtiExtEvent
    crypt32chain
    cryptnet
    cscdll
    ScCertProp
    Schedule
    sclgntfy
    SensLogn
    termsrv
    wlballoon


    Guardian Key--- is called:

    Guardian Key--- :

    User Agent String---
    SV1
     
    kreivi79, May 17, 2005
    #17
  18. Toymaatti

    Toymaatti Active member

    Joined:
    Feb 4, 2005
    Messages:
    1,038
    Likes Received:
    0
    Trophy Points:
    66
    Joo, ei löytynyt mitään sillä. Koitetaas sitten näin.
    Käynnistä VIKASIETOTILAAN, merkkaa nuo HjT:ssä, sulje muut ikkunat, klikkaa Fix
    N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.hoqcmmoapqxviatifsqavrg.com/JtQ8CoSwO8yQagy_3380uC_m1H...); (C:\Documents and Settings\esiasennettu\Application Data\Mozilla\Profiles\default\kbtnluk0.slt\prefs.js)
    O1 - Hosts: 80.69.74.15 auto.search.msn.com
    O4 - HKLM\..\Run: [YkFJYcEw] C:\PROGRA~1\ouvqpqtx\dcADf4BM.exe

    Poista nuo
    C:\PROGRA~1\===>ouvqpqtx<===
    C:\DOCUME~1\ESIASE~1\APPLIC~1\===>MEETSO~1<===

    Normaali käynnistys ja uusi loki.
     
    Last edited: May 17, 2005
    Toymaatti, May 17, 2005
    #18

Share This Page