Logfile of HijackThis v1.99.1 Scan saved at 14:18:31, on 23.11.2005 Platform: Windows ME (Win9x 4.90.3000) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\MSTASK.EXE C:\OHJELMATIEDOSTOT\NORTON PERSONAL FIREWALL\NISSERV.EXE C:\OHJELMATIEDOSTOT\YHTEISET TIEDOSTOT\SYMANTEC SHARED\CCEVTMGR.EXE C:\OHJELMATIEDOSTOT\YHTEISET TIEDOSTOT\SYMANTEC SHARED\CCSETMGR.EXE C:\OHJELMATIEDOSTOT\NORTON ANTIVIRUS\ADVTOOLS\NPROTECT.EXE C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE C:\OHJELMATIEDOSTOT\YHTEISET TIEDOSTOT\MICROSOFT SHARED\VS7DEBUG\MDM.EXE C:\OHJELMATIEDOSTOT\YHTEISET TIEDOSTOT\SYSTEM\MOSEARCH\BIN\MOSEARCH.EXE C:\WINDOWS\EXPLORER.EXE C:\OHJELMATIEDOSTOT\NORTON PERSONAL FIREWALL\NISUM.EXE C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE C:\OHJELMATIEDOSTOT\NORTON PERSONAL FIREWALL\SYMPROXYSVC.EXE C:\WINDOWS\SYSTEM\PSTORES.EXE C:\WINDOWS\TASKMON.EXE C:\OHJELMATIEDOSTOT\NORTON PERSONAL FIREWALL\IAMAPP.EXE C:\OHJELMATIEDOSTOT\BROWSER MOUSE\MOUSE32A.EXE C:\WINDOWS\SYSTEM\GRXP4EXE.EXE C:\WINDOWS\LOADQM.EXE C:\OHJELMATIEDOSTOT\MUILTMEDIA KEYBOARD UTILITY\1.3\KBDAP32A.EXE C:\WINDOWS\LOGI_MWX.EXE C:\WINDOWS\RUNDLL32.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\WINDOWS\SYSTEM\WMIEXE.EXE C:\OHJELMATIEDOSTOT\YHTEISET TIEDOSTOT\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE C:\OHJELMATIEDOSTOT\YHTEISET TIEDOSTOT\SYMANTEC SHARED\CCAPP.EXE C:\WINDOWS\SYSTEM\1033\2342\BPK.EXE C:\OHJELMATIEDOSTOT\CREATIVE\NEWS\NEWSUPD.EXE C:\OHJELMATIEDOSTOT\CREATIVE\SHAREDLL\CTNOTIFY.EXE C:\WINDOWS\SYSTEM\CTFMON.EXE C:\WINDOWS\SYSTEM\DDHELP.EXE C:\OHJELMATIEDOSTOT\CREATIVE\SHAREDLL\MEDIADET.EXE C:\OHJELMATIEDOSTOT\LOGITECH\PROFILER\LWEMON.EXE C:\OHJELMATIEDOSTOT\INTERNET EXPLORER\IEXPLORE.EXE C:\OHJELMATIEDOSTOT\INTERNET EXPLORER\IEXPLORE.EXE C:\HIJACKTHIS.EXE R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O1 - Hosts: 127.0.0.5 n-glx.s-redirect.com O1 - Hosts: 127.0.0.5 x.full-tgp.net O1 - Hosts: 127.0.0.5 counter.sexmaniack.com O1 - Hosts: 127.0.0.5 autoescrowpay.com O1 - Hosts: 127.0.0.5 www.autoescrowpay.com O1 - Hosts: 127.0.0.5 www.awmdabest.com O1 - Hosts: 127.0.0.5 www.sexfiles.nu O1 - Hosts: 127.0.0.5 awmdabest.com O1 - Hosts: 127.0.0.5 sexfiles.nu O1 - Hosts: 127.0.0.5 allforadult.com O1 - Hosts: 127.0.0.5 www.allforadult.com O1 - Hosts: 127.0.0.5 www.iframe.biz O1 - Hosts: 127.0.0.5 iframe.biz O1 - Hosts: 127.0.0.5 www.newiframe.biz O1 - Hosts: 127.0.0.5 newiframe.biz O1 - Hosts: 127.0.0.5 www.vesbiz.biz O1 - Hosts: 127.0.0.5 vesbiz.biz O1 - Hosts: 127.0.0.5 www.pizdato.biz O1 - Hosts: 127.0.0.5 pizdato.biz O1 - Hosts: 127.0.0.5 www.awmcash.biz O1 - Hosts: 127.0.0.5 awmcash.biz O1 - Hosts: 127.0.0.5 buldog-stats.com O1 - Hosts: 127.0.0.5 www.buldog-stats.com O1 - Hosts: 127.0.0.5 fregat.drocherway.com O1 - Hosts: 127.0.0.5 slutmania.biz O1 - Hosts: 127.0.0.5 www.slutmania.biz O1 - Hosts: 127.0.0.5 toolbarpartner.com O1 - Hosts: 127.0.0.5 www.toolbarpartner.com O1 - Hosts: 127.0.0.5 www.megapornix.com O1 - Hosts: 127.0.0.5 megapornix.com O1 - Hosts: 127.0.0.5 www.sp2fucked.biz O1 - Hosts: 127.0.0.5 sp2fucked.biz O1 - Hosts: 127.0.0.5 greg-tut.com O1 - Hosts: 127.0.0.5 www.greg-tut.com O1 - Hosts: 127.0.0.5 nylonsexy.com O1 - Hosts: 127.0.0.5 www.nylonsexy.com O1 - Hosts: 127.0.0.5 vparivalka.com O1 - Hosts: 127.0.0.5 www.vparivalka.com O1 - Hosts: 127.0.0.5 iframeprofit.com O1 - Hosts: 127.0.0.5 www.iframeprofit.com O1 - Hosts: 127.0.0.5 topsearch10.com O1 - Hosts: 127.0.0.5 www.topsearch10.com O1 - Hosts: 127.0.0.5 statscash.biz O1 - Hosts: 127.0.0.5 www.statscash.biz O1 - Hosts: 127.0.0.5 vxiframe.biz O1 - Hosts: 127.0.0.5 www.vxiframe.biz O1 - Hosts: 127.0.0.5 crazy-toolbar.com O1 - Hosts: 127.0.0.5 www.crazy-toolbar.com O1 - Hosts: 127.0.0.5 topcash.biz O1 - Hosts: 127.0.0.5 www.topcash.biz O1 - Hosts: 127.0.0.5 loadcash.biz O1 - Hosts: 127.0.0.5 www.loadcash.biz O1 - Hosts: 127.0.0.5 txiframe.biz O1 - Hosts: 127.0.0.5 www.txiframe.biz O1 - Hosts: 127.0.0.5 procounter.biz O1 - Hosts: 127.0.0.5 www.procounter.biz O1 - Hosts: 127.0.0.5 advadmin.biz O1 - Hosts: 127.0.0.5 www.advadmin.biz O1 - Hosts: 127.0.0.5 trafficbest.net O1 - Hosts: 127.0.0.5 www.trafficbest.net O1 - Hosts: 127.0.0.5 besthvac.com O1 - Hosts: 127.0.0.5 www.besthvac.com O1 - Hosts: 127.0.0.5 traff4.com O1 - Hosts: 127.0.0.5 www.traff4.com O1 - Hosts: 127.0.0.5 ambush-script.com O1 - Hosts: 127.0.0.5 www.ambush-script.com O1 - Hosts: 127.0.0.5 beehappyy.biz O1 - Hosts: 127.0.0.5 www.beehappyy.biz O1 - Hosts: 127.0.0.5 tracktraff.cc O1 - Hosts: 127.0.0.5 www.tracktraff.cc O1 - Hosts: 127.0.0.5 allcount.net O1 - Hosts: 127.0.0.5 www.allcount.net O1 - Hosts: 127.0.0.5 onedayoffer.biz O1 - Hosts: 127.0.0.5 www.onedayoffer.biz O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\OHJELMATIEDOSTOT\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Ohjelmatiedostot\Norton AntiVirus\NavShExt.dll O2 - BHO: PK IE Plugin - {1E1B2879-88FF-11D3-8D96-D7ACAC95951A} - (no file) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\ohjelmatiedostot\google\googletoolbar3.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Ohjelmatiedostot\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\ohjelmatiedostot\google\googletoolbar3.dll O3 - Toolbar: UCmore XP - The Search Accelerator - {44BE0690-5429-47f0-85BB-3FFD8020233E} - C:\OHJELMATIEDOSTOT\THESEARCHACCELERATOR\UCMTSAIE.DLL O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [iamapp] C:\Ohjelmatiedostot\Norton Personal Firewall\IAMAPP.EXE O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Ohjelmatiedostot\Browser MOUSE\mouse32a.exe O4 - HKLM\..\Run: [FLMK08KB] C:\Ohjelmatiedostot\Muiltmedia keyboard utility\1.3\MMKEYBD.EXE O4 - HKLM\..\Run: [Gravis Xperience Driver Support] Grxp4exe.exe /init O4 - HKLM\..\Run: [LoadQM] loadqm.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [Symantec Core LC] C:\Ohjelmatiedostot\Yhteiset tiedostot\Symantec Shared\CCPD-LC\symlcsvc.exe start O4 - HKLM\..\Run: [ccApp] "C:\Ohjelmatiedostot\Yhteiset tiedostot\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Advanced Tools Check] C:\OHJELM~1\NORTON~3\ADVTOOLS\ADVCHK.EXE O4 - HKLM\..\Run: [NPROTECT] C:\OHJELM~1\NORTON~3\ADVTOOLS\NPROTECT.EXE O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\OHJELM~1\SYMNET~1\SNDMON.EXE /Consumer O4 - HKLM\..\Run: [BPK] C:\WINDOWS\SYSTEM\1033\2342\BPK.EXE O4 - HKLM\..\Run: [LWBMOUSE] C:\Ohjelmatiedostot\Browser Mouse\Browser Mouse\1.1\MOUSE32A.EXE O4 - HKLM\..\Run: [CloneCDTray] "C:\Ohjelmatiedostot\CloneCD\CloneCDTray.exe" /s O4 - HKLM\..\Run: [NewsUpd] C:\Ohjelmatiedostot\Creative\News\NewsUpd.EXE /q O4 - HKLM\..\Run: [Disc Detector] C:\Ohjelmatiedostot\Creative\ShareDLL\CtNotify.exe O4 - HKLM\..\Run: [PayTime] C:\WINDOWS\SYSTEM\paytime.exe O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe O4 - HKLM\..\RunServices: [nisserv] C:\Ohjelmatiedostot\Norton Personal Firewall\NISSERV.EXE O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Ohjelmatiedostot\Yhteiset tiedostot\Symantec Shared\Script Blocking\SBServ.exe" -reg O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Ohjelmatiedostot\Yhteiset tiedostot\Symantec Shared\ccEvtMgr.exe" O4 - HKLM\..\RunServices: [ccSetMgr] "C:\Ohjelmatiedostot\Yhteiset tiedostot\Symantec Shared\ccSetMgr.exe" O4 - HKLM\..\RunServices: [NPROTECT] C:\OHJELM~1\NORTON~3\ADVTOOLS\NPROTECT.EXE O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE O4 - HKLM\..\RunServices: [MDM7] "C:\OHJELMATIEDOSTOT\YHTEISET TIEDOSTOT\MICROSOFT SHARED\VS7DEBUG\MDM.EXE" O4 - HKLM\..\RunServices: [MOSearch] C:\OHJELM~1\YHTEIS~1\SYSTEM\MOSEARCH\BIN\MOSEARCH.EXE O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe O4 - HKCU\..\Run: [Start WingMan Profiler] "C:\Ohjelmatiedostot\Logitech\Profiler\lwtest.exe" /detect /quiet /launch "C:\Ohjelmatiedostot\Logitech\Profiler\lwemon.exe /noui" O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NVMCTRAY.DLL,NvTaskbarInit O4 - HKCU\..\Run: [Shell] "C:\WINDOWS\SYSTEM\ibm00001.exe" O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe O4 - HKCU\..\Run: [PayTime] C:\WINDOWS\SYSTEM\paytime.exe O4 - HKCU\..\Run: [aupd] C:\WINDOWS\SYSTEM\sywsvcs.exe O4 - HKCU\..\Run: [SpySheriff] C:\PROGRAM FILES\SPYSHERIFF\SpySheriff.exe O4 - HKCU\..\RunServices: [aupd] C:\WINDOWS\SYSTEM\sywsvcs.exe O4 - Startup: Microsoft Office.lnk = C:\Ohjelmatiedostot\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\OHJELM~1\MICROS~1\OFFICE10\EXCEL.EXE/3000 O8 - Extra context menu item: &Google Search - res://C:\OHJELMATIEDOSTOT\GOOGLE\GOOGLETOOLBAR3.DLL/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://C:\OHJELMATIEDOSTOT\GOOGLE\GOOGLETOOLBAR3.DLL/cmwordtrans.html O8 - Extra context menu item: Cached Snapshot of Page - res://C:\OHJELMATIEDOSTOT\GOOGLE\GOOGLETOOLBAR3.DLL/cmcache.html O8 - Extra context menu item: Similar Pages - res://C:\OHJELMATIEDOSTOT\GOOGLE\GOOGLETOOLBAR3.DLL/cmsimilar.html O8 - Extra context menu item: Backward Links - res://C:\OHJELMATIEDOSTOT\GOOGLE\GOOGLETOOLBAR3.DLL/cmbacklinks.html O8 - Extra context menu item: Translate Page into English - res://C:\OHJELMATIEDOSTOT\GOOGLE\GOOGLETOOLBAR3.DLL/cmtrans.html O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra button: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\pelit\texas hold em poker\EmpirePoker.exe (file missing) O9 - Extra 'Tools' menuitem: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\pelit\texas hold em poker\EmpirePoker.exe (file missing) O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52...pple.com/mickey/us/win/QuickTimeInstaller.exe O16 - DPF: {7589EEE6-E336-11D4-8A7E-EE1D971D9B47} (AcontiX Control) - http://secure.aconti.net/acontix/goodthinxx.cab O16 - DPF: {0873478E-E67A-4876-B0A9-9A36D3AB3602} - http://www.thepaymentcentre.com/build/vviewer.cab O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F98} (CR64Loader Object) - http://www.miniclip.com/platypus/miniclipGameLoader.dll O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab O16 - DPF: {7C559105-9ECF-42B8-B3F7-832E75EDD959} - http://www.xxxtoolbar.com/ist/softwares/v4.0/0006_regular.cab
Kato ohjeet täältä -> http://keskustelu.afterdawn.com/thread_view.cfm/258304¨ EDIT: Tähän viestiketjuun voit kyllä jatkossa vastata
