Terve Ongelmani on sama kuin tässä ketjussa, eli työkalupalkkiin on ilmestynyt punainen kuvake, joka näyttää aina välillä tekstin: "Your computer is infected Windows has detected spyware infection. It is recommended to use special antispyware tools to prevent data loss. Windows will now download and install the most up-to-date antispyware for you. Click here to protect your computer from spyware". Ja välillä aukenee sivu, joka tarjoaa ratkaisua ongelmaan. Itse en paljon tietokoneista tiedä joten ajattelin, että joku täällä voisi auttaa... Logfile of Trend Micro HijackThis v2.0.0 (BETA) Scan saved at 13:04:29, on 7.6.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\system32\ZONELABS\vsmon.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\F-Secure\Common\FSM32.EXE C:\Program Files\Ahead\InCD\InCD.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\F-Secure\Common\FSAA.EXE C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\F-Secure\Common\FSMA32.EXE C:\WINDOWS\system32\ntvdm.exe C:\WINDOWS\system32\ipmon.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\F-Secure\Common\FSMB32.EXE C:\Program Files\D-Link AirPlus\AIRPLUS.EXE C:\WINDOWS\system32\ipmon.exe C:\Program Files\F-Secure\Common\FCH32.EXE C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\F-Secure\Common\FAMEH32.EXE C:\Program Files\F-Secure\Common\FSGK32.EXE C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\F-Secure\Common\FIH32.EXE C:\Program Files\F-Secure\Anti-Virus\fsav32.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Hjt\HiJackThis_v2.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {1EB53F98-7276-43E3-A32E-DEA0935FBA88} - C:\WINDOWS\system32\efccawv.dll O2 - BHO: (no name) - {1F0EAA6C-D19F-4692-A32A-83FCCB069EF7} - (no file) O2 - BHO: (no name) - {4B047827-4CE4-4DCC-A5C5-B89ECBC7BA8E} - C:\WINDOWS\system32\sstqp.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll O3 - Toolbar: NewsStand Toolbar - {6E94ACD5-2C6A-48AC-84EF-A4DE746D385F} - C:\Program Files\NewsStand\Reader\NSIETool.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM\..\Run: [OmniPage] C:\Program Files\Caere\OmniPagePro90\opware32.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SManager] smanager.7.exe O4 - HKLM\..\Run: [uhkxefqh.exe] C:\Documents and Settings\All Users\Application Data\uhkxefqh.exe O4 - HKLM\..\Run: [ipmon] ipmon.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1 O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: QuickTV.lnk = C:\Program Files\AVerTV2K\QuickTV.exe O4 - Global Startup: TeleSA.lnk = C:\Program Files\AVer Teletext\AVerSA.exe O4 - Global Startup: D-Link AirPlus Utility.lnk = ? O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1161518421031 O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab O20 - Winlogon Notify: efccawv - C:\WINDOWS\SYSTEM32\efccawv.dll O20 - Winlogon Notify: sstqp - C:\WINDOWS\system32\sstqp.dll O20 - Winlogon Notify: winrkq32 - C:\WINDOWS\SYSTEM32\winrkq32.dll O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll O23 - Service: BackWeb Client - Unknown owner - C:\Program Files\F-Secure\BackWeb\BackWeb\Program\ServiceWrapper.exe (file missing) O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe O23 - Service: Tapahtumaloki (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE O23 - Service: F-Secure Authentication Agent (FSAA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSAA.EXE O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE O23 - Service: CD-levyjen kirjoittamisen IMAPI COM -palvelu (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NetMeeting etätyöpöydän jakaminen (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Plug and Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Etätyöpöydän ohjeen istunnonhallinta (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe O23 - Service: Älykortti (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Check Point SecuRemote Service (SR_Service) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe O23 - Service: Check Point SecuRemote WatchDog (SR_WatchDog) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe O23 - Service: Resurssilokit ja -hälytykset (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe O23 - Service: Aseman tilannevedos (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe O23 - Service: WMI resurssisovitin (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe -- End of file - 10059 bytes
Lataa SmitfraudFix (by S!Ri) työpöydällesi. Tuplaklikkaa tiedostoa SmitfraudFix.exe Valitse optio #1 - Search kirjoittamalla 1 ja painamalla "Enter"; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa). Postita tämän tekstitiedoston sisältö viestiketjuusi. **Jos työkalu ei käynnisty työpöydältä niin siirrä SmitfraudFix.exe suoraan järjestelmäaseman juureen (yleensä C:). Kokeile sitten käynnistää ohjelma uudestaan sieltä. Huomaa : process.exe filun tunnistaa jotkut Anti-virus ohjelmat (AntiVir, Dr.Web, Kaspersky) "Haittakaluna"; se ei ole virus, vaan ohjelma joka pysäyttää prosesseja. A/V ohjelmat eivät pysty tunnistamaan hyvän ja pahan käytön tälläisten ohjelmian väliltä, silloin ne saattavat varoittaa käyttäjää. http://www.beyondlogic.org/consulting/processutil/processutil.htm ========== Lataa VundoFix.exe työpöydällesi. *Tupla-klikkaa VundoFix.exe ajaaksesi sen. *Klikkaa Scan for Vundo valintaa. *Kun skannaus on valmis, klikkaa Remove Vundo valintaa. *Sinulta kysytään haluatko poistaa filut - klikkaa YES. *Kun olet klikannut yes, työpöytäsi tyhjenee kun se alkaa poistamaan Vundoa. *Kun se on valmis, fiksi ilmoittaa käynnistäväsi koneesi uudelleen, klikkaa OK. *Postita C:\vundofix.txt lokin sekä tuoreen HijackThis lokin sisältö. Huomaa: Se on mahdollista että VundoFix löysi tiedoston jota se ei pystynyt poistamaan. Tässä tilanteessa, VundoFix ajaa itsensä rebootissa, seuraa vain yläpuolelle olevia ohjeita alkaen kohdasta "Klikkaa Scan for Vundo valintaa." kun VundoFix ilmaantuu uudelleenkäynnistyksen yhteydessä. =======0 Lataa SDFix by AndyManchesta http://downloads.andymanchesta.com/RemovalTools/SDFix.exe ja tallenna se työpöydällesi. Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi: * Käynnistä tietokone * Kun kuulet koneen piippaavan, paina F8, kuitenkin ennen Windowsin logon esiintuloa * Seuraavaksi pitäisi ilmestyä valikko * Valitse valikosta vikasietotila. * Tee ohjelmalle oma kansio C:\SDFix ja siirrä se sinne * Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman. * Paina Y käynnistääksesi skriptin. * Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot". * Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen. * Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta. * Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished". * Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle. * Lopuksi avaa SDFix kansio ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi ========0 1. Lataa combofix.exe työpöydällesi jommastakummasta linkistä: http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe http://download.bleepingcomputer.com/sUBs/ComboFix.exe 2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia. 3. Kun työkalu on valmis, se tuottaa lokin. (C:\ComboFix.txt) Lähetä tämä loki viesti ketjuusi. Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen. Kera uuden hijackthis login
Okei, kiitos avusta. Ongelma ei tosin ole vielä hävinnyt... Mutta tässä näitä lokeja joka tapauksessa. Ai niin, tuo SDFix meni vahingossa kansioon C:/SDFix/SDFix neuvomasi kansion sijasta. Eli tuli kaksi SDFix kansiota, toivottavasti se ei haittaa. SmitfraudFix: SmitFraudFix v2.192 Scan done at 16:56:34,06, to 07.06.2007 Run from C:\Documents and Settings\-\Ty”p”yt„\SmitfraudFix OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT The filesystem type is FAT32 Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» Process C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\system32\ZONELABS\vsmon.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\F-Secure\Common\FSAA.EXE C:\Program Files\F-Secure\Common\FSMA32.EXE C:\Program Files\F-Secure\Common\FSMB32.EXE C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\F-Secure\Common\FCH32.EXE C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\F-Secure\Common\FAMEH32.EXE C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe C:\WINDOWS\System32\svchost.exe VundoFix: VundoFix V6.4.2 Checking Java version... Java version is 1.5.0.3 Old versions of java are exploitable and should be removed. Java version is 1.5.0.11 Scan started at 17:01:30 7.6.2007 Listing files found while scanning.... C:\WINDOWS\system32\byxyxuu.dll C:\WINDOWS\system32\efccawv.dll C:\WINDOWS\system32\mljifgg.dll C:\WINDOWS\system32\nnnkjjk.dll C:\WINDOWS\system32\orqss.ini C:\WINDOWS\system32\pqtss.bak1 C:\WINDOWS\system32\pqtss.ini C:\WINDOWS\system32\rwsytppp.dll C:\WINDOWS\system32\ssqro.dll C:\WINDOWS\system32\sstqp.dll Beginning removal... Attempting to delete C:\WINDOWS\system32\byxyxuu.dll C:\WINDOWS\system32\byxyxuu.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\efccawv.dll C:\WINDOWS\system32\efccawv.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\mljifgg.dll C:\WINDOWS\system32\mljifgg.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\nnnkjjk.dll C:\WINDOWS\system32\nnnkjjk.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\orqss.ini C:\WINDOWS\system32\orqss.ini Has been deleted! Attempting to delete C:\WINDOWS\system32\pqtss.bak1 C:\WINDOWS\system32\pqtss.bak1 Has been deleted! Attempting to delete C:\WINDOWS\system32\pqtss.ini C:\WINDOWS\system32\pqtss.ini Has been deleted! Attempting to delete C:\WINDOWS\system32\rwsytppp.dll C:\WINDOWS\system32\rwsytppp.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\ssqro.dll C:\WINDOWS\system32\ssqro.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\sstqp.dll C:\WINDOWS\system32\sstqp.dll Has been deleted! Performing Repairs to the registry. Done! HijackThis Vundofixin jälkeen: Logfile of Trend Micro HijackThis v2.0.0 (BETA) Scan saved at 17:11:41, on 7.6.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\system32\ZONELABS\vsmon.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\F-Secure\Common\FSM32.EXE C:\Program Files\Ahead\InCD\InCD.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Caere\OmniPagePro90\opware32.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Documents and Settings\All Users\Application Data\uhkxefqh.exe C:\WINDOWS\system32\ipmon.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\ntvdm.exe C:\WINDOWS\system32\ipmon.exe C:\Program Files\AVerTV2K\QuickTV.exe C:\Program Files\D-Link AirPlus\AIRPLUS.EXE C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\Program Files\F-Secure\Common\FSAA.EXE C:\Program Files\F-Secure\Common\FSMA32.EXE C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\F-Secure\Common\FSMB32.EXE C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\F-Secure\Common\FCH32.EXE C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\F-Secure\Common\FAMEH32.EXE C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\F-Secure\Common\FSGK32.EXE C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\F-Secure\Common\FIH32.EXE C:\Program Files\F-Secure\Anti-Virus\fsav32.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Hjt\HiJackThis_v2.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {1F0EAA6C-D19F-4692-A32A-83FCCB069EF7} - (no file) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: (no name) - {B1E351E2-94BB-40CC-AC85-A53C4128F2B9} - C:\WINDOWS\system32\sstqp.dll (file missing) O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll O3 - Toolbar: NewsStand Toolbar - {6E94ACD5-2C6A-48AC-84EF-A4DE746D385F} - C:\Program Files\NewsStand\Reader\NSIETool.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM\..\Run: [OmniPage] C:\Program Files\Caere\OmniPagePro90\opware32.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SManager] smanager.7.exe O4 - HKLM\..\Run: [uhkxefqh.exe] C:\Documents and Settings\All Users\Application Data\uhkxefqh.exe O4 - HKLM\..\Run: [ipmon] ipmon.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1 O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: QuickTV.lnk = C:\Program Files\AVerTV2K\QuickTV.exe O4 - Global Startup: TeleSA.lnk = C:\Program Files\AVer Teletext\AVerSA.exe O4 - Global Startup: D-Link AirPlus Utility.lnk = ? O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1161518421031 O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab O20 - Winlogon Notify: winrkq32 - C:\WINDOWS\SYSTEM32\winrkq32.dll O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll O23 - Service: BackWeb Client - Unknown owner - C:\Program Files\F-Secure\BackWeb\BackWeb\Program\ServiceWrapper.exe (file missing) O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe O23 - Service: Tapahtumaloki (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE O23 - Service: F-Secure Authentication Agent (FSAA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSAA.EXE O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE O23 - Service: CD-levyjen kirjoittamisen IMAPI COM -palvelu (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NetMeeting etätyöpöydän jakaminen (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Plug and Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Etätyöpöydän ohjeen istunnonhallinta (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe O23 - Service: Älykortti (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Check Point SecuRemote Service (SR_Service) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe O23 - Service: Check Point SecuRemote WatchDog (SR_WatchDog) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe O23 - Service: Resurssilokit ja -hälytykset (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe O23 - Service: Aseman tilannevedos (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe O23 - Service: WMI resurssisovitin (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe -- End of file - 10352 bytes SDFix: SDFix: Version 1.87 Run by - - to 07.06.2007 - 17:20:35,95 Microsoft Windows XP [versio 5.1.2600] Running From: C:\SDFix\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Restoring Missing Security Center Service Restoring Missing SharedAccess Service Rebooting... Normal Mode: Checking Files: Below files will be copied to Backups folder then removed: C:\MGVRPRGL.EXE - Deleted C:\136876~1 - Deleted C:\WINDOWS\Temp\win64.tmp.exe - Deleted C:\WINDOWS\Temp\win64.tmp.exe - Deleted C:\DOCUME~1\-\LOCALS~1\Temp\win3CC.tmp.exe - Deleted C:\WINDOWS\system32\max1d1641.exe - Deleted C:\WINDOWS\system32\max1d1641.exe~ - Deleted C:\WINDOWS\Temp\removalfile.bat - Deleted C:\WINDOWS\Temp\win*.tmp - Deleted C:\DOCUME~1\-\LOCALS~1\Temp\tmp*.tmp - Deleted C:\DOCUME~1\-\LOCALS~1\Temp\win*.tmp - Deleted Could Not Remove C:\WINDOWS\system32\xpdx.sys Removing Temp Files... ADS Check: Checking if ADS is attached to system32 Folder C:\WINDOWS\system32 No streams found. Checking if ADS is attached to svchost.exe C:\WINDOWS\system32\svchost.exe No streams found. Checking if ADS is attached to ntoskrnl.exe C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: Remaining Services: ------------------ Rootkit xpdx Found, Use a Rootkit scanner ! Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019" "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger" "C:\\Program Files\\Microsoft Games\\Dungeon Siege 2\\DungeonSiege2.exe"="C:\\Program Files\\Microsoft Games\\Dungeon Siege 2\\DungeonSiege2.exe:*:Enabledungeon Siege 2 Game Executable" "C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_Service.exe"="C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_Service.exe:*:Enabled:VPN-1 SecuRemote/SecureClient service" "C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_GUI.exe"="C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_GUI.exe:*:Enabled:VPN-1 SecuRemote/SecureClient application" "C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\scc.exe"="C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\scc.exe:*:Enabled:VPN-1 SecuRemote/SecureClient command line" "C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_SDS.exe"="C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_SDS.exe:*:Enabled:VPN-1 SecuRemote/SecureClient SDS agent" "C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_Diagnostics.exe"="C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_Diagnostics.exe:*:Enabled:VPN-1 SecuRemote/SecureClient diagnostics" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" "C:\\Program Files\\Kazaa Lite Resurrection\\kazaalite.kpp"="C:\\Program Files\\Kazaa Lite Resurrection\\kazaalite.kpp:*:Enabled:kazaalite" "C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule" "C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000" "C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes" "C:\\DOCUME~1\\-\\LOCALS~1\\Temp\\win3CA.tmp.exe"="C:\\DOCUME~1\\-\\LOCALS~1\\Temp\\win3CA.tmp.exe:*:Enabled:win3CA.tmp" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019" "C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_Service.exe"="C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_Service.exe:*:Enabled:VPN-1 SecuRemote/SecureClient service" "C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_GUI.exe"="C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_GUI.exe:*:Enabled:VPN-1 SecuRemote/SecureClient application" "C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\scc.exe"="C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\scc.exe:*:Enabled:VPN-1 SecuRemote/SecureClient command line" "C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_SDS.exe"="C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_SDS.exe:*:Enabled:VPN-1 SecuRemote/SecureClient SDS agent" "C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_Diagnostics.exe"="C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_Diagnostics.exe:*:Enabled:VPN-1 SecuRemote/SecureClient diagnostics" "C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" Remaining Files: --------------- C:\WINDOWS\system32\xpdx.sys Found Backups Folder: - C:\SDFix\SDFix\backups\backups.zip Listing Files with Hidden Attributes: C:\Program Files\Common Files\Adobe\ESD\DLMCleanup.exe C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\0838e3ca46c974d22be0ec664b800381\BIT57.tmp C:\Documents and Settings\-\S„l„„\RPG\~WRL0003.tmp C:\Documents and Settings\-\S„l„„\RPG\~WRL1036.tmp C:\Documents and Settings\-\S„l„„\RPG\~WRL2666.tmp C:\Documents and Settings\-\S„l„„\RPG\~WRL1738.tmp C:\Documents and Settings\-\Local Settings\Temp\EMULE8b5\Alcohol 120% v1.9.5 build 2802 serial keygen.zip C:\Documents and Settings\-\Local Settings\Temp\EMULE8b5\NHL 2004 All serial keygen.zip C:\Documents and Settings\-\Local Settings\Temp\EMULE8b5\Avast Pro v4.6.665 French serial keygen.zip C:\Documents and Settings\-\Local Settings\Temp\EMULE8b5\A Speeder v2.8.0.122 serial keygen.zip C:\Documents and Settings\-\Local Settings\Temp\EMULE8b5\MathWorks Matlab Release 13 serial keygen.zip Listing User Accounts: K„ytt„j„tilit \\-- ----- ASPNET ----- HelpAssistant J„rjestelm„nvalvoja ----- ----- SUPPORT_388945a0 Vieras Komento on suoritettu. Finished ComboFix: "-" - 2007-06-07 17:33:12 Service Pack 2 ComboFix 07-06-3B - Running from: "C:\Documents and Settings\-\Ty”p”yt„\" (((((((((((((((((((((((((((((((((((((((((((( V Log ))))))))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\winrkq32.dll * * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\install.log C:\WINDOWS\NDNuninstall6_38.exe C:\WINDOWS\NDNuninstall7_48.exe C:\WINDOWS\system32\xpdx.sys ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) -------\xpdx ((((((((((((((((((((((((( Files Created from 2007-05-07 to 2007-06-07 ))))))))))))))))))))))))))))))) 2007-06-07 17:39 <KANSIO> d-------- C:\Avenger 2007-06-07 17:34 33,302 --a------ C:\WINDOWS\system32\hggfcdb.dll 2007-06-07 17:12 778,784 --a------ C:\SDFix.exe 2007-06-07 17:01 <KANSIO> d-------- C:\VundoFix Backups 2007-06-07 16:56 3,398 --a------ C:\WINDOWS\system32\tmp.reg 2007-06-07 12:41 <KANSIO> d-------- C:\Hjt 2007-06-07 00:01 2,580 --a------ C:\WINDOWS\system32\yakqjibm.exe 2007-06-06 23:50 56,832 --a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\uhkxefqh.exe 2007-06-06 23:50 48,128 --a------ C:\inlw.exe 2007-06-06 23:50 30,720 --a------ C:\WINDOWS\system32\ipmon.exe 2007-06-06 23:50 17,860 --a------ C:\WINDOWS\system32\winsys64.exe 2007-06-06 23:50 1,536 --a------ C:\intvuvmp.exe 2007-06-05 11:01 <KANSIO> d-------- C:\Program Files\iPod 2007-06-01 19:56 <KANSIO> d-------- C:\Program Files\Last.fm 2007-05-26 17:25 <KANSIO> d-------- C:\DOCUME~1\-\APPLIC~1\pdf995 2007-05-26 17:19 51,716 --a------ C:\WINDOWS\system32\pdf995mon.dll 2007-05-26 17:19 249,856 --a------ C:\WINDOWS\system32\pdfmona.dll 2007-05-26 17:19 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\pdf995 2007-05-26 16:56 <KANSIO> d--hs---- C:\FOUND.005 2007-05-25 19:56 <KANSIO> d--hs---- C:\FOUND.004 2007-05-16 19:16 <KANSIO> d--hs---- C:\FOUND.003 2007-05-15 22:36 <KANSIO> d-------- C:\DOCUME~1\-\APPLIC~1\WinRAR 2007-05-15 15:47 <KANSIO> d-------- C:\Program Files\iTunes 2007-05-15 15:46 <KANSIO> d-------- C:\Program Files\QuickTime 2007-05-15 15:46 <KANSIO> d-------- C:\Program Files\Apple Software Update 2007-05-09 22:30 <KANSIO> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-06-04 09:11:42 65,938 ----a-w C:\WINDOWS\system32\perfc00B.dat 2007-06-04 09:11:42 357,770 ----a-w C:\WINDOWS\system32\perfh00B.dat 2007-05-01 11:19:18 4,212 ---h--w C:\WINDOWS\system32\zllictbl.dat 2007-04-23 12:57:08 682,232 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2007-04-18 16:14:18 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll 2007-03-17 13:44:52 292,864 ----a-w C:\WINDOWS\system32\winsrv.dll 2007-03-08 22:02:00 75,512 ----a-w C:\WINDOWS\zllsputility.exe 2007-03-08 22:01:42 1,087,216 ----a-w C:\WINDOWS\system32\zpeng24.dll 2007-03-08 15:38:00 578,048 ----a-w C:\WINDOWS\system32\user32.dll 2007-03-08 15:38:00 40,960 ----a-w C:\WINDOWS\system32\mf3216.dll 2007-03-08 15:38:00 281,600 ----a-w C:\WINDOWS\system32\gdi32.dll 2007-03-08 15:34:26 1,843,840 ----a-w C:\WINDOWS\system32\win32k.sys ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43] {8A61098D-612B-4EF2-943D-64E920684061}=C:\WINDOWS\system32\hggfcdb.dll [2007-06-07 17:34] {9394EDE7-C8B5-483E-8773-474BF36AF6E4}=C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll [2004-08-13 17:42] {B1E351E2-94BB-40CC-AC85-A53C4128F2B9}=C:\WINDOWS\system32\sstqp.dll [] {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}=C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll [2006-01-17 16:04] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2003-06-10 13:12 C:\WINDOWS\SOUNDMAN.EXE] "nwiz"="nwiz.exe" [2004-03-24 10:04 C:\WINDOWS\system32\nwiz.exe] "F-Secure Manager"="C:\Program Files\F-Secure\Common\FSM32.exe" [2000-10-23 13:38] "NvMediaCenter"="NvMCTray.dll" [2004-03-24 10:04 C:\WINDOWS\system32\nvmctray.dll] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41] "InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2005-01-03 11:41] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11] "Zone Labs Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-03-09 01:02] "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2006-11-08 13:27] "OmniPage"="C:\Program Files\Caere\OmniPagePro90\opware32.exe" [1998-12-15 11:48] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-03-09 01:02] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-06-01 16:51] "uhkxefqh.exe"="C:\Documents and Settings\All Users\Application Data\uhkxefqh.exe" [2007-06-06 23:50] "ipmon"="ipmon.exe" [2007-06-06 23:50 C:\WINDOWS\system32\ipmon.exe] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 02:12] "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45] "eMuleAutoStart"="C:\Program Files\eMule\emule.exe" [2007-05-13 17:57] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "PcSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{8A61098D-612B-4EF2-943D-64E920684061}"="C:\WINDOWS\system32\hggfcdb.dll" [2007-06-07 17:34] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ckpNotify] ckpNotify.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\hggfcdb] hggfcdb.dll HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs* Contents of the 'Scheduled Tasks' folder 2007-05-20 10:03:02 C:\WINDOWS\tasks\AppleSoftwareUpdate.job ************************************************************************** catchme 0.3.692 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-06-07 17:42:52 Windows 5.1.2600 Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Files hidden from API: C:\WINDOWS\H”yhenkuvio.bmp C:\WINDOWS\system32\N„yt„ kanavat.scf Completion time: 2007-06-07 17:47:45 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-06-07 17:46 --- E O F --- Hijackthis ComboFixin jälkeen: Logfile of Trend Micro HijackThis v2.0.0 (BETA) Scan saved at 17:50:49, on 7.6.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\system32\ZONELABS\vsmon.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\F-Secure\Common\FSAA.EXE C:\Program Files\F-Secure\Common\FSMA32.EXE C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\F-Secure\Common\FSMB32.EXE C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe C:\Program Files\F-Secure\Common\FCH32.EXE C:\WINDOWS\System32\svchost.exe C:\Program Files\F-Secure\Common\FAMEH32.EXE C:\Program Files\F-Secure\Common\FSGK32.EXE C:\WINDOWS\Explorer.EXE C:\Program Files\F-Secure\Anti-Virus\fsav32.exe C:\Program Files\F-Secure\Common\FIH32.EXE C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\F-Secure\Common\FSM32.EXE C:\Program Files\Ahead\InCD\InCD.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Caere\OmniPagePro90\opware32.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Documents and Settings\All Users\Application Data\uhkxefqh.exe C:\WINDOWS\system32\ipmon.exe C:\WINDOWS\system32\ipmon.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\eMule\emule.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\D-Link AirPlus\AIRPLUS.EXE C:\WINDOWS\system32\rundll32.exe C:\Hjt\HiJackThis_v2.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {1F0EAA6C-D19F-4692-A32A-83FCCB069EF7} - (no file) O2 - BHO: (no name) - {3CBC236E-8662-48D7-90F8-F1D9D78E9727} - C:\WINDOWS\system32\vtsqp.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: (no name) - {8A61098D-612B-4EF2-943D-64E920684061} - C:\WINDOWS\system32\hggfcdb.dll O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: (no name) - {B1E351E2-94BB-40CC-AC85-A53C4128F2B9} - C:\WINDOWS\system32\sstqp.dll (file missing) O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll O3 - Toolbar: NewsStand Toolbar - {6E94ACD5-2C6A-48AC-84EF-A4DE746D385F} - C:\Program Files\NewsStand\Reader\NSIETool.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM\..\Run: [OmniPage] C:\Program Files\Caere\OmniPagePro90\opware32.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [uhkxefqh.exe] C:\Documents and Settings\All Users\Application Data\uhkxefqh.exe O4 - HKLM\..\Run: [ipmon] ipmon.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1 O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: QuickTV.lnk = C:\Program Files\AVerTV2K\QuickTV.exe O4 - Global Startup: TeleSA.lnk = C:\Program Files\AVer Teletext\AVerSA.exe O4 - Global Startup: D-Link AirPlus Utility.lnk = ? O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1161518421031 O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab O20 - Winlogon Notify: hggfcdb - C:\WINDOWS\SYSTEM32\hggfcdb.dll O20 - Winlogon Notify: vtsqp - C:\WINDOWS\system32\vtsqp.dll O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll O23 - Service: BackWeb Client - Unknown owner - C:\Program Files\F-Secure\BackWeb\BackWeb\Program\ServiceWrapper.exe (file missing) O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe O23 - Service: Tapahtumaloki (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE O23 - Service: F-Secure Authentication Agent (FSAA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSAA.EXE O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE O23 - Service: CD-levyjen kirjoittamisen IMAPI COM -palvelu (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NetMeeting etätyöpöydän jakaminen (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Plug and Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Etätyöpöydän ohjeen istunnonhallinta (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe O23 - Service: Älykortti (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Check Point SecuRemote Service (SR_Service) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe O23 - Service: Check Point SecuRemote WatchDog (SR_WatchDog) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe O23 - Service: Resurssilokit ja -hälytykset (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe O23 - Service: Aseman tilannevedos (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe O23 - Service: WMI resurssisovitin (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe -- End of file - 10259 bytes
Tallena nämä ohjeet teksitiedostoon sillä et voi lukea niitä muuten vikasietotilassa. ========== Avaa hijackthis merkkaa seuraavat rivi(t) ja paina fix checked, sulje muut ohjelmat siksi aikaa. O4 - HKLM\..\Run: [uhkxefqh.exe] C:\Documents and Settings\All Users\Application Data\uhkxefqh.exe O4 - HKLM\..\Run: [ipmon] ipmon.exe Tässä ohje miten merkataan: ========== [*]Tupla-klikkaa VundoFix.exe ajaaksesi sen. [*]Kun Vundofix uudelleenaukeaa, klikkaa Scan for Vundo valintaa. [*]Kun skannaus on valmis, oikea-klikkaa kyseisen listaboksin sisällä (valkoinen laatikko jossa on löydetyt tiedostot listattu) ja valitse Add more files [*]Kopioi ja liitä seuraavat 2 riviä kahteen ylimmäiseen boksiin [*]C:\WINDOWS\SYSTEM32\hggfcdb.dll [*]C:\WINDOWS\system32\vtsqp.dll [*]Klikkaa Add Files ja sitten klikkaa Close Window. [*]Klikkaa Remove Vundo valintaa. [*]Saat viestin jossa kysytään haluatko poistaa valitut tiedostot, klikkaa YES. [*]Kun klikkaat yes, työpöytäsi tyhjenee kun työkalu alkaa poistamaan Vundoa. [*]Kun valmis, saat viestin jossa pyydetään sammuttamaan tietokone, klikkaa OK. [*]Käynnistä koneesi uudelleen. [*]Postita C:\vundofix.txt sisältö ========== 1. Lataa AVG Anti-Spyware 7.5 ja tallenna ohjelma työpöydällesi. Jos sinulla on jo kyseinen ohjelma siirry suoraan kohtaan 2! [*]Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa. [*]Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää. 2. [*]Käynnistä AVG Anti-Spyware. [*]Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta. [*]Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa. [*]Paina hetken kuluttua uudestaan "Start Update" , jos päivitykset eivät heti onnistu [*]Jos automaattipäivitys ei jostain syystä toimi, niin tunnisteet voi ladata manuaalisesti http://www.ewido.net/en/download/updates/ -linkin takaa. [*]Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti. [*]Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine". [*]Sitten "Reports" valikon alta:a [*]Laita täppi kohtaan "Automatically generate report after every scan" [*]Ota täppi pois kohdasta"Only if threats were found" [*]Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa [*]"Resident shield is", muuta tila active:sta inactive:ksi [*]Sulje ohjelma, ÄLÄ skannaa vielä. Käynnistä tietokoneesi vikasietotilaan Laita piilotiedostot näkyviin ja poiston jälkeen piiloon takaisin Poista C:\Documents and Settings\All Users\Application Data\uhkxefqh.exe C:\WINDOWS\system32\ipmon.exe C:\WINDOWS\system32\yakqjibm.exe C:\inlw.exe C:\WINDOWS\system32\winsys64.exe HUOM! Älä käytä muita ohjelmia AVG skannauksen aikana, tämä saattaa häiritä skannausta. [*]Kun vikasietotilassa, käynnistä AVG Anti-Spyware. [*]Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan". [*]AVG aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa. Kun skannaus on valmis: TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions" [*]Varmistu, että Set all elements to: näyttää Quarantine(1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta. [*]Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions" [*]Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta. [*]Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle. [*]Sulje ohjelma, käynnistä kone normaalisti ja lähetä AVG:n raportti viestiketjuusi. ========== Tämä jos tunnet tietokoneesi olevan hitaan puoleinen, etkä ole eheyttänyt pitkään aikaan: Avaa Oma tietokone -> Tee seuraava toimenpide kaikille Paikallisille levyille ========== Lataa CCleaner ja asenna se: Avaa "Options", sieltä "Language" ja valitse "Suomi (Finnish)" Avaa "Virheet" kohta, paina "Etsi rekisterin virheitä", paina "Korjaa valitut rekisterin virheet..". Paina "Kyllä", kun ohjelma kysyy "Haluatko varmuuskopioida muutokset rekisteriin", tallenna tiedosto esim. työpöydälle. Avaa "Puhdistaja", paina "Tutki" ja tämän jälkeen "Aja Ccleaner". Puhdista väliaikaistiedostot ja -kansiot ohjelmalla säännöllisesti. ========== Ajetaanpas blacklightia. Lataa ja tallenna Blacklight työpöydällesi; Tupla-klikkaa fsbl.exe, hyväksy sopimus, klikkaa -> Scan, sitten -> Next Näet listan kaikesta mitä löytyi. Työpöydällesi myös ilmestyy loki jonka nimi on fsbl.xxxxxxx.log (xxxxxxx;n tilalla on luultavimmin numeroita). Kopioi ja liitä tämä loki seuraavaan vastaukseesi. Älä valitse "Rename" optiota vielä! Haluamme nähdä login ensin, koska hyviä tiedostoja saattaa olla mukana, kuten "wbemtest.exe". ========0 Lataa Deckard's System Scanner Työpöydällesi. Huomioi: Sinulla tulee olla Järjestelmänvalvojan oikeudet ajaaksesi ohjelman. [*]Sulje kaikki avoimet ikkunat ja ohjelmat. [*]Tupla Klikkaa Dss.exe tiedostoa ajaaksesi ohjelman, seuraa ohjeita. [*]Kun Scannaus on valmis 2 textitiedostoa pitäisi avautua, Main.txt ja extra.txt [*]Näppäile Kopioi ( CTRL+A -> CTRL + C ) ja liitä ( CTRL + V ) [*]kopioi ja liitä Extra.txt & Main.txt sisältö seuraavaan vastaukseesi.
No niin, tein kaiken mitä käskit ja kuvake hävisi työkalupalkista eikä tule enää viestejä eikä aukene sivustoja. Elikkä kiitos vain tosi paljon avusta. Olet nimimerkkisi veroinen. Muutamassa jutussa tosin tuli ongelmia: - ipmon.exe tiedostoa ei löytynyt. Katsoin siitä kansiosta jossa sanoit sen olevan ja etsin Windowsin etsintäsysteemillä, mutta ei vain löydy (piilotetut tiedostot oli näkyvissä). Muut tiedostot sain kyllä poistettua. - Asensin AVG:n, muutin asetuksia kuten käskit ja käynnistin koneen vikasietotilaan, mutta AVG ei käynnistynyt vikasietotilassa. Tuli seuraavanlainen viesti: "Connection failed. Please reinstall AVG Anti-Spyware". No, menin takaisin normaalitilaan, asensin uudelleen, mutta ei auttanut. Blacklight ei löytänyt mitään, mutta tässä kuitenkin loki: 06/07/07 20:03:12 [Info]: BlackLight Engine 1.0.61 initialized 06/07/07 20:03:12 [Info]: OS: 5.1 build 2600 (Service Pack 2) 06/07/07 20:03:12 [Note]: 7019 4 06/07/07 20:03:12 [Note]: 7005 0 06/07/07 20:03:13 [Note]: 7006 0 06/07/07 20:03:13 [Note]: 7011 1704 06/07/07 20:03:14 [Note]: 7026 0 06/07/07 20:03:14 [Note]: 7026 0 06/07/07 20:03:16 [Note]: FSRAW library version 1.7.1021 06/07/07 20:03:52 [Note]: 2000 1012 06/07/07 20:03:52 [Note]: 2000 1012 06/07/07 20:04:13 [Note]: 7007 0 Ja tässä main.txt Deckard's System Scanner v20070603.47 Run by on 2007-06-07 at 20:05:03 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 20: 2007-06-07 17:05:12 UTC - RP879 - Deckard's System Scanner Restore Point 19: 2007-06-06 15:52:42 UTC - RP878 - Järjestelmän tarkistuspiste 18: 2007-06-05 14:03:24 UTC - RP877 - Järjestelmän tarkistuspiste 17: 2007-06-04 13:40:07 UTC - RP876 - Järjestelmän tarkistuspiste 16: 2007-06-03 13:11:36 UTC - RP875 - Järjestelmän tarkistuspiste -- First Restore Point -- 1: 2007-05-21 18:56:06 UTC - RP860 - Järjestelmän tarkistuspiste Backed up registry hives. Performed disk cleanup. -- HijackThis (run as -.exe) ----------------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 20:06:57, on 7.6.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16441) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\system32\ZONELABS\vsmon.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\F-Secure\Common\FSM32.EXE C:\Program Files\Ahead\InCD\InCD.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Caere\OmniPagePro90\opware32.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\ntvdm.exe C:\Program Files\D-Link AirPlus\AIRPLUS.EXE C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\F-Secure\Common\FSAA.EXE C:\Program Files\F-Secure\Common\FSMA32.EXE C:\Program Files\F-Secure\Common\FSMB32.EXE C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\F-Secure\Common\FCH32.EXE C:\Program Files\F-Secure\Common\FAMEH32.EXE C:\Program Files\F-Secure\Common\FSGK32.EXE C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\F-Secure\Common\FIH32.EXE C:\Program Files\F-Secure\Anti-Virus\fsav32.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\-\Työpöytä\dss.exe C:\PROGRA~1\HIJACK~1\-.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {1F0EAA6C-D19F-4692-A32A-83FCCB069EF7} - (no file) O2 - BHO: (no name) - {3CBC236E-8662-48D7-90F8-F1D9D78E9727} - (no file) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: (no name) - {8A61098D-612B-4EF2-943D-64E920684061} - (no file) O2 - BHO: (no name) - {92A444D2-F945-4dd9-89A1-896A6C2D8D22} - C:\WINDOWS\system32\qlmmeqyy.dll O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: (no name) - {B1E351E2-94BB-40CC-AC85-A53C4128F2B9} - (no file) O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll O3 - Toolbar: NewsStand Toolbar - {6E94ACD5-2C6A-48AC-84EF-A4DE746D385F} - C:\Program Files\NewsStand\Reader\NSIETool.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM\..\Run: [OmniPage] C:\Program Files\Caere\OmniPagePro90\opware32.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1 O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart O4 - Global Startup: QuickTV.lnk = C:\Program Files\AVerTV2K\QuickTV.exe O4 - Global Startup: TeleSA.lnk = C:\Program Files\AVer Teletext\AVerSA.exe O4 - Global Startup: D-Link AirPlus Utility.lnk = ? O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1161518421031 O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: ckpNotify - C:\WINDOWS\SYSTEM32\ckpNotify.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: BackWeb Client - Unknown owner - C:\Program Files\F-Secure\BackWeb\BackWeb\Program\ServiceWrapper.exe (file missing) O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE O23 - Service: F-Secure Authentication Agent (FSAA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSAA.EXE O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Check Point SecuRemote Service (SR_Service) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe O23 - Service: Check Point SecuRemote WatchDog (SR_WatchDog) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe -- File Associations ----------------------------------------------------------- .bat - batfile - shell\edit\command - unable to read value .cmd - cmdfile - shell\edit\command - unable to read value .inf - inffile - shell\open\command - unable to read value .ini - inifile - shell\open\command - unable to read value .reg - regfile - shell\edit\command - unable to read value .txt - txtfile - shell\open\command - unable to read value .vbs - VBSFile - shell\edit\command - unable to read value -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R1 SSHDRV79 - c:\windows\system32\drivers\sshdrv79.sys <Not Verified; ; ProtectCD> R1 SSHDRV85 - c:\windows\system32\drivers\sshdrv85.sys <Not Verified; ; ProtectCD> R2 BT848 (AVerMedia, AVerTV WDM Video Capture) - c:\windows\system32\drivers\bt848.sys <Not Verified; AVerMedia TECHNOLOGIES, Inc.; bt848.sys> R2 BTTUNER (AVerMedia, AVerTV WDM TvTuner) - c:\windows\system32\drivers\bttuner.sys <Not Verified; AVerMedia TECHNOLOGIES, Inc.; bttuner.sys> R2 BTXBAR (AVerMedia, AVerTV WDM Crossbar) - c:\windows\system32\drivers\btxbar.sys <Not Verified; AVerMedia, TECHNOLOGIES, Inc.; btxbar.sys> R2 F-Secure AVP - c:\program files\f-secure\anti-virus\fsavp.sys <Not Verified; Kaspersky Labs.; Kaspersky Anti-Virus (AVP)> R2 F-Secure Filter (F-Secure File System Filter) - c:\program files\f-secure\common\fsfilter.sys <Not Verified; F-Secure Corporation; F-Secure Gatekeeper> R2 F-Secure F-PROT - c:\program files\f-secure\anti-virus\fsfp.sys <Not Verified; F-Secure Corporation; F-Secure Anti-Virus> R2 F-Secure Gatekeeper - c:\program files\f-secure\common\fsgk.sys <Not Verified; F-Secure Corporation; F-Secure Gatekeeper> R2 F-Secure Orion - c:\program files\f-secure\anti-virus\fsorion.sys <Not Verified; F-Secure Corporation; F-Secure Anti-Virus> R2 F-Secure Recognizer (F-Secure File System Recognizer) - c:\program files\f-secure\common\fsrec.sys <Not Verified; F-Secure Corporation; F-Secure Gatekeeper> R2 FSpm (F-Secure Policy Manager) - c:\program files\f-secure\common\fspm.sys <Not Verified; F-Secure Corporation; F-Secure Workstation Suite> R2 Scap (SecureClient Application Policy Module) - c:\windows\system32\drivers\scap.sys <Not Verified; Check Point Software Technologies; desktop> R2 VPN-1 (VPN-1 Module) - c:\windows\system32\drivers\vpn.sys <Not Verified; Check Point Software Technologies; vpn1> R2 XPROTECTOR - c:\windows\system32\drivers\oreans.sys R3 AIRPLUS (D-Link AirPlus Wireless Adapter) - c:\windows\system32\drivers\airplus.sys <Not Verified; Texas Instruments Incorporated; TI ACX100 WLAN Adapter> R3 PCANDIS5 (PCANDIS5 Protocol Driver) - c:\program files\d-link airplus\pcandis5.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows> R3 pfc (Padus ASPI Shell) - c:\windows\system32\drivers\pfc.sys <Not Verified; Padus, Inc.; Padus(R) ASPI Shell> S3 ENTECH - c:\windows\system32\drivers\entech.sys <Not Verified; EnTech Taiwan; PowerStrip> S3 jbridgep - c:\docume~1\-\locals~1\temp\jbridgep.sys (file missing) S3 WINIO - d:\driver\audio\winio.sys (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 FSAA (F-Secure Authentication Agent) - c:\program files\f-secure\common\fsaa.exe <Not Verified; F-Secure Corporation; F-Secure Authentication Agent> R2 FSMA (F-Secure Management Agent) - c:\program files\f-secure\common\fsma32.exe <Not Verified; F-Secure Corporation; F-Secure Workstation Suite> R2 SR_WatchDog (Check Point SecuRemote WatchDog) - "c:\program files\checkpoint\securemote\bin\sr_watchdog.exe" <Not Verified; Check Point Software Technologies; desktop> R3 ServiceLayer - "c:\program files\pc connectivity solution\servicelayer.exe" <Not Verified; Nokia.; PC Connectivity Solution> S2 BackWeb Client - c:\program files\f-secure\backweb\backweb\program\servicewrapper.exe (file missing) S2 SR_Service (Check Point SecuRemote Service) - "c:\program files\checkpoint\securemote\bin\sr_service.exe" <Not Verified; Check Point Software Technologies; VPN-1 SecuRemote/SecureClient> S3 F-Secure Network Request Broker - c:\program files\f-secure\common\fnrb32.exe <Not Verified; F-Secure Corporation; F-Secure Workstation Suite> -- Scheduled Tasks ------------------------------------------------------------- 2007-05-20 13:03:02 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job -- Files created between 2007-05-07 and 2007-06-07 ----------------------------- 2007-06-07 19:58:17 0 dr-h----- C:\Documents and Settings\-\Recent 2007-06-07 19:56:51 657219 --a------ C:\Documents and Settings\-\cc_20070607_1956.reg 2007-06-07 19:54:38 0 d-------- C:\Program Files\CCleaner 2007-06-07 19:41:07 0 d-------- C:\Documents and Settings\-\Application Data\Grisoft 2007-06-07 17:50:59 55316 --a------ C:\WINDOWS\system32\qlmmeqyy.dll 2007-06-07 17:39:57 0 d-------- C:\Avenger 2007-06-07 17:12:44 778784 --a------ C:\SDFix.exe 2007-06-07 17:01:30 0 d-------- C:\VundoFix Backups 2007-06-07 16:56:52 3398 --a------ C:\WINDOWS\system32\tmp.reg 2007-06-07 12:41:34 0 d-------- C:\Hjt 2007-06-06 23:50:19 1536 --a------ C:\intvuvmp.exe 2007-06-05 11:01:11 0 d-------- C:\Program Files\iPod 2007-06-01 19:56:48 0 d-------- C:\Program Files\Last.fm 2007-05-26 17:25:40 0 d-------- C:\Documents and Settings\-\Application Data\pdf995 2007-05-26 17:19:08 249856 --a------ C:\WINDOWS\system32\pdfmona.dll <Not Verified; TODO: <Company name>; TODO: <Product name>> 2007-05-26 17:19:08 51716 --a------ C:\WINDOWS\system32\pdf995mon.dll 2007-05-26 17:19:08 0 d-------- C:\Documents and Settings\All Users\Application Data\pdf995 2007-05-26 16:56:14 0 d--hs---- C:\FOUND.005 2007-05-25 19:56:04 0 d--hs---- C:\FOUND.004 2007-05-20 13:03:02 0 d--hs---- C:\Documents and Settings\NetworkService\Cookies 2007-05-16 19:16:10 0 d--hs---- C:\FOUND.003 2007-05-15 22:36:01 0 d-------- C:\Documents and Settings\-\Application Data\WinRAR 2007-05-15 15:47:49 0 d-------- C:\Program Files\iTunes 2007-05-15 15:46:34 0 d-------- C:\Program Files\QuickTime 2007-05-15 15:46:10 0 d-------- C:\Program Files\Apple Software Update 2007-05-09 22:30:24 0 d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2 -- Find3M Report --------------------------------------------------------------- 2007-06-04 12:11:42 357770 --a------ C:\WINDOWS\system32\perfh00B.dat 2007-06-04 12:11:42 65938 --a------ C:\WINDOWS\system32\perfc00B.dat 2007-05-01 14:19:18 4212 ---h----- C:\WINDOWS\system32\zllictbl.dat 2007-04-21 16:32:26 346976 --a------ C:\Documents and Settings\-\Application Data\NMM-MetaData.db -- Registry Dump --------------------------------------------------------------- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll {92A444D2-F945-4dd9-89A1-896A6C2D8D22} C:\WINDOWS\system32\qlmmeqyy.dll {9394EDE7-C8B5-483E-8773-474BF36AF6E4} C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "SoundMan"="SOUNDMAN.EXE" "nwiz"="nwiz.exe /install" "F-Secure Manager"="\"C:\\Program Files\\F-Secure\\Common\\FSM32.EXE\" /splash" "NvMediaCenter"="RunDLL32.exe NvMCTray.dll,NvTaskbarInit" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "InCD"="C:\\Program Files\\Ahead\\InCD\\InCD.exe" "HP Software Update"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe" "Zone Labs Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\"" "PCSuiteTrayApplication"="C:\\Program Files\\Nokia\\Nokia PC Suite 6\\LaunchApplication.exe -startup" "OmniPage"="C:\\Program Files\\Caere\\OmniPagePro90\\opware32.exe" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\"" "ZoneAlarm Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\"" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" "updateMgr"="\"C:\\Program Files\\Adobe\\Acrobat 7.0\\Reader\\AdobeUpdateManager.exe\" AcRdB7_0_9 -reboot 1" "eMuleAutoStart"="C:\\Program Files\\eMule\\emule.exe -AutoStart" [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE" "PcSync"="C:\\Program Files\\Nokia\\Nokia PC Suite 6\\PcSync2.exe /NoDialog" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{8A61098D-612B-4EF2-943D-64E920684061}"="" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ckpNotify HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 -- End of Deckard's System Scanner: finished at 2007-06-07 at 20:07:24 --------- Ja extra.txt Deckard's System Scanner v20070603.47 Extra logfile - please post this as an attachment with your post. -------------------------------------------------------------------------------- -- System Information ---------------------------------------------------------- Microsoft Windows XP Home Edition (build 2600) SP 2.0 Architecture: X86; Language: Other (040B) - see http://preview.tinyurl.com/mhhp6 CPU 0: AMD Athlon(tm) XP 3000+ Percentage of Memory in Use: 63% Physical Memory (total/avail): 511.48 MiB / 185.38 MiB Pagefile Memory (total/avail): 1250.16 MiB / 954.42 MiB Virtual Memory (total/avail): 2047.88 MiB / 1959.77 MiB A: is Removable (No Media) C: is Fixed (FAT32) - 114.46 GiB total, 61.64 GiB free. D: is CDROM (No Media) E: is CDROM (No Media) -- Security Center ------------------------------------------------------------- AUOptions is scheduled to auto-install. Windows Internal Firewall is disabled. FW: ZoneAlarm Firewall v7.0.337.000 (Check Point, LTD.) [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] -- Environment Variables ------------------------------------------------------- ALLUSERSPROFILE=C:\Documents and Settings\All Users APPDATA=C:\Documents and Settings\-\Application Data CLASSPATH=.;C:\Program Files\Java\jre1.6.0_01\lib\ext\QTJava.zip CLIENTNAME=Console CommonProgramFiles=C:\Program Files\Common Files COMPUTERNAME=----- ComSpec=C:\WINDOWS\system32\cmd.exe FP_NO_HOST_CHECK=NO HOMEDRIVE=C: HOMEPATH=\Documents and Settings\- LOGONSERVER=\\----- NUMBER_OF_PROCESSORS=1 OS=Windows_NT Path=C:\Program Files\PC Connectivity Solution\;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Documents and Settings\-\LilyPond\usr\bin;"C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier";C:\Program Files\QuickTime\QTSystem\;C:\Program Files\EUPHORIA\BIN; ; PATHEXT=.PY;.SCM;.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH PROCESSOR_ARCHITECTURE=x86 PROCESSOR_IDENTIFIER=x86 Family 6 Model 10 Stepping 0, AuthenticAMD PROCESSOR_LEVEL=6 PROCESSOR_REVISION=0a00 ProgramFiles=C:\Program Files PROMPT=$P$G QTJAVA=C:\Program Files\Java\jre1.6.0_01\lib\ext\QTJava.zip SESSIONNAME=Console SystemDrive=C: SystemRoot=C:\WINDOWS TEMP=C:\DOCUME~1\-\LOCALS~1\Temp TMP=C:\DOCUME~1\-\LOCALS~1\Temp tvdumpflags=8 USERDOMAIN=- USERNAME=- USERPROFILE=C:\Documents and Settings\- windir=C:\WINDOWS -- User Profiles --------------------------------------------------------------- ----- (admin) ----- (admin) ----- (admin) ----- (admin) -- Add/Remove Programs --------------------------------------------------------- ACD/Labs Software in C:\ACDFREE8\ --> C:\ACDFREE8\setup\setup.exe -uninstall Adobe Flash Player 9 ActiveX --> C:\WINDOWS\system32\Macromed\Flash\UninstFl.exe -q Adobe Flash Player Plugin --> C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe Adobe Reader 7.0.9 - Suomi --> MsiExec.exe /I{AC76BA86-7AD7-1035-7B44-A70900000002} Adobe Reader Japanese Fonts --> MsiExec.exe /I{AC76BA86-7AD7-5760-0000-705000000001} Apple Software Update --> MsiExec.exe /I{A260B422-70E1-41E2-957D-F76FA21266D5} Audacity 1.2.4 --> "C:\Program Files\Audacity\unins000.exe" AVG Anti-Spyware 7.5 --> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Uninstall.exe Caere Scan Manager 4.0 --> C:\WINDOWS\UNSCAN40.EXE -f"C:\Program Files\Common Files\Caere\Scan Manager\DeIsL1.isu" CCleaner (remove only) --> "C:\Program Files\CCleaner\uninst.exe" eMule --> "C:\Program Files\eMule\Uninstall.exe" Google Earth --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3DE5E7D4-7B88-403C-A3FD-2017A8240C5B}\setup.exe" -l0x9 -removeonly Haluatko miljonääriksi --> MsiExec.exe /I{9EF13972-F5DC-4D0B-89E8-E7D1E6FA0E4C} Heroes of Might and Magic V --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{20071984-5EB1-4881-8EDB-082532ACEC6D}\setup.exe" -l0x9 Hotfix-päivitys Windows XP:lle (KB914440) --> "C:\WINDOWS\$NtUninstallKB914440$\spuninst\spuninst.exe" iTunes --> MsiExec.exe /I{553E56C3-7AA1-45FE-A2FC-2C43DC27F765} J2SE Runtime Environment 5.0 Update 11 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150110} J2SE Runtime Environment 5.0 Update 3 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150030} Java(TM) SE Runtime Environment 6 Update 1 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160010} Last.fm 1.1.3.0 --> "C:\Program Files\Last.fm\unins000.exe" LilyPond --> "C:\Documents and Settings\-\LilyPond\uninstall.exe" LimeWire 4.12.11 --> "C:\Program Files\LimeWire\uninstall.exe" Little Fighter 2 1.9c --> C:\Program Files\LittleFighter2\LF2_v1.9c\uninst.exe Microsoft Office Professional Edition 2003 --> MsiExec.exe /I{91E3040B-6000-11D3-8CFE-0150048383C9} Mozilla Firefox (2.0.0.4) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe Native Instruments Sibelius Player --> C:\PROGRA~1\SIBELI~1\NATIVE~1\SIBELI~1\UNWISE.EXE C:\PROGRA~1\SIBELI~1\NATIVE~1\SIBELI~1\INSTALL.LOG Neuratron PhotoScore Lite --> C:\PROGRA~1\SIBELI~1\NEURAT~1\UNWISE.EXE C:\PROGRA~1\SIBELI~1\NEURAT~1\INSTALL.LOG Nokia Connectivity Cable Driver --> MsiExec.exe /X{0FF1922C-B6C4-40BB-AF30-BEF75A482444} Nokia PC Suite --> MsiExec.exe /I{D89AC4DF-7A00-4D0B-BA99-D582C7974A09} OmniPage Pro 9.0 --> C:\Program Files\Caere\OmniPagePro90\uninstall.exe -f"C:\Program Files\Caere\OmniPagePro90\DeIsL1.isu" Paint Shop Pro 7 Anniversary Edition --> MsiExec.exe /I{D6DE02C7-1F47-11D4-9515-00105AE4B89A} PC Connectivity Solution --> MsiExec.exe /I{AB2347E4-153B-4194-AA3B-97C0A662B369} Päivitys Windows XP:lle (KB904942) --> "C:\WINDOWS\$NtUninstallKB904942$\spuninst\spuninst.exe" Päivitys Windows XP:lle (KB916595) --> "C:\WINDOWS\$NtUninstallKB916595$\spuninst\spuninst.exe" Päivitys Windows XP:lle (KB920872) --> "C:\WINDOWS\$NtUninstallKB920872$\spuninst\spuninst.exe" Päivitys Windows XP:lle (KB922582) --> "C:\WINDOWS\$NtUninstallKB922582$\spuninst\spuninst.exe" Päivitys Windows XP:lle (KB927891) --> "C:\WINDOWS\$NtUninstallKB927891$\spuninst\spuninst.exe" Päivitys Windows XP:lle (KB929338) --> "C:\WINDOWS\$NtUninstallKB929338$\spuninst\spuninst.exe" Päivitys Windows XP:lle (KB930916) --> "C:\WINDOWS\$NtUninstallKB930916$\spuninst\spuninst.exe" Päivitys Windows XP:lle (KB931836) --> "C:\WINDOWS\$NtUninstallKB931836$\spuninst\spuninst.exe" QuickTime --> MsiExec.exe /I{08094E03-AFE4-4853-9D31-6D0743DF5328} Security Update for CAPICOM (KB931906) --> MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A} Security Update for CAPICOM (KB931906) --> MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A} Star Wars Jedi Knight Jedi Academy --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0D994CC5-819F-4657-84DD-397B8FE1EA80}\Setup.exe" -l0x9 Suojauspäivitys ohjelmistolle Windows XP (KB923689) --> "C:\WINDOWS\$NtUninstallKB923689$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB914388) --> "C:\WINDOWS\$NtUninstallKB914388$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB917159) --> "C:\WINDOWS\$NtUninstallKB917159$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB917422) --> "C:\WINDOWS\$NtUninstallKB917422$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB918118) --> "C:\WINDOWS\$NtUninstallKB918118$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB918899) --> "C:\WINDOWS\$NtUninstallKB918899$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB919007) --> "C:\WINDOWS\$NtUninstallKB919007$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB920213) --> "C:\WINDOWS\$NtUninstallKB920213$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB920214) --> "C:\WINDOWS\$NtUninstallKB920214$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB920670) --> "C:\WINDOWS\$NtUninstallKB920670$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB920683) --> "C:\WINDOWS\$NtUninstallKB920683$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB920685) --> "C:\WINDOWS\$NtUninstallKB920685$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB921398) --> "C:\WINDOWS\$NtUninstallKB921398$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB921883) --> "C:\WINDOWS\$NtUninstallKB921883$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB922616) --> "C:\WINDOWS\$NtUninstallKB922616$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB922760) --> "C:\WINDOWS\$NtUninstallKB922760$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB922819) --> "C:\WINDOWS\$NtUninstallKB922819$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB923191) --> "C:\WINDOWS\$NtUninstallKB923191$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB923414) --> "C:\WINDOWS\$NtUninstallKB923414$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB923694) --> "C:\WINDOWS\$NtUninstallKB923694$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB923980) --> "C:\WINDOWS\$NtUninstallKB923980$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB924191) --> "C:\WINDOWS\$NtUninstallKB924191$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB924270) --> "C:\WINDOWS\$NtUninstallKB924270$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB924496) --> "C:\WINDOWS\$NtUninstallKB924496$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB924667) --> "C:\WINDOWS\$NtUninstallKB924667$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB925486) --> "C:\WINDOWS\$NtUninstallKB925486$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB925902) --> "C:\WINDOWS\$NtUninstallKB925902$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB926255) --> "C:\WINDOWS\$NtUninstallKB926255$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB926436) --> "C:\WINDOWS\$NtUninstallKB926436$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB927779) --> "C:\WINDOWS\$NtUninstallKB927779$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB927802) --> "C:\WINDOWS\$NtUninstallKB927802$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB928255) --> "C:\WINDOWS\$NtUninstallKB928255$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB928843) --> "C:\WINDOWS\$NtUninstallKB928843$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB930178) --> "C:\WINDOWS\$NtUninstallKB930178$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB931261) --> "C:\WINDOWS\$NtUninstallKB931261$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB931784) --> "C:\WINDOWS\$NtUninstallKB931784$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB932168) --> "C:\WINDOWS\$NtUninstallKB932168$\spuninst\spuninst.exe" Windows Driver Package - Nokia (WUDFRd) WPD (11/03/2006 6.82.26.2) --> C:\PROGRA~1\DIFX\D6ACC4BE676423A2B130B78A4B627FC457D98997\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\pccswpddri_6B630EE2E66584353C6CD8683D447072872F34D8\pccswpddriver.inf Windows Driver Package - Nokia Modem (11/03/2006 6.82.0.1) --> C:\PROGRA~1\DIFX\D6ACC4BE676423A2B130B78A4B627FC457D98997\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\nokbtmdm_4EFFAAE27A08EDFDE145390033D8EF099DA65567\nokbtmdm.inf Windows Live Messenger --> MsiExec.exe /I{571700F0-DB9D-4B3A-B03D-35A14BB5939F} WinRAR archiver --> C:\Program Files\WinRAR\uninstall.exe Winter Moonlight Skaters --> C:\Program Files\Winter Moonlight Skaters\Uninstall.exe wintermoonskatersss.exe --> C:\PROGRA~1\FILESU~1\WINTER~1.EXE\UNWISE.EXE C:\PROGRA~1\FILESU~1\WINTER~1.EXE\INSTALL.LOG ZoneAlarm --> C:\Program Files\Zone Labs\ZoneAlarm\zauninst.exe -- End of Deckard's System Scanner: finished at 2007-06-07 at 20:07:24 ---------
Ai niin, vundofix.txt unohtui. Sähläsin sen vundonfixinkin kanssa muuten jotain: poistin ne tiedostot jo ennen niiden uusien lisäämistä ja lisäsin uudet tiedostot, vasta kun kone käynnistyi uudelleen. No, toivottavasti se ei haitannut. VundoFix V6.4.2 Checking Java version... Java version is 1.5.0.3 Old versions of java are exploitable and should be removed. Java version is 1.5.0.11 Scan started at 17:01:30 7.6.2007 Listing files found while scanning.... C:\WINDOWS\system32\byxyxuu.dll C:\WINDOWS\system32\efccawv.dll C:\WINDOWS\system32\mljifgg.dll C:\WINDOWS\system32\nnnkjjk.dll C:\WINDOWS\system32\orqss.ini C:\WINDOWS\system32\pqtss.bak1 C:\WINDOWS\system32\pqtss.ini C:\WINDOWS\system32\rwsytppp.dll C:\WINDOWS\system32\ssqro.dll C:\WINDOWS\system32\sstqp.dll Beginning removal... Attempting to delete C:\WINDOWS\system32\byxyxuu.dll C:\WINDOWS\system32\byxyxuu.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\efccawv.dll C:\WINDOWS\system32\efccawv.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\mljifgg.dll C:\WINDOWS\system32\mljifgg.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\nnnkjjk.dll C:\WINDOWS\system32\nnnkjjk.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\orqss.ini C:\WINDOWS\system32\orqss.ini Has been deleted! Attempting to delete C:\WINDOWS\system32\pqtss.bak1 C:\WINDOWS\system32\pqtss.bak1 Has been deleted! Attempting to delete C:\WINDOWS\system32\pqtss.ini C:\WINDOWS\system32\pqtss.ini Has been deleted! Attempting to delete C:\WINDOWS\system32\rwsytppp.dll C:\WINDOWS\system32\rwsytppp.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\ssqro.dll C:\WINDOWS\system32\ssqro.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\sstqp.dll C:\WINDOWS\system32\sstqp.dll Has been deleted! Performing Repairs to the registry. Done! VundoFix V6.4.2 Checking Java version... Java version is 1.5.0.3 Old versions of java are exploitable and should be removed. Java version is 1.5.0.11 Scan started at 18:34:18 7.6.2007 Listing files found while scanning.... C:\WINDOWS\system32\hggfcdb.dll C:\WINDOWS\system32\mmbcopcu.dll C:\WINDOWS\system32\pqstv.bak1 C:\WINDOWS\system32\pqstv.ini C:\WINDOWS\system32\ucpocbmm.ini C:\WINDOWS\system32\vtsqp.dll Beginning removal... Attempting to delete C:\WINDOWS\system32\hggfcdb.dll C:\WINDOWS\system32\hggfcdb.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\mmbcopcu.dll C:\WINDOWS\system32\mmbcopcu.dll Could not be deleted. Attempting to delete C:\WINDOWS\system32\pqstv.bak1 C:\WINDOWS\system32\pqstv.bak1 Has been deleted! Attempting to delete C:\WINDOWS\system32\pqstv.ini C:\WINDOWS\system32\pqstv.ini Has been deleted! Attempting to delete C:\WINDOWS\system32\ucpocbmm.ini C:\WINDOWS\system32\ucpocbmm.ini Has been deleted! Attempting to delete C:\WINDOWS\system32\vtsqp.dll C:\WINDOWS\system32\vtsqp.dll Could not be deleted. Performing Repairs to the registry. Done! Beginning removal... Attempting to delete C:\WINDOWS\system32\mmbcopcu.dll C:\WINDOWS\system32\mmbcopcu.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\vtsqp.dll C:\WINDOWS\system32\vtsqp.dll Has been deleted! Performing Repairs to the registry. Done!
Moi tuolla avg a.slla voi skannata normaalitilassakin, jos jaksat tee se ja laita raportti ===== Avaa hijackthis merkkaa seuraavat rivi(t) ja paina fix checked, sulje muut ohjelmat siksi aikaa. O2 - BHO: (no name) - {1F0EAA6C-D19F-4692-A32A-83FCCB069EF7} - (no file) O2 - BHO: (no name) - {3CBC236E-8662-48D7-90F8-F1D9D78E9727} - (no file) O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: (no name) - {8A61098D-612B-4EF2-943D-64E920684061} - (no file) O2 - BHO: (no name) - {92A444D2-F945-4dd9-89A1-896A6C2D8D22} - C:\WINDOWS\system32\qlmmeqyy.dll O2 - BHO: (no name) - {B1E351E2-94BB-40CC-AC85-A53C4128F2B9} - (no file) == käväse vikasietotilassa ja poista C:\WINDOWS\system32\qlmmeqyy.dll Laita piilotiedostot näkyviin ja poiston jälkeen piiloon takaisin ======= uusi hjtlogi Tässä ohje miten merkataan:
Terve taas AVG-skannaus oli hyvä idea, kyllähän sieltä kaikenlaista mukavaa löytyi. --------------------------------------------------------- AVG Anti-Spyware - Scan Report --------------------------------------------------------- + Created at: 23:23:20 7.6.2007 + Scan result: C:\Program Files\filesubmit\NNWDAC638.EXE -> Adware.NewDotNet : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\NDNuninstall6_38.exe.vir -> Adware.NewDotNet : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\NDNuninstall7_48.exe.vir -> Adware.NewDotNet : Cleaned with backup (quarantined). C:\System Volume Information\_restore{649A1DB3-760A-42C1-B128-64C43EC0FF05}\RP878\A0269971.exe -> Adware.NewDotNet : Cleaned with backup (quarantined). C:\System Volume Information\_restore{649A1DB3-760A-42C1-B128-64C43EC0FF05}\RP878\A0269972.exe -> Adware.NewDotNet : Cleaned with backup (quarantined). C:\System Volume Information\_restore{649A1DB3-760A-42C1-B128-64C43EC0FF05}\RP878\A0269659.exe/crack.exe -> Adware.Virtumonde : Cleaned with backup (quarantined). C:\System Volume Information\_restore{649A1DB3-760A-42C1-B128-64C43EC0FF05}\RP878\A0269901.dll -> Adware.Virtumonde : Cleaned with backup (quarantined). C:\System Volume Information\_restore{649A1DB3-760A-42C1-B128-64C43EC0FF05}\RP878\A0269903.dll -> Adware.Virtumonde : Cleaned with backup (quarantined). C:\VundoFix Backups\efccawv.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined). C:\VundoFix Backups\nnnkjjk.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined). C:\SDFix\SDFix\backups\backups.zip/backups/max1d1641.exe -> Dialer.GBDialer.j : Cleaned with backup (quarantined). C:\SDFix\SDFix\backups\backups.zip/backups/max1d1641.exe~ -> Dialer.GBDialer.j : Cleaned with backup (quarantined). C:\System Volume Information\_restore{649A1DB3-760A-42C1-B128-64C43EC0FF05}\RP878\A0269919.exe -> Dialer.GBDialer.j : Cleaned with backup (quarantined). C:\System Volume Information\_restore{649A1DB3-760A-42C1-B128-64C43EC0FF05}\RP878\A0269928.exe -> Dialer.GBDialer.j : Cleaned with backup (quarantined). C:\SDFix\SDFix\backups\backups.zip/backups/win3CC.tmp.exe -> Downloader.Alphabet : Cleaned with backup (quarantined). C:\System Volume Information\_restore{649A1DB3-760A-42C1-B128-64C43EC0FF05}\RP878\A0269927.exe -> Downloader.Alphabet : Cleaned with backup (quarantined). C:\WINDOWS\smanager.7.exe~ -> Downloader.Alphabet : Cleaned with backup (quarantined). C:\System Volume Information\_restore{649A1DB3-760A-42C1-B128-64C43EC0FF05}\RP878\A0269659.exe/keygen.exe -> Downloader.LoadAdv : Cleaned with backup (quarantined). C:\SDFix\SDFix\backups\backups.zip/backups/mgvrprgl.exe -> Downloader.Small.cwj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{649A1DB3-760A-42C1-B128-64C43EC0FF05}\RP878\A0269918.exe -> Downloader.Small.cwj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{649A1DB3-760A-42C1-B128-64C43EC0FF05}\RP878\A0269925.exe -> Downloader.Small.cwj : Cleaned with backup (quarantined). C:\System Volume Information\_restore{649A1DB3-760A-42C1-B128-64C43EC0FF05}\RP878\A0270104.EXE -> Hijacker.Agent.is : Cleaned with backup (quarantined). C:\System Volume Information\_restore{649A1DB3-760A-42C1-B128-64C43EC0FF05}\RP878\A0270149.exe -> Hijacker.Agent.is : Cleaned with backup (quarantined). :mozilla.50:C:\Documents and Settings\-\Application Data\Mozilla\Firefox\Profiles\b22h8o43.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.61:C:\Documents and Settings\-\Application Data\Mozilla\Firefox\Profiles\b22h8o43.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned. :mozilla.60:C:\Documents and Settings\-\Application Data\Mozilla\Firefox\Profiles\495aw7en.default\cookies.txt -> TrackingCookie.Adtech : Cleaned. :mozilla.61:C:\Documents and Settings\-\Application Data\Mozilla\Firefox\Profiles\495aw7en.default\cookies.txt -> TrackingCookie.Adtech : Cleaned. :mozilla.10:C:\FOUND.001\FILE0004.CHK -> TrackingCookie.Advertising : Cleaned. :mozilla.24:C:\Documents and Settings\-\Application Data\Mozilla\Firefox\Profiles\495aw7en.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned. C:\Documents and Settings\-\Cookies\-@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned. :mozilla.22:C:\Documents and Settings\-\Application Data\Mozilla\Firefox\Profiles\b22h8o43.default\cookies.txt -> TrackingCookie.Com : Cleaned. :mozilla.26:C:\Documents and Settings\-\Application Data\Mozilla\Firefox\Profiles\495aw7en.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned. :mozilla.6:C:\FOUND.001\FILE0004.CHK -> TrackingCookie.Doubleclick : Cleaned. :mozilla.12:C:\FOUND.001\FILE0004.CHK -> TrackingCookie.Estat : Cleaned. :mozilla.16:C:\FOUND.001\FILE0004.CHK -> TrackingCookie.Hitbox : Cleaned. :mozilla.15:C:\Documents and Settings\-\Application Data\Mozilla\Firefox\Profiles\kt3fjoln.default\cookies.txt -> TrackingCookie.Hitslink : Cleaned. :mozilla.69:C:\Documents and Settings\-\Application Data\Mozilla\Firefox\Profiles\495aw7en.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned. C:\Documents and Settings\-\Cookies\-@search.live[1].txt -> TrackingCookie.Live : Cleaned. C:\Documents and Settings\-\Cookies\-@search.live[2].txt -> TrackingCookie.Live : Cleaned. :mozilla.27:C:\Documents and Settings\-\Application Data\Mozilla\Firefox\Profiles\495aw7en.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned. C:\Documents and Settings\-\Cookies\-@ssl-hints.netflame[2].txt -> TrackingCookie.Netflame : Cleaned. :mozilla.64:C:\Documents and Settings\-\Application Data\Mozilla\Firefox\Profiles\b22h8o43.default\cookies.txt -> TrackingCookie.Overture : Cleaned. :mozilla.41:C:\Documents and Settings\-\Application Data\Mozilla\Firefox\Profiles\b22h8o43.default\cookies.txt -> TrackingCookie.Paypal : Cleaned. :mozilla.28:C:\Documents and Settings\-\Application Data\Mozilla\Firefox\Profiles\495aw7en.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned. :mozilla.29:C:\Documents and Settings\-\Application Data\Mozilla\Firefox\Profiles\495aw7en.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned. :mozilla.45:C:\Documents and Settings\-\Application Data\Mozilla\Firefox\Profiles\b22h8o43.default\cookies.txt -> TrackingCookie.Spylog : Cleaned. :mozilla.19:C:\Documents and Settings\-\Application Data\Mozilla\Firefox\Profiles\kt3fjoln.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.74:C:\Documents and Settings\-\Application Data\Mozilla\Firefox\Profiles\b22h8o43.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.31:C:\Documents and Settings\-\Application Data\Mozilla\Firefox\Profiles\b22h8o43.default\cookies.txt -> TrackingCookie.Statistik-gallup : Cleaned. :mozilla.52:C:\Documents and Settings\-\Application Data\Mozilla\Firefox\Profiles\495aw7en.default\cookies.txt -> TrackingCookie.Statistik-gallup : Cleaned. :mozilla.8:C:\Documents and Settings\-\Application Data\Mozilla\Firefox\Profiles\kt3fjoln.default\cookies.txt -> TrackingCookie.Statistik-gallup : Cleaned. :mozilla.12:C:\Documents and Settings\-\Application Data\Mozilla\Firefox\Profiles\495aw7en.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.25:C:\Documents and Settings\-\Application Data\Mozilla\Firefox\Profiles\495aw7en.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.13:C:\Documents and Settings\-\Application Data\Mozilla\Firefox\Profiles\kt3fjoln.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned. :mozilla.14:C:\Documents and Settings\-\Application Data\Mozilla\Firefox\Profiles\kt3fjoln.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned. :mozilla.53:C:\Documents and Settings\-\Application Data\Mozilla\Firefox\Profiles\495aw7en.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned. :mozilla.54:C:\Documents and Settings\-\Application Data\Mozilla\Firefox\Profiles\495aw7en.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned. :mozilla.59:C:\Documents and Settings\-\Application Data\Mozilla\Firefox\Profiles\b22h8o43.default\cookies.txt -> TrackingCookie.Trafic : Cleaned. :mozilla.13:C:\FOUND.001\FILE0004.CHK -> TrackingCookie.Weborama : Cleaned. :mozilla.67:C:\Documents and Settings\-\Application Data\Mozilla\Firefox\Profiles\b22h8o43.default\cookies.txt -> TrackingCookie.Webtrends : Cleaned. C:\Documents and Settings\-\Cookies\-@m.webtrends[2].txt -> TrackingCookie.Webtrends : Cleaned. C:\Documents and Settings\-\Cookies\-@m.webtrends[2].txt -> TrackingCookie.Webtrends : Cleaned. :mozilla.77:C:\Documents and Settings\-\Application Data\Mozilla\Firefox\Profiles\b22h8o43.default\cookies.txt -> TrackingCookie.Zedo : Cleaned. :mozilla.78:C:\Documents and Settings\-\Application Data\Mozilla\Firefox\Profiles\b22h8o43.default\cookies.txt -> TrackingCookie.Zedo : Cleaned. C:\WINDOWS\system32\drivers\etc\radman\radman.exe -> Trojan.Agent.abv : Cleaned with backup (quarantined). C:\WINDOWS\system32\drivers\etc\radman\upd.exe -> Trojan.Agent.abv : Cleaned with backup (quarantined). C:\WINDOWS\system32\drivers\etc\radman\update.exe -> Trojan.Agent.abv : Cleaned with backup (quarantined). C:\System Volume Information\_restore{649A1DB3-760A-42C1-B128-64C43EC0FF05}\RP878\A0270148.exe -> Trojan.Agent.anr : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\system32\winrkq32.dll.vir -> Trojan.Agent.qt : Cleaned with backup (quarantined). C:\System Volume Information\_restore{649A1DB3-760A-42C1-B128-64C43EC0FF05}\RP878\A0269973.DLL -> Trojan.Agent.qt : Cleaned with backup (quarantined). C:\SDFix\SDFix\backups\backups.zip/backups/win64.tmp.exe -> Trojan.Dialer.qn : Cleaned with backup (quarantined). C:\System Volume Information\_restore{649A1DB3-760A-42C1-B128-64C43EC0FF05}\RP878\A0269926.exe -> Trojan.Dialer.qn : Cleaned with backup (quarantined). C:\WINDOWS\system32\Autorun.exe -> Trojan.Legmir : Cleaned with backup (quarantined). ::Report end Ja tässä vielä uusi hijackthis-loki. Logfile of Trend Micro HijackThis v2.0.0 (BETA) Scan saved at 23:29:24, on 7.6.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\system32\ZONELABS\vsmon.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\F-Secure\Common\FSAA.EXE C:\Program Files\F-Secure\Common\FSMA32.EXE C:\Program Files\F-Secure\Common\FSMB32.EXE C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\F-Secure\Common\FCH32.EXE C:\Program Files\F-Secure\Common\FAMEH32.EXE C:\Program Files\F-Secure\Common\FSGK32.EXE C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\F-Secure\Common\FIH32.EXE C:\Program Files\F-Secure\Anti-Virus\fsav32.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\F-Secure\Common\FSM32.EXE C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Ahead\InCD\InCD.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Caere\OmniPagePro90\opware32.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\WINDOWS\system32\ntvdm.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\D-Link AirPlus\AIRPLUS.EXE C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Hjt\HiJackThis_v2.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll O3 - Toolbar: NewsStand Toolbar - {6E94ACD5-2C6A-48AC-84EF-A4DE746D385F} - C:\Program Files\NewsStand\Reader\NSIETool.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM\..\Run: [OmniPage] C:\Program Files\Caere\OmniPagePro90\opware32.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1 O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: QuickTV.lnk = C:\Program Files\AVerTV2K\QuickTV.exe O4 - Global Startup: TeleSA.lnk = C:\Program Files\AVer Teletext\AVerSA.exe O4 - Global Startup: D-Link AirPlus Utility.lnk = ? O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1161518421031 O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: BackWeb Client - Unknown owner - C:\Program Files\F-Secure\BackWeb\BackWeb\Program\ServiceWrapper.exe (file missing) O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe O23 - Service: Tapahtumaloki (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE O23 - Service: F-Secure Authentication Agent (FSAA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSAA.EXE O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE O23 - Service: CD-levyjen kirjoittamisen IMAPI COM -palvelu (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NetMeeting etätyöpöydän jakaminen (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Plug and Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Etätyöpöydän ohjeen istunnonhallinta (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe O23 - Service: Älykortti (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Check Point SecuRemote Service (SR_Service) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe O23 - Service: Check Point SecuRemote WatchDog (SR_WatchDog) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe O23 - Service: Resurssilokit ja -hälytykset (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe O23 - Service: Aseman tilannevedos (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe O23 - Service: WMI resurssisovitin (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe -- End of file - 9605 bytes
Jees, loki on kunnossa =========0 täll voi viel varmistella Tarkista koneesi F-Securen online skannerilla Huom, skanneri toimii vain Internet Explorer selaimella * Lue sivun ohjeet huolella läpi * Klikkaa Start scanning * Mikäli saat Internet Explorer -suojausvaroituksen, klikkaa Asenna * Klikkaa Accept * Klikkaa Custom Scan * Säädä asetukset seuraavasti o "Virus Scan Option" kohdasta valitse Scan whole system o "Other Scan Option" kohdasta valitse Scan All Files o Valitse Scan whole system for rootkits o Valitse Scan whole system for spyware o Laita ruksi kohtaan Scan inside archives o Varmista että Use advanced heuristics on valittuna * Klikkaa Start * Skannaus käynnistyy kun tarvittavat tiedostot/päivitykset on ladattu * Odota kärsivällisesti * Kun sakannaus on suoritettu, klikkaa Automatic cleaning * Klikkaa Show Report * Raportti aukeaa selaimessa, kopioi teksti kokonaan * Liitä kopioitu teksti esim. muistioon tai Wordiin ja tallenna työpöydälle * Voit sulkea skannerin * Lähetä raportti viestiketjuusi ======== Pysy puhtaana -> Tyhjennä järjestelmänpalautus Ohjeet Tyhjennä järjestelmänpalautuskansio ja luo uusi palautuspiste. Tämä puhdistaa palautuskansion mahdollisista haittaohjelmajäännöksistä. -> Käytä CCleaneria -> CCleaner Lataa ja asenna CCleaner. Puhdista väliaikaistiedostot ja -kansiot ohjelmalla säännöllisesti. -> Asenna SpywareBlaster -> SpywareBlaster SpywareBlaster estää haittaohjelmia asentumasta koneellesi. Ei kuluta muistia! Opas saatavilla suomeksi! Nimimerkki Ad-Awaren opas -> Asenna MVPS Hosts tiedosto -> MVPS Hosts Estää koneesi yhteyden haitallisiin sivustoihin. Opas saatavilla suomeksi! Nimimerkki Axelin opas -> Vaihda selaimesi Firefoxiin -> Firefox Firefox on nopeampi, turvallisempi ja parempi selain kuin Internet Explorer. -> Pidä järjestelmäsi ajantasalla. -> Windows Update Vieraile Windows Updatessa säännöllisesti. -> Pidä palomuuri ja virustorjunta ajantasalla Päivitä ja skannaa koneesi säännöllisesti virustorjuntaohjelmallasi. ja hyvä myös escan http://koti.mbnet.fi/pattaya1/escanmwav.htm ->Pidä ohjelmistosi ajantasalla. -> Secunia Software Inspector Secunia Software Inspector tutkii sinun järjestälmäsi ja ohjelmistosi puuttuvien turvallisuuspäivityksien osalta. Tavallinen tutkinta kestää normaalisti 5-40 sekuntia, kun läpikotainen (thorough system inspection) voi kestää useita minuutteja. ->Seuraa säännöllisesti viestintäviraston tietoja uusista haavoittuvuuksista -> CERT-FI -> Rekistöröidy. -> Virustorjunta.net Virustorjunta.net on suomalainen haittaohjelmien poistoon keskittyvä sivusto joka kykenee auttamaan sinua mitä erilaisimmissa ongelmissa. Lisäksi siellä on suomen ainut HJT-koulu. Koulussa syvennytään HJT-ohjelman tuottaman informaation analysoimiseen sekä analysoinnin jälkeiseen tietokoneen puhdistamiseen. Jos tulevaisuudessa tulee haittaohjelmien kanssa ongelmia, älä epäröi laittaa Hijackthis-logia tarkistettavaksi!
